@yielded/auth-persistence 0.1.0-beta.13 → 0.1.0-beta.15

package/dist/internal/storage-mapping.d.mts

@@ -0,0 +1,59 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { SqlFragment, TableModel } from "./query-operations.mjs";
+import { AnyEmailAddressMapping } from "./models/email-model.mjs";
+import { AnyPasswordPersistenceMapping } from "./models/password-model.mjs";
+import { AnyProofPersistenceMapping } from "./models/proof-model.mjs";
+import { StatefulSessionMapping } from "./models/session-model.mjs";
+import { StorageRole } from "./storage-tables.mjs";
+import { MappingInput } from "./configuration.mjs";
+import { Effect, Schema } from "effect";
+import { SecurityRevision } from "@yielded/auth/Sessions";
+//#region src/internal/storage-mapping.d.ts
+declare const string: (value: unknown) => string;
+/** Derive shared row mappings from a managed or custom storage layout.
+ * Each factory requires its role tables to exist. Adapter authors supply typed
+ * table handles and dialect-specific clocks/commit predicates, and may refine
+ * authority policy for explicit services. This does not alter composed defaults.
+ */
+export declare const makeMappings: (input: MappingInput) => {
+  table: (role: StorageRole) => object;
+  authority: () => {
+    subjectId: {
+      toNative: (value: import("@yielded/auth/Schema").SubjectId) => Effect.Effect<unknown, PersistenceMappingError>;
+      toSubject: (value: unknown) => Effect.Effect<import("@yielded/auth/Schema").SubjectId, PersistenceMappingError>;
+      equals: (value1: any, value2: any) => boolean;
+    };
+    subject: {
+      table: object;
+      id: string;
+      status: string;
+      securityRevision: string;
+      isActiveStatus: (value: unknown) => boolean;
+      d1ActiveStatusValue: unknown;
+      decodeRequirement: (row: Readonly<Record<string, unknown>>) => Effect.Effect<import("@yielded/auth/Sessions").AuthenticationRequirement, PersistenceMappingError>;
+      decodeActionRequirement: (row: Readonly<Record<string, unknown>>, action: import("@yielded/auth/Password").PasswordAction | import("@yielded/auth/Email").EmailAction | import("@yielded/auth/Passkey").PasskeyActionChallenge["action"]) => Effect.Effect<import("@yielded/auth/Sessions").AuthenticationRequirement, PersistenceMappingError>;
+      nextSecurityRevisionSync: () => string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+    };
+    credential: {
+      table: object;
+      subjectId: string;
+      credentialId: string;
+      revision: string;
+      status: string;
+      isActiveStatus: (value: unknown) => value is true;
+      encodeInsert: (row: object) => {
+        active: boolean;
+      };
+      encodeRevision: (revision: SecurityRevision) => {
+        revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
+      };
+    };
+  };
+  proofs: () => AnyProofPersistenceMapping<SqlFragment>;
+  passwords: () => AnyPasswordPersistenceMapping<SqlFragment>;
+  emails: () => AnyEmailAddressMapping<SqlFragment>;
+  sessions: <C extends Schema.Codec<unknown, unknown, never, never>>(claims: C) => StatefulSessionMapping<C["Type"], TableModel, TableModel, TableModel, TableModel, TableModel, unknown, string>;
+  string: typeof string;
+};
+//#endregion
+//# sourceMappingURL=storage-mapping.d.mts.map

package/dist/internal/storage-mapping.mjs

@@ -48,6 +48,11 @@ const ProofContinuation = Schema.Struct({
 	expiresAtMillis: Schema.Int,
 	version: ProofVersion
 });
+/** Derive shared row mappings from a managed or custom storage layout.
+* Each factory requires its role tables to exist. Adapter authors supply typed
+* table handles and dialect-specific clocks/commit predicates, and may refine
+* authority policy for explicit services. This does not alter composed defaults.
+*/
 const makeMappings = (input) => {
 	const table = (role) => {
 		const found = input.tables[role];

package/dist/internal/storage-mapping.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"storage-mapping.mjs","names":["ProofRecord"],"sources":["../../src/internal/storage-mapping.ts"],"sourcesContent":["import { randomId } from \"@yielded/auth-crypto\";\nimport { EmailCredentialSnapshot } from \"@yielded/auth/Email\";\nimport { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  PasswordAttemptId,\n  PasswordCredentialSnapshot,\n  EncodedPasswordHash,\n  type PasswordReplacement,\n} from \"@yielded/auth/Password\";\nimport {\n  ProofBinding,\n  ProofContinuationId,\n  ProofDeliveryId,\n  ProofId,\n  ProofPurpose,\n  ProofRequestId,\n  ProofRequestReceipt,\n  ProofVersion,\n} from \"@yielded/auth/Proofs\";\nimport { TokenDigest } from \"@yielded/auth/Schema\";\nimport {\n  SecurityRevision,\n  SessionId,\n  SessionMetadata,\n  SessionAuthenticationProvenance,\n  SessionCredentialVersion,\n  type StatefulSessionRecord,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Redacted, Schema } from \"effect\";\n\nimport type { MappingInput } from \"./configuration\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport { requiredEmailAddressConstraints, type AnyEmailAddressMapping } from \"./models/email-model\";\nimport {\n  requiredPasswordConstraints,\n  type AnyPasswordPersistenceMapping,\n} from \"./models/password-model\";\nimport { requiredProofConstraints, type AnyProofPersistenceMapping } from \"./models/proof-model\";\nimport type { StatefulSessionMapping } from \"./models/session-model\";\nimport type { TableModel, SqlFragment } from \"./query-operations\";\nimport { storageTables, type StorageRole } from \"./storage-tables\";\n\nconst failure = (cause: unknown) => PersistenceMappingError.make({ operation: \"decode\", cause });\n\nconst decode = <S extends Schema.Codec<unknown, unknown>>(schema: S, value: unknown) =>\n  Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(failure));\n\nconst string = (value: unknown) => Schema.decodeUnknownSync(Schema.String)(value);\nconst tuple = Schema.encodeSync(Schema.fromJsonString(Schema.Array(Schema.String)));\nconst bindingJson = Schema.fromJsonString(ProofBinding);\nconst receiptJson = Schema.fromJsonString(ProofRequestReceipt);\n\nconst ProofRecord = Schema.Struct({\n  moduleId: Schema.String,\n  purpose: ProofPurpose,\n  proofId: ProofId,\n  requestId: ProofRequestId,\n  fingerprint: TokenDigest,\n  deliveryId: ProofDeliveryId,\n  binding: ProofBinding,\n  verifier: Schema.Struct({ keyId: Schema.String, digest: TokenDigest }),\n  issuedAtMillis: Schema.Int,\n  expiresAtMillis: Schema.Int,\n  version: ProofVersion,\n});\n\nconst ProofContinuation = Schema.Struct({\n  moduleId: Schema.String,\n  purpose: ProofPurpose,\n  continuationId: ProofContinuationId,\n  digest: TokenDigest,\n  proofId: ProofId,\n  seriesKey: Schema.String,\n  binding: ProofBinding,\n  expiresAtMillis: Schema.Int,\n  version: ProofVersion,\n});\n\nexport const makeMappings = (input: MappingInput) => {\n  const table = (role: StorageRole) => {\n    const found = input.tables[role];\n\n    if (found === undefined) throw failure(`Missing ${role} mapping`);\n\n    return found;\n  };\n\n  const mapped = (role: StorageRole) => ({\n    table: table(role),\n    ...Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key])),\n  });\n\n  const { subjects: s, encodeInstant: instant, decodeInstant: readInstant } = input;\n  const subjectId = { toNative: s.toNative, toSubject: s.toSubject, equals: Object.is };\n\n  const subject = {\n    table: s.table,\n    id: s.id,\n    status: s.status,\n    securityRevision: s.securityRevision,\n    isActiveStatus: (value: unknown) => Object.is(value, s.activeValue),\n    d1ActiveStatusValue: s.activeValue,\n    decodeRequirement: s.requirements,\n    decodeActionRequirement: s.actionRequirements,\n    nextSecurityRevisionSync: () => SecurityRevision.make(randomId()),\n  };\n\n  const authorityCredential = () => ({\n    ...mapped(\"credentials\"),\n    subjectId: \"subjectId\",\n    credentialId: \"credentialId\",\n    revision: \"revision\",\n    status: \"active\",\n    isActiveStatus: (value: unknown) => value === true,\n    encodeInsert: (row: object) => ({ ...row, active: true }),\n    encodeRevision: (revision: SecurityRevision) => ({ revision }),\n  });\n\n  const authority = () => ({ subjectId, subject, credential: authorityCredential() });\n\n  const proofs = (): AnyProofPersistenceMapping<SqlFragment> => ({\n    constraints: requiredProofConstraints,\n    encodeInstant: instant,\n    decodeInstant: readInstant,\n    allocateVersionSync: () => ProofVersion.make(randomId()),\n    isRequestConflict: () => false,\n    isSeriesConflict: () => false,\n    isCommandConflict: () => false,\n    scopeKeys: ({ binding }) => ({\n      series: tuple([\n        binding.identifier.namespace,\n        binding.identifier.value,\n        binding._tag === \"Identifier\" ? \"anonymous\" : binding.revision.subjectId,\n      ]),\n      identifier: tuple([binding.identifier.namespace, binding.identifier.value]),\n      subject: binding._tag === \"Identifier\" ? \"anonymous\" : binding.revision.subjectId,\n    }),\n    authority: {\n      ...authority(),\n      identifier: {\n        table: table(\"identifiers\"),\n        namespace: \"namespace\",\n        value: \"value\",\n        isCurrent: (request, rows) =>\n          request.binding._tag === \"Identifier\"\n            ? rows.length === 0\n            : request.binding._tag === \"IdentifierChange\"\n              ? rows.length === 0 ||\n                (rows.length === 1 &&\n                  rows.every(\n                    (row) =>\n                      Object.is(row.subjectId, request.nativeSubjectId) &&\n                      row.active === true &&\n                      row.verifiedAt === null,\n                  ))\n              : rows.length === 1 &&\n                rows.every(\n                  (row) => Object.is(row.subjectId, request.nativeSubjectId) && row.active === true,\n                ),\n      },\n    },\n    request: {\n      ...mapped(\"proofRequests\"),\n      moduleId: \"moduleId\",\n      requestId: \"requestId\",\n      fingerprint: \"fingerprint\",\n      proofId: \"proofId\",\n      purpose: \"purpose\",\n      keyId: \"keyId\",\n      createdAt: \"createdAt\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: ({ record, retentionUntilMillis }) => ({\n        moduleId: record.moduleId,\n        requestId: record.requestId,\n        fingerprint: record.fingerprint,\n        proofId: record.proofId,\n        purpose: record.purpose,\n        keyId: record.verifier.keyId,\n        createdAt: instant(record.issuedAtMillis),\n        retentionUntil: instant(retentionUntilMillis),\n        receipt: Schema.encodeSync(receiptJson)({\n          requestId: record.requestId,\n          reference: {\n            proofId: record.proofId,\n            purpose: record.purpose,\n            keyId: record.verifier.keyId,\n          },\n        }),\n      }),\n      decodeReceipt: (row) => decode(receiptJson, row.receipt),\n    },\n    series: {\n      ...mapped(\"proofSeries\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      scopeKey: \"scopeKey\",\n      activeProofId: \"activeProofId\",\n      lastIssueAt: \"lastIssueAt\",\n      version: \"version\",\n      encodeInsert: (row) => ({ ...row, activeProofId: null, lastIssueAt: null }),\n    },\n    generation: {\n      ...mapped(\"proofGenerations\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      proofId: \"proofId\",\n      requestId: \"requestId\",\n      seriesKey: \"seriesKey\",\n      deliveryId: \"deliveryId\",\n      binding: \"binding\",\n      verifierKeyId: \"verifierKeyId\",\n      verifierDigest: \"verifierDigest\",\n      issuedAt: \"issuedAt\",\n      expiresAt: \"expiresAt\",\n      version: \"version\",\n      state: \"state\",\n      sendCount: \"sendCount\",\n      deliveryState: \"deliveryState\",\n      claimVersion: \"claimVersion\",\n      claimDeadline: \"claimDeadline\",\n      retryAt: \"retryAt\",\n      deliveryRetryMillis: \"deliveryRetryMillis\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: ({\n        record,\n        seriesKey,\n        retentionUntilMillis,\n        state,\n        deliveryState,\n        policy,\n      }) => ({\n        moduleId: record.moduleId,\n        purpose: record.purpose,\n        proofId: record.proofId,\n        requestId: record.requestId,\n        seriesKey,\n        deliveryId: record.deliveryId,\n        binding: Schema.encodeSync(bindingJson)(record.binding),\n        verifierKeyId: record.verifier.keyId,\n        verifierDigest: record.verifier.digest,\n        issuedAt: instant(record.issuedAtMillis),\n        expiresAt: instant(record.expiresAtMillis),\n        version: record.version,\n        state,\n        sendCount: 0,\n        deliveryState,\n        claimVersion: null,\n        claimDeadline: null,\n        retryAt: null,\n        deliveryRetryMillis: policy.deliveryRetryMillis,\n        retentionUntil: instant(retentionUntilMillis),\n        fingerprint: record.fingerprint,\n      }),\n      decodeBinding: (row) => decode(bindingJson, row.binding),\n      decodeRecord: (row) =>\n        Effect.gen(function* () {\n          return yield* decode(ProofRecord, {\n            moduleId: row.moduleId,\n            purpose: row.purpose,\n            proofId: row.proofId,\n            requestId: row.requestId,\n            fingerprint: row.fingerprint,\n            deliveryId: row.deliveryId,\n            binding: yield* decode(bindingJson, row.binding),\n            verifier: { keyId: row.verifierKeyId, digest: row.verifierDigest },\n            issuedAtMillis: yield* readInstant(row.issuedAt),\n            expiresAtMillis: yield* readInstant(row.expiresAt),\n            version: row.version,\n          });\n        }),\n    },\n    continuation: {\n      ...mapped(\"proofContinuations\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      continuationId: \"continuationId\",\n      digest: \"digest\",\n      proofId: \"proofId\",\n      seriesKey: \"seriesKey\",\n      binding: \"binding\",\n      expiresAt: \"expiresAt\",\n      consumed: \"consumed\",\n      version: \"version\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: (record) => ({\n        ...record,\n        binding: Schema.encodeSync(bindingJson)(record.binding),\n        expiresAt: instant(record.expiresAtMillis),\n        consumed: false,\n        retentionUntil: instant(record.retentionUntilMillis),\n      }),\n      decode: (row) =>\n        Effect.gen(function* () {\n          return yield* decode(ProofContinuation, {\n            ...row,\n            binding: yield* decode(bindingJson, row.binding),\n            expiresAtMillis: yield* readInstant(row.expiresAt),\n          });\n        }),\n    },\n    rateScope: {\n      ...mapped(\"proofScopes\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      action: \"action\",\n      scopeKind: \"scopeKind\",\n      scopeKey: \"scopeKey\",\n      encodeInsert: (row) => ({ ...row }),\n    },\n    abuseEvent: {\n      ...mapped(\"proofAbuse\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      action: \"action\",\n      scopeKind: \"scopeKind\",\n      scopeKey: \"scopeKey\",\n      commandId: \"commandId\",\n      occurredAt: \"occurredAt\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: (row) => ({\n        ...row,\n        occurredAt: instant(row.occurredAtMillis),\n        retentionUntil: instant(row.retentionUntilMillis),\n      }),\n    },\n    failureEvent: {\n      ...mapped(\"proofFailures\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      seriesKey: \"seriesKey\",\n      commandId: \"commandId\",\n      occurredAt: \"occurredAt\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: (row) => ({\n        ...row,\n        occurredAt: instant(row.occurredAtMillis),\n        retentionUntil: instant(row.retentionUntilMillis),\n      }),\n    },\n    command: {\n      ...mapped(\"proofCommands\"),\n      moduleId: \"moduleId\",\n      commandId: \"commandId\",\n      kind: \"kind\",\n      decision: \"decision\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: (row) => ({ ...row, retentionUntil: instant(row.retentionUntilMillis) }),\n    },\n  });\n\n  const passwords = (): AnyPasswordPersistenceMapping<SqlFragment> => {\n    const verifier = (replacement: PasswordReplacement) => ({\n      verifier: Redacted.value(replacement.verifier),\n      normalization: replacement.normalization,\n    });\n\n    return {\n      subjectId,\n      subject,\n      authorityCredential: authorityCredential(),\n      constraints: requiredPasswordConstraints,\n      isCommandConflict: () => false,\n      isRateScopeConflict: () => false,\n      scopeKeys: ({ moduleId, action, identifier, subjectId }) => ({\n        action: tuple([moduleId, action]),\n        identifier: tuple([identifier.namespace, identifier.value]),\n        ...(subjectId === undefined ? {} : { subject: subjectId }),\n      }),\n      encodeInstant: instant,\n      decodeInstant: readInstant,\n      allocateAttemptIdSync: () => PasswordAttemptId.make(randomId()),\n      allocateCredentialIdSync: randomId,\n      allocateRevisionSync: () => SecurityRevision.make(randomId()),\n      commandRetentionMillis: 86_400_000,\n      sessionInvalidation: \"same-authority-immediate\",\n      identifier: {\n        table: table(\"identifiers\"),\n        namespace: \"namespace\",\n        value: \"value\",\n        subjectId: \"subjectId\",\n        verifiedAt: \"verifiedAt\",\n        bindingRevision: \"revision\",\n        isCurrent: (row) => row.active === true,\n        encodeInitialInsert: (identifier, subjectId, revision) => ({\n          ...identifier,\n          subjectId,\n          revision,\n          verifiedAt: null,\n          active: true,\n        }),\n      },\n      credential: {\n        ...mapped(\"passwords\"),\n        moduleId: \"moduleId\",\n        subjectId: \"subjectId\",\n        credentialId: \"credentialId\",\n        credentialRevision: \"credentialRevision\",\n        verifierVersion: \"verifierVersion\",\n        verifier: \"verifier\",\n        normalization: \"normalization\",\n        encodeInsert: ({ replacement, ...row }) => ({ ...row, ...verifier(replacement) }),\n        encodeVerifier: (hash, verifierVersion) => ({\n          verifier: Redacted.value(hash),\n          verifierVersion,\n        }),\n        encodeReplacement: ({ replacement, ...row }) => ({ ...row, ...verifier(replacement) }),\n        decode: ({ moduleId, subject: row, identifier, credential }) =>\n          Effect.gen(function* () {\n            const id = yield* s.toSubject(row[s.id]);\n            const hash = yield* decode(EncodedPasswordHash, credential.verifier);\n\n            return yield* decode(PasswordCredentialSnapshot, {\n              moduleId,\n              revision: {\n                subjectId: id,\n                securityRevision: row[s.securityRevision],\n                credentials: [\n                  {\n                    credentialId: credential.credentialId,\n                    revision: credential.credentialRevision,\n                  },\n                ],\n              },\n              credentialId: credential.credentialId,\n              credentialRevision: credential.credentialRevision,\n              verifierVersion: credential.verifierVersion,\n              verifier: hash,\n              normalization: credential.normalization,\n              identifier: yield* decode(LoginIdentifier, {\n                namespace: identifier.namespace,\n                value: identifier.value,\n              }),\n              identifierBindingRevision: identifier.revision,\n              ...(identifier.verifiedAt === null\n                ? {}\n                : { identifierVerifiedAtMillis: yield* readInstant(identifier.verifiedAt) }),\n            });\n          }),\n      },\n      attempt: {\n        ...mapped(\"passwordAttempts\"),\n        moduleId: \"moduleId\",\n        action: \"action\",\n        attemptId: \"attemptId\",\n        identifierNamespace: \"identifierNamespace\",\n        identifierValue: \"identifierValue\",\n        subjectId: \"subjectId\",\n        credentialId: \"credentialId\",\n        securityRevision: \"securityRevision\",\n        credentialRevision: \"credentialRevision\",\n        verifierVersion: \"verifierVersion\",\n        identifierBindingRevision: \"identifierBindingRevision\",\n        admittedAt: \"admittedAt\",\n        deadline: \"deadline\",\n        retentionUntil: \"retentionUntil\",\n        state: \"state\",\n        encodeInsert: (row, { nativeSubjectId, state }) => ({\n          moduleId: row.moduleId,\n          action: row.action,\n          attemptId: row.attemptId,\n          identifierNamespace: row.identifier.namespace,\n          identifierValue: row.identifier.value,\n          subjectId: nativeSubjectId ?? null,\n          credentialId: row.credentialId ?? null,\n          securityRevision: row.securityRevision ?? null,\n          credentialRevision: row.credentialRevision ?? null,\n          verifierVersion: row.verifierVersion ?? null,\n          identifierBindingRevision: row.identifierBindingRevision ?? null,\n          admittedAt: instant(row.admittedAtMillis),\n          deadline: instant(row.deadlineMillis),\n          retentionUntil: instant(row.retentionUntilMillis),\n          state,\n        }),\n      },\n      rateScope: {\n        ...mapped(\"passwordScopes\"),\n        moduleId: \"moduleId\",\n        action: \"action\",\n        scopeKind: \"scopeKind\",\n        scopeKey: \"scopeKey\",\n        encodeInsert: (row) => ({ ...row }),\n      },\n      charge: {\n        ...mapped(\"passwordCharges\"),\n        moduleId: \"moduleId\",\n        action: \"action\",\n        scopeKind: \"scopeKind\",\n        scopeKey: \"scopeKey\",\n        attemptId: \"attemptId\",\n        occurredAt: \"occurredAt\",\n        retentionUntil: \"retentionUntil\",\n        encodeInsert: (row) => ({\n          ...row,\n          occurredAt: instant(row.occurredAtMillis),\n          retentionUntil: instant(row.retentionUntilMillis),\n        }),\n      },\n      command: {\n        ...mapped(\"passwordCommands\"),\n        moduleId: \"moduleId\",\n        commandId: \"commandId\",\n        action: \"action\",\n        bindingDigest: \"bindingDigest\",\n        decision: \"decision\",\n        retentionUntil: \"retentionUntil\",\n        encodeInsert: (row) => ({ ...row, retentionUntil: instant(row.retentionUntilMillis) }),\n      },\n    };\n  };\n\n  const emails = (): AnyEmailAddressMapping<SqlFragment> => ({\n    subjectId,\n    subject,\n    constraints: requiredEmailAddressConstraints,\n    addressCardinality: \"single\",\n    changeDisposition: \"retire-source\",\n    encodeInstant: instant,\n    decodeInstant: readInstant,\n    allocateCredentialIdSync: randomId,\n    allocateRevisionSync: () => SecurityRevision.make(randomId()),\n    commandRetentionMillis: 86_400_000,\n    sessionInvalidation: \"same-authority-immediate\",\n    isCommandConflict: () => false,\n    isIdentifierConflict: () => false,\n    isCredentialConflict: () => false,\n    authorityCredential: {\n      ...authorityCredential(),\n      encodeActivation: (revision) => ({ revision, active: true }),\n      encodeRetirement: (revision) => ({ revision, active: false }),\n    },\n    identifier: {\n      table: table(\"identifiers\"),\n      namespace: \"namespace\",\n      value: \"value\",\n      subjectId: \"subjectId\",\n      verifiedAt: \"verifiedAt\",\n      bindingRevision: \"revision\",\n      isCurrent: (row) => row.active === true && row.verifiedAt !== null,\n      isMutableTarget: (row) => row.active === true && row.verifiedAt === null,\n      encodeVerifiedInsert: ({ identifier, subjectId, verifiedAtMillis, bindingRevision }) => ({\n        ...identifier,\n        subjectId,\n        verifiedAt: instant(verifiedAtMillis),\n        revision: bindingRevision,\n        active: true,\n      }),\n      encodeVerification: ({ verifiedAtMillis, bindingRevision }) => ({\n        verifiedAt: instant(verifiedAtMillis),\n        revision: bindingRevision,\n        active: true,\n      }),\n      encodeRetirement: ({ bindingRevision }) => ({ revision: bindingRevision, active: false }),\n    },\n    credential: {\n      table: table(\"emailCredentials\"),\n      moduleId: \"moduleId\",\n      subjectId: \"subjectId\",\n      credentialId: \"credentialId\",\n      identifierNamespace: \"identifierNamespace\",\n      identifierValue: \"identifierValue\",\n      credentialRevision: \"credentialRevision\",\n      status: \"active\",\n      isActiveStatus: (value) => value === true,\n      encodeVerifiedInsert: ({ identifier, ...row }) => ({\n        ...row,\n        identifierNamespace: identifier.namespace,\n        identifierValue: identifier.value,\n        active: true,\n      }),\n      encodeActivation: ({ identifier, credentialRevision }) => ({\n        identifierNamespace: identifier.namespace,\n        identifierValue: identifier.value,\n        credentialRevision,\n        active: true,\n      }),\n      encodeRetirement: ({ credentialRevision }) => ({ credentialRevision, active: false }),\n      decode: ({ moduleId, subject: row, identifier, credential }) =>\n        Effect.gen(function* () {\n          return yield* decode(EmailCredentialSnapshot, {\n            moduleId,\n            identifier: { namespace: identifier.namespace, value: identifier.value },\n            identifierRevision: identifier.revision,\n            verifiedAtMillis: yield* readInstant(identifier.verifiedAt),\n            credentialId: credential.credentialId,\n            credentialRevision: credential.credentialRevision,\n            revision: {\n              subjectId: yield* s.toSubject(row[s.id]),\n              securityRevision: row[s.securityRevision],\n              credentials: [\n                { credentialId: credential.credentialId, revision: credential.credentialRevision },\n              ],\n            },\n          });\n        }),\n    },\n    command: {\n      table: table(\"emailCommands\"),\n      moduleId: \"moduleId\",\n      commandId: \"commandId\",\n      action: \"action\",\n      bindingDigest: \"bindingDigest\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: ({ retentionUntilMillis, ...row }) => ({\n        ...row,\n        retentionUntil: instant(retentionUntilMillis),\n      }),\n    },\n  });\n\n  const sessions = <C extends Schema.Codec<unknown, unknown, never, never>>(\n    claims: C,\n  ): StatefulSessionMapping<\n    C[\"Type\"],\n    TableModel,\n    TableModel,\n    TableModel,\n    TableModel,\n    TableModel,\n    unknown,\n    string\n  > => {\n    const record = Schema.fromJsonString(\n      Schema.Struct({\n        ...SessionMetadata.fields,\n        claims: Schema.Unknown,\n        digest: TokenDigest,\n        version: SecurityRevision,\n        provenance: SessionAuthenticationProvenance,\n        credentialVersion: SessionCredentialVersion,\n      }),\n    );\n\n    const encodeRow = (value: StatefulSessionRecord<C[\"Type\"]>) => ({\n      digest: value.digest,\n      version: value.version,\n      securityRevision: value.securityRevision,\n      issuedAt: instant(DateTime.toEpochMillis(value.issuedAt)),\n      expiresAt: instant(DateTime.toEpochMillis(value.expiresAt)),\n      absoluteExpiresAt: instant(DateTime.toEpochMillis(value.absoluteExpiresAt)),\n      record: Schema.encodeSync(record)({\n        ...value,\n        claims: Schema.encodeSync(claims)(value.claims),\n      }),\n    });\n\n    return {\n      ...authority(),\n      isConstraintConflict: () => false,\n      constraints: { sessionDigest: \"unique(session.digest)\", flowId: \"unique(flow.flowId)\" },\n      sessionId: {\n        toNative: (id) => Effect.succeed(id),\n        toSession: (id) => decode(SessionId, id),\n        equals: Object.is,\n      },\n      flow: {\n        table: table(\"sessionFlows\"),\n        flowId: \"flowId\",\n        subjectId: \"subjectId\",\n        state: \"state\",\n        pendingDigest: \"pendingDigest\",\n        dedupUntil: \"dedupUntil\",\n        pendingStateValue: \"pending\",\n        establishedStateValue: \"established\",\n        encodeInstant: (date) => instant(DateTime.toEpochMillis(date)),\n        decodeInstant: (value) => readInstant(value).pipe(Effect.map(DateTime.makeUnsafe)),\n        encodePendingInsert: (row) => ({\n          flowId: row.evidence.flowId,\n          subjectId: row.subjectId,\n          state: \"pending\",\n          pendingDigest: row.pendingDigest,\n          dedupUntil: instant(DateTime.toEpochMillis(row.dedupUntil)),\n        }),\n        encodeEstablishedInsert: (row) => ({\n          flowId: row.evidence.flowId,\n          subjectId: row.subjectId,\n          state: \"established\",\n          pendingDigest: null,\n          dedupUntil: instant(DateTime.toEpochMillis(row.dedupUntil)),\n        }),\n      },\n      session: {\n        table: table(\"sessions\"),\n        sessionId: \"sessionId\",\n        subjectId: \"subjectId\",\n        digest: \"digest\",\n        version: \"version\",\n        securityRevision: \"securityRevision\",\n        issuedAt: \"issuedAt\",\n        expiresAt: \"expiresAt\",\n        absoluteExpiresAt: \"absoluteExpiresAt\",\n        encodeInstant: (date) => instant(DateTime.toEpochMillis(date)),\n        allocateIdSync: randomId,\n        allocateVersionSync: () => SecurityRevision.make(randomId()),\n        encodeInsert: (value, ids) => ({ ...encodeRow(value), ...ids }),\n        encodeRotation: encodeRow,\n        decode: (row) =>\n          Effect.gen(function* () {\n            const saved = yield* decode(record, row.record);\n            const decodedClaims = yield* decode(claims, saved.claims);\n\n            return { ...saved, claims: decodedClaims };\n          }),\n      },\n    };\n  };\n\n  return { table, authority, proofs, passwords, emails, sessions, string };\n};\n"],"mappings":";;;;;;;;;;;;;;AA0CA,MAAM,WAAW,UAAmB,wBAAwB,KAAK;CAAE,WAAW;CAAU;AAAM,CAAC;AAE/F,MAAM,UAAoD,QAAW,UACnE,OAAO,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;AAEzE,MAAM,UAAU,UAAmB,OAAO,kBAAkB,OAAO,MAAM,CAAC,CAAC,KAAK;AAChF,MAAM,QAAQ,OAAO,WAAW,OAAO,eAAe,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC;AAClF,MAAM,cAAc,OAAO,eAAe,YAAY;AACtD,MAAM,cAAc,OAAO,eAAe,mBAAmB;AAE7D,MAAMA,gBAAc,OAAO,OAAO;CAChC,UAAU,OAAO;CACjB,SAAS;CACT,SAAS;CACT,WAAW;CACX,aAAa;CACb,YAAY;CACZ,SAAS;CACT,UAAU,OAAO,OAAO;EAAE,OAAO,OAAO;EAAQ,QAAQ;CAAY,CAAC;CACrE,gBAAgB,OAAO;CACvB,iBAAiB,OAAO;CACxB,SAAS;AACX,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,UAAU,OAAO;CACjB,SAAS;CACT,gBAAgB;CAChB,QAAQ;CACR,SAAS;CACT,WAAW,OAAO;CAClB,SAAS;CACT,iBAAiB,OAAO;CACxB,SAAS;AACX,CAAC;AAED,MAAa,gBAAgB,UAAwB;CACnD,MAAM,SAAS,SAAsB;EACnC,MAAM,QAAQ,MAAM,OAAO;EAE3B,IAAI,UAAU,KAAA,GAAW,MAAM,QAAQ,WAAW,KAAK,SAAS;EAEhE,OAAO;CACT;CAEA,MAAM,UAAU,UAAuB;EACrC,OAAO,MAAM,IAAI;EACjB,GAAG,OAAO,YAAY,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;CACzF;CAEA,MAAM,EAAE,UAAU,GAAG,eAAe,SAAS,eAAe,gBAAgB;CAC5E,MAAM,YAAY;EAAE,UAAU,EAAE;EAAU,WAAW,EAAE;EAAW,QAAQ,OAAO;CAAG;CAEpF,MAAM,UAAU;EACd,OAAO,EAAE;EACT,IAAI,EAAE;EACN,QAAQ,EAAE;EACV,kBAAkB,EAAE;EACpB,iBAAiB,UAAmB,OAAO,GAAG,OAAO,EAAE,WAAW;EAClE,qBAAqB,EAAE;EACvB,mBAAmB,EAAE;EACrB,yBAAyB,EAAE;EAC3B,gCAAgC,iBAAiB,KAAK,SAAS,CAAC;CAClE;CAEA,MAAM,6BAA6B;EACjC,GAAG,OAAO,aAAa;EACvB,WAAW;EACX,cAAc;EACd,UAAU;EACV,QAAQ;EACR,iBAAiB,UAAmB,UAAU;EAC9C,eAAe,SAAiB;GAAE,GAAG;GAAK,QAAQ;EAAK;EACvD,iBAAiB,cAAgC,EAAE,SAAS;CAC9D;CAEA,MAAM,mBAAmB;EAAE;EAAW;EAAS,YAAY,oBAAoB;CAAE;CAEjF,MAAM,gBAAyD;EAC7D,aAAa;EACb,eAAe;EACf,eAAe;EACf,2BAA2B,aAAa,KAAK,SAAS,CAAC;EACvD,yBAAyB;EACzB,wBAAwB;EACxB,yBAAyB;EACzB,YAAY,EAAE,eAAe;GAC3B,QAAQ,MAAM;IACZ,QAAQ,WAAW;IACnB,QAAQ,WAAW;IACnB,QAAQ,SAAS,eAAe,cAAc,QAAQ,SAAS;GACjE,CAAC;GACD,YAAY,MAAM,CAAC,QAAQ,WAAW,WAAW,QAAQ,WAAW,KAAK,CAAC;GAC1E,SAAS,QAAQ,SAAS,eAAe,cAAc,QAAQ,SAAS;EAC1E;EACA,WAAW;GACT,GAAG,UAAU;GACb,YAAY;IACV,OAAO,MAAM,aAAa;IAC1B,WAAW;IACX,OAAO;IACP,YAAY,SAAS,SACnB,QAAQ,QAAQ,SAAS,eACrB,KAAK,WAAW,IAChB,QAAQ,QAAQ,SAAS,qBACvB,KAAK,WAAW,KACf,KAAK,WAAW,KACf,KAAK,OACF,QACC,OAAO,GAAG,IAAI,WAAW,QAAQ,eAAe,KAChD,IAAI,WAAW,QACf,IAAI,eAAe,IACvB,IACF,KAAK,WAAW,KAChB,KAAK,OACF,QAAQ,OAAO,GAAG,IAAI,WAAW,QAAQ,eAAe,KAAK,IAAI,WAAW,IAC/E;GACV;EACF;EACA,SAAS;GACP,GAAG,OAAO,eAAe;GACzB,UAAU;GACV,WAAW;GACX,aAAa;GACb,SAAS;GACT,SAAS;GACT,OAAO;GACP,WAAW;GACX,gBAAgB;GAChB,eAAe,EAAE,QAAQ,4BAA4B;IACnD,UAAU,OAAO;IACjB,WAAW,OAAO;IAClB,aAAa,OAAO;IACpB,SAAS,OAAO;IAChB,SAAS,OAAO;IAChB,OAAO,OAAO,SAAS;IACvB,WAAW,QAAQ,OAAO,cAAc;IACxC,gBAAgB,QAAQ,oBAAoB;IAC5C,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC;KACtC,WAAW,OAAO;KAClB,WAAW;MACT,SAAS,OAAO;MAChB,SAAS,OAAO;MAChB,OAAO,OAAO,SAAS;KACzB;IACF,CAAC;GACH;GACA,gBAAgB,QAAQ,OAAO,aAAa,IAAI,OAAO;EACzD;EACA,QAAQ;GACN,GAAG,OAAO,aAAa;GACvB,UAAU;GACV,SAAS;GACT,UAAU;GACV,eAAe;GACf,aAAa;GACb,SAAS;GACT,eAAe,SAAS;IAAE,GAAG;IAAK,eAAe;IAAM,aAAa;GAAK;EAC3E;EACA,YAAY;GACV,GAAG,OAAO,kBAAkB;GAC5B,UAAU;GACV,SAAS;GACT,SAAS;GACT,WAAW;GACX,WAAW;GACX,YAAY;GACZ,SAAS;GACT,eAAe;GACf,gBAAgB;GAChB,UAAU;GACV,WAAW;GACX,SAAS;GACT,OAAO;GACP,WAAW;GACX,eAAe;GACf,cAAc;GACd,eAAe;GACf,SAAS;GACT,qBAAqB;GACrB,gBAAgB;GAChB,eAAe,EACb,QACA,WACA,sBACA,OACA,eACA,cACK;IACL,UAAU,OAAO;IACjB,SAAS,OAAO;IAChB,SAAS,OAAO;IAChB,WAAW,OAAO;IAClB;IACA,YAAY,OAAO;IACnB,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,OAAO;IACtD,eAAe,OAAO,SAAS;IAC/B,gBAAgB,OAAO,SAAS;IAChC,UAAU,QAAQ,OAAO,cAAc;IACvC,WAAW,QAAQ,OAAO,eAAe;IACzC,SAAS,OAAO;IAChB;IACA,WAAW;IACX;IACA,cAAc;IACd,eAAe;IACf,SAAS;IACT,qBAAqB,OAAO;IAC5B,gBAAgB,QAAQ,oBAAoB;IAC5C,aAAa,OAAO;GACtB;GACA,gBAAgB,QAAQ,OAAO,aAAa,IAAI,OAAO;GACvD,eAAe,QACb,OAAO,IAAI,aAAa;IACtB,OAAO,OAAO,OAAOA,eAAa;KAChC,UAAU,IAAI;KACd,SAAS,IAAI;KACb,SAAS,IAAI;KACb,WAAW,IAAI;KACf,aAAa,IAAI;KACjB,YAAY,IAAI;KAChB,SAAS,OAAO,OAAO,aAAa,IAAI,OAAO;KAC/C,UAAU;MAAE,OAAO,IAAI;MAAe,QAAQ,IAAI;KAAe;KACjE,gBAAgB,OAAO,YAAY,IAAI,QAAQ;KAC/C,iBAAiB,OAAO,YAAY,IAAI,SAAS;KACjD,SAAS,IAAI;IACf,CAAC;GACH,CAAC;EACL;EACA,cAAc;GACZ,GAAG,OAAO,oBAAoB;GAC9B,UAAU;GACV,SAAS;GACT,gBAAgB;GAChB,QAAQ;GACR,SAAS;GACT,WAAW;GACX,SAAS;GACT,WAAW;GACX,UAAU;GACV,SAAS;GACT,gBAAgB;GAChB,eAAe,YAAY;IACzB,GAAG;IACH,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,OAAO;IACtD,WAAW,QAAQ,OAAO,eAAe;IACzC,UAAU;IACV,gBAAgB,QAAQ,OAAO,oBAAoB;GACrD;GACA,SAAS,QACP,OAAO,IAAI,aAAa;IACtB,OAAO,OAAO,OAAO,mBAAmB;KACtC,GAAG;KACH,SAAS,OAAO,OAAO,aAAa,IAAI,OAAO;KAC/C,iBAAiB,OAAO,YAAY,IAAI,SAAS;IACnD,CAAC;GACH,CAAC;EACL;EACA,WAAW;GACT,GAAG,OAAO,aAAa;GACvB,UAAU;GACV,SAAS;GACT,QAAQ;GACR,WAAW;GACX,UAAU;GACV,eAAe,SAAS,EAAE,GAAG,IAAI;EACnC;EACA,YAAY;GACV,GAAG,OAAO,YAAY;GACtB,UAAU;GACV,SAAS;GACT,QAAQ;GACR,WAAW;GACX,UAAU;GACV,WAAW;GACX,YAAY;GACZ,gBAAgB;GAChB,eAAe,SAAS;IACtB,GAAG;IACH,YAAY,QAAQ,IAAI,gBAAgB;IACxC,gBAAgB,QAAQ,IAAI,oBAAoB;GAClD;EACF;EACA,cAAc;GACZ,GAAG,OAAO,eAAe;GACzB,UAAU;GACV,SAAS;GACT,WAAW;GACX,WAAW;GACX,YAAY;GACZ,gBAAgB;GAChB,eAAe,SAAS;IACtB,GAAG;IACH,YAAY,QAAQ,IAAI,gBAAgB;IACxC,gBAAgB,QAAQ,IAAI,oBAAoB;GAClD;EACF;EACA,SAAS;GACP,GAAG,OAAO,eAAe;GACzB,UAAU;GACV,WAAW;GACX,MAAM;GACN,UAAU;GACV,gBAAgB;GAChB,eAAe,SAAS;IAAE,GAAG;IAAK,gBAAgB,QAAQ,IAAI,oBAAoB;GAAE;EACtF;CACF;CAEA,MAAM,kBAA8D;EAClE,MAAM,YAAY,iBAAsC;GACtD,UAAU,SAAS,MAAM,YAAY,QAAQ;GAC7C,eAAe,YAAY;EAC7B;EAEA,OAAO;GACL;GACA;GACA,qBAAqB,oBAAoB;GACzC,aAAa;GACb,yBAAyB;GACzB,2BAA2B;GAC3B,YAAY,EAAE,UAAU,QAAQ,YAAY,iBAAiB;IAC3D,QAAQ,MAAM,CAAC,UAAU,MAAM,CAAC;IAChC,YAAY,MAAM,CAAC,WAAW,WAAW,WAAW,KAAK,CAAC;IAC1D,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,UAAU;GAC1D;GACA,eAAe;GACf,eAAe;GACf,6BAA6B,kBAAkB,KAAK,SAAS,CAAC;GAC9D,0BAA0B;GAC1B,4BAA4B,iBAAiB,KAAK,SAAS,CAAC;GAC5D,wBAAwB;GACxB,qBAAqB;GACrB,YAAY;IACV,OAAO,MAAM,aAAa;IAC1B,WAAW;IACX,OAAO;IACP,WAAW;IACX,YAAY;IACZ,iBAAiB;IACjB,YAAY,QAAQ,IAAI,WAAW;IACnC,sBAAsB,YAAY,WAAW,cAAc;KACzD,GAAG;KACH;KACA;KACA,YAAY;KACZ,QAAQ;IACV;GACF;GACA,YAAY;IACV,GAAG,OAAO,WAAW;IACrB,UAAU;IACV,WAAW;IACX,cAAc;IACd,oBAAoB;IACpB,iBAAiB;IACjB,UAAU;IACV,eAAe;IACf,eAAe,EAAE,aAAa,GAAG,WAAW;KAAE,GAAG;KAAK,GAAG,SAAS,WAAW;IAAE;IAC/E,iBAAiB,MAAM,qBAAqB;KAC1C,UAAU,SAAS,MAAM,IAAI;KAC7B;IACF;IACA,oBAAoB,EAAE,aAAa,GAAG,WAAW;KAAE,GAAG;KAAK,GAAG,SAAS,WAAW;IAAE;IACpF,SAAS,EAAE,UAAU,SAAS,KAAK,YAAY,iBAC7C,OAAO,IAAI,aAAa;KACtB,MAAM,KAAK,OAAO,EAAE,UAAU,IAAI,EAAE,GAAG;KACvC,MAAM,OAAO,OAAO,OAAO,qBAAqB,WAAW,QAAQ;KAEnE,OAAO,OAAO,OAAO,4BAA4B;MAC/C;MACA,UAAU;OACR,WAAW;OACX,kBAAkB,IAAI,EAAE;OACxB,aAAa,CACX;QACE,cAAc,WAAW;QACzB,UAAU,WAAW;OACvB,CACF;MACF;MACA,cAAc,WAAW;MACzB,oBAAoB,WAAW;MAC/B,iBAAiB,WAAW;MAC5B,UAAU;MACV,eAAe,WAAW;MAC1B,YAAY,OAAO,OAAO,iBAAiB;OACzC,WAAW,WAAW;OACtB,OAAO,WAAW;MACpB,CAAC;MACD,2BAA2B,WAAW;MACtC,GAAI,WAAW,eAAe,OAC1B,CAAC,IACD,EAAE,4BAA4B,OAAO,YAAY,WAAW,UAAU,EAAE;KAC9E,CAAC;IACH,CAAC;GACL;GACA,SAAS;IACP,GAAG,OAAO,kBAAkB;IAC5B,UAAU;IACV,QAAQ;IACR,WAAW;IACX,qBAAqB;IACrB,iBAAiB;IACjB,WAAW;IACX,cAAc;IACd,kBAAkB;IAClB,oBAAoB;IACpB,iBAAiB;IACjB,2BAA2B;IAC3B,YAAY;IACZ,UAAU;IACV,gBAAgB;IAChB,OAAO;IACP,eAAe,KAAK,EAAE,iBAAiB,aAAa;KAClD,UAAU,IAAI;KACd,QAAQ,IAAI;KACZ,WAAW,IAAI;KACf,qBAAqB,IAAI,WAAW;KACpC,iBAAiB,IAAI,WAAW;KAChC,WAAW,mBAAmB;KAC9B,cAAc,IAAI,gBAAgB;KAClC,kBAAkB,IAAI,oBAAoB;KAC1C,oBAAoB,IAAI,sBAAsB;KAC9C,iBAAiB,IAAI,mBAAmB;KACxC,2BAA2B,IAAI,6BAA6B;KAC5D,YAAY,QAAQ,IAAI,gBAAgB;KACxC,UAAU,QAAQ,IAAI,cAAc;KACpC,gBAAgB,QAAQ,IAAI,oBAAoB;KAChD;IACF;GACF;GACA,WAAW;IACT,GAAG,OAAO,gBAAgB;IAC1B,UAAU;IACV,QAAQ;IACR,WAAW;IACX,UAAU;IACV,eAAe,SAAS,EAAE,GAAG,IAAI;GACnC;GACA,QAAQ;IACN,GAAG,OAAO,iBAAiB;IAC3B,UAAU;IACV,QAAQ;IACR,WAAW;IACX,UAAU;IACV,WAAW;IACX,YAAY;IACZ,gBAAgB;IAChB,eAAe,SAAS;KACtB,GAAG;KACH,YAAY,QAAQ,IAAI,gBAAgB;KACxC,gBAAgB,QAAQ,IAAI,oBAAoB;IAClD;GACF;GACA,SAAS;IACP,GAAG,OAAO,kBAAkB;IAC5B,UAAU;IACV,WAAW;IACX,QAAQ;IACR,eAAe;IACf,UAAU;IACV,gBAAgB;IAChB,eAAe,SAAS;KAAE,GAAG;KAAK,gBAAgB,QAAQ,IAAI,oBAAoB;IAAE;GACtF;EACF;CACF;CAEA,MAAM,gBAAqD;EACzD;EACA;EACA,aAAa;EACb,oBAAoB;EACpB,mBAAmB;EACnB,eAAe;EACf,eAAe;EACf,0BAA0B;EAC1B,4BAA4B,iBAAiB,KAAK,SAAS,CAAC;EAC5D,wBAAwB;EACxB,qBAAqB;EACrB,yBAAyB;EACzB,4BAA4B;EAC5B,4BAA4B;EAC5B,qBAAqB;GACnB,GAAG,oBAAoB;GACvB,mBAAmB,cAAc;IAAE;IAAU,QAAQ;GAAK;GAC1D,mBAAmB,cAAc;IAAE;IAAU,QAAQ;GAAM;EAC7D;EACA,YAAY;GACV,OAAO,MAAM,aAAa;GAC1B,WAAW;GACX,OAAO;GACP,WAAW;GACX,YAAY;GACZ,iBAAiB;GACjB,YAAY,QAAQ,IAAI,WAAW,QAAQ,IAAI,eAAe;GAC9D,kBAAkB,QAAQ,IAAI,WAAW,QAAQ,IAAI,eAAe;GACpE,uBAAuB,EAAE,YAAY,WAAW,kBAAkB,uBAAuB;IACvF,GAAG;IACH;IACA,YAAY,QAAQ,gBAAgB;IACpC,UAAU;IACV,QAAQ;GACV;GACA,qBAAqB,EAAE,kBAAkB,uBAAuB;IAC9D,YAAY,QAAQ,gBAAgB;IACpC,UAAU;IACV,QAAQ;GACV;GACA,mBAAmB,EAAE,uBAAuB;IAAE,UAAU;IAAiB,QAAQ;GAAM;EACzF;EACA,YAAY;GACV,OAAO,MAAM,kBAAkB;GAC/B,UAAU;GACV,WAAW;GACX,cAAc;GACd,qBAAqB;GACrB,iBAAiB;GACjB,oBAAoB;GACpB,QAAQ;GACR,iBAAiB,UAAU,UAAU;GACrC,uBAAuB,EAAE,YAAY,GAAG,WAAW;IACjD,GAAG;IACH,qBAAqB,WAAW;IAChC,iBAAiB,WAAW;IAC5B,QAAQ;GACV;GACA,mBAAmB,EAAE,YAAY,0BAA0B;IACzD,qBAAqB,WAAW;IAChC,iBAAiB,WAAW;IAC5B;IACA,QAAQ;GACV;GACA,mBAAmB,EAAE,0BAA0B;IAAE;IAAoB,QAAQ;GAAM;GACnF,SAAS,EAAE,UAAU,SAAS,KAAK,YAAY,iBAC7C,OAAO,IAAI,aAAa;IACtB,OAAO,OAAO,OAAO,yBAAyB;KAC5C;KACA,YAAY;MAAE,WAAW,WAAW;MAAW,OAAO,WAAW;KAAM;KACvE,oBAAoB,WAAW;KAC/B,kBAAkB,OAAO,YAAY,WAAW,UAAU;KAC1D,cAAc,WAAW;KACzB,oBAAoB,WAAW;KAC/B,UAAU;MACR,WAAW,OAAO,EAAE,UAAU,IAAI,EAAE,GAAG;MACvC,kBAAkB,IAAI,EAAE;MACxB,aAAa,CACX;OAAE,cAAc,WAAW;OAAc,UAAU,WAAW;MAAmB,CACnF;KACF;IACF,CAAC;GACH,CAAC;EACL;EACA,SAAS;GACP,OAAO,MAAM,eAAe;GAC5B,UAAU;GACV,WAAW;GACX,QAAQ;GACR,eAAe;GACf,gBAAgB;GAChB,eAAe,EAAE,sBAAsB,GAAG,WAAW;IACnD,GAAG;IACH,gBAAgB,QAAQ,oBAAoB;GAC9C;EACF;CACF;CAEA,MAAM,YACJ,WAUG;EACH,MAAM,SAAS,OAAO,eACpB,OAAO,OAAO;GACZ,GAAG,gBAAgB;GACnB,QAAQ,OAAO;GACf,QAAQ;GACR,SAAS;GACT,YAAY;GACZ,mBAAmB;EACrB,CAAC,CACH;EAEA,MAAM,aAAa,WAA6C;GAC9D,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,kBAAkB,MAAM;GACxB,UAAU,QAAQ,SAAS,cAAc,MAAM,QAAQ,CAAC;GACxD,WAAW,QAAQ,SAAS,cAAc,MAAM,SAAS,CAAC;GAC1D,mBAAmB,QAAQ,SAAS,cAAc,MAAM,iBAAiB,CAAC;GAC1E,QAAQ,OAAO,WAAW,MAAM,CAAC,CAAC;IAChC,GAAG;IACH,QAAQ,OAAO,WAAW,MAAM,CAAC,CAAC,MAAM,MAAM;GAChD,CAAC;EACH;EAEA,OAAO;GACL,GAAG,UAAU;GACb,4BAA4B;GAC5B,aAAa;IAAE,eAAe;IAA0B,QAAQ;GAAsB;GACtF,WAAW;IACT,WAAW,OAAO,OAAO,QAAQ,EAAE;IACnC,YAAY,OAAO,OAAO,WAAW,EAAE;IACvC,QAAQ,OAAO;GACjB;GACA,MAAM;IACJ,OAAO,MAAM,cAAc;IAC3B,QAAQ;IACR,WAAW;IACX,OAAO;IACP,eAAe;IACf,YAAY;IACZ,mBAAmB;IACnB,uBAAuB;IACvB,gBAAgB,SAAS,QAAQ,SAAS,cAAc,IAAI,CAAC;IAC7D,gBAAgB,UAAU,YAAY,KAAK,CAAC,CAAC,KAAK,OAAO,IAAI,SAAS,UAAU,CAAC;IACjF,sBAAsB,SAAS;KAC7B,QAAQ,IAAI,SAAS;KACrB,WAAW,IAAI;KACf,OAAO;KACP,eAAe,IAAI;KACnB,YAAY,QAAQ,SAAS,cAAc,IAAI,UAAU,CAAC;IAC5D;IACA,0BAA0B,SAAS;KACjC,QAAQ,IAAI,SAAS;KACrB,WAAW,IAAI;KACf,OAAO;KACP,eAAe;KACf,YAAY,QAAQ,SAAS,cAAc,IAAI,UAAU,CAAC;IAC5D;GACF;GACA,SAAS;IACP,OAAO,MAAM,UAAU;IACvB,WAAW;IACX,WAAW;IACX,QAAQ;IACR,SAAS;IACT,kBAAkB;IAClB,UAAU;IACV,WAAW;IACX,mBAAmB;IACnB,gBAAgB,SAAS,QAAQ,SAAS,cAAc,IAAI,CAAC;IAC7D,gBAAgB;IAChB,2BAA2B,iBAAiB,KAAK,SAAS,CAAC;IAC3D,eAAe,OAAO,SAAS;KAAE,GAAG,UAAU,KAAK;KAAG,GAAG;IAAI;IAC7D,gBAAgB;IAChB,SAAS,QACP,OAAO,IAAI,aAAa;KACtB,MAAM,QAAQ,OAAO,OAAO,QAAQ,IAAI,MAAM;KAC9C,MAAM,gBAAgB,OAAO,OAAO,QAAQ,MAAM,MAAM;KAExD,OAAO;MAAE,GAAG;MAAO,QAAQ;KAAc;IAC3C,CAAC;GACL;EACF;CACF;CAEA,OAAO;EAAE;EAAO;EAAW;EAAQ;EAAW;EAAQ;EAAU;CAAO;AACzE"}
+{"version":3,"file":"storage-mapping.mjs","names":["ProofRecord"],"sources":["../../src/internal/storage-mapping.ts"],"sourcesContent":["import { randomId } from \"@yielded/auth-crypto\";\nimport { EmailCredentialSnapshot } from \"@yielded/auth/Email\";\nimport { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  PasswordAttemptId,\n  PasswordCredentialSnapshot,\n  EncodedPasswordHash,\n  type PasswordReplacement,\n} from \"@yielded/auth/Password\";\nimport {\n  ProofBinding,\n  ProofContinuationId,\n  ProofDeliveryId,\n  ProofId,\n  ProofPurpose,\n  ProofRequestId,\n  ProofRequestReceipt,\n  ProofVersion,\n} from \"@yielded/auth/Proofs\";\nimport { TokenDigest } from \"@yielded/auth/Schema\";\nimport {\n  SecurityRevision,\n  SessionId,\n  SessionMetadata,\n  SessionAuthenticationProvenance,\n  SessionCredentialVersion,\n  type StatefulSessionRecord,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Redacted, Schema } from \"effect\";\n\nimport type { MappingInput } from \"./configuration\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport { requiredEmailAddressConstraints, type AnyEmailAddressMapping } from \"./models/email-model\";\nimport {\n  requiredPasswordConstraints,\n  type AnyPasswordPersistenceMapping,\n} from \"./models/password-model\";\nimport { requiredProofConstraints, type AnyProofPersistenceMapping } from \"./models/proof-model\";\nimport type { StatefulSessionMapping } from \"./models/session-model\";\nimport type { TableModel, SqlFragment } from \"./query-operations\";\nimport { storageTables, type StorageRole } from \"./storage-tables\";\n\nconst failure = (cause: unknown) => PersistenceMappingError.make({ operation: \"decode\", cause });\n\nconst decode = <S extends Schema.Codec<unknown, unknown>>(schema: S, value: unknown) =>\n  Schema.decodeUnknownEffect(schema)(value).pipe(Effect.mapError(failure));\n\nconst string = (value: unknown) => Schema.decodeUnknownSync(Schema.String)(value);\nconst tuple = Schema.encodeSync(Schema.fromJsonString(Schema.Array(Schema.String)));\nconst bindingJson = Schema.fromJsonString(ProofBinding);\nconst receiptJson = Schema.fromJsonString(ProofRequestReceipt);\n\nconst ProofRecord = Schema.Struct({\n  moduleId: Schema.String,\n  purpose: ProofPurpose,\n  proofId: ProofId,\n  requestId: ProofRequestId,\n  fingerprint: TokenDigest,\n  deliveryId: ProofDeliveryId,\n  binding: ProofBinding,\n  verifier: Schema.Struct({ keyId: Schema.String, digest: TokenDigest }),\n  issuedAtMillis: Schema.Int,\n  expiresAtMillis: Schema.Int,\n  version: ProofVersion,\n});\n\nconst ProofContinuation = Schema.Struct({\n  moduleId: Schema.String,\n  purpose: ProofPurpose,\n  continuationId: ProofContinuationId,\n  digest: TokenDigest,\n  proofId: ProofId,\n  seriesKey: Schema.String,\n  binding: ProofBinding,\n  expiresAtMillis: Schema.Int,\n  version: ProofVersion,\n});\n\n/** Derive shared row mappings from a managed or custom storage layout.\n * Each factory requires its role tables to exist. Adapter authors supply typed\n * table handles and dialect-specific clocks/commit predicates, and may refine\n * authority policy for explicit services. This does not alter composed defaults.\n */\nexport const makeMappings = (input: MappingInput) => {\n  const table = (role: StorageRole) => {\n    const found = input.tables[role];\n\n    if (found === undefined) throw failure(`Missing ${role} mapping`);\n\n    return found;\n  };\n\n  const mapped = (role: StorageRole) => ({\n    table: table(role),\n    ...Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key])),\n  });\n\n  const { subjects: s, encodeInstant: instant, decodeInstant: readInstant } = input;\n  const subjectId = { toNative: s.toNative, toSubject: s.toSubject, equals: Object.is };\n\n  const subject = {\n    table: s.table,\n    id: s.id,\n    status: s.status,\n    securityRevision: s.securityRevision,\n    isActiveStatus: (value: unknown) => Object.is(value, s.activeValue),\n    d1ActiveStatusValue: s.activeValue,\n    decodeRequirement: s.requirements,\n    decodeActionRequirement: s.actionRequirements,\n    nextSecurityRevisionSync: () => SecurityRevision.make(randomId()),\n  };\n\n  const authorityCredential = () => ({\n    ...mapped(\"credentials\"),\n    subjectId: \"subjectId\",\n    credentialId: \"credentialId\",\n    revision: \"revision\",\n    status: \"active\",\n    isActiveStatus: (value: unknown) => value === true,\n    encodeInsert: (row: object) => ({ ...row, active: true }),\n    encodeRevision: (revision: SecurityRevision) => ({ revision }),\n  });\n\n  const authority = () => ({ subjectId, subject, credential: authorityCredential() });\n\n  const proofs = (): AnyProofPersistenceMapping<SqlFragment> => ({\n    constraints: requiredProofConstraints,\n    encodeInstant: instant,\n    decodeInstant: readInstant,\n    allocateVersionSync: () => ProofVersion.make(randomId()),\n    isRequestConflict: () => false,\n    isSeriesConflict: () => false,\n    isCommandConflict: () => false,\n    scopeKeys: ({ binding }) => ({\n      series: tuple([\n        binding.identifier.namespace,\n        binding.identifier.value,\n        binding._tag === \"Identifier\" ? \"anonymous\" : binding.revision.subjectId,\n      ]),\n      identifier: tuple([binding.identifier.namespace, binding.identifier.value]),\n      subject: binding._tag === \"Identifier\" ? \"anonymous\" : binding.revision.subjectId,\n    }),\n    authority: {\n      ...authority(),\n      identifier: {\n        table: table(\"identifiers\"),\n        namespace: \"namespace\",\n        value: \"value\",\n        isCurrent: (request, rows) =>\n          request.binding._tag === \"Identifier\"\n            ? rows.length === 0\n            : request.binding._tag === \"IdentifierChange\"\n              ? rows.length === 0 ||\n                (rows.length === 1 &&\n                  rows.every(\n                    (row) =>\n                      Object.is(row.subjectId, request.nativeSubjectId) &&\n                      row.active === true &&\n                      row.verifiedAt === null,\n                  ))\n              : rows.length === 1 &&\n                rows.every(\n                  (row) => Object.is(row.subjectId, request.nativeSubjectId) && row.active === true,\n                ),\n      },\n    },\n    request: {\n      ...mapped(\"proofRequests\"),\n      moduleId: \"moduleId\",\n      requestId: \"requestId\",\n      fingerprint: \"fingerprint\",\n      proofId: \"proofId\",\n      purpose: \"purpose\",\n      keyId: \"keyId\",\n      createdAt: \"createdAt\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: ({ record, retentionUntilMillis }) => ({\n        moduleId: record.moduleId,\n        requestId: record.requestId,\n        fingerprint: record.fingerprint,\n        proofId: record.proofId,\n        purpose: record.purpose,\n        keyId: record.verifier.keyId,\n        createdAt: instant(record.issuedAtMillis),\n        retentionUntil: instant(retentionUntilMillis),\n        receipt: Schema.encodeSync(receiptJson)({\n          requestId: record.requestId,\n          reference: {\n            proofId: record.proofId,\n            purpose: record.purpose,\n            keyId: record.verifier.keyId,\n          },\n        }),\n      }),\n      decodeReceipt: (row) => decode(receiptJson, row.receipt),\n    },\n    series: {\n      ...mapped(\"proofSeries\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      scopeKey: \"scopeKey\",\n      activeProofId: \"activeProofId\",\n      lastIssueAt: \"lastIssueAt\",\n      version: \"version\",\n      encodeInsert: (row) => ({ ...row, activeProofId: null, lastIssueAt: null }),\n    },\n    generation: {\n      ...mapped(\"proofGenerations\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      proofId: \"proofId\",\n      requestId: \"requestId\",\n      seriesKey: \"seriesKey\",\n      deliveryId: \"deliveryId\",\n      binding: \"binding\",\n      verifierKeyId: \"verifierKeyId\",\n      verifierDigest: \"verifierDigest\",\n      issuedAt: \"issuedAt\",\n      expiresAt: \"expiresAt\",\n      version: \"version\",\n      state: \"state\",\n      sendCount: \"sendCount\",\n      deliveryState: \"deliveryState\",\n      claimVersion: \"claimVersion\",\n      claimDeadline: \"claimDeadline\",\n      retryAt: \"retryAt\",\n      deliveryRetryMillis: \"deliveryRetryMillis\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: ({\n        record,\n        seriesKey,\n        retentionUntilMillis,\n        state,\n        deliveryState,\n        policy,\n      }) => ({\n        moduleId: record.moduleId,\n        purpose: record.purpose,\n        proofId: record.proofId,\n        requestId: record.requestId,\n        seriesKey,\n        deliveryId: record.deliveryId,\n        binding: Schema.encodeSync(bindingJson)(record.binding),\n        verifierKeyId: record.verifier.keyId,\n        verifierDigest: record.verifier.digest,\n        issuedAt: instant(record.issuedAtMillis),\n        expiresAt: instant(record.expiresAtMillis),\n        version: record.version,\n        state,\n        sendCount: 0,\n        deliveryState,\n        claimVersion: null,\n        claimDeadline: null,\n        retryAt: null,\n        deliveryRetryMillis: policy.deliveryRetryMillis,\n        retentionUntil: instant(retentionUntilMillis),\n        fingerprint: record.fingerprint,\n      }),\n      decodeBinding: (row) => decode(bindingJson, row.binding),\n      decodeRecord: (row) =>\n        Effect.gen(function* () {\n          return yield* decode(ProofRecord, {\n            moduleId: row.moduleId,\n            purpose: row.purpose,\n            proofId: row.proofId,\n            requestId: row.requestId,\n            fingerprint: row.fingerprint,\n            deliveryId: row.deliveryId,\n            binding: yield* decode(bindingJson, row.binding),\n            verifier: { keyId: row.verifierKeyId, digest: row.verifierDigest },\n            issuedAtMillis: yield* readInstant(row.issuedAt),\n            expiresAtMillis: yield* readInstant(row.expiresAt),\n            version: row.version,\n          });\n        }),\n    },\n    continuation: {\n      ...mapped(\"proofContinuations\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      continuationId: \"continuationId\",\n      digest: \"digest\",\n      proofId: \"proofId\",\n      seriesKey: \"seriesKey\",\n      binding: \"binding\",\n      expiresAt: \"expiresAt\",\n      consumed: \"consumed\",\n      version: \"version\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: (record) => ({\n        ...record,\n        binding: Schema.encodeSync(bindingJson)(record.binding),\n        expiresAt: instant(record.expiresAtMillis),\n        consumed: false,\n        retentionUntil: instant(record.retentionUntilMillis),\n      }),\n      decode: (row) =>\n        Effect.gen(function* () {\n          return yield* decode(ProofContinuation, {\n            ...row,\n            binding: yield* decode(bindingJson, row.binding),\n            expiresAtMillis: yield* readInstant(row.expiresAt),\n          });\n        }),\n    },\n    rateScope: {\n      ...mapped(\"proofScopes\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      action: \"action\",\n      scopeKind: \"scopeKind\",\n      scopeKey: \"scopeKey\",\n      encodeInsert: (row) => ({ ...row }),\n    },\n    abuseEvent: {\n      ...mapped(\"proofAbuse\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      action: \"action\",\n      scopeKind: \"scopeKind\",\n      scopeKey: \"scopeKey\",\n      commandId: \"commandId\",\n      occurredAt: \"occurredAt\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: (row) => ({\n        ...row,\n        occurredAt: instant(row.occurredAtMillis),\n        retentionUntil: instant(row.retentionUntilMillis),\n      }),\n    },\n    failureEvent: {\n      ...mapped(\"proofFailures\"),\n      moduleId: \"moduleId\",\n      purpose: \"purpose\",\n      seriesKey: \"seriesKey\",\n      commandId: \"commandId\",\n      occurredAt: \"occurredAt\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: (row) => ({\n        ...row,\n        occurredAt: instant(row.occurredAtMillis),\n        retentionUntil: instant(row.retentionUntilMillis),\n      }),\n    },\n    command: {\n      ...mapped(\"proofCommands\"),\n      moduleId: \"moduleId\",\n      commandId: \"commandId\",\n      kind: \"kind\",\n      decision: \"decision\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: (row) => ({ ...row, retentionUntil: instant(row.retentionUntilMillis) }),\n    },\n  });\n\n  const passwords = (): AnyPasswordPersistenceMapping<SqlFragment> => {\n    const verifier = (replacement: PasswordReplacement) => ({\n      verifier: Redacted.value(replacement.verifier),\n      normalization: replacement.normalization,\n    });\n\n    return {\n      subjectId,\n      subject,\n      authorityCredential: authorityCredential(),\n      constraints: requiredPasswordConstraints,\n      isCommandConflict: () => false,\n      isRateScopeConflict: () => false,\n      scopeKeys: ({ moduleId, action, identifier, subjectId }) => ({\n        action: tuple([moduleId, action]),\n        identifier: tuple([identifier.namespace, identifier.value]),\n        ...(subjectId === undefined ? {} : { subject: subjectId }),\n      }),\n      encodeInstant: instant,\n      decodeInstant: readInstant,\n      allocateAttemptIdSync: () => PasswordAttemptId.make(randomId()),\n      allocateCredentialIdSync: randomId,\n      allocateRevisionSync: () => SecurityRevision.make(randomId()),\n      commandRetentionMillis: 86_400_000,\n      sessionInvalidation: \"same-authority-immediate\",\n      identifier: {\n        table: table(\"identifiers\"),\n        namespace: \"namespace\",\n        value: \"value\",\n        subjectId: \"subjectId\",\n        verifiedAt: \"verifiedAt\",\n        bindingRevision: \"revision\",\n        isCurrent: (row) => row.active === true,\n        encodeInitialInsert: (identifier, subjectId, revision) => ({\n          ...identifier,\n          subjectId,\n          revision,\n          verifiedAt: null,\n          active: true,\n        }),\n      },\n      credential: {\n        ...mapped(\"passwords\"),\n        moduleId: \"moduleId\",\n        subjectId: \"subjectId\",\n        credentialId: \"credentialId\",\n        credentialRevision: \"credentialRevision\",\n        verifierVersion: \"verifierVersion\",\n        verifier: \"verifier\",\n        normalization: \"normalization\",\n        encodeInsert: ({ replacement, ...row }) => ({ ...row, ...verifier(replacement) }),\n        encodeVerifier: (hash, verifierVersion) => ({\n          verifier: Redacted.value(hash),\n          verifierVersion,\n        }),\n        encodeReplacement: ({ replacement, ...row }) => ({ ...row, ...verifier(replacement) }),\n        decode: ({ moduleId, subject: row, identifier, credential }) =>\n          Effect.gen(function* () {\n            const id = yield* s.toSubject(row[s.id]);\n            const hash = yield* decode(EncodedPasswordHash, credential.verifier);\n\n            return yield* decode(PasswordCredentialSnapshot, {\n              moduleId,\n              revision: {\n                subjectId: id,\n                securityRevision: row[s.securityRevision],\n                credentials: [\n                  {\n                    credentialId: credential.credentialId,\n                    revision: credential.credentialRevision,\n                  },\n                ],\n              },\n              credentialId: credential.credentialId,\n              credentialRevision: credential.credentialRevision,\n              verifierVersion: credential.verifierVersion,\n              verifier: hash,\n              normalization: credential.normalization,\n              identifier: yield* decode(LoginIdentifier, {\n                namespace: identifier.namespace,\n                value: identifier.value,\n              }),\n              identifierBindingRevision: identifier.revision,\n              ...(identifier.verifiedAt === null\n                ? {}\n                : { identifierVerifiedAtMillis: yield* readInstant(identifier.verifiedAt) }),\n            });\n          }),\n      },\n      attempt: {\n        ...mapped(\"passwordAttempts\"),\n        moduleId: \"moduleId\",\n        action: \"action\",\n        attemptId: \"attemptId\",\n        identifierNamespace: \"identifierNamespace\",\n        identifierValue: \"identifierValue\",\n        subjectId: \"subjectId\",\n        credentialId: \"credentialId\",\n        securityRevision: \"securityRevision\",\n        credentialRevision: \"credentialRevision\",\n        verifierVersion: \"verifierVersion\",\n        identifierBindingRevision: \"identifierBindingRevision\",\n        admittedAt: \"admittedAt\",\n        deadline: \"deadline\",\n        retentionUntil: \"retentionUntil\",\n        state: \"state\",\n        encodeInsert: (row, { nativeSubjectId, state }) => ({\n          moduleId: row.moduleId,\n          action: row.action,\n          attemptId: row.attemptId,\n          identifierNamespace: row.identifier.namespace,\n          identifierValue: row.identifier.value,\n          subjectId: nativeSubjectId ?? null,\n          credentialId: row.credentialId ?? null,\n          securityRevision: row.securityRevision ?? null,\n          credentialRevision: row.credentialRevision ?? null,\n          verifierVersion: row.verifierVersion ?? null,\n          identifierBindingRevision: row.identifierBindingRevision ?? null,\n          admittedAt: instant(row.admittedAtMillis),\n          deadline: instant(row.deadlineMillis),\n          retentionUntil: instant(row.retentionUntilMillis),\n          state,\n        }),\n      },\n      rateScope: {\n        ...mapped(\"passwordScopes\"),\n        moduleId: \"moduleId\",\n        action: \"action\",\n        scopeKind: \"scopeKind\",\n        scopeKey: \"scopeKey\",\n        encodeInsert: (row) => ({ ...row }),\n      },\n      charge: {\n        ...mapped(\"passwordCharges\"),\n        moduleId: \"moduleId\",\n        action: \"action\",\n        scopeKind: \"scopeKind\",\n        scopeKey: \"scopeKey\",\n        attemptId: \"attemptId\",\n        occurredAt: \"occurredAt\",\n        retentionUntil: \"retentionUntil\",\n        encodeInsert: (row) => ({\n          ...row,\n          occurredAt: instant(row.occurredAtMillis),\n          retentionUntil: instant(row.retentionUntilMillis),\n        }),\n      },\n      command: {\n        ...mapped(\"passwordCommands\"),\n        moduleId: \"moduleId\",\n        commandId: \"commandId\",\n        action: \"action\",\n        bindingDigest: \"bindingDigest\",\n        decision: \"decision\",\n        retentionUntil: \"retentionUntil\",\n        encodeInsert: (row) => ({ ...row, retentionUntil: instant(row.retentionUntilMillis) }),\n      },\n    };\n  };\n\n  const emails = (): AnyEmailAddressMapping<SqlFragment> => ({\n    subjectId,\n    subject,\n    constraints: requiredEmailAddressConstraints,\n    addressCardinality: \"single\",\n    changeDisposition: \"retire-source\",\n    encodeInstant: instant,\n    decodeInstant: readInstant,\n    allocateCredentialIdSync: randomId,\n    allocateRevisionSync: () => SecurityRevision.make(randomId()),\n    commandRetentionMillis: 86_400_000,\n    sessionInvalidation: \"same-authority-immediate\",\n    isCommandConflict: () => false,\n    isIdentifierConflict: () => false,\n    isCredentialConflict: () => false,\n    authorityCredential: {\n      ...authorityCredential(),\n      encodeActivation: (revision) => ({ revision, active: true }),\n      encodeRetirement: (revision) => ({ revision, active: false }),\n    },\n    identifier: {\n      table: table(\"identifiers\"),\n      namespace: \"namespace\",\n      value: \"value\",\n      subjectId: \"subjectId\",\n      verifiedAt: \"verifiedAt\",\n      bindingRevision: \"revision\",\n      isCurrent: (row) => row.active === true && row.verifiedAt !== null,\n      isMutableTarget: (row) => row.active === true && row.verifiedAt === null,\n      encodeVerifiedInsert: ({ identifier, subjectId, verifiedAtMillis, bindingRevision }) => ({\n        ...identifier,\n        subjectId,\n        verifiedAt: instant(verifiedAtMillis),\n        revision: bindingRevision,\n        active: true,\n      }),\n      encodeVerification: ({ verifiedAtMillis, bindingRevision }) => ({\n        verifiedAt: instant(verifiedAtMillis),\n        revision: bindingRevision,\n        active: true,\n      }),\n      encodeRetirement: ({ bindingRevision }) => ({ revision: bindingRevision, active: false }),\n    },\n    credential: {\n      table: table(\"emailCredentials\"),\n      moduleId: \"moduleId\",\n      subjectId: \"subjectId\",\n      credentialId: \"credentialId\",\n      identifierNamespace: \"identifierNamespace\",\n      identifierValue: \"identifierValue\",\n      credentialRevision: \"credentialRevision\",\n      status: \"active\",\n      isActiveStatus: (value) => value === true,\n      encodeVerifiedInsert: ({ identifier, ...row }) => ({\n        ...row,\n        identifierNamespace: identifier.namespace,\n        identifierValue: identifier.value,\n        active: true,\n      }),\n      encodeActivation: ({ identifier, credentialRevision }) => ({\n        identifierNamespace: identifier.namespace,\n        identifierValue: identifier.value,\n        credentialRevision,\n        active: true,\n      }),\n      encodeRetirement: ({ credentialRevision }) => ({ credentialRevision, active: false }),\n      decode: ({ moduleId, subject: row, identifier, credential }) =>\n        Effect.gen(function* () {\n          return yield* decode(EmailCredentialSnapshot, {\n            moduleId,\n            identifier: { namespace: identifier.namespace, value: identifier.value },\n            identifierRevision: identifier.revision,\n            verifiedAtMillis: yield* readInstant(identifier.verifiedAt),\n            credentialId: credential.credentialId,\n            credentialRevision: credential.credentialRevision,\n            revision: {\n              subjectId: yield* s.toSubject(row[s.id]),\n              securityRevision: row[s.securityRevision],\n              credentials: [\n                { credentialId: credential.credentialId, revision: credential.credentialRevision },\n              ],\n            },\n          });\n        }),\n    },\n    command: {\n      table: table(\"emailCommands\"),\n      moduleId: \"moduleId\",\n      commandId: \"commandId\",\n      action: \"action\",\n      bindingDigest: \"bindingDigest\",\n      retentionUntil: \"retentionUntil\",\n      encodeInsert: ({ retentionUntilMillis, ...row }) => ({\n        ...row,\n        retentionUntil: instant(retentionUntilMillis),\n      }),\n    },\n  });\n\n  const sessions = <C extends Schema.Codec<unknown, unknown, never, never>>(\n    claims: C,\n  ): StatefulSessionMapping<\n    C[\"Type\"],\n    TableModel,\n    TableModel,\n    TableModel,\n    TableModel,\n    TableModel,\n    unknown,\n    string\n  > => {\n    const record = Schema.fromJsonString(\n      Schema.Struct({\n        ...SessionMetadata.fields,\n        claims: Schema.Unknown,\n        digest: TokenDigest,\n        version: SecurityRevision,\n        provenance: SessionAuthenticationProvenance,\n        credentialVersion: SessionCredentialVersion,\n      }),\n    );\n\n    const encodeRow = (value: StatefulSessionRecord<C[\"Type\"]>) => ({\n      digest: value.digest,\n      version: value.version,\n      securityRevision: value.securityRevision,\n      issuedAt: instant(DateTime.toEpochMillis(value.issuedAt)),\n      expiresAt: instant(DateTime.toEpochMillis(value.expiresAt)),\n      absoluteExpiresAt: instant(DateTime.toEpochMillis(value.absoluteExpiresAt)),\n      record: Schema.encodeSync(record)({\n        ...value,\n        claims: Schema.encodeSync(claims)(value.claims),\n      }),\n    });\n\n    return {\n      ...authority(),\n      isConstraintConflict: () => false,\n      constraints: { sessionDigest: \"unique(session.digest)\", flowId: \"unique(flow.flowId)\" },\n      sessionId: {\n        toNative: (id) => Effect.succeed(id),\n        toSession: (id) => decode(SessionId, id),\n        equals: Object.is,\n      },\n      flow: {\n        table: table(\"sessionFlows\"),\n        flowId: \"flowId\",\n        subjectId: \"subjectId\",\n        state: \"state\",\n        pendingDigest: \"pendingDigest\",\n        dedupUntil: \"dedupUntil\",\n        pendingStateValue: \"pending\",\n        establishedStateValue: \"established\",\n        encodeInstant: (date) => instant(DateTime.toEpochMillis(date)),\n        decodeInstant: (value) => readInstant(value).pipe(Effect.map(DateTime.makeUnsafe)),\n        encodePendingInsert: (row) => ({\n          flowId: row.evidence.flowId,\n          subjectId: row.subjectId,\n          state: \"pending\",\n          pendingDigest: row.pendingDigest,\n          dedupUntil: instant(DateTime.toEpochMillis(row.dedupUntil)),\n        }),\n        encodeEstablishedInsert: (row) => ({\n          flowId: row.evidence.flowId,\n          subjectId: row.subjectId,\n          state: \"established\",\n          pendingDigest: null,\n          dedupUntil: instant(DateTime.toEpochMillis(row.dedupUntil)),\n        }),\n      },\n      session: {\n        table: table(\"sessions\"),\n        sessionId: \"sessionId\",\n        subjectId: \"subjectId\",\n        digest: \"digest\",\n        version: \"version\",\n        securityRevision: \"securityRevision\",\n        issuedAt: \"issuedAt\",\n        expiresAt: \"expiresAt\",\n        absoluteExpiresAt: \"absoluteExpiresAt\",\n        encodeInstant: (date) => instant(DateTime.toEpochMillis(date)),\n        allocateIdSync: randomId,\n        allocateVersionSync: () => SecurityRevision.make(randomId()),\n        encodeInsert: (value, ids) => ({ ...encodeRow(value), ...ids }),\n        encodeRotation: encodeRow,\n        decode: (row) =>\n          Effect.gen(function* () {\n            const saved = yield* decode(record, row.record);\n            const decodedClaims = yield* decode(claims, saved.claims);\n\n            return { ...saved, claims: decodedClaims };\n          }),\n      },\n    };\n  };\n\n  return { table, authority, proofs, passwords, emails, sessions, string };\n};\n"],"mappings":";;;;;;;;;;;;;;AA0CA,MAAM,WAAW,UAAmB,wBAAwB,KAAK;CAAE,WAAW;CAAU;AAAM,CAAC;AAE/F,MAAM,UAAoD,QAAW,UACnE,OAAO,oBAAoB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;AAEzE,MAAM,UAAU,UAAmB,OAAO,kBAAkB,OAAO,MAAM,CAAC,CAAC,KAAK;AAChF,MAAM,QAAQ,OAAO,WAAW,OAAO,eAAe,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC;AAClF,MAAM,cAAc,OAAO,eAAe,YAAY;AACtD,MAAM,cAAc,OAAO,eAAe,mBAAmB;AAE7D,MAAMA,gBAAc,OAAO,OAAO;CAChC,UAAU,OAAO;CACjB,SAAS;CACT,SAAS;CACT,WAAW;CACX,aAAa;CACb,YAAY;CACZ,SAAS;CACT,UAAU,OAAO,OAAO;EAAE,OAAO,OAAO;EAAQ,QAAQ;CAAY,CAAC;CACrE,gBAAgB,OAAO;CACvB,iBAAiB,OAAO;CACxB,SAAS;AACX,CAAC;AAED,MAAM,oBAAoB,OAAO,OAAO;CACtC,UAAU,OAAO;CACjB,SAAS;CACT,gBAAgB;CAChB,QAAQ;CACR,SAAS;CACT,WAAW,OAAO;CAClB,SAAS;CACT,iBAAiB,OAAO;CACxB,SAAS;AACX,CAAC;;;;;;AAOD,MAAa,gBAAgB,UAAwB;CACnD,MAAM,SAAS,SAAsB;EACnC,MAAM,QAAQ,MAAM,OAAO;EAE3B,IAAI,UAAU,KAAA,GAAW,MAAM,QAAQ,WAAW,KAAK,SAAS;EAEhE,OAAO;CACT;CAEA,MAAM,UAAU,UAAuB;EACrC,OAAO,MAAM,IAAI;EACjB,GAAG,OAAO,YAAY,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;CACzF;CAEA,MAAM,EAAE,UAAU,GAAG,eAAe,SAAS,eAAe,gBAAgB;CAC5E,MAAM,YAAY;EAAE,UAAU,EAAE;EAAU,WAAW,EAAE;EAAW,QAAQ,OAAO;CAAG;CAEpF,MAAM,UAAU;EACd,OAAO,EAAE;EACT,IAAI,EAAE;EACN,QAAQ,EAAE;EACV,kBAAkB,EAAE;EACpB,iBAAiB,UAAmB,OAAO,GAAG,OAAO,EAAE,WAAW;EAClE,qBAAqB,EAAE;EACvB,mBAAmB,EAAE;EACrB,yBAAyB,EAAE;EAC3B,gCAAgC,iBAAiB,KAAK,SAAS,CAAC;CAClE;CAEA,MAAM,6BAA6B;EACjC,GAAG,OAAO,aAAa;EACvB,WAAW;EACX,cAAc;EACd,UAAU;EACV,QAAQ;EACR,iBAAiB,UAAmB,UAAU;EAC9C,eAAe,SAAiB;GAAE,GAAG;GAAK,QAAQ;EAAK;EACvD,iBAAiB,cAAgC,EAAE,SAAS;CAC9D;CAEA,MAAM,mBAAmB;EAAE;EAAW;EAAS,YAAY,oBAAoB;CAAE;CAEjF,MAAM,gBAAyD;EAC7D,aAAa;EACb,eAAe;EACf,eAAe;EACf,2BAA2B,aAAa,KAAK,SAAS,CAAC;EACvD,yBAAyB;EACzB,wBAAwB;EACxB,yBAAyB;EACzB,YAAY,EAAE,eAAe;GAC3B,QAAQ,MAAM;IACZ,QAAQ,WAAW;IACnB,QAAQ,WAAW;IACnB,QAAQ,SAAS,eAAe,cAAc,QAAQ,SAAS;GACjE,CAAC;GACD,YAAY,MAAM,CAAC,QAAQ,WAAW,WAAW,QAAQ,WAAW,KAAK,CAAC;GAC1E,SAAS,QAAQ,SAAS,eAAe,cAAc,QAAQ,SAAS;EAC1E;EACA,WAAW;GACT,GAAG,UAAU;GACb,YAAY;IACV,OAAO,MAAM,aAAa;IAC1B,WAAW;IACX,OAAO;IACP,YAAY,SAAS,SACnB,QAAQ,QAAQ,SAAS,eACrB,KAAK,WAAW,IAChB,QAAQ,QAAQ,SAAS,qBACvB,KAAK,WAAW,KACf,KAAK,WAAW,KACf,KAAK,OACF,QACC,OAAO,GAAG,IAAI,WAAW,QAAQ,eAAe,KAChD,IAAI,WAAW,QACf,IAAI,eAAe,IACvB,IACF,KAAK,WAAW,KAChB,KAAK,OACF,QAAQ,OAAO,GAAG,IAAI,WAAW,QAAQ,eAAe,KAAK,IAAI,WAAW,IAC/E;GACV;EACF;EACA,SAAS;GACP,GAAG,OAAO,eAAe;GACzB,UAAU;GACV,WAAW;GACX,aAAa;GACb,SAAS;GACT,SAAS;GACT,OAAO;GACP,WAAW;GACX,gBAAgB;GAChB,eAAe,EAAE,QAAQ,4BAA4B;IACnD,UAAU,OAAO;IACjB,WAAW,OAAO;IAClB,aAAa,OAAO;IACpB,SAAS,OAAO;IAChB,SAAS,OAAO;IAChB,OAAO,OAAO,SAAS;IACvB,WAAW,QAAQ,OAAO,cAAc;IACxC,gBAAgB,QAAQ,oBAAoB;IAC5C,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC;KACtC,WAAW,OAAO;KAClB,WAAW;MACT,SAAS,OAAO;MAChB,SAAS,OAAO;MAChB,OAAO,OAAO,SAAS;KACzB;IACF,CAAC;GACH;GACA,gBAAgB,QAAQ,OAAO,aAAa,IAAI,OAAO;EACzD;EACA,QAAQ;GACN,GAAG,OAAO,aAAa;GACvB,UAAU;GACV,SAAS;GACT,UAAU;GACV,eAAe;GACf,aAAa;GACb,SAAS;GACT,eAAe,SAAS;IAAE,GAAG;IAAK,eAAe;IAAM,aAAa;GAAK;EAC3E;EACA,YAAY;GACV,GAAG,OAAO,kBAAkB;GAC5B,UAAU;GACV,SAAS;GACT,SAAS;GACT,WAAW;GACX,WAAW;GACX,YAAY;GACZ,SAAS;GACT,eAAe;GACf,gBAAgB;GAChB,UAAU;GACV,WAAW;GACX,SAAS;GACT,OAAO;GACP,WAAW;GACX,eAAe;GACf,cAAc;GACd,eAAe;GACf,SAAS;GACT,qBAAqB;GACrB,gBAAgB;GAChB,eAAe,EACb,QACA,WACA,sBACA,OACA,eACA,cACK;IACL,UAAU,OAAO;IACjB,SAAS,OAAO;IAChB,SAAS,OAAO;IAChB,WAAW,OAAO;IAClB;IACA,YAAY,OAAO;IACnB,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,OAAO;IACtD,eAAe,OAAO,SAAS;IAC/B,gBAAgB,OAAO,SAAS;IAChC,UAAU,QAAQ,OAAO,cAAc;IACvC,WAAW,QAAQ,OAAO,eAAe;IACzC,SAAS,OAAO;IAChB;IACA,WAAW;IACX;IACA,cAAc;IACd,eAAe;IACf,SAAS;IACT,qBAAqB,OAAO;IAC5B,gBAAgB,QAAQ,oBAAoB;IAC5C,aAAa,OAAO;GACtB;GACA,gBAAgB,QAAQ,OAAO,aAAa,IAAI,OAAO;GACvD,eAAe,QACb,OAAO,IAAI,aAAa;IACtB,OAAO,OAAO,OAAOA,eAAa;KAChC,UAAU,IAAI;KACd,SAAS,IAAI;KACb,SAAS,IAAI;KACb,WAAW,IAAI;KACf,aAAa,IAAI;KACjB,YAAY,IAAI;KAChB,SAAS,OAAO,OAAO,aAAa,IAAI,OAAO;KAC/C,UAAU;MAAE,OAAO,IAAI;MAAe,QAAQ,IAAI;KAAe;KACjE,gBAAgB,OAAO,YAAY,IAAI,QAAQ;KAC/C,iBAAiB,OAAO,YAAY,IAAI,SAAS;KACjD,SAAS,IAAI;IACf,CAAC;GACH,CAAC;EACL;EACA,cAAc;GACZ,GAAG,OAAO,oBAAoB;GAC9B,UAAU;GACV,SAAS;GACT,gBAAgB;GAChB,QAAQ;GACR,SAAS;GACT,WAAW;GACX,SAAS;GACT,WAAW;GACX,UAAU;GACV,SAAS;GACT,gBAAgB;GAChB,eAAe,YAAY;IACzB,GAAG;IACH,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,OAAO;IACtD,WAAW,QAAQ,OAAO,eAAe;IACzC,UAAU;IACV,gBAAgB,QAAQ,OAAO,oBAAoB;GACrD;GACA,SAAS,QACP,OAAO,IAAI,aAAa;IACtB,OAAO,OAAO,OAAO,mBAAmB;KACtC,GAAG;KACH,SAAS,OAAO,OAAO,aAAa,IAAI,OAAO;KAC/C,iBAAiB,OAAO,YAAY,IAAI,SAAS;IACnD,CAAC;GACH,CAAC;EACL;EACA,WAAW;GACT,GAAG,OAAO,aAAa;GACvB,UAAU;GACV,SAAS;GACT,QAAQ;GACR,WAAW;GACX,UAAU;GACV,eAAe,SAAS,EAAE,GAAG,IAAI;EACnC;EACA,YAAY;GACV,GAAG,OAAO,YAAY;GACtB,UAAU;GACV,SAAS;GACT,QAAQ;GACR,WAAW;GACX,UAAU;GACV,WAAW;GACX,YAAY;GACZ,gBAAgB;GAChB,eAAe,SAAS;IACtB,GAAG;IACH,YAAY,QAAQ,IAAI,gBAAgB;IACxC,gBAAgB,QAAQ,IAAI,oBAAoB;GAClD;EACF;EACA,cAAc;GACZ,GAAG,OAAO,eAAe;GACzB,UAAU;GACV,SAAS;GACT,WAAW;GACX,WAAW;GACX,YAAY;GACZ,gBAAgB;GAChB,eAAe,SAAS;IACtB,GAAG;IACH,YAAY,QAAQ,IAAI,gBAAgB;IACxC,gBAAgB,QAAQ,IAAI,oBAAoB;GAClD;EACF;EACA,SAAS;GACP,GAAG,OAAO,eAAe;GACzB,UAAU;GACV,WAAW;GACX,MAAM;GACN,UAAU;GACV,gBAAgB;GAChB,eAAe,SAAS;IAAE,GAAG;IAAK,gBAAgB,QAAQ,IAAI,oBAAoB;GAAE;EACtF;CACF;CAEA,MAAM,kBAA8D;EAClE,MAAM,YAAY,iBAAsC;GACtD,UAAU,SAAS,MAAM,YAAY,QAAQ;GAC7C,eAAe,YAAY;EAC7B;EAEA,OAAO;GACL;GACA;GACA,qBAAqB,oBAAoB;GACzC,aAAa;GACb,yBAAyB;GACzB,2BAA2B;GAC3B,YAAY,EAAE,UAAU,QAAQ,YAAY,iBAAiB;IAC3D,QAAQ,MAAM,CAAC,UAAU,MAAM,CAAC;IAChC,YAAY,MAAM,CAAC,WAAW,WAAW,WAAW,KAAK,CAAC;IAC1D,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,UAAU;GAC1D;GACA,eAAe;GACf,eAAe;GACf,6BAA6B,kBAAkB,KAAK,SAAS,CAAC;GAC9D,0BAA0B;GAC1B,4BAA4B,iBAAiB,KAAK,SAAS,CAAC;GAC5D,wBAAwB;GACxB,qBAAqB;GACrB,YAAY;IACV,OAAO,MAAM,aAAa;IAC1B,WAAW;IACX,OAAO;IACP,WAAW;IACX,YAAY;IACZ,iBAAiB;IACjB,YAAY,QAAQ,IAAI,WAAW;IACnC,sBAAsB,YAAY,WAAW,cAAc;KACzD,GAAG;KACH;KACA;KACA,YAAY;KACZ,QAAQ;IACV;GACF;GACA,YAAY;IACV,GAAG,OAAO,WAAW;IACrB,UAAU;IACV,WAAW;IACX,cAAc;IACd,oBAAoB;IACpB,iBAAiB;IACjB,UAAU;IACV,eAAe;IACf,eAAe,EAAE,aAAa,GAAG,WAAW;KAAE,GAAG;KAAK,GAAG,SAAS,WAAW;IAAE;IAC/E,iBAAiB,MAAM,qBAAqB;KAC1C,UAAU,SAAS,MAAM,IAAI;KAC7B;IACF;IACA,oBAAoB,EAAE,aAAa,GAAG,WAAW;KAAE,GAAG;KAAK,GAAG,SAAS,WAAW;IAAE;IACpF,SAAS,EAAE,UAAU,SAAS,KAAK,YAAY,iBAC7C,OAAO,IAAI,aAAa;KACtB,MAAM,KAAK,OAAO,EAAE,UAAU,IAAI,EAAE,GAAG;KACvC,MAAM,OAAO,OAAO,OAAO,qBAAqB,WAAW,QAAQ;KAEnE,OAAO,OAAO,OAAO,4BAA4B;MAC/C;MACA,UAAU;OACR,WAAW;OACX,kBAAkB,IAAI,EAAE;OACxB,aAAa,CACX;QACE,cAAc,WAAW;QACzB,UAAU,WAAW;OACvB,CACF;MACF;MACA,cAAc,WAAW;MACzB,oBAAoB,WAAW;MAC/B,iBAAiB,WAAW;MAC5B,UAAU;MACV,eAAe,WAAW;MAC1B,YAAY,OAAO,OAAO,iBAAiB;OACzC,WAAW,WAAW;OACtB,OAAO,WAAW;MACpB,CAAC;MACD,2BAA2B,WAAW;MACtC,GAAI,WAAW,eAAe,OAC1B,CAAC,IACD,EAAE,4BAA4B,OAAO,YAAY,WAAW,UAAU,EAAE;KAC9E,CAAC;IACH,CAAC;GACL;GACA,SAAS;IACP,GAAG,OAAO,kBAAkB;IAC5B,UAAU;IACV,QAAQ;IACR,WAAW;IACX,qBAAqB;IACrB,iBAAiB;IACjB,WAAW;IACX,cAAc;IACd,kBAAkB;IAClB,oBAAoB;IACpB,iBAAiB;IACjB,2BAA2B;IAC3B,YAAY;IACZ,UAAU;IACV,gBAAgB;IAChB,OAAO;IACP,eAAe,KAAK,EAAE,iBAAiB,aAAa;KAClD,UAAU,IAAI;KACd,QAAQ,IAAI;KACZ,WAAW,IAAI;KACf,qBAAqB,IAAI,WAAW;KACpC,iBAAiB,IAAI,WAAW;KAChC,WAAW,mBAAmB;KAC9B,cAAc,IAAI,gBAAgB;KAClC,kBAAkB,IAAI,oBAAoB;KAC1C,oBAAoB,IAAI,sBAAsB;KAC9C,iBAAiB,IAAI,mBAAmB;KACxC,2BAA2B,IAAI,6BAA6B;KAC5D,YAAY,QAAQ,IAAI,gBAAgB;KACxC,UAAU,QAAQ,IAAI,cAAc;KACpC,gBAAgB,QAAQ,IAAI,oBAAoB;KAChD;IACF;GACF;GACA,WAAW;IACT,GAAG,OAAO,gBAAgB;IAC1B,UAAU;IACV,QAAQ;IACR,WAAW;IACX,UAAU;IACV,eAAe,SAAS,EAAE,GAAG,IAAI;GACnC;GACA,QAAQ;IACN,GAAG,OAAO,iBAAiB;IAC3B,UAAU;IACV,QAAQ;IACR,WAAW;IACX,UAAU;IACV,WAAW;IACX,YAAY;IACZ,gBAAgB;IAChB,eAAe,SAAS;KACtB,GAAG;KACH,YAAY,QAAQ,IAAI,gBAAgB;KACxC,gBAAgB,QAAQ,IAAI,oBAAoB;IAClD;GACF;GACA,SAAS;IACP,GAAG,OAAO,kBAAkB;IAC5B,UAAU;IACV,WAAW;IACX,QAAQ;IACR,eAAe;IACf,UAAU;IACV,gBAAgB;IAChB,eAAe,SAAS;KAAE,GAAG;KAAK,gBAAgB,QAAQ,IAAI,oBAAoB;IAAE;GACtF;EACF;CACF;CAEA,MAAM,gBAAqD;EACzD;EACA;EACA,aAAa;EACb,oBAAoB;EACpB,mBAAmB;EACnB,eAAe;EACf,eAAe;EACf,0BAA0B;EAC1B,4BAA4B,iBAAiB,KAAK,SAAS,CAAC;EAC5D,wBAAwB;EACxB,qBAAqB;EACrB,yBAAyB;EACzB,4BAA4B;EAC5B,4BAA4B;EAC5B,qBAAqB;GACnB,GAAG,oBAAoB;GACvB,mBAAmB,cAAc;IAAE;IAAU,QAAQ;GAAK;GAC1D,mBAAmB,cAAc;IAAE;IAAU,QAAQ;GAAM;EAC7D;EACA,YAAY;GACV,OAAO,MAAM,aAAa;GAC1B,WAAW;GACX,OAAO;GACP,WAAW;GACX,YAAY;GACZ,iBAAiB;GACjB,YAAY,QAAQ,IAAI,WAAW,QAAQ,IAAI,eAAe;GAC9D,kBAAkB,QAAQ,IAAI,WAAW,QAAQ,IAAI,eAAe;GACpE,uBAAuB,EAAE,YAAY,WAAW,kBAAkB,uBAAuB;IACvF,GAAG;IACH;IACA,YAAY,QAAQ,gBAAgB;IACpC,UAAU;IACV,QAAQ;GACV;GACA,qBAAqB,EAAE,kBAAkB,uBAAuB;IAC9D,YAAY,QAAQ,gBAAgB;IACpC,UAAU;IACV,QAAQ;GACV;GACA,mBAAmB,EAAE,uBAAuB;IAAE,UAAU;IAAiB,QAAQ;GAAM;EACzF;EACA,YAAY;GACV,OAAO,MAAM,kBAAkB;GAC/B,UAAU;GACV,WAAW;GACX,cAAc;GACd,qBAAqB;GACrB,iBAAiB;GACjB,oBAAoB;GACpB,QAAQ;GACR,iBAAiB,UAAU,UAAU;GACrC,uBAAuB,EAAE,YAAY,GAAG,WAAW;IACjD,GAAG;IACH,qBAAqB,WAAW;IAChC,iBAAiB,WAAW;IAC5B,QAAQ;GACV;GACA,mBAAmB,EAAE,YAAY,0BAA0B;IACzD,qBAAqB,WAAW;IAChC,iBAAiB,WAAW;IAC5B;IACA,QAAQ;GACV;GACA,mBAAmB,EAAE,0BAA0B;IAAE;IAAoB,QAAQ;GAAM;GACnF,SAAS,EAAE,UAAU,SAAS,KAAK,YAAY,iBAC7C,OAAO,IAAI,aAAa;IACtB,OAAO,OAAO,OAAO,yBAAyB;KAC5C;KACA,YAAY;MAAE,WAAW,WAAW;MAAW,OAAO,WAAW;KAAM;KACvE,oBAAoB,WAAW;KAC/B,kBAAkB,OAAO,YAAY,WAAW,UAAU;KAC1D,cAAc,WAAW;KACzB,oBAAoB,WAAW;KAC/B,UAAU;MACR,WAAW,OAAO,EAAE,UAAU,IAAI,EAAE,GAAG;MACvC,kBAAkB,IAAI,EAAE;MACxB,aAAa,CACX;OAAE,cAAc,WAAW;OAAc,UAAU,WAAW;MAAmB,CACnF;KACF;IACF,CAAC;GACH,CAAC;EACL;EACA,SAAS;GACP,OAAO,MAAM,eAAe;GAC5B,UAAU;GACV,WAAW;GACX,QAAQ;GACR,eAAe;GACf,gBAAgB;GAChB,eAAe,EAAE,sBAAsB,GAAG,WAAW;IACnD,GAAG;IACH,gBAAgB,QAAQ,oBAAoB;GAC9C;EACF;CACF;CAEA,MAAM,YACJ,WAUG;EACH,MAAM,SAAS,OAAO,eACpB,OAAO,OAAO;GACZ,GAAG,gBAAgB;GACnB,QAAQ,OAAO;GACf,QAAQ;GACR,SAAS;GACT,YAAY;GACZ,mBAAmB;EACrB,CAAC,CACH;EAEA,MAAM,aAAa,WAA6C;GAC9D,QAAQ,MAAM;GACd,SAAS,MAAM;GACf,kBAAkB,MAAM;GACxB,UAAU,QAAQ,SAAS,cAAc,MAAM,QAAQ,CAAC;GACxD,WAAW,QAAQ,SAAS,cAAc,MAAM,SAAS,CAAC;GAC1D,mBAAmB,QAAQ,SAAS,cAAc,MAAM,iBAAiB,CAAC;GAC1E,QAAQ,OAAO,WAAW,MAAM,CAAC,CAAC;IAChC,GAAG;IACH,QAAQ,OAAO,WAAW,MAAM,CAAC,CAAC,MAAM,MAAM;GAChD,CAAC;EACH;EAEA,OAAO;GACL,GAAG,UAAU;GACb,4BAA4B;GAC5B,aAAa;IAAE,eAAe;IAA0B,QAAQ;GAAsB;GACtF,WAAW;IACT,WAAW,OAAO,OAAO,QAAQ,EAAE;IACnC,YAAY,OAAO,OAAO,WAAW,EAAE;IACvC,QAAQ,OAAO;GACjB;GACA,MAAM;IACJ,OAAO,MAAM,cAAc;IAC3B,QAAQ;IACR,WAAW;IACX,OAAO;IACP,eAAe;IACf,YAAY;IACZ,mBAAmB;IACnB,uBAAuB;IACvB,gBAAgB,SAAS,QAAQ,SAAS,cAAc,IAAI,CAAC;IAC7D,gBAAgB,UAAU,YAAY,KAAK,CAAC,CAAC,KAAK,OAAO,IAAI,SAAS,UAAU,CAAC;IACjF,sBAAsB,SAAS;KAC7B,QAAQ,IAAI,SAAS;KACrB,WAAW,IAAI;KACf,OAAO;KACP,eAAe,IAAI;KACnB,YAAY,QAAQ,SAAS,cAAc,IAAI,UAAU,CAAC;IAC5D;IACA,0BAA0B,SAAS;KACjC,QAAQ,IAAI,SAAS;KACrB,WAAW,IAAI;KACf,OAAO;KACP,eAAe;KACf,YAAY,QAAQ,SAAS,cAAc,IAAI,UAAU,CAAC;IAC5D;GACF;GACA,SAAS;IACP,OAAO,MAAM,UAAU;IACvB,WAAW;IACX,WAAW;IACX,QAAQ;IACR,SAAS;IACT,kBAAkB;IAClB,UAAU;IACV,WAAW;IACX,mBAAmB;IACnB,gBAAgB,SAAS,QAAQ,SAAS,cAAc,IAAI,CAAC;IAC7D,gBAAgB;IAChB,2BAA2B,iBAAiB,KAAK,SAAS,CAAC;IAC3D,eAAe,OAAO,SAAS;KAAE,GAAG,UAAU,KAAK;KAAG,GAAG;IAAI;IAC7D,gBAAgB;IAChB,SAAS,QACP,OAAO,IAAI,aAAa;KACtB,MAAM,QAAQ,OAAO,OAAO,QAAQ,IAAI,MAAM;KAC9C,MAAM,gBAAgB,OAAO,OAAO,QAAQ,MAAM,MAAM;KAExD,OAAO;MAAE,GAAG;MAAO,QAAQ;KAAc;IAC3C,CAAC;GACL;EACF;CACF;CAEA,OAAO;EAAE;EAAO;EAAW;EAAQ;EAAW;EAAQ;EAAU;CAAO;AACzE"}

package/dist/internal/storage-validation.d.mts

@@ -0,0 +1,18 @@
+import "./storage-tables.mjs";
+import { PersistenceConfigurationError } from "./configuration.mjs";
+import { Effect } from "effect";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/storage-validation.d.ts
+/** Physical metadata needed for catalog validation; value codecs remain adapter-owned. */
+export interface PhysicalStorageTable {
+  readonly name: string;
+  readonly schema?: string;
+  readonly columns: Readonly<Record<string, {
+    readonly name: string;
+  }>>;
+}
+/** Validate physical uniqueness before the first authentication operation. A
+ * partial or expression index cannot establish these unconditional guarantees. */
+export declare const validateStorage: (dialect: "mysql" | "pg" | "sqlite", table: PhysicalStorageTable, required: readonly (readonly string[])[]) => Effect.Effect<undefined, PersistenceConfigurationError, SqlClient>;
+//#endregion
+//# sourceMappingURL=storage-validation.d.mts.map

package/dist/internal/storage-validation.mjs

@@ -34,6 +34,31 @@ const validateStorage = Effect.fnUntraced(function* (dialect, table, required) {
 			if (columns.every((column) => column.name !== null)) keys.push(columns.flatMap((column) => column.name === null ? [] : [column.name]));
 		}
 		return keys;
+	}) : dialect === "mysql" ? Effect.gen(function* () {
+		const columns = yield* client`
+              select column_name as name from information_schema.columns
+              where table_schema = coalesce(${table.schema ?? null}, database())
+                and table_name = ${table.name}
+            `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(PgColumns)));
+		for (const column of Object.values(table.columns)) if (!columns.some((actual) => actual.name === column.name)) return yield* PersistenceConfigurationError.make({ reason: `Missing SQL column ${table.name}.${column.name}` });
+		const indexes = yield* client`
+              select index_name as name, column_name as columnName, sub_part as prefix
+              from information_schema.statistics
+              where table_schema = coalesce(${table.schema ?? null}, database())
+                and table_name = ${table.name} and non_unique = 0
+              order by index_name, seq_in_index
+            `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(Schema.Struct({
+			name: Schema.String,
+			columnName: Schema.NullOr(Schema.String),
+			prefix: Schema.NullOr(Schema.Number)
+		})))));
+		const keys = /* @__PURE__ */ new Map();
+		for (const index of indexes) {
+			const columns = keys.get(index.name) ?? [];
+			columns.push(index);
+			keys.set(index.name, columns);
+		}
+		return [...keys.values()].filter((columns) => columns.every((column) => column.columnName !== null && column.prefix === null)).map((columns) => columns.flatMap((column) => column.columnName === null ? [] : [column.columnName]));
 	}) : Effect.gen(function* () {
 		const relation = qualifiedTableName(table);
 		const columns = yield* client`select attname as name from pg_attribute where attrelid = to_regclass(${relation}) and attnum > 0 and not attisdropped`.pipe(Effect.flatMap(Schema.decodeUnknownEffect(PgColumns)));
@@ -51,7 +76,7 @@ const validateStorage = Effect.fnUntraced(function* (dialect, table, required) {
 	});
 	for (const keys of required) {
 		const columns = keys.map((key) => table.columns[key]?.name);
-		if (columns.some((column) => column === void 0) || !physicalKeys.some((actual) => actual.length === columns.length && actual.every((column) => columns.includes(column)))) return yield* PersistenceConfigurationError.make({ reason: `Missing unique key on ${table.name} (${keys.join(", ")})` });
+		if (columns.some((column) => column === void 0) || !physicalKeys.some((actual) => actual.length > 0 && actual.length <= columns.length && actual.every((column) => columns.includes(column)))) return yield* PersistenceConfigurationError.make({ reason: `Missing unique key on ${table.name} (${keys.join(", ")})` });
 	}
 }, (effect, _dialect, table) => effect.pipe(Effect.mapError((error) => Schema.is(PersistenceConfigurationError)(error) ? error : PersistenceConfigurationError.make({ reason: `Cannot validate SQL storage for ${table.name}` }))));
 //#endregion

package/dist/internal/storage-validation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"storage-validation.mjs","names":[],"sources":["../../src/internal/storage-validation.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\n\nimport { PersistenceConfigurationError } from \"./configuration\";\nimport type { StorageTable } from \"./storage-tables\";\n\nconst Column = Schema.Struct({ name: Schema.String, pk: Schema.Int });\nconst Index = Schema.Struct({ name: Schema.String, unique: Schema.Int, partial: Schema.Int });\nconst IndexColumn = Schema.Struct({ name: Schema.NullOr(Schema.String) });\nconst PgColumns = Schema.Array(Schema.Struct({ name: Schema.String }));\nconst PgKeys = Schema.Array(Schema.Struct({ columns: Schema.Array(Schema.String) }));\nconst quote = (value: string) => '\"' + value.replaceAll('\"', '\"\"') + '\"';\n\nexport const qualifiedTableName = (table: Pick<StorageTable, \"name\" | \"schema\">) =>\n  (table.schema === undefined ? \"\" : quote(table.schema) + \".\") + quote(table.name);\n\n/** Validate physical uniqueness before the first authentication operation. A\n * partial or expression index cannot establish these unconditional guarantees. */\nexport const validateStorage = Effect.fnUntraced(\n  function* (\n    dialect: \"pg\" | \"sqlite\",\n    table: StorageTable,\n    required: ReadonlyArray<ReadonlyArray<string>>,\n  ) {\n    const client = yield* SqlClient;\n\n    const physicalKeys: ReadonlyArray<ReadonlyArray<string>> = yield* dialect === \"sqlite\"\n      ? Effect.gen(function* () {\n          if (table.schema !== undefined && table.schema !== \"main\")\n            return yield* PersistenceConfigurationError.make({\n              reason: \"SQLite storage must belong to the main database\",\n            });\n\n          const columns = yield* client`select name, pk from pragma_table_info(${table.name})`.pipe(\n            Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(Column))),\n          );\n\n          for (const column of Object.values(table.columns)) {\n            if (!columns.some((actual) => actual.name === column.name))\n              return yield* PersistenceConfigurationError.make({\n                reason: `Missing SQL column ${table.name}.${column.name}`,\n              });\n          }\n          const keys: string[][] = [];\n          const primary = columns.filter((column) => column.pk > 0).sort((a, b) => a.pk - b.pk);\n\n          if (primary.length > 0) keys.push(primary.map((column) => column.name));\n\n          const indexes =\n            yield* client`select name, \"unique\", partial from pragma_index_list(${table.name})`.pipe(\n              Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(Index))),\n            );\n\n          for (const index of indexes) {\n            if (index.unique !== 1 || index.partial !== 0) continue;\n\n            const columns = yield* client`select name from pragma_index_info(${index.name})`.pipe(\n              Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(IndexColumn))),\n            );\n\n            if (columns.every((column) => column.name !== null))\n              keys.push(columns.flatMap((column) => (column.name === null ? [] : [column.name])));\n          }\n\n          return keys;\n        })\n      : Effect.gen(function* () {\n          const relation = qualifiedTableName(table);\n\n          const columns =\n            yield* client`select attname as name from pg_attribute where attrelid = to_regclass(${relation}) and attnum > 0 and not attisdropped`.pipe(\n              Effect.flatMap(Schema.decodeUnknownEffect(PgColumns)),\n            );\n\n          for (const column of Object.values(table.columns)) {\n            if (!columns.some((actual) => actual.name === column.name))\n              return yield* PersistenceConfigurationError.make({\n                reason: `Missing SQL column ${relation}.${column.name}`,\n              });\n          }\n\n          const indexes = yield* client`\n          select array_agg(a.attname order by k.ordinality) as columns\n          from pg_index i\n          cross join lateral unnest(i.indkey) with ordinality as k(attnum, ordinality)\n          join pg_attribute a on a.attrelid = i.indrelid and a.attnum = k.attnum\n          where i.indrelid = to_regclass(${relation}) and i.indisunique and i.indisvalid\n            and i.indimmediate and i.indpred is null and i.indexprs is null\n            and k.ordinality <= i.indnkeyatts\n          group by i.indexrelid\n        `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(PgKeys)));\n\n          return indexes.map((index) => index.columns);\n        });\n\n    for (const keys of required) {\n      const columns = keys.map((key) => table.columns[key]?.name);\n\n      if (\n        columns.some((column) => column === undefined) ||\n        !physicalKeys.some(\n          (actual) =>\n            actual.length === columns.length && actual.every((column) => columns.includes(column)),\n        )\n      )\n        return yield* PersistenceConfigurationError.make({\n          reason: `Missing unique key on ${table.name} (${keys.join(\", \")})`,\n        });\n    }\n  },\n  (effect, _dialect, table) =>\n    effect.pipe(\n      Effect.mapError((error) =>\n        Schema.is(PersistenceConfigurationError)(error)\n          ? error\n          : PersistenceConfigurationError.make({\n              reason: `Cannot validate SQL storage for ${table.name}`,\n            }),\n      ),\n    ),\n);\n"],"mappings":";;;;AAMA,MAAM,SAAS,OAAO,OAAO;CAAE,MAAM,OAAO;CAAQ,IAAI,OAAO;AAAI,CAAC;AACpE,MAAM,QAAQ,OAAO,OAAO;CAAE,MAAM,OAAO;CAAQ,QAAQ,OAAO;CAAK,SAAS,OAAO;AAAI,CAAC;AAC5F,MAAM,cAAc,OAAO,OAAO,EAAE,MAAM,OAAO,OAAO,OAAO,MAAM,EAAE,CAAC;AACxE,MAAM,YAAY,OAAO,MAAM,OAAO,OAAO,EAAE,MAAM,OAAO,OAAO,CAAC,CAAC;AACrE,MAAM,SAAS,OAAO,MAAM,OAAO,OAAO,EAAE,SAAS,OAAO,MAAM,OAAO,MAAM,EAAE,CAAC,CAAC;AACnF,MAAM,SAAS,UAAkB,OAAM,MAAM,WAAW,MAAK,MAAI,IAAI;AAErE,MAAa,sBAAsB,WAChC,MAAM,WAAW,KAAA,IAAY,KAAK,MAAM,MAAM,MAAM,IAAI,OAAO,MAAM,MAAM,IAAI;;;AAIlF,MAAa,kBAAkB,OAAO,WACpC,WACE,SACA,OACA,UACA;CACA,MAAM,SAAS,OAAO;CAEtB,MAAM,eAAqD,OAAO,YAAY,WAC1E,OAAO,IAAI,aAAa;EACtB,IAAI,MAAM,WAAW,KAAA,KAAa,MAAM,WAAW,QACjD,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,kDACV,CAAC;EAEH,MAAM,UAAU,OAAO,MAAM,0CAA0C,MAAM,KAAK,GAAG,KACnF,OAAO,QAAQ,OAAO,oBAAoB,OAAO,MAAM,MAAM,CAAC,CAAC,CACjE;EAEA,KAAK,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,GAC9C,IAAI,CAAC,QAAQ,MAAM,WAAW,OAAO,SAAS,OAAO,IAAI,GACvD,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,sBAAsB,MAAM,KAAK,GAAG,OAAO,OACrD,CAAC;EAEL,MAAM,OAAmB,CAAC;EAC1B,MAAM,UAAU,QAAQ,QAAQ,WAAW,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE;EAEpF,IAAI,QAAQ,SAAS,GAAG,KAAK,KAAK,QAAQ,KAAK,WAAW,OAAO,IAAI,CAAC;EAEtE,MAAM,UACJ,OAAO,MAAM,yDAAyD,MAAM,KAAK,GAAG,KAClF,OAAO,QAAQ,OAAO,oBAAoB,OAAO,MAAM,KAAK,CAAC,CAAC,CAChE;EAEF,KAAK,MAAM,SAAS,SAAS;GAC3B,IAAI,MAAM,WAAW,KAAK,MAAM,YAAY,GAAG;GAE/C,MAAM,UAAU,OAAO,MAAM,sCAAsC,MAAM,KAAK,GAAG,KAC/E,OAAO,QAAQ,OAAO,oBAAoB,OAAO,MAAM,WAAW,CAAC,CAAC,CACtE;GAEA,IAAI,QAAQ,OAAO,WAAW,OAAO,SAAS,IAAI,GAChD,KAAK,KAAK,QAAQ,SAAS,WAAY,OAAO,SAAS,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,CAAE,CAAC;EACtF;EAEA,OAAO;CACT,CAAC,IACD,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,mBAAmB,KAAK;EAEzC,MAAM,UACJ,OAAO,MAAM,yEAAyE,SAAS,uCAAuC,KACpI,OAAO,QAAQ,OAAO,oBAAoB,SAAS,CAAC,CACtD;EAEF,KAAK,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,GAC9C,IAAI,CAAC,QAAQ,MAAM,WAAW,OAAO,SAAS,OAAO,IAAI,GACvD,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,sBAAsB,SAAS,GAAG,OAAO,OACnD,CAAC;EAcL,QAAO,OAXgB,MAAM;;;;;2CAKI,SAAS;;;;UAI1C,KAAK,OAAO,QAAQ,OAAO,oBAAoB,MAAM,CAAC,CAAC,EAAA,CAExC,KAAK,UAAU,MAAM,OAAO;CAC7C,CAAC;CAEL,KAAK,MAAM,QAAQ,UAAU;EAC3B,MAAM,UAAU,KAAK,KAAK,QAAQ,MAAM,QAAQ,IAAI,EAAE,IAAI;EAE1D,IACE,QAAQ,MAAM,WAAW,WAAW,KAAA,CAAS,KAC7C,CAAC,aAAa,MACX,WACC,OAAO,WAAW,QAAQ,UAAU,OAAO,OAAO,WAAW,QAAQ,SAAS,MAAM,CAAC,CACzF,GAEA,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,yBAAyB,MAAM,KAAK,IAAI,KAAK,KAAK,IAAI,EAAE,GAClE,CAAC;CACL;AACF,IACC,QAAQ,UAAU,UACjB,OAAO,KACL,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,8BAA8B,KAAK,EACjC,QAAQ,mCAAmC,MAAM,OACnD,CAAC,CACP,CACF,CACJ"}
+{"version":3,"file":"storage-validation.mjs","names":[],"sources":["../../src/internal/storage-validation.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\n\nimport { PersistenceConfigurationError } from \"./configuration\";\nimport type { StorageTable } from \"./storage-tables\";\n\nconst Column = Schema.Struct({ name: Schema.String, pk: Schema.Int });\nconst Index = Schema.Struct({ name: Schema.String, unique: Schema.Int, partial: Schema.Int });\nconst IndexColumn = Schema.Struct({ name: Schema.NullOr(Schema.String) });\nconst PgColumns = Schema.Array(Schema.Struct({ name: Schema.String }));\nconst PgKeys = Schema.Array(Schema.Struct({ columns: Schema.Array(Schema.String) }));\nconst quote = (value: string) => '\"' + value.replaceAll('\"', '\"\"') + '\"';\n\n/** Physical metadata needed for catalog validation; value codecs remain adapter-owned. */\nexport interface PhysicalStorageTable {\n  readonly name: string;\n  readonly schema?: string;\n  readonly columns: Readonly<Record<string, { readonly name: string }>>;\n}\n\nexport const qualifiedTableName = (table: Pick<StorageTable, \"name\" | \"schema\">) =>\n  (table.schema === undefined ? \"\" : quote(table.schema) + \".\") + quote(table.name);\n\n/** Validate physical uniqueness before the first authentication operation. A\n * partial or expression index cannot establish these unconditional guarantees. */\nexport const validateStorage = Effect.fnUntraced(\n  function* (\n    dialect: \"pg\" | \"mysql\" | \"sqlite\",\n    table: PhysicalStorageTable,\n    required: ReadonlyArray<ReadonlyArray<string>>,\n  ) {\n    const client = yield* SqlClient;\n\n    const physicalKeys: ReadonlyArray<ReadonlyArray<string>> = yield* dialect === \"sqlite\"\n      ? Effect.gen(function* () {\n          if (table.schema !== undefined && table.schema !== \"main\")\n            return yield* PersistenceConfigurationError.make({\n              reason: \"SQLite storage must belong to the main database\",\n            });\n\n          const columns = yield* client`select name, pk from pragma_table_info(${table.name})`.pipe(\n            Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(Column))),\n          );\n\n          for (const column of Object.values(table.columns)) {\n            if (!columns.some((actual) => actual.name === column.name))\n              return yield* PersistenceConfigurationError.make({\n                reason: `Missing SQL column ${table.name}.${column.name}`,\n              });\n          }\n          const keys: string[][] = [];\n          const primary = columns.filter((column) => column.pk > 0).sort((a, b) => a.pk - b.pk);\n\n          if (primary.length > 0) keys.push(primary.map((column) => column.name));\n\n          const indexes =\n            yield* client`select name, \"unique\", partial from pragma_index_list(${table.name})`.pipe(\n              Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(Index))),\n            );\n\n          for (const index of indexes) {\n            if (index.unique !== 1 || index.partial !== 0) continue;\n\n            const columns = yield* client`select name from pragma_index_info(${index.name})`.pipe(\n              Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(IndexColumn))),\n            );\n\n            if (columns.every((column) => column.name !== null))\n              keys.push(columns.flatMap((column) => (column.name === null ? [] : [column.name])));\n          }\n\n          return keys;\n        })\n      : dialect === \"mysql\"\n        ? Effect.gen(function* () {\n            const columns = yield* client`\n              select column_name as name from information_schema.columns\n              where table_schema = coalesce(${table.schema ?? null}, database())\n                and table_name = ${table.name}\n            `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(PgColumns)));\n\n            for (const column of Object.values(table.columns)) {\n              if (!columns.some((actual) => actual.name === column.name))\n                return yield* PersistenceConfigurationError.make({\n                  reason: `Missing SQL column ${table.name}.${column.name}`,\n                });\n            }\n\n            const indexes = yield* client`\n              select index_name as name, column_name as columnName, sub_part as prefix\n              from information_schema.statistics\n              where table_schema = coalesce(${table.schema ?? null}, database())\n                and table_name = ${table.name} and non_unique = 0\n              order by index_name, seq_in_index\n            `.pipe(\n              Effect.flatMap(\n                Schema.decodeUnknownEffect(\n                  Schema.Array(\n                    Schema.Struct({\n                      name: Schema.String,\n                      columnName: Schema.NullOr(Schema.String),\n                      prefix: Schema.NullOr(Schema.Number),\n                    }),\n                  ),\n                ),\n              ),\n            );\n\n            const keys = new Map<string, Array<(typeof indexes)[number]>>();\n\n            for (const index of indexes) {\n              const columns = keys.get(index.name) ?? [];\n\n              columns.push(index);\n              keys.set(index.name, columns);\n            }\n\n            return [...keys.values()]\n              .filter((columns) =>\n                columns.every((column) => column.columnName !== null && column.prefix === null),\n              )\n              .map((columns) =>\n                columns.flatMap((column) =>\n                  column.columnName === null ? [] : [column.columnName],\n                ),\n              );\n          })\n        : Effect.gen(function* () {\n            const relation = qualifiedTableName(table);\n\n            const columns =\n              yield* client`select attname as name from pg_attribute where attrelid = to_regclass(${relation}) and attnum > 0 and not attisdropped`.pipe(\n                Effect.flatMap(Schema.decodeUnknownEffect(PgColumns)),\n              );\n\n            for (const column of Object.values(table.columns)) {\n              if (!columns.some((actual) => actual.name === column.name))\n                return yield* PersistenceConfigurationError.make({\n                  reason: `Missing SQL column ${relation}.${column.name}`,\n                });\n            }\n\n            const indexes = yield* client`\n          select array_agg(a.attname order by k.ordinality) as columns\n          from pg_index i\n          cross join lateral unnest(i.indkey) with ordinality as k(attnum, ordinality)\n          join pg_attribute a on a.attrelid = i.indrelid and a.attnum = k.attnum\n          where i.indrelid = to_regclass(${relation}) and i.indisunique and i.indisvalid\n            and i.indimmediate and i.indpred is null and i.indexprs is null\n            and k.ordinality <= i.indnkeyatts\n          group by i.indexrelid\n        `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(PgKeys)));\n\n            return indexes.map((index) => index.columns);\n          });\n\n    for (const keys of required) {\n      const columns = keys.map((key) => table.columns[key]?.name);\n\n      if (\n        columns.some((column) => column === undefined) ||\n        !physicalKeys.some(\n          // A stronger key also guarantees the required tuple's uniqueness.\n          (actual) =>\n            actual.length > 0 &&\n            actual.length <= columns.length &&\n            actual.every((column) => columns.includes(column)),\n        )\n      )\n        return yield* PersistenceConfigurationError.make({\n          reason: `Missing unique key on ${table.name} (${keys.join(\", \")})`,\n        });\n    }\n  },\n  (effect, _dialect, table) =>\n    effect.pipe(\n      Effect.mapError((error) =>\n        Schema.is(PersistenceConfigurationError)(error)\n          ? error\n          : PersistenceConfigurationError.make({\n              reason: `Cannot validate SQL storage for ${table.name}`,\n            }),\n      ),\n    ),\n);\n"],"mappings":";;;;AAMA,MAAM,SAAS,OAAO,OAAO;CAAE,MAAM,OAAO;CAAQ,IAAI,OAAO;AAAI,CAAC;AACpE,MAAM,QAAQ,OAAO,OAAO;CAAE,MAAM,OAAO;CAAQ,QAAQ,OAAO;CAAK,SAAS,OAAO;AAAI,CAAC;AAC5F,MAAM,cAAc,OAAO,OAAO,EAAE,MAAM,OAAO,OAAO,OAAO,MAAM,EAAE,CAAC;AACxE,MAAM,YAAY,OAAO,MAAM,OAAO,OAAO,EAAE,MAAM,OAAO,OAAO,CAAC,CAAC;AACrE,MAAM,SAAS,OAAO,MAAM,OAAO,OAAO,EAAE,SAAS,OAAO,MAAM,OAAO,MAAM,EAAE,CAAC,CAAC;AACnF,MAAM,SAAS,UAAkB,OAAM,MAAM,WAAW,MAAK,MAAI,IAAI;AASrE,MAAa,sBAAsB,WAChC,MAAM,WAAW,KAAA,IAAY,KAAK,MAAM,MAAM,MAAM,IAAI,OAAO,MAAM,MAAM,IAAI;;;AAIlF,MAAa,kBAAkB,OAAO,WACpC,WACE,SACA,OACA,UACA;CACA,MAAM,SAAS,OAAO;CAEtB,MAAM,eAAqD,OAAO,YAAY,WAC1E,OAAO,IAAI,aAAa;EACtB,IAAI,MAAM,WAAW,KAAA,KAAa,MAAM,WAAW,QACjD,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,kDACV,CAAC;EAEH,MAAM,UAAU,OAAO,MAAM,0CAA0C,MAAM,KAAK,GAAG,KACnF,OAAO,QAAQ,OAAO,oBAAoB,OAAO,MAAM,MAAM,CAAC,CAAC,CACjE;EAEA,KAAK,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,GAC9C,IAAI,CAAC,QAAQ,MAAM,WAAW,OAAO,SAAS,OAAO,IAAI,GACvD,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,sBAAsB,MAAM,KAAK,GAAG,OAAO,OACrD,CAAC;EAEL,MAAM,OAAmB,CAAC;EAC1B,MAAM,UAAU,QAAQ,QAAQ,WAAW,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE;EAEpF,IAAI,QAAQ,SAAS,GAAG,KAAK,KAAK,QAAQ,KAAK,WAAW,OAAO,IAAI,CAAC;EAEtE,MAAM,UACJ,OAAO,MAAM,yDAAyD,MAAM,KAAK,GAAG,KAClF,OAAO,QAAQ,OAAO,oBAAoB,OAAO,MAAM,KAAK,CAAC,CAAC,CAChE;EAEF,KAAK,MAAM,SAAS,SAAS;GAC3B,IAAI,MAAM,WAAW,KAAK,MAAM,YAAY,GAAG;GAE/C,MAAM,UAAU,OAAO,MAAM,sCAAsC,MAAM,KAAK,GAAG,KAC/E,OAAO,QAAQ,OAAO,oBAAoB,OAAO,MAAM,WAAW,CAAC,CAAC,CACtE;GAEA,IAAI,QAAQ,OAAO,WAAW,OAAO,SAAS,IAAI,GAChD,KAAK,KAAK,QAAQ,SAAS,WAAY,OAAO,SAAS,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,CAAE,CAAC;EACtF;EAEA,OAAO;CACT,CAAC,IACD,YAAY,UACV,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,MAAM;;8CAEK,MAAM,UAAU,KAAK;mCAChC,MAAM,KAAK;cAChC,KAAK,OAAO,QAAQ,OAAO,oBAAoB,SAAS,CAAC,CAAC;EAE5D,KAAK,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,GAC9C,IAAI,CAAC,QAAQ,MAAM,WAAW,OAAO,SAAS,OAAO,IAAI,GACvD,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,sBAAsB,MAAM,KAAK,GAAG,OAAO,OACrD,CAAC;EAGL,MAAM,UAAU,OAAO,MAAM;;;8CAGK,MAAM,UAAU,KAAK;mCAChC,MAAM,KAAK;;cAEhC,KACA,OAAO,QACL,OAAO,oBACL,OAAO,MACL,OAAO,OAAO;GACZ,MAAM,OAAO;GACb,YAAY,OAAO,OAAO,OAAO,MAAM;GACvC,QAAQ,OAAO,OAAO,OAAO,MAAM;EACrC,CAAC,CACH,CACF,CACF,CACF;EAEA,MAAM,uBAAO,IAAI,IAA6C;EAE9D,KAAK,MAAM,SAAS,SAAS;GAC3B,MAAM,UAAU,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC;GAEzC,QAAQ,KAAK,KAAK;GAClB,KAAK,IAAI,MAAM,MAAM,OAAO;EAC9B;EAEA,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CACtB,QAAQ,YACP,QAAQ,OAAO,WAAW,OAAO,eAAe,QAAQ,OAAO,WAAW,IAAI,CAChF,CAAC,CACA,KAAK,YACJ,QAAQ,SAAS,WACf,OAAO,eAAe,OAAO,CAAC,IAAI,CAAC,OAAO,UAAU,CACtD,CACF;CACJ,CAAC,IACD,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,mBAAmB,KAAK;EAEzC,MAAM,UACJ,OAAO,MAAM,yEAAyE,SAAS,uCAAuC,KACpI,OAAO,QAAQ,OAAO,oBAAoB,SAAS,CAAC,CACtD;EAEF,KAAK,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,GAC9C,IAAI,CAAC,QAAQ,MAAM,WAAW,OAAO,SAAS,OAAO,IAAI,GACvD,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,sBAAsB,SAAS,GAAG,OAAO,OACnD,CAAC;EAcL,QAAO,OAXgB,MAAM;;;;;2CAKE,SAAS;;;;UAI1C,KAAK,OAAO,QAAQ,OAAO,oBAAoB,MAAM,CAAC,CAAC,EAAA,CAEtC,KAAK,UAAU,MAAM,OAAO;CAC7C,CAAC;CAEP,KAAK,MAAM,QAAQ,UAAU;EAC3B,MAAM,UAAU,KAAK,KAAK,QAAQ,MAAM,QAAQ,IAAI,EAAE,IAAI;EAE1D,IACE,QAAQ,MAAM,WAAW,WAAW,KAAA,CAAS,KAC7C,CAAC,aAAa,MAEX,WACC,OAAO,SAAS,KAChB,OAAO,UAAU,QAAQ,UACzB,OAAO,OAAO,WAAW,QAAQ,SAAS,MAAM,CAAC,CACrD,GAEA,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,yBAAyB,MAAM,KAAK,IAAI,KAAK,KAAK,IAAI,EAAE,GAClE,CAAC;CACL;AACF,IACC,QAAQ,UAAU,UACjB,OAAO,KACL,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,8BAA8B,KAAK,EACjC,QAAQ,mCAAmC,MAAM,OACnD,CAAC,CACP,CACF,CACJ"}

package/dist/internal/transaction-execution-kernel.d.mts

@@ -31,7 +31,7 @@ export interface TransactionExecution<Failure, OwnerId, Requirements = Lifecycle
 export declare const makeTransactionExecutionKernel: (transactions: Pick<ReturnType<typeof makeTransactionKernel>, "makeTransactionOwner" | "reportTransactionFailure">) => {
   sqlClientTransactionStandaloneGuard: <Failure>(unavailable: () => Failure, transactionService: SqlClient$1.SqlClient["transactionService"] | undefined) => Effect.Effect<void, Failure, never>;
   makeTransactionExecution: <Failure, OwnerId>(ownerTag: Context.Key<OwnerId, TransactionOwner<Failure>>, configuration: TransactionTargetConfiguration<Failure>, unavailable: () => Failure, nonce: () => string, bound?: TransactionBound<Failure> | undefined) => Effect.Effect<TransactionExecution<Failure, OwnerId, LifecycleHooks>, never, NativeDatabase>;
-  coordinateTransactionOwner: <Failure, OwnerId, Resources, AllocationError, Services, Transaction, A, E, R>(database: TransactionNativeDatabase, ownerTag: Context.Key<OwnerId, TransactionOwner<Failure>>, configuration: TransactionTargetConfiguration<Failure>, allocate: Effect.Effect<Resources, AllocationError>, unavailable: () => Failure, nonce: () => string, services: (execution: TransactionExecution<Failure, OwnerId>, resources: Resources) => Services, owner: (transaction: Transaction, services: Services, append: (statement: Statement<any>) => void) => Effect.Effect<A, E, R>) => Effect.Effect<A, TransactionCoordinatorError<E, Failure>, Exclude<R, CurrentCommitJournal> | LifecycleHooks>;
+  coordinateTransactionOwner: <Failure, OwnerId, Resources, AllocationError, AllocationRequirements, Services, Transaction, A, E, R>(database: TransactionNativeDatabase, ownerTag: Context.Key<OwnerId, TransactionOwner<Failure>>, configuration: TransactionTargetConfiguration<Failure>, allocate: Effect.Effect<Resources, AllocationError, AllocationRequirements>, unavailable: () => Failure, nonce: () => string, services: (execution: TransactionExecution<Failure, OwnerId>, resources: Resources) => Services, owner: (transaction: Transaction, services: Services, append: (statement: Statement<any>) => void) => Effect.Effect<A, E, R>) => Effect.Effect<A, TransactionCoordinatorError<E, Failure>, Exclude<R, CurrentCommitJournal> | LifecycleHooks | AllocationRequirements>;
 };
 //#endregion
 //# sourceMappingURL=transaction-execution-kernel.d.mts.map

package/dist/internal/transaction-execution-kernel.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"transaction-execution-kernel.mjs","names":[],"sources":["../../src/internal/transaction-execution-kernel.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  hasCommitScope,\n  CurrentCommitJournal,\n  type LifecycleHooks,\n  type HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\n/* oxlint-disable no-explicit-any -- private execution bridge retains exact public driver wrappers. */\nimport { Context, Effect } from \"effect\";\nimport type * as SqlClient from \"effect/sql/SqlClient\";\nimport type * as SqlError from \"effect/sql/SqlError\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport { requireStandalone } from \"./standalone\";\nimport {\n  NativeDatabase,\n  type TransactionNativeDatabase,\n  type TransactionOwner,\n  type makeTransactionKernel,\n} from \"./transaction-kernel\";\n\nexport interface TransactionTargetConfiguration<Failure> {\n  readonly mode: \"interactive\" | \"synchronous\" | \"batch\";\n  readonly dialect: \"pg\" | \"mysql\" | \"sqlite\";\n  readonly locking: boolean;\n  /** The captured database's transaction marker; batch drivers may omit it. */\n  readonly standaloneGuard: (\n    transactionService: SqlClient.SqlClient[\"transactionService\"] | undefined,\n  ) => Effect.Effect<void, Failure>;\n  readonly transaction?: <A, E, R>(\n    database: any,\n    body: (transaction: any) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError | Failure, R>;\n}\n\nexport type TransactionCoordinatorError<E, Failure> =\n  | E\n  | Failure\n  | HookConfigurationError\n  | SqlError.SqlError;\n\nexport interface TransactionBound<Failure> {\n  readonly owner: TransactionOwner<Failure>;\n  used: boolean;\n  poisoned: boolean;\n  active: boolean;\n  inFlight: number;\n}\n\nexport interface TransactionExecution<Failure, OwnerId, Requirements = LifecycleHooks> {\n  readonly bound: boolean;\n  readonly active: () => boolean;\n  readonly admit: Effect.Effect<void, Failure>;\n  readonly poison: () => void;\n  readonly run: <A, E, R>(\n    body: Effect.Effect<A, E, R>,\n    mutation?: boolean,\n  ) => Effect.Effect<A, Failure, Exclude<R, OwnerId | CurrentCommitJournal> | Requirements>;\n}\n\nexport const makeTransactionExecutionKernel = (\n  transactions: Pick<\n    ReturnType<typeof makeTransactionKernel>,\n    \"makeTransactionOwner\" | \"reportTransactionFailure\"\n  >,\n) => {\n  const { makeTransactionOwner, reportTransactionFailure } = transactions;\n\n  const sqlClientTransactionStandaloneGuard = <Failure>(\n    unavailable: () => Failure,\n    transactionService: SqlClient.SqlClient[\"transactionService\"] | undefined,\n  ) => requireStandalone(unavailable, transactionService);\n\n  const makeTransactionExecution = Effect.fnUntraced(function* <Failure, OwnerId>(\n    ownerTag: Context.Key<OwnerId, TransactionOwner<Failure>>,\n    configuration: TransactionTargetConfiguration<Failure>,\n    unavailable: () => Failure,\n    nonce: () => string,\n    bound?: TransactionBound<Failure>,\n  ): Effect.fn.Return<TransactionExecution<Failure, OwnerId>, never, NativeDatabase> {\n    const database = yield* NativeDatabase;\n\n    const invariant: (value: unknown) => asserts value = (value) => {\n      if (!value) throw unavailable();\n    };\n\n    return {\n      bound: bound !== undefined,\n      active: () => bound === undefined || bound.active,\n      admit:\n        bound !== undefined\n          ? Effect.suspend(() => (bound.active ? Effect.void : Effect.fail(unavailable())))\n          : Effect.gen(function* () {\n              if (yield* hasCommitScope) return yield* Effect.fail(unavailable());\n              yield* configuration.standaloneGuard(database.$client.transactionService);\n            }),\n      poison: () => {\n        if (bound !== undefined) bound.poisoned = true;\n      },\n      run: <A, E, R>(\n        body: Effect.Effect<A, E, R>,\n        mutation = true,\n      ): Effect.Effect<A, Failure, Exclude<R, OwnerId | CurrentCommitJournal> | LifecycleHooks> => {\n        return Effect.suspend(() => {\n          let entered = false;\n\n          const work =\n            bound !== undefined\n              ? Effect.gen(function* () {\n                  if (!bound.active) return yield* Effect.fail(unavailable());\n                  entered = true;\n                  bound.inFlight++;\n                  if (!mutation)\n                    return yield* Effect.provideContext(\n                      body,\n                      Context.make(ownerTag, bound.owner).pipe(\n                        Context.add(CurrentCommitJournal, bound.owner.journal),\n                      ),\n                    );\n                  invariant(!bound.used && !bound.poisoned);\n                  bound.used = true;\n\n                  const result = yield* coordinateCommit(\n                    (journal) =>\n                      Effect.gen(function* () {\n                        bound.owner.guards.push(journal.prepare(undefined));\n\n                        return yield* Effect.provideContext(\n                          body,\n                          Context.make(ownerTag, { ...bound.owner, journal }).pipe(\n                            Context.add(CurrentCommitJournal, journal),\n                          ),\n                        );\n                      }),\n                    { mode: configuration.mode },\n                  );\n\n                  return result.value;\n                }).pipe(\n                  Effect.onExit((exit) =>\n                    Effect.sync(() => {\n                      if (entered) bound.inFlight--;\n                      if (exit._tag === \"Failure\") bound.poisoned = true;\n                    }),\n                  ),\n                )\n              : Effect.gen(function* () {\n                  if (yield* hasCommitScope) return yield* Effect.fail(unavailable());\n                  yield* configuration.standaloneGuard(database.$client.transactionService);\n                  const marker = nonce();\n\n                  const result = yield* coordinateCommit(\n                    (journal) => {\n                      const run = (tx: TransactionNativeDatabase) =>\n                        Effect.gen(function* () {\n                          const owner = makeTransactionOwner(tx, journal, marker, unavailable, {\n                            client: database.$client,\n                            batch: configuration.mode === \"batch\",\n                            locking: configuration.locking,\n                            mysql: configuration.dialect === \"mysql\",\n                            dialect: configuration.dialect,\n                          });\n\n                          const value = yield* Effect.provideContext(\n                            body,\n                            Context.make(ownerTag, owner).pipe(\n                              Context.add(CurrentCommitJournal, journal),\n                            ),\n                          );\n\n                          yield* owner.finish();\n                          if (configuration.mode === \"batch\")\n                            yield* tx.$client.batch(owner.statements);\n\n                          return value;\n                        });\n\n                      return configuration.mode === \"batch\"\n                        ? run(database)\n                        : configuration.transaction !== undefined\n                          ? configuration.transaction(database, run)\n                          : database.transaction(run);\n                    },\n                    { mode: configuration.mode },\n                  );\n\n                  return result.value;\n                });\n\n          return work.pipe(\n            (operation) => reportTransactionFailure(operation, unavailable),\n            Effect.mapError(unavailable),\n            Effect.catchDefect(() => Effect.fail(unavailable())),\n          );\n        });\n      },\n    };\n  });\n\n  const coordinateTransactionOwner = <\n    Failure,\n    OwnerId,\n    Resources,\n    AllocationError,\n    Services,\n    Transaction,\n    A,\n    E,\n    R,\n  >(\n    database: TransactionNativeDatabase,\n    ownerTag: Context.Key<OwnerId, TransactionOwner<Failure>>,\n    configuration: TransactionTargetConfiguration<Failure>,\n    allocate: Effect.Effect<Resources, AllocationError>,\n    unavailable: () => Failure,\n    nonce: () => string,\n    services: (execution: TransactionExecution<Failure, OwnerId>, resources: Resources) => Services,\n    owner: (\n      transaction: Transaction,\n      services: Services,\n      append: (statement: Statement<any>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    TransactionCoordinatorError<E, Failure>,\n    Exclude<R, CurrentCommitJournal> | LifecycleHooks\n  > => {\n    return Effect.gen(function* () {\n      if (yield* hasCommitScope) return yield* Effect.fail(unavailable());\n      yield* configuration.standaloneGuard(database.$client.transactionService);\n\n      // Allocation is independent of registration data and always precedes the physical owner.\n      const resources = yield* allocate.pipe(\n        (operation) => reportTransactionFailure(operation, unavailable),\n        Effect.mapError(unavailable),\n        Effect.catchDefect(() => Effect.fail(unavailable())),\n      );\n\n      const marker = nonce();\n\n      const result = yield* coordinateCommit(\n        (journal) => {\n          const run = (tx: TransactionNativeDatabase) =>\n            Effect.gen(function* () {\n              const state = makeTransactionOwner(tx, journal, marker, unavailable, {\n                client: database.$client,\n                batch: configuration.mode === \"batch\",\n                dialect: configuration.dialect,\n                mysql: configuration.dialect === \"mysql\",\n                locking: configuration.locking,\n              });\n\n              const bound: TransactionBound<Failure> = {\n                owner: state,\n                used: false,\n                poisoned: false,\n                active: true,\n                inFlight: 0,\n              };\n\n              return yield* Effect.gen(function* () {\n                const value = yield* owner(\n                  tx as Transaction,\n                  services(\n                    yield* makeTransactionExecution(\n                      ownerTag,\n                      configuration,\n                      unavailable,\n                      nonce,\n                      bound,\n                    ).pipe(Effect.provideService(NativeDatabase, tx)),\n                    resources,\n                  ),\n                  (statement) => {\n                    if (!bound.active) throw unavailable();\n                    state.statements.push(statement);\n                  },\n                );\n\n                bound.active = false;\n                if (bound.poisoned || bound.inFlight !== 0)\n                  return yield* Effect.fail(unavailable());\n                yield* state.finish();\n                if (configuration.mode === \"batch\") yield* tx.$client.batch(state.statements);\n\n                return value;\n              }).pipe(\n                Effect.ensuring(\n                  Effect.sync(() => {\n                    bound.active = false;\n                  }),\n                ),\n              );\n            });\n\n          return configuration.mode === \"batch\"\n            ? run(database)\n            : configuration.transaction !== undefined\n              ? configuration.transaction(database, run)\n              : database.transaction(run);\n        },\n        { mode: configuration.mode },\n      );\n\n      return result.value as A;\n    });\n  };\n\n  return {\n    sqlClientTransactionStandaloneGuard,\n    makeTransactionExecution,\n    coordinateTransactionOwner,\n  };\n};\n"],"mappings":";;;;;AA6DA,MAAa,kCACX,iBAIG;CACH,MAAM,EAAE,sBAAsB,6BAA6B;CAE3D,MAAM,uCACJ,aACA,uBACG,kBAAkB,aAAa,kBAAkB;CAEtD,MAAM,2BAA2B,OAAO,WAAW,WACjD,UACA,eACA,aACA,OACA,OACiF;EACjF,MAAM,WAAW,OAAO;EAExB,MAAM,aAAgD,UAAU;GAC9D,IAAI,CAAC,OAAO,MAAM,YAAY;EAChC;EAEA,OAAO;GACL,OAAO,UAAU,KAAA;GACjB,cAAc,UAAU,KAAA,KAAa,MAAM;GAC3C,OACE,UAAU,KAAA,IACN,OAAO,cAAe,MAAM,SAAS,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC,CAAE,IAC9E,OAAO,IAAI,aAAa;IACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;IAClE,OAAO,cAAc,gBAAgB,SAAS,QAAQ,kBAAkB;GAC1E,CAAC;GACP,cAAc;IACZ,IAAI,UAAU,KAAA,GAAW,MAAM,WAAW;GAC5C;GACA,MACE,MACA,WAAW,SACgF;IAC3F,OAAO,OAAO,cAAc;KAC1B,IAAI,UAAU;KAqFd,QAlFE,UAAU,KAAA,IACN,OAAO,IAAI,aAAa;MACtB,IAAI,CAAC,MAAM,QAAQ,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;MAC1D,UAAU;MACV,MAAM;MACN,IAAI,CAAC,UACH,OAAO,OAAO,OAAO,eACnB,MACA,QAAQ,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,KAClC,QAAQ,IAAI,sBAAsB,MAAM,MAAM,OAAO,CACvD,CACF;MACF,UAAU,CAAC,MAAM,QAAQ,CAAC,MAAM,QAAQ;MACxC,MAAM,OAAO;MAiBb,QAAO,OAfe,kBACnB,YACC,OAAO,IAAI,aAAa;OACtB,MAAM,MAAM,OAAO,KAAK,QAAQ,QAAQ,KAAA,CAAS,CAAC;OAElD,OAAO,OAAO,OAAO,eACnB,MACA,QAAQ,KAAK,UAAU;QAAE,GAAG,MAAM;QAAO;OAAQ,CAAC,CAAC,CAAC,KAClD,QAAQ,IAAI,sBAAsB,OAAO,CAC3C,CACF;MACF,CAAC,GACH,EAAE,MAAM,cAAc,KAAK,CAC7B,EAAA,CAEc;KAChB,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;MAChB,IAAI,SAAS,MAAM;MACnB,IAAI,KAAK,SAAS,WAAW,MAAM,WAAW;KAChD,CAAC,CACH,CACF,IACA,OAAO,IAAI,aAAa;MACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;MAClE,OAAO,cAAc,gBAAgB,SAAS,QAAQ,kBAAkB;MACxE,MAAM,SAAS,MAAM;MAqCrB,QAAO,OAnCe,kBACnB,YAAY;OACX,MAAM,OAAO,OACX,OAAO,IAAI,aAAa;QACtB,MAAM,QAAQ,qBAAqB,IAAI,SAAS,QAAQ,aAAa;SACnE,QAAQ,SAAS;SACjB,OAAO,cAAc,SAAS;SAC9B,SAAS,cAAc;SACvB,OAAO,cAAc,YAAY;SACjC,SAAS,cAAc;QACzB,CAAC;QAED,MAAM,QAAQ,OAAO,OAAO,eAC1B,MACA,QAAQ,KAAK,UAAU,KAAK,CAAC,CAAC,KAC5B,QAAQ,IAAI,sBAAsB,OAAO,CAC3C,CACF;QAEA,OAAO,MAAM,OAAO;QACpB,IAAI,cAAc,SAAS,SACzB,OAAO,GAAG,QAAQ,MAAM,MAAM,UAAU;QAE1C,OAAO;OACT,CAAC;OAEH,OAAO,cAAc,SAAS,UAC1B,IAAI,QAAQ,IACZ,cAAc,gBAAgB,KAAA,IAC5B,cAAc,YAAY,UAAU,GAAG,IACvC,SAAS,YAAY,GAAG;MAChC,GACA,EAAE,MAAM,cAAc,KAAK,CAC7B,EAAA,CAEc;KAChB,CAAC,EAAA,CAEK,MACT,cAAc,yBAAyB,WAAW,WAAW,GAC9D,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;IACF,CAAC;GACH;EACF;CACF,CAAC;CAED,MAAM,8BAWJ,UACA,UACA,eACA,UACA,aACA,OACA,UACA,UASG;EACH,OAAO,OAAO,IAAI,aAAa;GAC7B,IAAI,OAAO,gBAAgB,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;GAClE,OAAO,cAAc,gBAAgB,SAAS,QAAQ,kBAAkB;GAGxE,MAAM,YAAY,OAAO,SAAS,MAC/B,cAAc,yBAAyB,WAAW,WAAW,GAC9D,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;GAEA,MAAM,SAAS,MAAM;GAkErB,QAAO,OAhEe,kBACnB,YAAY;IACX,MAAM,OAAO,OACX,OAAO,IAAI,aAAa;KACtB,MAAM,QAAQ,qBAAqB,IAAI,SAAS,QAAQ,aAAa;MACnE,QAAQ,SAAS;MACjB,OAAO,cAAc,SAAS;MAC9B,SAAS,cAAc;MACvB,OAAO,cAAc,YAAY;MACjC,SAAS,cAAc;KACzB,CAAC;KAED,MAAM,QAAmC;MACvC,OAAO;MACP,MAAM;MACN,UAAU;MACV,QAAQ;MACR,UAAU;KACZ;KAEA,OAAO,OAAO,OAAO,IAAI,aAAa;MACpC,MAAM,QAAQ,OAAO,MACnB,IACA,SACE,OAAO,yBACL,UACA,eACA,aACA,OACA,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,EAAE,CAAC,GAChD,SACF,IACC,cAAc;OACb,IAAI,CAAC,MAAM,QAAQ,MAAM,YAAY;OACrC,MAAM,WAAW,KAAK,SAAS;MACjC,CACF;MAEA,MAAM,SAAS;MACf,IAAI,MAAM,YAAY,MAAM,aAAa,GACvC,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;MACzC,OAAO,MAAM,OAAO;MACpB,IAAI,cAAc,SAAS,SAAS,OAAO,GAAG,QAAQ,MAAM,MAAM,UAAU;MAE5E,OAAO;KACT,CAAC,CAAC,CAAC,KACD,OAAO,SACL,OAAO,WAAW;MAChB,MAAM,SAAS;KACjB,CAAC,CACH,CACF;IACF,CAAC;IAEH,OAAO,cAAc,SAAS,UAC1B,IAAI,QAAQ,IACZ,cAAc,gBAAgB,KAAA,IAC5B,cAAc,YAAY,UAAU,GAAG,IACvC,SAAS,YAAY,GAAG;GAChC,GACA,EAAE,MAAM,cAAc,KAAK,CAC7B,EAAA,CAEc;EAChB,CAAC;CACH;CAEA,OAAO;EACL;EACA;EACA;CACF;AACF"}
+{"version":3,"file":"transaction-execution-kernel.mjs","names":[],"sources":["../../src/internal/transaction-execution-kernel.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  hasCommitScope,\n  CurrentCommitJournal,\n  type LifecycleHooks,\n  type HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\n/* oxlint-disable no-explicit-any -- private execution bridge retains exact public driver wrappers. */\nimport { Context, Effect } from \"effect\";\nimport type * as SqlClient from \"effect/sql/SqlClient\";\nimport type * as SqlError from \"effect/sql/SqlError\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport { requireStandalone } from \"./standalone\";\nimport {\n  NativeDatabase,\n  type TransactionNativeDatabase,\n  type TransactionOwner,\n  type makeTransactionKernel,\n} from \"./transaction-kernel\";\n\nexport interface TransactionTargetConfiguration<Failure> {\n  readonly mode: \"interactive\" | \"synchronous\" | \"batch\";\n  readonly dialect: \"pg\" | \"mysql\" | \"sqlite\";\n  readonly locking: boolean;\n  /** The captured database's transaction marker; batch drivers may omit it. */\n  readonly standaloneGuard: (\n    transactionService: SqlClient.SqlClient[\"transactionService\"] | undefined,\n  ) => Effect.Effect<void, Failure>;\n  readonly transaction?: <A, E, R>(\n    database: any,\n    body: (transaction: any) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError | Failure, R>;\n}\n\nexport type TransactionCoordinatorError<E, Failure> =\n  | E\n  | Failure\n  | HookConfigurationError\n  | SqlError.SqlError;\n\nexport interface TransactionBound<Failure> {\n  readonly owner: TransactionOwner<Failure>;\n  used: boolean;\n  poisoned: boolean;\n  active: boolean;\n  inFlight: number;\n}\n\nexport interface TransactionExecution<Failure, OwnerId, Requirements = LifecycleHooks> {\n  readonly bound: boolean;\n  readonly active: () => boolean;\n  readonly admit: Effect.Effect<void, Failure>;\n  readonly poison: () => void;\n  readonly run: <A, E, R>(\n    body: Effect.Effect<A, E, R>,\n    mutation?: boolean,\n  ) => Effect.Effect<A, Failure, Exclude<R, OwnerId | CurrentCommitJournal> | Requirements>;\n}\n\nexport const makeTransactionExecutionKernel = (\n  transactions: Pick<\n    ReturnType<typeof makeTransactionKernel>,\n    \"makeTransactionOwner\" | \"reportTransactionFailure\"\n  >,\n) => {\n  const { makeTransactionOwner, reportTransactionFailure } = transactions;\n\n  const sqlClientTransactionStandaloneGuard = <Failure>(\n    unavailable: () => Failure,\n    transactionService: SqlClient.SqlClient[\"transactionService\"] | undefined,\n  ) => requireStandalone(unavailable, transactionService);\n\n  const makeTransactionExecution = Effect.fnUntraced(function* <Failure, OwnerId>(\n    ownerTag: Context.Key<OwnerId, TransactionOwner<Failure>>,\n    configuration: TransactionTargetConfiguration<Failure>,\n    unavailable: () => Failure,\n    nonce: () => string,\n    bound?: TransactionBound<Failure>,\n  ): Effect.fn.Return<TransactionExecution<Failure, OwnerId>, never, NativeDatabase> {\n    const database = yield* NativeDatabase;\n\n    const invariant: (value: unknown) => asserts value = (value) => {\n      if (!value) throw unavailable();\n    };\n\n    return {\n      bound: bound !== undefined,\n      active: () => bound === undefined || bound.active,\n      admit:\n        bound !== undefined\n          ? Effect.suspend(() => (bound.active ? Effect.void : Effect.fail(unavailable())))\n          : Effect.gen(function* () {\n              if (yield* hasCommitScope) return yield* Effect.fail(unavailable());\n              yield* configuration.standaloneGuard(database.$client.transactionService);\n            }),\n      poison: () => {\n        if (bound !== undefined) bound.poisoned = true;\n      },\n      run: <A, E, R>(\n        body: Effect.Effect<A, E, R>,\n        mutation = true,\n      ): Effect.Effect<A, Failure, Exclude<R, OwnerId | CurrentCommitJournal> | LifecycleHooks> => {\n        return Effect.suspend(() => {\n          let entered = false;\n\n          const work =\n            bound !== undefined\n              ? Effect.gen(function* () {\n                  if (!bound.active) return yield* Effect.fail(unavailable());\n                  entered = true;\n                  bound.inFlight++;\n                  if (!mutation)\n                    return yield* Effect.provideContext(\n                      body,\n                      Context.make(ownerTag, bound.owner).pipe(\n                        Context.add(CurrentCommitJournal, bound.owner.journal),\n                      ),\n                    );\n                  invariant(!bound.used && !bound.poisoned);\n                  bound.used = true;\n\n                  const result = yield* coordinateCommit(\n                    (journal) =>\n                      Effect.gen(function* () {\n                        bound.owner.guards.push(journal.prepare(undefined));\n\n                        return yield* Effect.provideContext(\n                          body,\n                          Context.make(ownerTag, { ...bound.owner, journal }).pipe(\n                            Context.add(CurrentCommitJournal, journal),\n                          ),\n                        );\n                      }),\n                    { mode: configuration.mode },\n                  );\n\n                  return result.value;\n                }).pipe(\n                  Effect.onExit((exit) =>\n                    Effect.sync(() => {\n                      if (entered) bound.inFlight--;\n                      if (exit._tag === \"Failure\") bound.poisoned = true;\n                    }),\n                  ),\n                )\n              : Effect.gen(function* () {\n                  if (yield* hasCommitScope) return yield* Effect.fail(unavailable());\n                  yield* configuration.standaloneGuard(database.$client.transactionService);\n                  const marker = nonce();\n\n                  const result = yield* coordinateCommit(\n                    (journal) => {\n                      const run = (tx: TransactionNativeDatabase) =>\n                        Effect.gen(function* () {\n                          const owner = makeTransactionOwner(tx, journal, marker, unavailable, {\n                            client: database.$client,\n                            batch: configuration.mode === \"batch\",\n                            locking: configuration.locking,\n                            mysql: configuration.dialect === \"mysql\",\n                            dialect: configuration.dialect,\n                          });\n\n                          const value = yield* Effect.provideContext(\n                            body,\n                            Context.make(ownerTag, owner).pipe(\n                              Context.add(CurrentCommitJournal, journal),\n                            ),\n                          );\n\n                          yield* owner.finish();\n                          if (configuration.mode === \"batch\")\n                            yield* tx.$client.batch(owner.statements);\n\n                          return value;\n                        });\n\n                      return configuration.mode === \"batch\"\n                        ? run(database)\n                        : configuration.transaction !== undefined\n                          ? configuration.transaction(database, run)\n                          : database.transaction(run);\n                    },\n                    { mode: configuration.mode },\n                  );\n\n                  return result.value;\n                });\n\n          return work.pipe(\n            (operation) => reportTransactionFailure(operation, unavailable),\n            Effect.mapError(unavailable),\n            Effect.catchDefect(() => Effect.fail(unavailable())),\n          );\n        });\n      },\n    };\n  });\n\n  const coordinateTransactionOwner = <\n    Failure,\n    OwnerId,\n    Resources,\n    AllocationError,\n    AllocationRequirements,\n    Services,\n    Transaction,\n    A,\n    E,\n    R,\n  >(\n    database: TransactionNativeDatabase,\n    ownerTag: Context.Key<OwnerId, TransactionOwner<Failure>>,\n    configuration: TransactionTargetConfiguration<Failure>,\n    allocate: Effect.Effect<Resources, AllocationError, AllocationRequirements>,\n    unavailable: () => Failure,\n    nonce: () => string,\n    services: (execution: TransactionExecution<Failure, OwnerId>, resources: Resources) => Services,\n    owner: (\n      transaction: Transaction,\n      services: Services,\n      append: (statement: Statement<any>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    TransactionCoordinatorError<E, Failure>,\n    Exclude<R, CurrentCommitJournal> | LifecycleHooks | AllocationRequirements\n  > => {\n    return Effect.gen(function* () {\n      if (yield* hasCommitScope) return yield* Effect.fail(unavailable());\n      yield* configuration.standaloneGuard(database.$client.transactionService);\n\n      // Allocation is independent of registration data and always precedes the physical owner.\n      const resources = yield* allocate.pipe(\n        (operation) => reportTransactionFailure(operation, unavailable),\n        Effect.mapError(unavailable),\n        Effect.catchDefect(() => Effect.fail(unavailable())),\n      );\n\n      const marker = nonce();\n\n      const result = yield* coordinateCommit(\n        (journal) => {\n          const run = (tx: TransactionNativeDatabase) =>\n            Effect.gen(function* () {\n              const state = makeTransactionOwner(tx, journal, marker, unavailable, {\n                client: database.$client,\n                batch: configuration.mode === \"batch\",\n                dialect: configuration.dialect,\n                mysql: configuration.dialect === \"mysql\",\n                locking: configuration.locking,\n              });\n\n              const bound: TransactionBound<Failure> = {\n                owner: state,\n                used: false,\n                poisoned: false,\n                active: true,\n                inFlight: 0,\n              };\n\n              return yield* Effect.gen(function* () {\n                const value = yield* owner(\n                  tx as Transaction,\n                  services(\n                    yield* makeTransactionExecution(\n                      ownerTag,\n                      configuration,\n                      unavailable,\n                      nonce,\n                      bound,\n                    ).pipe(Effect.provideService(NativeDatabase, tx)),\n                    resources,\n                  ),\n                  (statement) => {\n                    if (!bound.active) throw unavailable();\n                    state.statements.push(statement);\n                  },\n                );\n\n                bound.active = false;\n                if (bound.poisoned || bound.inFlight !== 0)\n                  return yield* Effect.fail(unavailable());\n                yield* state.finish();\n                if (configuration.mode === \"batch\") yield* tx.$client.batch(state.statements);\n\n                return value;\n              }).pipe(\n                Effect.ensuring(\n                  Effect.sync(() => {\n                    bound.active = false;\n                  }),\n                ),\n              );\n            });\n\n          return configuration.mode === \"batch\"\n            ? run(database)\n            : configuration.transaction !== undefined\n              ? configuration.transaction(database, run)\n              : database.transaction(run);\n        },\n        { mode: configuration.mode },\n      );\n\n      return result.value as A;\n    });\n  };\n\n  return {\n    sqlClientTransactionStandaloneGuard,\n    makeTransactionExecution,\n    coordinateTransactionOwner,\n  };\n};\n"],"mappings":";;;;;AA6DA,MAAa,kCACX,iBAIG;CACH,MAAM,EAAE,sBAAsB,6BAA6B;CAE3D,MAAM,uCACJ,aACA,uBACG,kBAAkB,aAAa,kBAAkB;CAEtD,MAAM,2BAA2B,OAAO,WAAW,WACjD,UACA,eACA,aACA,OACA,OACiF;EACjF,MAAM,WAAW,OAAO;EAExB,MAAM,aAAgD,UAAU;GAC9D,IAAI,CAAC,OAAO,MAAM,YAAY;EAChC;EAEA,OAAO;GACL,OAAO,UAAU,KAAA;GACjB,cAAc,UAAU,KAAA,KAAa,MAAM;GAC3C,OACE,UAAU,KAAA,IACN,OAAO,cAAe,MAAM,SAAS,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC,CAAE,IAC9E,OAAO,IAAI,aAAa;IACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;IAClE,OAAO,cAAc,gBAAgB,SAAS,QAAQ,kBAAkB;GAC1E,CAAC;GACP,cAAc;IACZ,IAAI,UAAU,KAAA,GAAW,MAAM,WAAW;GAC5C;GACA,MACE,MACA,WAAW,SACgF;IAC3F,OAAO,OAAO,cAAc;KAC1B,IAAI,UAAU;KAqFd,QAlFE,UAAU,KAAA,IACN,OAAO,IAAI,aAAa;MACtB,IAAI,CAAC,MAAM,QAAQ,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;MAC1D,UAAU;MACV,MAAM;MACN,IAAI,CAAC,UACH,OAAO,OAAO,OAAO,eACnB,MACA,QAAQ,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,KAClC,QAAQ,IAAI,sBAAsB,MAAM,MAAM,OAAO,CACvD,CACF;MACF,UAAU,CAAC,MAAM,QAAQ,CAAC,MAAM,QAAQ;MACxC,MAAM,OAAO;MAiBb,QAAO,OAfe,kBACnB,YACC,OAAO,IAAI,aAAa;OACtB,MAAM,MAAM,OAAO,KAAK,QAAQ,QAAQ,KAAA,CAAS,CAAC;OAElD,OAAO,OAAO,OAAO,eACnB,MACA,QAAQ,KAAK,UAAU;QAAE,GAAG,MAAM;QAAO;OAAQ,CAAC,CAAC,CAAC,KAClD,QAAQ,IAAI,sBAAsB,OAAO,CAC3C,CACF;MACF,CAAC,GACH,EAAE,MAAM,cAAc,KAAK,CAC7B,EAAA,CAEc;KAChB,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;MAChB,IAAI,SAAS,MAAM;MACnB,IAAI,KAAK,SAAS,WAAW,MAAM,WAAW;KAChD,CAAC,CACH,CACF,IACA,OAAO,IAAI,aAAa;MACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;MAClE,OAAO,cAAc,gBAAgB,SAAS,QAAQ,kBAAkB;MACxE,MAAM,SAAS,MAAM;MAqCrB,QAAO,OAnCe,kBACnB,YAAY;OACX,MAAM,OAAO,OACX,OAAO,IAAI,aAAa;QACtB,MAAM,QAAQ,qBAAqB,IAAI,SAAS,QAAQ,aAAa;SACnE,QAAQ,SAAS;SACjB,OAAO,cAAc,SAAS;SAC9B,SAAS,cAAc;SACvB,OAAO,cAAc,YAAY;SACjC,SAAS,cAAc;QACzB,CAAC;QAED,MAAM,QAAQ,OAAO,OAAO,eAC1B,MACA,QAAQ,KAAK,UAAU,KAAK,CAAC,CAAC,KAC5B,QAAQ,IAAI,sBAAsB,OAAO,CAC3C,CACF;QAEA,OAAO,MAAM,OAAO;QACpB,IAAI,cAAc,SAAS,SACzB,OAAO,GAAG,QAAQ,MAAM,MAAM,UAAU;QAE1C,OAAO;OACT,CAAC;OAEH,OAAO,cAAc,SAAS,UAC1B,IAAI,QAAQ,IACZ,cAAc,gBAAgB,KAAA,IAC5B,cAAc,YAAY,UAAU,GAAG,IACvC,SAAS,YAAY,GAAG;MAChC,GACA,EAAE,MAAM,cAAc,KAAK,CAC7B,EAAA,CAEc;KAChB,CAAC,EAAA,CAEK,MACT,cAAc,yBAAyB,WAAW,WAAW,GAC9D,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;IACF,CAAC;GACH;EACF;CACF,CAAC;CAED,MAAM,8BAYJ,UACA,UACA,eACA,UACA,aACA,OACA,UACA,UASG;EACH,OAAO,OAAO,IAAI,aAAa;GAC7B,IAAI,OAAO,gBAAgB,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;GAClE,OAAO,cAAc,gBAAgB,SAAS,QAAQ,kBAAkB;GAGxE,MAAM,YAAY,OAAO,SAAS,MAC/B,cAAc,yBAAyB,WAAW,WAAW,GAC9D,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;GAEA,MAAM,SAAS,MAAM;GAkErB,QAAO,OAhEe,kBACnB,YAAY;IACX,MAAM,OAAO,OACX,OAAO,IAAI,aAAa;KACtB,MAAM,QAAQ,qBAAqB,IAAI,SAAS,QAAQ,aAAa;MACnE,QAAQ,SAAS;MACjB,OAAO,cAAc,SAAS;MAC9B,SAAS,cAAc;MACvB,OAAO,cAAc,YAAY;MACjC,SAAS,cAAc;KACzB,CAAC;KAED,MAAM,QAAmC;MACvC,OAAO;MACP,MAAM;MACN,UAAU;MACV,QAAQ;MACR,UAAU;KACZ;KAEA,OAAO,OAAO,OAAO,IAAI,aAAa;MACpC,MAAM,QAAQ,OAAO,MACnB,IACA,SACE,OAAO,yBACL,UACA,eACA,aACA,OACA,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,EAAE,CAAC,GAChD,SACF,IACC,cAAc;OACb,IAAI,CAAC,MAAM,QAAQ,MAAM,YAAY;OACrC,MAAM,WAAW,KAAK,SAAS;MACjC,CACF;MAEA,MAAM,SAAS;MACf,IAAI,MAAM,YAAY,MAAM,aAAa,GACvC,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;MACzC,OAAO,MAAM,OAAO;MACpB,IAAI,cAAc,SAAS,SAAS,OAAO,GAAG,QAAQ,MAAM,MAAM,UAAU;MAE5E,OAAO;KACT,CAAC,CAAC,CAAC,KACD,OAAO,SACL,OAAO,WAAW;MAChB,MAAM,SAAS;KACjB,CAAC,CACH,CACF;IACF,CAAC;IAEH,OAAO,cAAc,SAAS,UAC1B,IAAI,QAAQ,IACZ,cAAc,gBAAgB,KAAA,IAC5B,cAAc,YAAY,UAAU,GAAG,IACvC,SAAS,YAAY,GAAG;GAChC,GACA,EAAE,MAAM,cAAc,KAAK,CAC7B,EAAA,CAEc;EAChB,CAAC;CACH;CAEA,OAAO;EACL;EACA;EACA;CACF;AACF"}

package/dist/internal/transaction-kernel.d.mts

@@ -14,7 +14,7 @@ export interface TransactionNativeDatabase {
   readonly transaction: <A, E, R>(body: (transaction: any) => Effect.Effect<A, E, R>) => Effect.Effect<A, E | SqlError, R>;
 }
 declare const NativeDatabase_base: Context.ServiceClass<NativeDatabase, "effect-auth/persistence/NativeDatabase", TransactionNativeDatabase>;
-/** Root native database required only while constructing standalone services.
+/** Captured root database for service construction and pre-transaction catalog checks.
  * Active transactions remain owned by their coordinator and journal. */
 export declare class NativeDatabase extends NativeDatabase_base {}
 export interface Observation {

package/dist/internal/transaction-kernel.mjs

@@ -2,7 +2,7 @@ import { Cause, Context, Effect } from "effect";
 import "@yielded/auth/Hooks";
 import { reportAuthFailure } from "@yielded/auth/Persistence";
 //#region src/internal/transaction-kernel.ts
-/** Root native database required only while constructing standalone services.
+/** Captured root database for service construction and pre-transaction catalog checks.
 * Active transactions remain owned by their coordinator and journal. */
 var NativeDatabase = class extends Context.Service()("effect-auth/persistence/NativeDatabase") {};
 const makeTransactionKernel = (operations) => {