@yielded/auth-persistence 0.1.0-beta.18 → 0.1.0-beta.20

package/dist/internal/passkeys.mjs

@@ -1,4 +1,5 @@
 import { PersistenceConfigurationError } from "./configuration.mjs";
+import { digest } from "./crypto.mjs";
 import { PersistenceMappingError } from "./mapping-error.mjs";
 import { requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "./models/passkey-model.mjs";
 import { requiredPasskeyManagementConstraints } from "./models/passkey-write-model.mjs";
@@ -8,7 +9,6 @@ import { CurrentProofSql } from "./proof-kernel.mjs";
 import { storageTables } from "./storage-tables.mjs";
 import { Context, Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql";
-import { digest } from "@yielded/auth-crypto";
 import { PasskeyCredential, PasskeyCredentials, PasskeyEnrollmentContext, PasskeyManagementPersistence, PasskeyManagementPolicy, PasskeyMethodPolicy, PasskeyPersistence, PasskeyProfile, PasskeyRequirement, PasskeyUnavailable } from "@yielded/auth/Passkey";
 //#region src/internal/passkeys.ts
 const profileJson = Schema.fromJsonString(PasskeyProfile);
@@ -22,6 +22,12 @@ const ModuleRow = Schema.Struct({
 	policy: Schema.String,
 	policyRevision: Schema.String
 });
+const ConfiguredModuleRow = Schema.Struct({
+	moduleId: Schema.String,
+	active: Schema.Boolean,
+	policyRevision: Schema.String,
+	admitted: Schema.Literals(["present", "missing"])
+});
 const credentialData = PasskeyCredential.mapFields(({ revision: _revision, active: _active, ...fields }) => fields);
 const unavailable = () => PasskeyUnavailable.make({});
 const configurationError = (reason) => PersistenceConfigurationError.make({ reason });
@@ -274,10 +280,18 @@ const makeComposedPasskeys = (operations) => {
 	};
 	return Effect.fn("AuthPersistence.passkeys")(function* ({ storage, namespace, dialect, features, passwordModules }) {
 		const client = yield* SqlClient.SqlClient;
-		const policies = yield* Effect.forEach(features, (feature) => Effect.map(feature.policy, (policy) => ({
-			feature,
-			policy
-		})));
+		const policies = yield* Effect.forEach(features, (feature) => Effect.gen(function* () {
+			const policy = yield* feature.policy;
+			return {
+				feature,
+				policy,
+				encoded: yield* Schema.encodeEffect(policyJson)(policy),
+				policyRevision: yield* digest(yield* Schema.encodeEffect(seedJson)({
+					policy,
+					...feature.managementPolicy === void 0 ? {} : { management: feature.managementPolicy }
+				}))
+			};
+		}));
 		const m = yield* Effect.try({
 			try: () => mappings(storage, namespace, dialect, passwordModules, policies.flatMap(({ feature, policy }) => feature.management ? [] : policy.profiles)),
 			catch: () => configurationError("Invalid passkey table mappings")
@@ -289,16 +303,20 @@ const makeComposedPasskeys = (operations) => {
 			standaloneGuard: () => requireStandalone(unavailable, client.transactionService)
 		};
 		const native = yield* CurrentProofSql;
-		yield* client.withTransaction(Effect.gen(function* () {
+		const module = m.table("passkeyModules");
+		const columns = getTableColumns(module);
+		const admission = m.table("passkeyAdmissions");
+		const ac = getTableColumns(admission);
+		if (!(yield* native.select({
+			moduleId: columns.moduleId,
+			active: columns.active,
+			policyRevision: columns.policyRevision,
+			admitted: sql`case when exists(select 1 from ${admission}
+            where ${and(eq(ac.authorityScope, namespace), eq(ac.moduleId, columns.moduleId))})
+              then 'present' else 'missing' end`
+		}).from(module).where(inArray(columns.moduleId, policies.map(({ feature }) => feature.moduleId))).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(ConfiguredModuleRow))), Effect.map((rows) => policies.every(({ feature, policyRevision }) => rows.some((row) => row.moduleId === feature.moduleId && row.active && row.admitted === "present" && row.policyRevision === policyRevision)))))) yield* client.withTransaction(Effect.gen(function* () {
 			if (dialect === "pg") yield* client`select pg_advisory_xact_lock(hashtext(${`${namespace}/passkeys`}))`;
-			for (const { feature, policy } of policies) {
-				const encoded = yield* Schema.encodeEffect(policyJson)(policy);
-				const policyRevision = digest(yield* Schema.encodeEffect(seedJson)({
-					policy,
-					...feature.managementPolicy === void 0 ? {} : { management: feature.managementPolicy }
-				}));
-				const module = m.table("passkeyModules");
-				const columns = getTableColumns(module);
+			for (const { feature, policy, encoded, policyRevision } of policies) {
 				yield* native.insert(module).values({
 					moduleId: feature.moduleId,
 					active: true,

package/dist/internal/passkeys.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"passkeys.mjs","names":[],"sources":["../../src/internal/passkeys.ts"],"sourcesContent":["import { digest } from \"@yielded/auth-crypto\";\nimport {\n  PasskeyCredentials,\n  PasskeyCredential,\n  PasskeyEnrollmentContext,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  PasskeyPersistence,\n  PasskeyProfile,\n  PasskeyRequirement,\n  PasskeyUnavailable,\n} from \"@yielded/auth/Passkey\";\nimport { Context, Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport {\n  PersistenceConfigurationError,\n  type MappingInput,\n  type PasskeyFeature,\n} from \"./configuration\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n  requiredPasskeyCredentialConstraints,\n  requiredPasskeyPersistenceConstraints,\n  type PasskeyCredentialMapping,\n  type PasskeyPersistenceMapping,\n} from \"./models/passkey-model\";\nimport {\n  requiredPasskeyManagementConstraints,\n  type PasskeyManagementMapping,\n} from \"./models/passkey-write-model\";\nimport { makePasskeyKernel } from \"./passkey-kernel\";\nimport type { PasskeyTargetConfiguration } from \"./passkey/target\";\nimport type { Backend } from \"./persistence\";\nimport { CurrentProofSql } from \"./proof-kernel\";\nimport type { SqlExpression as SQL, QueryOperations, TableModel } from \"./query-operations\";\nimport { requireStandalone } from \"./standalone\";\nimport { storageTables, type StorageRole } from \"./storage-tables\";\n\nconst profileJson = Schema.fromJsonString(PasskeyProfile);\nconst policyJson = Schema.fromJsonString(PasskeyMethodPolicy);\n\nconst seedJson = Schema.fromJsonString(\n  Schema.Struct({\n    policy: PasskeyMethodPolicy,\n    management: Schema.optionalKey(PasskeyManagementPolicy),\n  }),\n);\n\nconst ModuleRow = Schema.Struct({\n  active: Schema.Boolean,\n  policy: Schema.String,\n  policyRevision: Schema.String,\n});\n\nconst credentialData = PasskeyCredential.mapFields(\n  ({ revision: _revision, active: _active, ...fields }) => fields,\n);\n\nconst unavailable = () => PasskeyUnavailable.make({});\nconst configurationError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\ntype ReadMapping = PasskeyCredentialMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown\n>;\ntype BaseMapping = PasskeyPersistenceMapping<\n  ReadMapping,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown\n>;\ntype ManagementMapping = PasskeyManagementMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown\n>;\n\n/** Share the same passkey algorithms across raw SQL and Drizzle compilers. */\nexport const makeComposedPasskeys = (\n  operations: QueryOperations,\n): Backend<object, never>[\"passkeys\"] => {\n  const { and, eq, getTableColumns, inArray, or, sql } = operations;\n  const { target, writeTarget } = makePasskeyKernel(operations);\n\n  const {\n    makeTargetPasskeyCredentials,\n    makeTargetPasskeyEnrollmentContext,\n    makeTargetPasskeyPersistence,\n  } = target;\n\n  const { makeTargetPasskeyManagement } = writeTarget;\n\n  const mappings = (\n    storage: MappingInput,\n    namespace: string,\n    dialect: \"pg\" | \"sqlite\",\n    passwordModules: ReadonlyArray<string>,\n    signInProfiles: ReadonlyArray<PasskeyProfile>,\n  ) => {\n    const table = (role: StorageRole) => {\n      const value = storage.tables[role];\n\n      if (value === undefined) throw configurationError(`Missing ${role} mapping`);\n\n      // Backend validation owns the foreign table shape. Row values are decoded below.\n      return value;\n    };\n\n    const mapped = <Role extends StorageRole>(role: Role) => ({\n      table: table(role),\n      ...(Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key])) as {\n        readonly [Key in keyof (typeof storageTables)[Role][\"columns\"]]: Key;\n      }),\n    });\n\n    const column = (role: StorageRole, key: string) => getTableColumns(table(role))[key];\n    const s = storage.subjects;\n    const subject = s.table;\n    const sc = getTableColumns(subject);\n    const active = (value: unknown) => value === true;\n    const owned = (value: unknown) => value === \"owned\";\n\n    const read: ReadMapping = {\n      subject: {\n        table: subject,\n        id: s.id,\n        status: s.status,\n        securityRevision: s.securityRevision,\n        decodeId: (row) => row[s.id],\n        isActiveStatus: (value) => Object.is(value, s.activeValue),\n        activeCondition: eq(sc[s.status], s.activeValue),\n      },\n      credential: {\n        ...mapped(\"passkeyCredentials\"),\n        status: \"active\",\n        decode: (row) =>\n          Schema.decodeUnknownSync(credentialData)({\n            ...row,\n            profile: Schema.decodeUnknownSync(profileJson)(row.profile),\n          }),\n        decodeSubjectId: (row) => row.subjectId,\n        isActiveStatus: active,\n        activeCondition: eq(column(\"passkeyCredentials\", \"active\"), true),\n      },\n      authority: {\n        ...mapped(\"credentials\"),\n        status: \"active\",\n        isActiveStatus: active,\n        activeCondition: eq(column(\"credentials\", \"active\"), true),\n      },\n      credentialOwnership: {\n        ...mapped(\"passkeyOwnership\"),\n        isOwnedState: owned,\n        ownedCondition: eq(column(\"passkeyOwnership\", \"state\"), \"owned\"),\n        decodeSubjectId: (row) => row.subjectId,\n      },\n      handleOwnership: {\n        ...mapped(\"passkeyHandles\"),\n        isOwnedState: owned,\n        ownedCondition: eq(column(\"passkeyHandles\", \"state\"), \"owned\"),\n        decodeSubjectId: (row) => row.subjectId,\n      },\n      subjectIds: { toNative: s.toNativeSync, toSubject: s.toSubjectSync, equals: Object.is },\n      constraints: requiredPasskeyCredentialConstraints,\n    };\n\n    const base = (feature: PasskeyFeature): BaseMapping => ({\n      moduleId: feature.moduleId,\n      authorityScope: namespace,\n      read,\n      module: {\n        ...mapped(\"passkeyModules\"),\n        status: \"active\",\n        policyColumns: [\"policy\", \"policyRevision\"],\n        isActiveStatus: active,\n        activeCondition: eq(column(\"passkeyModules\", \"active\"), true),\n        decodeMethodPolicy: (row) => Schema.decodeUnknownSync(policyJson)(row.policy),\n      },\n      flow: {\n        ...mapped(\"passkeyFlows\"),\n        states: {\n          Pending: \"Pending\",\n          Claimed: \"Claimed\",\n          Verified: \"Verified\",\n          Rejected: \"Rejected\",\n          Ambiguous: \"Ambiguous\",\n          RegistrationAccepted: \"RegistrationAccepted\",\n          ProvisioningPending: \"ProvisioningPending\",\n        },\n        encodeInsert: () => ({}),\n      },\n      admission: mapped(\"passkeyAdmissions\"),\n      charge: { ...mapped(\"passkeyCharges\"), encodeInsert: () => ({}) },\n      clock: {\n        encodeInstant: storage.encodeInstant,\n        decodeInstant: storage.decodeInstantSync,\n        engineNowMillis:\n          dialect === \"pg\"\n            ? sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)`\n            : sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`,\n        toMillis: (expression) => expression,\n        fromMillis: (expression) => expression,\n      },\n      telemetry: { lastUsedAt: \"lastUsedAt\", encodeBackupState: (value) => value },\n      constraints: requiredPasskeyPersistenceConstraints,\n    });\n\n    const management = (feature: PasskeyFeature): ManagementMapping => {\n      const policy = feature.managementPolicy;\n\n      if (policy === undefined)\n        throw configurationError(`Missing passkey management policy for ${feature.moduleId}`);\n      const c = getTableColumns(table(\"passkeyCredentials\"));\n      const f = getTableColumns(table(\"credentials\"));\n\n      const metadata = (subjectId: unknown) =>\n        sql`exists(select 1 from ${subject} where ${sc[s.id]} = ${subjectId} and ${sc[s.status]} = ${s.activeValue})`;\n\n      return {\n        ...base(feature),\n        write: {\n          credential: {\n            name: \"name\",\n            createdAt: \"createdAt\",\n            encodeInsert: ({ credential, subjectId, summary, marker }) => ({\n              credentialId: credential.credentialId,\n              subjectId,\n              rpId: credential.rpId,\n              protocolCredentialId: credential.protocolCredentialId,\n              userHandle: credential.userHandle,\n              credentialKey: \"\",\n              handleKey: \"\",\n              publicKey: credential.publicKey,\n              algorithm: credential.algorithm,\n              profile: Schema.encodeSync(profileJson)(credential.profile),\n              credentialRevision: marker,\n              active: true,\n              primarySignIn: credential.primarySignIn,\n              enrollmentUserVerified: credential.enrollmentUserVerified,\n              backupEligible: credential.backupEligible,\n              backupState: credential.backupState,\n              counter: credential.counter,\n              maximumCounter: credential.maximumCounter,\n              name: summary.name,\n              createdAt: storage.encodeInstant(summary.createdAtMillis),\n            }),\n            encodePrimarySignIn: (value) => value,\n            encodeEnrollmentUserVerified: (value) => value,\n            encodeBackupEligible: (value) => value,\n            activeStatus: true,\n            removedStatus: false,\n          },\n          authority: {\n            encodeInsert: ({ subjectId, credential, marker }) => ({\n              subjectId,\n              credentialId: credential.credentialId,\n              revision: marker,\n              active: true,\n            }),\n            activeStatus: true,\n            removedStatus: false,\n          },\n          credentialOwnership: {\n            encodeInsert: ({ credential, marker }) => ({\n              credentialKey: \"\",\n              rpId: credential.rpId,\n              protocolCredentialId: credential.protocolCredentialId,\n              state: \"owned\",\n              version: marker,\n            }),\n            ownedState: \"owned\",\n            removedState: \"removed\",\n          },\n          handleOwnership: {\n            encodeInsert: ({ subjectId, rpId, userHandle, marker }) => ({\n              subjectId,\n              rpId,\n              userHandle,\n              handleKey: \"\",\n              state: \"owned\",\n              version: marker,\n            }),\n            ownedState: \"owned\",\n          },\n          policy: {\n            subjectColumns: Object.keys(sc),\n            management: () => policy,\n            requirement: s.actionRequirements,\n            metadata,\n            action: metadata,\n            remainingSignIn: (subjectId, excluded, row) =>\n              Effect.gen(function* () {\n                const requirement = yield* Schema.decodeUnknownEffect(PasskeyRequirement)(\n                  yield* s.requirements(row),\n                );\n\n                const alternatives: SQL[] = [];\n\n                // Only retain complete sign-in paths enabled by this Auth definition.\n                // More involved combinations require an explicit application's predicate.\n                if (\n                  requirement.alternatives.some(\n                    (alternative) =>\n                      alternative.minimumCredentials === 1 &&\n                      alternative.factors.every((factor) => factor === \"possession\"),\n                  )\n                ) {\n                  const profiles = signInProfiles.map((profile) =>\n                    Schema.encodeSync(profileJson)(profile),\n                  );\n\n                  alternatives.push(sql`exists(\n                  select 1 from ${table(\"passkeyCredentials\")} join ${table(\"credentials\")}\n                  on ${f.credentialId} = ${c.credentialId} and ${f.subjectId} = ${c.subjectId}\n                    and ${f.revision} = ${c.credentialRevision} and ${f.active} = ${true}\n                  where ${c.subjectId} = ${subjectId} and ${c.credentialId} <> ${excluded}\n                    and ${c.active} = ${true} and ${c.primarySignIn} = ${true}\n                    and ${c.enrollmentUserVerified} = ${true} and ${inArray(c.profile, profiles)}\n                )`);\n                }\n                if (\n                  passwordModules.length > 0 &&\n                  requirement.alternatives.some(\n                    (alternative) =>\n                      alternative.minimumCredentials === 1 &&\n                      !alternative.userVerified &&\n                      !alternative.phishingResistant &&\n                      alternative.factors.every((factor) => factor === \"knowledge\"),\n                  )\n                ) {\n                  const p = getTableColumns(table(\"passwords\"));\n                  const i = getTableColumns(table(\"identifiers\"));\n\n                  alternatives.push(sql`exists(\n                  select 1 from ${table(\"passwords\")} join ${table(\"credentials\")}\n                  on ${f.credentialId} = ${p.credentialId} and ${f.subjectId} = ${p.subjectId}\n                    and ${f.revision} = ${p.credentialRevision} and ${f.active} = ${true}\n                  join ${table(\"identifiers\")} on ${i.subjectId} = ${p.subjectId}\n                    and ${i.active} = ${true} and ${i.namespace} = 'email'\n                  where ${p.subjectId} = ${subjectId} and ${p.credentialId} <> ${excluded}\n                    and ${inArray(p.moduleId, passwordModules)}\n                )`);\n                }\n\n                return or(...alternatives) ?? sql`false`;\n              }).pipe(\n                Effect.mapError((cause) =>\n                  PersistenceMappingError.make({ operation: \"mapping\", cause }),\n                ),\n              ),\n          },\n        },\n        command: { ...mapped(\"passkeyCommands\"), encodeInsert: (input) => ({ ...input }) },\n        managementConstraints: requiredPasskeyManagementConstraints,\n        invalidation: {\n          window: {\n            trigger: \"credential-change\",\n            existingSessions: \"immediate\",\n            maximumExposureMillis: 0,\n            oldAuthenticationEvidence: \"rejected\",\n          },\n          mutations: [],\n          postcondition: ({ subjectId, securityRevision }) =>\n            sql`exists(select 1 from ${subject} where ${sc[s.id]} = ${subjectId} and ${sc[s.securityRevision]} = ${securityRevision})`,\n        },\n      };\n    };\n\n    return { read, base, management, table };\n  };\n\n  const make: Backend<object, never>[\"passkeys\"] = Effect.fn(\"AuthPersistence.passkeys\")(\n    function* ({ storage, namespace, dialect, features, passwordModules }) {\n      const client = yield* SqlClient.SqlClient;\n\n      const policies = yield* Effect.forEach(features, (feature) =>\n        Effect.map(feature.policy, (policy) => ({ feature, policy })),\n      );\n\n      const m = yield* Effect.try({\n        try: () =>\n          mappings(\n            storage,\n            namespace,\n            dialect,\n            passwordModules,\n            policies.flatMap(({ feature, policy }) => (feature.management ? [] : policy.profiles)),\n          ),\n        catch: () => configurationError(\"Invalid passkey table mappings\"),\n      });\n\n      const configuration: PasskeyTargetConfiguration = {\n        mode: \"interactive\",\n        dialect,\n        locking: dialect === \"pg\",\n        standaloneGuard: () => requireStandalone(unavailable, client.transactionService),\n      };\n\n      const native = yield* CurrentProofSql;\n\n      yield* client.withTransaction(\n        Effect.gen(function* () {\n          if (dialect === \"pg\")\n            yield* client`select pg_advisory_xact_lock(hashtext(${`${namespace}/passkeys`}))`;\n          for (const { feature, policy } of policies) {\n            const encoded = yield* Schema.encodeEffect(policyJson)(policy);\n\n            const policyRevision = digest(\n              yield* Schema.encodeEffect(seedJson)({\n                policy,\n                ...(feature.managementPolicy === undefined\n                  ? {}\n                  : { management: feature.managementPolicy }),\n              }),\n            );\n\n            const module = m.table(\"passkeyModules\");\n            const columns = getTableColumns(module);\n\n            yield* native\n              .insert(module)\n              .values({ moduleId: feature.moduleId, active: true, policy: encoded, policyRevision })\n              .onConflictDoNothing();\n\n            const rows = yield* native\n              .select()\n              .from(module)\n              .where(eq(columns.moduleId, feature.moduleId));\n\n            const row = yield* Schema.decodeUnknownEffect(ModuleRow)(rows[0]);\n\n            if (!row.active)\n              return yield* configurationError(`Passkey module ${feature.moduleId} is disabled`);\n            if (row.policyRevision !== policyRevision) {\n              const previous = yield* Schema.decodeEffect(policyJson)(row.policy);\n\n              if (policy.generation <= previous.generation)\n                return yield* configurationError(\n                  `Increase the passkey policy generation to change ${feature.moduleId}`,\n                );\n              yield* native\n                .update(module)\n                .set({ policy: encoded, policyRevision })\n                .where(\n                  and(\n                    eq(columns.moduleId, feature.moduleId),\n                    eq(columns.policyRevision, row.policyRevision),\n                    eq(columns.active, true),\n                  ),\n                );\n\n              const updated = yield* native\n                .select()\n                .from(module)\n                .where(eq(columns.moduleId, feature.moduleId));\n\n              const applied = yield* Schema.decodeUnknownEffect(ModuleRow)(updated[0]);\n\n              if (!applied.active || applied.policyRevision !== policyRevision)\n                return yield* configurationError(\n                  `Passkey policy changed while configuring ${feature.moduleId}`,\n                );\n            }\n            yield* native\n              .insert(m.table(\"passkeyAdmissions\"))\n              .values({\n                authorityScope: namespace,\n                moduleId: feature.moduleId,\n                version: policyRevision,\n                ownerMarker: policyRevision,\n              })\n              .onConflictDoNothing();\n          }\n        }),\n      );\n\n      const credential = yield* makeTargetPasskeyCredentials<ReadMapping, never>(\n        m.read,\n        configuration,\n      );\n\n      const persistence = new Map<string, PasskeyPersistence[\"Service\"]>();\n      const managers = new Map<string, PasskeyManagementPersistence[\"Service\"]>();\n      const enrollment = new Map<string, PasskeyEnrollmentContext[\"Service\"]>();\n\n      for (const feature of features) {\n        if (feature.management) {\n          const mapping = yield* Effect.try({\n            try: () => m.management(feature),\n            catch: () =>\n              configurationError(`Invalid passkey management mapping for ${feature.moduleId}`),\n          });\n\n          const services = yield* makeTargetPasskeyManagement<ManagementMapping, never>(\n            mapping,\n            configuration,\n          );\n\n          persistence.set(feature.moduleId, services.passkeyPersistence);\n          managers.set(feature.moduleId, services.passkeyManagementPersistence);\n          enrollment.set(\n            feature.moduleId,\n            (yield* makeTargetPasskeyEnrollmentContext<ManagementMapping, never>(\n              mapping,\n              configuration,\n            )).passkeyEnrollmentContext,\n          );\n        } else {\n          persistence.set(\n            feature.moduleId,\n            (yield* makeTargetPasskeyPersistence<BaseMapping, never>(\n              m.base(feature),\n              configuration,\n            )).passkeyPersistence,\n          );\n        }\n      }\n\n      const service = <A>(services: ReadonlyMap<string, A>, moduleId: string) => {\n        const value = services.get(moduleId);\n\n        return value === undefined ? Effect.fail(unavailable()) : Effect.succeed(value);\n      };\n\n      let context: Context.Context<never> = Context.make(\n        PasskeyCredentials,\n        credential.passkeyCredentials,\n      ).pipe(\n        Context.add(PasskeyPersistence, {\n          issue: (input, prepare) =>\n            Effect.flatMap(service(persistence, input.ceremony.moduleId), (s) =>\n              s.issue(input, prepare),\n            ),\n          context: (input) =>\n            Effect.flatMap(service(persistence, input.moduleId), (s) => s.context(input)),\n          claim: (input, prepare) =>\n            Effect.flatMap(service(persistence, input.ceremony.moduleId), (s) =>\n              s.claim(input, prepare),\n            ),\n          settle: (input, prepare) =>\n            Effect.flatMap(service(persistence, input.claim.ceremony.moduleId), (s) =>\n              s.settle(input, prepare),\n            ),\n          cleanup: (input, prepare) =>\n            Effect.flatMap(service(persistence, input.moduleId), (s) => s.cleanup(input, prepare)),\n        }),\n      );\n\n      if (managers.size > 0)\n        context = context.pipe(\n          Context.add(PasskeyEnrollmentContext, {\n            capture: (input) =>\n              Effect.flatMap(service(enrollment, input.moduleId), (s) => s.capture(input)),\n          }),\n          Context.add(PasskeyManagementPersistence, {\n            issueEnrollment: (input, prepare) =>\n              Effect.flatMap(service(managers, input.ceremony.moduleId), (s) =>\n                s.issueEnrollment(input, prepare),\n              ),\n            completeEnrollment: (input, prepare) =>\n              Effect.flatMap(service(managers, input.claim.ceremony.moduleId), (s) =>\n                s.completeEnrollment(input, prepare),\n              ),\n            list: (input) =>\n              Effect.flatMap(service(managers, input.moduleId), (s) => s.list(input)),\n            inspectRemove: (input) =>\n              Effect.flatMap(service(managers, input.moduleId), (s) => s.inspectRemove(input)),\n            rename: (input, prepare) =>\n              Effect.flatMap(service(managers, input.moduleId), (s) => s.rename(input, prepare)),\n            remove: (input, prepare) =>\n              Effect.flatMap(service(managers, input.moduleId), (s) => s.remove(input, prepare)),\n          }),\n        );\n\n      return context;\n    },\n    Effect.mapError((error) =>\n      Schema.is(PersistenceConfigurationError)(error)\n        ? error\n        : configurationError(\"Unable to configure passkey persistence\"),\n    ),\n  );\n\n  return make;\n};\n"],"mappings":";;;;;;;;;;;;;AAwCA,MAAM,cAAc,OAAO,eAAe,cAAc;AACxD,MAAM,aAAa,OAAO,eAAe,mBAAmB;AAE5D,MAAM,WAAW,OAAO,eACtB,OAAO,OAAO;CACZ,QAAQ;CACR,YAAY,OAAO,YAAY,uBAAuB;AACxD,CAAC,CACH;AAEA,MAAM,YAAY,OAAO,OAAO;CAC9B,QAAQ,OAAO;CACf,QAAQ,OAAO;CACf,gBAAgB,OAAO;AACzB,CAAC;AAED,MAAM,iBAAiB,kBAAkB,WACtC,EAAE,UAAU,WAAW,QAAQ,SAAS,GAAG,aAAa,MAC3D;AAEA,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;AACpD,MAAM,sBAAsB,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;;AAiC5F,MAAa,wBACX,eACuC;CACvC,MAAM,EAAE,KAAK,IAAI,iBAAiB,SAAS,IAAI,QAAQ;CACvD,MAAM,EAAE,QAAQ,gBAAgB,kBAAkB,UAAU;CAE5D,MAAM,EACJ,8BACA,oCACA,iCACE;CAEJ,MAAM,EAAE,gCAAgC;CAExC,MAAM,YACJ,SACA,WACA,SACA,iBACA,mBACG;EACH,MAAM,SAAS,SAAsB;GACnC,MAAM,QAAQ,QAAQ,OAAO;GAE7B,IAAI,UAAU,KAAA,GAAW,MAAM,mBAAmB,WAAW,KAAK,SAAS;GAG3E,OAAO;EACT;EAEA,MAAM,UAAoC,UAAgB;GACxD,OAAO,MAAM,IAAI;GACjB,GAAI,OAAO,YAAY,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;EAG1F;EAEA,MAAM,UAAU,MAAmB,QAAgB,gBAAgB,MAAM,IAAI,CAAC,CAAC,CAAC;EAChF,MAAM,IAAI,QAAQ;EAClB,MAAM,UAAU,EAAE;EAClB,MAAM,KAAK,gBAAgB,OAAO;EAClC,MAAM,UAAU,UAAmB,UAAU;EAC7C,MAAM,SAAS,UAAmB,UAAU;EAE5C,MAAM,OAAoB;GACxB,SAAS;IACP,OAAO;IACP,IAAI,EAAE;IACN,QAAQ,EAAE;IACV,kBAAkB,EAAE;IACpB,WAAW,QAAQ,IAAI,EAAE;IACzB,iBAAiB,UAAU,OAAO,GAAG,OAAO,EAAE,WAAW;IACzD,iBAAiB,GAAG,GAAG,EAAE,SAAS,EAAE,WAAW;GACjD;GACA,YAAY;IACV,GAAG,OAAO,oBAAoB;IAC9B,QAAQ;IACR,SAAS,QACP,OAAO,kBAAkB,cAAc,CAAC,CAAC;KACvC,GAAG;KACH,SAAS,OAAO,kBAAkB,WAAW,CAAC,CAAC,IAAI,OAAO;IAC5D,CAAC;IACH,kBAAkB,QAAQ,IAAI;IAC9B,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,sBAAsB,QAAQ,GAAG,IAAI;GAClE;GACA,WAAW;IACT,GAAG,OAAO,aAAa;IACvB,QAAQ;IACR,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,eAAe,QAAQ,GAAG,IAAI;GAC3D;GACA,qBAAqB;IACnB,GAAG,OAAO,kBAAkB;IAC5B,cAAc;IACd,gBAAgB,GAAG,OAAO,oBAAoB,OAAO,GAAG,OAAO;IAC/D,kBAAkB,QAAQ,IAAI;GAChC;GACA,iBAAiB;IACf,GAAG,OAAO,gBAAgB;IAC1B,cAAc;IACd,gBAAgB,GAAG,OAAO,kBAAkB,OAAO,GAAG,OAAO;IAC7D,kBAAkB,QAAQ,IAAI;GAChC;GACA,YAAY;IAAE,UAAU,EAAE;IAAc,WAAW,EAAE;IAAe,QAAQ,OAAO;GAAG;GACtF,aAAa;EACf;EAEA,MAAM,QAAQ,aAA0C;GACtD,UAAU,QAAQ;GAClB,gBAAgB;GAChB;GACA,QAAQ;IACN,GAAG,OAAO,gBAAgB;IAC1B,QAAQ;IACR,eAAe,CAAC,UAAU,gBAAgB;IAC1C,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,kBAAkB,QAAQ,GAAG,IAAI;IAC5D,qBAAqB,QAAQ,OAAO,kBAAkB,UAAU,CAAC,CAAC,IAAI,MAAM;GAC9E;GACA,MAAM;IACJ,GAAG,OAAO,cAAc;IACxB,QAAQ;KACN,SAAS;KACT,SAAS;KACT,UAAU;KACV,UAAU;KACV,WAAW;KACX,sBAAsB;KACtB,qBAAqB;IACvB;IACA,qBAAqB,CAAC;GACxB;GACA,WAAW,OAAO,mBAAmB;GACrC,QAAQ;IAAE,GAAG,OAAO,gBAAgB;IAAG,qBAAqB,CAAC;GAAG;GAChE,OAAO;IACL,eAAe,QAAQ;IACvB,eAAe,QAAQ;IACvB,iBACE,YAAY,OACR,GAAG,iEACH,GAAG;IACT,WAAW,eAAe;IAC1B,aAAa,eAAe;GAC9B;GACA,WAAW;IAAE,YAAY;IAAc,oBAAoB,UAAU;GAAM;GAC3E,aAAa;EACf;EAEA,MAAM,cAAc,YAA+C;GACjE,MAAM,SAAS,QAAQ;GAEvB,IAAI,WAAW,KAAA,GACb,MAAM,mBAAmB,yCAAyC,QAAQ,UAAU;GACtF,MAAM,IAAI,gBAAgB,MAAM,oBAAoB,CAAC;GACrD,MAAM,IAAI,gBAAgB,MAAM,aAAa,CAAC;GAE9C,MAAM,YAAY,cAChB,GAAG,wBAAwB,QAAQ,SAAS,GAAG,EAAE,IAAI,KAAK,UAAU,OAAO,GAAG,EAAE,QAAQ,KAAK,EAAE,YAAY;GAE7G,OAAO;IACL,GAAG,KAAK,OAAO;IACf,OAAO;KACL,YAAY;MACV,MAAM;MACN,WAAW;MACX,eAAe,EAAE,YAAY,WAAW,SAAS,cAAc;OAC7D,cAAc,WAAW;OACzB;OACA,MAAM,WAAW;OACjB,sBAAsB,WAAW;OACjC,YAAY,WAAW;OACvB,eAAe;OACf,WAAW;OACX,WAAW,WAAW;OACtB,WAAW,WAAW;OACtB,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC,WAAW,OAAO;OAC1D,oBAAoB;OACpB,QAAQ;OACR,eAAe,WAAW;OAC1B,wBAAwB,WAAW;OACnC,gBAAgB,WAAW;OAC3B,aAAa,WAAW;OACxB,SAAS,WAAW;OACpB,gBAAgB,WAAW;OAC3B,MAAM,QAAQ;OACd,WAAW,QAAQ,cAAc,QAAQ,eAAe;MAC1D;MACA,sBAAsB,UAAU;MAChC,+BAA+B,UAAU;MACzC,uBAAuB,UAAU;MACjC,cAAc;MACd,eAAe;KACjB;KACA,WAAW;MACT,eAAe,EAAE,WAAW,YAAY,cAAc;OACpD;OACA,cAAc,WAAW;OACzB,UAAU;OACV,QAAQ;MACV;MACA,cAAc;MACd,eAAe;KACjB;KACA,qBAAqB;MACnB,eAAe,EAAE,YAAY,cAAc;OACzC,eAAe;OACf,MAAM,WAAW;OACjB,sBAAsB,WAAW;OACjC,OAAO;OACP,SAAS;MACX;MACA,YAAY;MACZ,cAAc;KAChB;KACA,iBAAiB;MACf,eAAe,EAAE,WAAW,MAAM,YAAY,cAAc;OAC1D;OACA;OACA;OACA,WAAW;OACX,OAAO;OACP,SAAS;MACX;MACA,YAAY;KACd;KACA,QAAQ;MACN,gBAAgB,OAAO,KAAK,EAAE;MAC9B,kBAAkB;MAClB,aAAa,EAAE;MACf;MACA,QAAQ;MACR,kBAAkB,WAAW,UAAU,QACrC,OAAO,IAAI,aAAa;OACtB,MAAM,cAAc,OAAO,OAAO,oBAAoB,kBAAkB,CAAC,CACvE,OAAO,EAAE,aAAa,GAAG,CAC3B;OAEA,MAAM,eAAsB,CAAC;OAI7B,IACE,YAAY,aAAa,MACtB,gBACC,YAAY,uBAAuB,KACnC,YAAY,QAAQ,OAAO,WAAW,WAAW,YAAY,CACjE,GACA;QACA,MAAM,WAAW,eAAe,KAAK,YACnC,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,CACxC;QAEA,aAAa,KAAK,GAAG;kCACL,MAAM,oBAAoB,EAAE,QAAQ,MAAM,aAAa,EAAE;uBACpE,EAAE,aAAa,KAAK,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,EAAE,UAAU;0BACpE,EAAE,SAAS,KAAK,EAAE,mBAAmB,OAAO,EAAE,OAAO,KAAK,KAAK;0BAC/D,EAAE,UAAU,KAAK,UAAU,OAAO,EAAE,aAAa,MAAM,SAAS;0BAChE,EAAE,OAAO,KAAK,KAAK,OAAO,EAAE,cAAc,KAAK,KAAK;0BACpD,EAAE,uBAAuB,KAAK,KAAK,OAAO,QAAQ,EAAE,SAAS,QAAQ,EAAE;kBAC/E;OACF;OACA,IACE,gBAAgB,SAAS,KACzB,YAAY,aAAa,MACtB,gBACC,YAAY,uBAAuB,KACnC,CAAC,YAAY,gBACb,CAAC,YAAY,qBACb,YAAY,QAAQ,OAAO,WAAW,WAAW,WAAW,CAChE,GACA;QACA,MAAM,IAAI,gBAAgB,MAAM,WAAW,CAAC;QAC5C,MAAM,IAAI,gBAAgB,MAAM,aAAa,CAAC;QAE9C,aAAa,KAAK,GAAG;kCACL,MAAM,WAAW,EAAE,QAAQ,MAAM,aAAa,EAAE;uBAC3D,EAAE,aAAa,KAAK,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,EAAE,UAAU;0BACpE,EAAE,SAAS,KAAK,EAAE,mBAAmB,OAAO,EAAE,OAAO,KAAK,KAAK;yBAChE,MAAM,aAAa,EAAE,MAAM,EAAE,UAAU,KAAK,EAAE,UAAU;0BACvD,EAAE,OAAO,KAAK,KAAK,OAAO,EAAE,UAAU;0BACtC,EAAE,UAAU,KAAK,UAAU,OAAO,EAAE,aAAa,MAAM,SAAS;0BAChE,QAAQ,EAAE,UAAU,eAAe,EAAE;kBAC7C;OACF;OAEA,OAAO,GAAG,GAAG,YAAY,KAAK,GAAG;MACnC,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,wBAAwB,KAAK;OAAE,WAAW;OAAW;MAAM,CAAC,CAC9D,CACF;KACJ;IACF;IACA,SAAS;KAAE,GAAG,OAAO,iBAAiB;KAAG,eAAe,WAAW,EAAE,GAAG,MAAM;IAAG;IACjF,uBAAuB;IACvB,cAAc;KACZ,QAAQ;MACN,SAAS;MACT,kBAAkB;MAClB,uBAAuB;MACvB,2BAA2B;KAC7B;KACA,WAAW,CAAC;KACZ,gBAAgB,EAAE,WAAW,uBAC3B,GAAG,wBAAwB,QAAQ,SAAS,GAAG,EAAE,IAAI,KAAK,UAAU,OAAO,GAAG,EAAE,kBAAkB,KAAK,iBAAiB;IAC5H;GACF;EACF;EAEA,OAAO;GAAE;GAAM;GAAM;GAAY;EAAM;CACzC;CAsNA,OApNiD,OAAO,GAAG,0BAA0B,CAAC,CACpF,WAAW,EAAE,SAAS,WAAW,SAAS,UAAU,mBAAmB;EACrE,MAAM,SAAS,OAAO,UAAU;EAEhC,MAAM,WAAW,OAAO,OAAO,QAAQ,WAAW,YAChD,OAAO,IAAI,QAAQ,SAAS,YAAY;GAAE;GAAS;EAAO,EAAE,CAC9D;EAEA,MAAM,IAAI,OAAO,OAAO,IAAI;GAC1B,WACE,SACE,SACA,WACA,SACA,iBACA,SAAS,SAAS,EAAE,SAAS,aAAc,QAAQ,aAAa,CAAC,IAAI,OAAO,QAAS,CACvF;GACF,aAAa,mBAAmB,gCAAgC;EAClE,CAAC;EAED,MAAM,gBAA4C;GAChD,MAAM;GACN;GACA,SAAS,YAAY;GACrB,uBAAuB,kBAAkB,aAAa,OAAO,kBAAkB;EACjF;EAEA,MAAM,SAAS,OAAO;EAEtB,OAAO,OAAO,gBACZ,OAAO,IAAI,aAAa;GACtB,IAAI,YAAY,MACd,OAAO,MAAM,yCAAyC,GAAG,UAAU,WAAW;GAChF,KAAK,MAAM,EAAE,SAAS,YAAY,UAAU;IAC1C,MAAM,UAAU,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,MAAM;IAE7D,MAAM,iBAAiB,OACrB,OAAO,OAAO,aAAa,QAAQ,CAAC,CAAC;KACnC;KACA,GAAI,QAAQ,qBAAqB,KAAA,IAC7B,CAAC,IACD,EAAE,YAAY,QAAQ,iBAAiB;IAC7C,CAAC,CACH;IAEA,MAAM,SAAS,EAAE,MAAM,gBAAgB;IACvC,MAAM,UAAU,gBAAgB,MAAM;IAEtC,OAAO,OACJ,OAAO,MAAM,CAAC,CACd,OAAO;KAAE,UAAU,QAAQ;KAAU,QAAQ;KAAM,QAAQ;KAAS;IAAe,CAAC,CAAC,CACrF,oBAAoB;IAEvB,MAAM,OAAO,OAAO,OACjB,OAAO,CAAC,CACR,KAAK,MAAM,CAAC,CACZ,MAAM,GAAG,QAAQ,UAAU,QAAQ,QAAQ,CAAC;IAE/C,MAAM,MAAM,OAAO,OAAO,oBAAoB,SAAS,CAAC,CAAC,KAAK,EAAE;IAEhE,IAAI,CAAC,IAAI,QACP,OAAO,OAAO,mBAAmB,kBAAkB,QAAQ,SAAS,aAAa;IACnF,IAAI,IAAI,mBAAmB,gBAAgB;KACzC,MAAM,WAAW,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,IAAI,MAAM;KAElE,IAAI,OAAO,cAAc,SAAS,YAChC,OAAO,OAAO,mBACZ,oDAAoD,QAAQ,UAC9D;KACF,OAAO,OACJ,OAAO,MAAM,CAAC,CACd,IAAI;MAAE,QAAQ;MAAS;KAAe,CAAC,CAAC,CACxC,MACC,IACE,GAAG,QAAQ,UAAU,QAAQ,QAAQ,GACrC,GAAG,QAAQ,gBAAgB,IAAI,cAAc,GAC7C,GAAG,QAAQ,QAAQ,IAAI,CACzB,CACF;KAEF,MAAM,UAAU,OAAO,OACpB,OAAO,CAAC,CACR,KAAK,MAAM,CAAC,CACZ,MAAM,GAAG,QAAQ,UAAU,QAAQ,QAAQ,CAAC;KAE/C,MAAM,UAAU,OAAO,OAAO,oBAAoB,SAAS,CAAC,CAAC,QAAQ,EAAE;KAEvE,IAAI,CAAC,QAAQ,UAAU,QAAQ,mBAAmB,gBAChD,OAAO,OAAO,mBACZ,4CAA4C,QAAQ,UACtD;IACJ;IACA,OAAO,OACJ,OAAO,EAAE,MAAM,mBAAmB,CAAC,CAAC,CACpC,OAAO;KACN,gBAAgB;KAChB,UAAU,QAAQ;KAClB,SAAS;KACT,aAAa;IACf,CAAC,CAAC,CACD,oBAAoB;GACzB;EACF,CAAC,CACH;EAEA,MAAM,aAAa,OAAO,6BACxB,EAAE,MACF,aACF;EAEA,MAAM,8BAAc,IAAI,IAA2C;EACnE,MAAM,2BAAW,IAAI,IAAqD;EAC1E,MAAM,6BAAa,IAAI,IAAiD;EAExE,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,YAAY;GACtB,MAAM,UAAU,OAAO,OAAO,IAAI;IAChC,WAAW,EAAE,WAAW,OAAO;IAC/B,aACE,mBAAmB,0CAA0C,QAAQ,UAAU;GACnF,CAAC;GAED,MAAM,WAAW,OAAO,4BACtB,SACA,aACF;GAEA,YAAY,IAAI,QAAQ,UAAU,SAAS,kBAAkB;GAC7D,SAAS,IAAI,QAAQ,UAAU,SAAS,4BAA4B;GACpE,WAAW,IACT,QAAQ,WACP,OAAO,mCACN,SACA,aACF,EAAA,CAAG,wBACL;EACF,OACE,YAAY,IACV,QAAQ,WACP,OAAO,6BACN,EAAE,KAAK,OAAO,GACd,aACF,EAAA,CAAG,kBACL;EAIJ,MAAM,WAAc,UAAkC,aAAqB;GACzE,MAAM,QAAQ,SAAS,IAAI,QAAQ;GAEnC,OAAO,UAAU,KAAA,IAAY,OAAO,KAAK,YAAY,CAAC,IAAI,OAAO,QAAQ,KAAK;EAChF;EAEA,IAAI,UAAkC,QAAQ,KAC5C,oBACA,WAAW,kBACb,CAAC,CAAC,KACA,QAAQ,IAAI,oBAAoB;GAC9B,QAAQ,OAAO,YACb,OAAO,QAAQ,QAAQ,aAAa,MAAM,SAAS,QAAQ,IAAI,MAC7D,EAAE,MAAM,OAAO,OAAO,CACxB;GACF,UAAU,UACR,OAAO,QAAQ,QAAQ,aAAa,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,KAAK,CAAC;GAC9E,QAAQ,OAAO,YACb,OAAO,QAAQ,QAAQ,aAAa,MAAM,SAAS,QAAQ,IAAI,MAC7D,EAAE,MAAM,OAAO,OAAO,CACxB;GACF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,aAAa,MAAM,MAAM,SAAS,QAAQ,IAAI,MACnE,EAAE,OAAO,OAAO,OAAO,CACzB;GACF,UAAU,OAAO,YACf,OAAO,QAAQ,QAAQ,aAAa,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;EACzF,CAAC,CACH;EAEA,IAAI,SAAS,OAAO,GAClB,UAAU,QAAQ,KAChB,QAAQ,IAAI,0BAA0B,EACpC,UAAU,UACR,OAAO,QAAQ,QAAQ,YAAY,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,KAAK,CAAC,EAC/E,CAAC,GACD,QAAQ,IAAI,8BAA8B;GACxC,kBAAkB,OAAO,YACvB,OAAO,QAAQ,QAAQ,UAAU,MAAM,SAAS,QAAQ,IAAI,MAC1D,EAAE,gBAAgB,OAAO,OAAO,CAClC;GACF,qBAAqB,OAAO,YAC1B,OAAO,QAAQ,QAAQ,UAAU,MAAM,MAAM,SAAS,QAAQ,IAAI,MAChE,EAAE,mBAAmB,OAAO,OAAO,CACrC;GACF,OAAO,UACL,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,KAAK,KAAK,CAAC;GACxE,gBAAgB,UACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,cAAc,KAAK,CAAC;GACjF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;GACnF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;EACrF,CAAC,CACH;EAEF,OAAO;CACT,GACA,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,mBAAmB,yCAAyC,CAClE,CAGQ;AACZ"}
+{"version":3,"file":"passkeys.mjs","names":[],"sources":["../../src/internal/passkeys.ts"],"sourcesContent":["import {\n  PasskeyCredentials,\n  PasskeyCredential,\n  PasskeyEnrollmentContext,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  PasskeyPersistence,\n  PasskeyProfile,\n  PasskeyRequirement,\n  PasskeyUnavailable,\n} from \"@yielded/auth/Passkey\";\nimport { Context, Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport {\n  PersistenceConfigurationError,\n  type MappingInput,\n  type PasskeyFeature,\n} from \"./configuration\";\nimport { digest } from \"./crypto\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n  requiredPasskeyCredentialConstraints,\n  requiredPasskeyPersistenceConstraints,\n  type PasskeyCredentialMapping,\n  type PasskeyPersistenceMapping,\n} from \"./models/passkey-model\";\nimport {\n  requiredPasskeyManagementConstraints,\n  type PasskeyManagementMapping,\n} from \"./models/passkey-write-model\";\nimport { makePasskeyKernel } from \"./passkey-kernel\";\nimport type { PasskeyTargetConfiguration } from \"./passkey/target\";\nimport type { Backend } from \"./persistence\";\nimport { CurrentProofSql } from \"./proof-kernel\";\nimport type { SqlExpression as SQL, QueryOperations, TableModel } from \"./query-operations\";\nimport { requireStandalone } from \"./standalone\";\nimport { storageTables, type StorageRole } from \"./storage-tables\";\n\nconst profileJson = Schema.fromJsonString(PasskeyProfile);\nconst policyJson = Schema.fromJsonString(PasskeyMethodPolicy);\n\nconst seedJson = Schema.fromJsonString(\n  Schema.Struct({\n    policy: PasskeyMethodPolicy,\n    management: Schema.optionalKey(PasskeyManagementPolicy),\n  }),\n);\n\nconst ModuleRow = Schema.Struct({\n  active: Schema.Boolean,\n  policy: Schema.String,\n  policyRevision: Schema.String,\n});\n\nconst ConfiguredModuleRow = Schema.Struct({\n  moduleId: Schema.String,\n  active: Schema.Boolean,\n  policyRevision: Schema.String,\n  admitted: Schema.Literals([\"present\", \"missing\"]),\n});\n\nconst credentialData = PasskeyCredential.mapFields(\n  ({ revision: _revision, active: _active, ...fields }) => fields,\n);\n\nconst unavailable = () => PasskeyUnavailable.make({});\nconst configurationError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\ntype ReadMapping = PasskeyCredentialMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown\n>;\ntype BaseMapping = PasskeyPersistenceMapping<\n  ReadMapping,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown\n>;\ntype ManagementMapping = PasskeyManagementMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown\n>;\n\n/** Share the same passkey algorithms across raw SQL and Drizzle compilers. */\nexport const makeComposedPasskeys = (\n  operations: QueryOperations,\n): Backend<object, never>[\"passkeys\"] => {\n  const { and, eq, getTableColumns, inArray, or, sql } = operations;\n  const { target, writeTarget } = makePasskeyKernel(operations);\n\n  const {\n    makeTargetPasskeyCredentials,\n    makeTargetPasskeyEnrollmentContext,\n    makeTargetPasskeyPersistence,\n  } = target;\n\n  const { makeTargetPasskeyManagement } = writeTarget;\n\n  const mappings = (\n    storage: MappingInput,\n    namespace: string,\n    dialect: \"pg\" | \"sqlite\",\n    passwordModules: ReadonlyArray<string>,\n    signInProfiles: ReadonlyArray<PasskeyProfile>,\n  ) => {\n    const table = (role: StorageRole) => {\n      const value = storage.tables[role];\n\n      if (value === undefined) throw configurationError(`Missing ${role} mapping`);\n\n      // Backend validation owns the foreign table shape. Row values are decoded below.\n      return value;\n    };\n\n    const mapped = <Role extends StorageRole>(role: Role) => ({\n      table: table(role),\n      ...(Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key])) as {\n        readonly [Key in keyof (typeof storageTables)[Role][\"columns\"]]: Key;\n      }),\n    });\n\n    const column = (role: StorageRole, key: string) => getTableColumns(table(role))[key];\n    const s = storage.subjects;\n    const subject = s.table;\n    const sc = getTableColumns(subject);\n    const active = (value: unknown) => value === true;\n    const owned = (value: unknown) => value === \"owned\";\n\n    const read: ReadMapping = {\n      subject: {\n        table: subject,\n        id: s.id,\n        status: s.status,\n        securityRevision: s.securityRevision,\n        decodeId: (row) => row[s.id],\n        isActiveStatus: (value) => Object.is(value, s.activeValue),\n        activeCondition: eq(sc[s.status], s.activeValue),\n      },\n      credential: {\n        ...mapped(\"passkeyCredentials\"),\n        status: \"active\",\n        decode: (row) =>\n          Schema.decodeUnknownSync(credentialData)({\n            ...row,\n            profile: Schema.decodeUnknownSync(profileJson)(row.profile),\n          }),\n        decodeSubjectId: (row) => row.subjectId,\n        isActiveStatus: active,\n        activeCondition: eq(column(\"passkeyCredentials\", \"active\"), true),\n      },\n      authority: {\n        ...mapped(\"credentials\"),\n        status: \"active\",\n        isActiveStatus: active,\n        activeCondition: eq(column(\"credentials\", \"active\"), true),\n      },\n      credentialOwnership: {\n        ...mapped(\"passkeyOwnership\"),\n        isOwnedState: owned,\n        ownedCondition: eq(column(\"passkeyOwnership\", \"state\"), \"owned\"),\n        decodeSubjectId: (row) => row.subjectId,\n      },\n      handleOwnership: {\n        ...mapped(\"passkeyHandles\"),\n        isOwnedState: owned,\n        ownedCondition: eq(column(\"passkeyHandles\", \"state\"), \"owned\"),\n        decodeSubjectId: (row) => row.subjectId,\n      },\n      subjectIds: { toNative: s.toNativeSync, toSubject: s.toSubjectSync, equals: Object.is },\n      constraints: requiredPasskeyCredentialConstraints,\n    };\n\n    const base = (feature: PasskeyFeature): BaseMapping => ({\n      moduleId: feature.moduleId,\n      authorityScope: namespace,\n      read,\n      module: {\n        ...mapped(\"passkeyModules\"),\n        status: \"active\",\n        policyColumns: [\"policy\", \"policyRevision\"],\n        isActiveStatus: active,\n        activeCondition: eq(column(\"passkeyModules\", \"active\"), true),\n        decodeMethodPolicy: (row) => Schema.decodeUnknownSync(policyJson)(row.policy),\n      },\n      flow: {\n        ...mapped(\"passkeyFlows\"),\n        states: {\n          Pending: \"Pending\",\n          Claimed: \"Claimed\",\n          Verified: \"Verified\",\n          Rejected: \"Rejected\",\n          Ambiguous: \"Ambiguous\",\n          RegistrationAccepted: \"RegistrationAccepted\",\n          ProvisioningPending: \"ProvisioningPending\",\n        },\n        encodeInsert: () => ({}),\n      },\n      admission: mapped(\"passkeyAdmissions\"),\n      charge: { ...mapped(\"passkeyCharges\"), encodeInsert: () => ({}) },\n      clock: {\n        encodeInstant: storage.encodeInstant,\n        decodeInstant: storage.decodeInstantSync,\n        engineNowMillis:\n          dialect === \"pg\"\n            ? sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)`\n            : sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`,\n        toMillis: (expression) => expression,\n        fromMillis: (expression) => expression,\n      },\n      telemetry: { lastUsedAt: \"lastUsedAt\", encodeBackupState: (value) => value },\n      constraints: requiredPasskeyPersistenceConstraints,\n    });\n\n    const management = (feature: PasskeyFeature): ManagementMapping => {\n      const policy = feature.managementPolicy;\n\n      if (policy === undefined)\n        throw configurationError(`Missing passkey management policy for ${feature.moduleId}`);\n      const c = getTableColumns(table(\"passkeyCredentials\"));\n      const f = getTableColumns(table(\"credentials\"));\n\n      const metadata = (subjectId: unknown) =>\n        sql`exists(select 1 from ${subject} where ${sc[s.id]} = ${subjectId} and ${sc[s.status]} = ${s.activeValue})`;\n\n      return {\n        ...base(feature),\n        write: {\n          credential: {\n            name: \"name\",\n            createdAt: \"createdAt\",\n            encodeInsert: ({ credential, subjectId, summary, marker }) => ({\n              credentialId: credential.credentialId,\n              subjectId,\n              rpId: credential.rpId,\n              protocolCredentialId: credential.protocolCredentialId,\n              userHandle: credential.userHandle,\n              credentialKey: \"\",\n              handleKey: \"\",\n              publicKey: credential.publicKey,\n              algorithm: credential.algorithm,\n              profile: Schema.encodeSync(profileJson)(credential.profile),\n              credentialRevision: marker,\n              active: true,\n              primarySignIn: credential.primarySignIn,\n              enrollmentUserVerified: credential.enrollmentUserVerified,\n              backupEligible: credential.backupEligible,\n              backupState: credential.backupState,\n              counter: credential.counter,\n              maximumCounter: credential.maximumCounter,\n              name: summary.name,\n              createdAt: storage.encodeInstant(summary.createdAtMillis),\n            }),\n            encodePrimarySignIn: (value) => value,\n            encodeEnrollmentUserVerified: (value) => value,\n            encodeBackupEligible: (value) => value,\n            activeStatus: true,\n            removedStatus: false,\n          },\n          authority: {\n            encodeInsert: ({ subjectId, credential, marker }) => ({\n              subjectId,\n              credentialId: credential.credentialId,\n              revision: marker,\n              active: true,\n            }),\n            activeStatus: true,\n            removedStatus: false,\n          },\n          credentialOwnership: {\n            encodeInsert: ({ credential, marker }) => ({\n              credentialKey: \"\",\n              rpId: credential.rpId,\n              protocolCredentialId: credential.protocolCredentialId,\n              state: \"owned\",\n              version: marker,\n            }),\n            ownedState: \"owned\",\n            removedState: \"removed\",\n          },\n          handleOwnership: {\n            encodeInsert: ({ subjectId, rpId, userHandle, marker }) => ({\n              subjectId,\n              rpId,\n              userHandle,\n              handleKey: \"\",\n              state: \"owned\",\n              version: marker,\n            }),\n            ownedState: \"owned\",\n          },\n          policy: {\n            subjectColumns: Object.keys(sc),\n            management: () => policy,\n            requirement: s.actionRequirements,\n            metadata,\n            action: metadata,\n            remainingSignIn: (subjectId, excluded, row) =>\n              Effect.gen(function* () {\n                const requirement = yield* Schema.decodeUnknownEffect(PasskeyRequirement)(\n                  yield* s.requirements(row),\n                );\n\n                const alternatives: SQL[] = [];\n\n                // Only retain complete sign-in paths enabled by this Auth definition.\n                // More involved combinations require an explicit application's predicate.\n                if (\n                  requirement.alternatives.some(\n                    (alternative) =>\n                      alternative.minimumCredentials === 1 &&\n                      alternative.factors.every((factor) => factor === \"possession\"),\n                  )\n                ) {\n                  const profiles = signInProfiles.map((profile) =>\n                    Schema.encodeSync(profileJson)(profile),\n                  );\n\n                  alternatives.push(sql`exists(\n                  select 1 from ${table(\"passkeyCredentials\")} join ${table(\"credentials\")}\n                  on ${f.credentialId} = ${c.credentialId} and ${f.subjectId} = ${c.subjectId}\n                    and ${f.revision} = ${c.credentialRevision} and ${f.active} = ${true}\n                  where ${c.subjectId} = ${subjectId} and ${c.credentialId} <> ${excluded}\n                    and ${c.active} = ${true} and ${c.primarySignIn} = ${true}\n                    and ${c.enrollmentUserVerified} = ${true} and ${inArray(c.profile, profiles)}\n                )`);\n                }\n                if (\n                  passwordModules.length > 0 &&\n                  requirement.alternatives.some(\n                    (alternative) =>\n                      alternative.minimumCredentials === 1 &&\n                      !alternative.userVerified &&\n                      !alternative.phishingResistant &&\n                      alternative.factors.every((factor) => factor === \"knowledge\"),\n                  )\n                ) {\n                  const p = getTableColumns(table(\"passwords\"));\n                  const i = getTableColumns(table(\"identifiers\"));\n\n                  alternatives.push(sql`exists(\n                  select 1 from ${table(\"passwords\")} join ${table(\"credentials\")}\n                  on ${f.credentialId} = ${p.credentialId} and ${f.subjectId} = ${p.subjectId}\n                    and ${f.revision} = ${p.credentialRevision} and ${f.active} = ${true}\n                  join ${table(\"identifiers\")} on ${i.subjectId} = ${p.subjectId}\n                    and ${i.active} = ${true} and ${i.namespace} = 'email'\n                  where ${p.subjectId} = ${subjectId} and ${p.credentialId} <> ${excluded}\n                    and ${inArray(p.moduleId, passwordModules)}\n                )`);\n                }\n\n                return or(...alternatives) ?? sql`false`;\n              }).pipe(\n                Effect.mapError((cause) =>\n                  PersistenceMappingError.make({ operation: \"mapping\", cause }),\n                ),\n              ),\n          },\n        },\n        command: { ...mapped(\"passkeyCommands\"), encodeInsert: (input) => ({ ...input }) },\n        managementConstraints: requiredPasskeyManagementConstraints,\n        invalidation: {\n          window: {\n            trigger: \"credential-change\",\n            existingSessions: \"immediate\",\n            maximumExposureMillis: 0,\n            oldAuthenticationEvidence: \"rejected\",\n          },\n          mutations: [],\n          postcondition: ({ subjectId, securityRevision }) =>\n            sql`exists(select 1 from ${subject} where ${sc[s.id]} = ${subjectId} and ${sc[s.securityRevision]} = ${securityRevision})`,\n        },\n      };\n    };\n\n    return { read, base, management, table };\n  };\n\n  const make: Backend<object, never>[\"passkeys\"] = Effect.fn(\"AuthPersistence.passkeys\")(\n    function* ({ storage, namespace, dialect, features, passwordModules }) {\n      const client = yield* SqlClient.SqlClient;\n\n      const policies = yield* Effect.forEach(features, (feature) =>\n        Effect.gen(function* () {\n          const policy = yield* feature.policy;\n          const encoded = yield* Schema.encodeEffect(policyJson)(policy);\n\n          const policyRevision = yield* digest(\n            yield* Schema.encodeEffect(seedJson)({\n              policy,\n              ...(feature.managementPolicy === undefined\n                ? {}\n                : { management: feature.managementPolicy }),\n            }),\n          );\n\n          return { feature, policy, encoded, policyRevision };\n        }),\n      );\n\n      const m = yield* Effect.try({\n        try: () =>\n          mappings(\n            storage,\n            namespace,\n            dialect,\n            passwordModules,\n            policies.flatMap(({ feature, policy }) => (feature.management ? [] : policy.profiles)),\n          ),\n        catch: () => configurationError(\"Invalid passkey table mappings\"),\n      });\n\n      const configuration: PasskeyTargetConfiguration = {\n        mode: \"interactive\",\n        dialect,\n        locking: dialect === \"pg\",\n        standaloneGuard: () => requireStandalone(unavailable, client.transactionService),\n      };\n\n      const native = yield* CurrentProofSql;\n      const module = m.table(\"passkeyModules\");\n      const columns = getTableColumns(module);\n      const admission = m.table(\"passkeyAdmissions\");\n      const ac = getTableColumns(admission);\n\n      // Read live configuration on every acquisition. Matching modules and\n      // admission ownership need no initialization writes or advisory lock.\n      const configured = yield* native\n        .select({\n          moduleId: columns.moduleId,\n          active: columns.active,\n          policyRevision: columns.policyRevision,\n          // Predicate SQL preserves qualifiers through single-table projections.\n          admitted: sql`case when exists(select 1 from ${admission}\n            where ${and(eq(ac.authorityScope, namespace), eq(ac.moduleId, columns.moduleId))})\n              then 'present' else 'missing' end`,\n        })\n        .from(module)\n        .where(\n          inArray(\n            columns.moduleId,\n            policies.map(({ feature }) => feature.moduleId),\n          ),\n        )\n        .pipe(\n          Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(ConfiguredModuleRow))),\n          Effect.map((rows) =>\n            policies.every(({ feature, policyRevision }) =>\n              rows.some(\n                (row) =>\n                  row.moduleId === feature.moduleId &&\n                  row.active &&\n                  row.admitted === \"present\" &&\n                  row.policyRevision === policyRevision,\n              ),\n            ),\n          ),\n        );\n\n      if (!configured)\n        yield* client.withTransaction(\n          Effect.gen(function* () {\n            if (dialect === \"pg\")\n              yield* client`select pg_advisory_xact_lock(hashtext(${`${namespace}/passkeys`}))`;\n            for (const { feature, policy, encoded, policyRevision } of policies) {\n              yield* native\n                .insert(module)\n                .values({\n                  moduleId: feature.moduleId,\n                  active: true,\n                  policy: encoded,\n                  policyRevision,\n                })\n                .onConflictDoNothing();\n\n              const rows = yield* native\n                .select()\n                .from(module)\n                .where(eq(columns.moduleId, feature.moduleId));\n\n              const row = yield* Schema.decodeUnknownEffect(ModuleRow)(rows[0]);\n\n              if (!row.active)\n                return yield* configurationError(`Passkey module ${feature.moduleId} is disabled`);\n              if (row.policyRevision !== policyRevision) {\n                const previous = yield* Schema.decodeEffect(policyJson)(row.policy);\n\n                if (policy.generation <= previous.generation)\n                  return yield* configurationError(\n                    `Increase the passkey policy generation to change ${feature.moduleId}`,\n                  );\n                yield* native\n                  .update(module)\n                  .set({ policy: encoded, policyRevision })\n                  .where(\n                    and(\n                      eq(columns.moduleId, feature.moduleId),\n                      eq(columns.policyRevision, row.policyRevision),\n                      eq(columns.active, true),\n                    ),\n                  );\n\n                const updated = yield* native\n                  .select()\n                  .from(module)\n                  .where(eq(columns.moduleId, feature.moduleId));\n\n                const applied = yield* Schema.decodeUnknownEffect(ModuleRow)(updated[0]);\n\n                if (!applied.active || applied.policyRevision !== policyRevision)\n                  return yield* configurationError(\n                    `Passkey policy changed while configuring ${feature.moduleId}`,\n                  );\n              }\n              yield* native\n                .insert(m.table(\"passkeyAdmissions\"))\n                .values({\n                  authorityScope: namespace,\n                  moduleId: feature.moduleId,\n                  version: policyRevision,\n                  ownerMarker: policyRevision,\n                })\n                .onConflictDoNothing();\n            }\n          }),\n        );\n\n      const credential = yield* makeTargetPasskeyCredentials<ReadMapping, never>(\n        m.read,\n        configuration,\n      );\n\n      const persistence = new Map<string, PasskeyPersistence[\"Service\"]>();\n      const managers = new Map<string, PasskeyManagementPersistence[\"Service\"]>();\n      const enrollment = new Map<string, PasskeyEnrollmentContext[\"Service\"]>();\n\n      for (const feature of features) {\n        if (feature.management) {\n          const mapping = yield* Effect.try({\n            try: () => m.management(feature),\n            catch: () =>\n              configurationError(`Invalid passkey management mapping for ${feature.moduleId}`),\n          });\n\n          const services = yield* makeTargetPasskeyManagement<ManagementMapping, never>(\n            mapping,\n            configuration,\n          );\n\n          persistence.set(feature.moduleId, services.passkeyPersistence);\n          managers.set(feature.moduleId, services.passkeyManagementPersistence);\n          enrollment.set(\n            feature.moduleId,\n            (yield* makeTargetPasskeyEnrollmentContext<ManagementMapping, never>(\n              mapping,\n              configuration,\n            )).passkeyEnrollmentContext,\n          );\n        } else {\n          persistence.set(\n            feature.moduleId,\n            (yield* makeTargetPasskeyPersistence<BaseMapping, never>(\n              m.base(feature),\n              configuration,\n            )).passkeyPersistence,\n          );\n        }\n      }\n\n      const service = <A>(services: ReadonlyMap<string, A>, moduleId: string) => {\n        const value = services.get(moduleId);\n\n        return value === undefined ? Effect.fail(unavailable()) : Effect.succeed(value);\n      };\n\n      let context: Context.Context<never> = Context.make(\n        PasskeyCredentials,\n        credential.passkeyCredentials,\n      ).pipe(\n        Context.add(PasskeyPersistence, {\n          issue: (input, prepare) =>\n            Effect.flatMap(service(persistence, input.ceremony.moduleId), (s) =>\n              s.issue(input, prepare),\n            ),\n          context: (input) =>\n            Effect.flatMap(service(persistence, input.moduleId), (s) => s.context(input)),\n          claim: (input, prepare) =>\n            Effect.flatMap(service(persistence, input.ceremony.moduleId), (s) =>\n              s.claim(input, prepare),\n            ),\n          settle: (input, prepare) =>\n            Effect.flatMap(service(persistence, input.claim.ceremony.moduleId), (s) =>\n              s.settle(input, prepare),\n            ),\n          cleanup: (input, prepare) =>\n            Effect.flatMap(service(persistence, input.moduleId), (s) => s.cleanup(input, prepare)),\n        }),\n      );\n\n      if (managers.size > 0)\n        context = context.pipe(\n          Context.add(PasskeyEnrollmentContext, {\n            capture: (input) =>\n              Effect.flatMap(service(enrollment, input.moduleId), (s) => s.capture(input)),\n          }),\n          Context.add(PasskeyManagementPersistence, {\n            issueEnrollment: (input, prepare) =>\n              Effect.flatMap(service(managers, input.ceremony.moduleId), (s) =>\n                s.issueEnrollment(input, prepare),\n              ),\n            completeEnrollment: (input, prepare) =>\n              Effect.flatMap(service(managers, input.claim.ceremony.moduleId), (s) =>\n                s.completeEnrollment(input, prepare),\n              ),\n            list: (input) =>\n              Effect.flatMap(service(managers, input.moduleId), (s) => s.list(input)),\n            inspectRemove: (input) =>\n              Effect.flatMap(service(managers, input.moduleId), (s) => s.inspectRemove(input)),\n            rename: (input, prepare) =>\n              Effect.flatMap(service(managers, input.moduleId), (s) => s.rename(input, prepare)),\n            remove: (input, prepare) =>\n              Effect.flatMap(service(managers, input.moduleId), (s) => s.remove(input, prepare)),\n          }),\n        );\n\n      return context;\n    },\n    Effect.mapError((error) =>\n      Schema.is(PersistenceConfigurationError)(error)\n        ? error\n        : configurationError(\"Unable to configure passkey persistence\"),\n    ),\n  );\n\n  return make;\n};\n"],"mappings":";;;;;;;;;;;;;AAwCA,MAAM,cAAc,OAAO,eAAe,cAAc;AACxD,MAAM,aAAa,OAAO,eAAe,mBAAmB;AAE5D,MAAM,WAAW,OAAO,eACtB,OAAO,OAAO;CACZ,QAAQ;CACR,YAAY,OAAO,YAAY,uBAAuB;AACxD,CAAC,CACH;AAEA,MAAM,YAAY,OAAO,OAAO;CAC9B,QAAQ,OAAO;CACf,QAAQ,OAAO;CACf,gBAAgB,OAAO;AACzB,CAAC;AAED,MAAM,sBAAsB,OAAO,OAAO;CACxC,UAAU,OAAO;CACjB,QAAQ,OAAO;CACf,gBAAgB,OAAO;CACvB,UAAU,OAAO,SAAS,CAAC,WAAW,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,iBAAiB,kBAAkB,WACtC,EAAE,UAAU,WAAW,QAAQ,SAAS,GAAG,aAAa,MAC3D;AAEA,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;AACpD,MAAM,sBAAsB,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;;AAiC5F,MAAa,wBACX,eACuC;CACvC,MAAM,EAAE,KAAK,IAAI,iBAAiB,SAAS,IAAI,QAAQ;CACvD,MAAM,EAAE,QAAQ,gBAAgB,kBAAkB,UAAU;CAE5D,MAAM,EACJ,8BACA,oCACA,iCACE;CAEJ,MAAM,EAAE,gCAAgC;CAExC,MAAM,YACJ,SACA,WACA,SACA,iBACA,mBACG;EACH,MAAM,SAAS,SAAsB;GACnC,MAAM,QAAQ,QAAQ,OAAO;GAE7B,IAAI,UAAU,KAAA,GAAW,MAAM,mBAAmB,WAAW,KAAK,SAAS;GAG3E,OAAO;EACT;EAEA,MAAM,UAAoC,UAAgB;GACxD,OAAO,MAAM,IAAI;GACjB,GAAI,OAAO,YAAY,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;EAG1F;EAEA,MAAM,UAAU,MAAmB,QAAgB,gBAAgB,MAAM,IAAI,CAAC,CAAC,CAAC;EAChF,MAAM,IAAI,QAAQ;EAClB,MAAM,UAAU,EAAE;EAClB,MAAM,KAAK,gBAAgB,OAAO;EAClC,MAAM,UAAU,UAAmB,UAAU;EAC7C,MAAM,SAAS,UAAmB,UAAU;EAE5C,MAAM,OAAoB;GACxB,SAAS;IACP,OAAO;IACP,IAAI,EAAE;IACN,QAAQ,EAAE;IACV,kBAAkB,EAAE;IACpB,WAAW,QAAQ,IAAI,EAAE;IACzB,iBAAiB,UAAU,OAAO,GAAG,OAAO,EAAE,WAAW;IACzD,iBAAiB,GAAG,GAAG,EAAE,SAAS,EAAE,WAAW;GACjD;GACA,YAAY;IACV,GAAG,OAAO,oBAAoB;IAC9B,QAAQ;IACR,SAAS,QACP,OAAO,kBAAkB,cAAc,CAAC,CAAC;KACvC,GAAG;KACH,SAAS,OAAO,kBAAkB,WAAW,CAAC,CAAC,IAAI,OAAO;IAC5D,CAAC;IACH,kBAAkB,QAAQ,IAAI;IAC9B,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,sBAAsB,QAAQ,GAAG,IAAI;GAClE;GACA,WAAW;IACT,GAAG,OAAO,aAAa;IACvB,QAAQ;IACR,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,eAAe,QAAQ,GAAG,IAAI;GAC3D;GACA,qBAAqB;IACnB,GAAG,OAAO,kBAAkB;IAC5B,cAAc;IACd,gBAAgB,GAAG,OAAO,oBAAoB,OAAO,GAAG,OAAO;IAC/D,kBAAkB,QAAQ,IAAI;GAChC;GACA,iBAAiB;IACf,GAAG,OAAO,gBAAgB;IAC1B,cAAc;IACd,gBAAgB,GAAG,OAAO,kBAAkB,OAAO,GAAG,OAAO;IAC7D,kBAAkB,QAAQ,IAAI;GAChC;GACA,YAAY;IAAE,UAAU,EAAE;IAAc,WAAW,EAAE;IAAe,QAAQ,OAAO;GAAG;GACtF,aAAa;EACf;EAEA,MAAM,QAAQ,aAA0C;GACtD,UAAU,QAAQ;GAClB,gBAAgB;GAChB;GACA,QAAQ;IACN,GAAG,OAAO,gBAAgB;IAC1B,QAAQ;IACR,eAAe,CAAC,UAAU,gBAAgB;IAC1C,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,kBAAkB,QAAQ,GAAG,IAAI;IAC5D,qBAAqB,QAAQ,OAAO,kBAAkB,UAAU,CAAC,CAAC,IAAI,MAAM;GAC9E;GACA,MAAM;IACJ,GAAG,OAAO,cAAc;IACxB,QAAQ;KACN,SAAS;KACT,SAAS;KACT,UAAU;KACV,UAAU;KACV,WAAW;KACX,sBAAsB;KACtB,qBAAqB;IACvB;IACA,qBAAqB,CAAC;GACxB;GACA,WAAW,OAAO,mBAAmB;GACrC,QAAQ;IAAE,GAAG,OAAO,gBAAgB;IAAG,qBAAqB,CAAC;GAAG;GAChE,OAAO;IACL,eAAe,QAAQ;IACvB,eAAe,QAAQ;IACvB,iBACE,YAAY,OACR,GAAG,iEACH,GAAG;IACT,WAAW,eAAe;IAC1B,aAAa,eAAe;GAC9B;GACA,WAAW;IAAE,YAAY;IAAc,oBAAoB,UAAU;GAAM;GAC3E,aAAa;EACf;EAEA,MAAM,cAAc,YAA+C;GACjE,MAAM,SAAS,QAAQ;GAEvB,IAAI,WAAW,KAAA,GACb,MAAM,mBAAmB,yCAAyC,QAAQ,UAAU;GACtF,MAAM,IAAI,gBAAgB,MAAM,oBAAoB,CAAC;GACrD,MAAM,IAAI,gBAAgB,MAAM,aAAa,CAAC;GAE9C,MAAM,YAAY,cAChB,GAAG,wBAAwB,QAAQ,SAAS,GAAG,EAAE,IAAI,KAAK,UAAU,OAAO,GAAG,EAAE,QAAQ,KAAK,EAAE,YAAY;GAE7G,OAAO;IACL,GAAG,KAAK,OAAO;IACf,OAAO;KACL,YAAY;MACV,MAAM;MACN,WAAW;MACX,eAAe,EAAE,YAAY,WAAW,SAAS,cAAc;OAC7D,cAAc,WAAW;OACzB;OACA,MAAM,WAAW;OACjB,sBAAsB,WAAW;OACjC,YAAY,WAAW;OACvB,eAAe;OACf,WAAW;OACX,WAAW,WAAW;OACtB,WAAW,WAAW;OACtB,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC,WAAW,OAAO;OAC1D,oBAAoB;OACpB,QAAQ;OACR,eAAe,WAAW;OAC1B,wBAAwB,WAAW;OACnC,gBAAgB,WAAW;OAC3B,aAAa,WAAW;OACxB,SAAS,WAAW;OACpB,gBAAgB,WAAW;OAC3B,MAAM,QAAQ;OACd,WAAW,QAAQ,cAAc,QAAQ,eAAe;MAC1D;MACA,sBAAsB,UAAU;MAChC,+BAA+B,UAAU;MACzC,uBAAuB,UAAU;MACjC,cAAc;MACd,eAAe;KACjB;KACA,WAAW;MACT,eAAe,EAAE,WAAW,YAAY,cAAc;OACpD;OACA,cAAc,WAAW;OACzB,UAAU;OACV,QAAQ;MACV;MACA,cAAc;MACd,eAAe;KACjB;KACA,qBAAqB;MACnB,eAAe,EAAE,YAAY,cAAc;OACzC,eAAe;OACf,MAAM,WAAW;OACjB,sBAAsB,WAAW;OACjC,OAAO;OACP,SAAS;MACX;MACA,YAAY;MACZ,cAAc;KAChB;KACA,iBAAiB;MACf,eAAe,EAAE,WAAW,MAAM,YAAY,cAAc;OAC1D;OACA;OACA;OACA,WAAW;OACX,OAAO;OACP,SAAS;MACX;MACA,YAAY;KACd;KACA,QAAQ;MACN,gBAAgB,OAAO,KAAK,EAAE;MAC9B,kBAAkB;MAClB,aAAa,EAAE;MACf;MACA,QAAQ;MACR,kBAAkB,WAAW,UAAU,QACrC,OAAO,IAAI,aAAa;OACtB,MAAM,cAAc,OAAO,OAAO,oBAAoB,kBAAkB,CAAC,CACvE,OAAO,EAAE,aAAa,GAAG,CAC3B;OAEA,MAAM,eAAsB,CAAC;OAI7B,IACE,YAAY,aAAa,MACtB,gBACC,YAAY,uBAAuB,KACnC,YAAY,QAAQ,OAAO,WAAW,WAAW,YAAY,CACjE,GACA;QACA,MAAM,WAAW,eAAe,KAAK,YACnC,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,CACxC;QAEA,aAAa,KAAK,GAAG;kCACL,MAAM,oBAAoB,EAAE,QAAQ,MAAM,aAAa,EAAE;uBACpE,EAAE,aAAa,KAAK,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,EAAE,UAAU;0BACpE,EAAE,SAAS,KAAK,EAAE,mBAAmB,OAAO,EAAE,OAAO,KAAK,KAAK;0BAC/D,EAAE,UAAU,KAAK,UAAU,OAAO,EAAE,aAAa,MAAM,SAAS;0BAChE,EAAE,OAAO,KAAK,KAAK,OAAO,EAAE,cAAc,KAAK,KAAK;0BACpD,EAAE,uBAAuB,KAAK,KAAK,OAAO,QAAQ,EAAE,SAAS,QAAQ,EAAE;kBAC/E;OACF;OACA,IACE,gBAAgB,SAAS,KACzB,YAAY,aAAa,MACtB,gBACC,YAAY,uBAAuB,KACnC,CAAC,YAAY,gBACb,CAAC,YAAY,qBACb,YAAY,QAAQ,OAAO,WAAW,WAAW,WAAW,CAChE,GACA;QACA,MAAM,IAAI,gBAAgB,MAAM,WAAW,CAAC;QAC5C,MAAM,IAAI,gBAAgB,MAAM,aAAa,CAAC;QAE9C,aAAa,KAAK,GAAG;kCACL,MAAM,WAAW,EAAE,QAAQ,MAAM,aAAa,EAAE;uBAC3D,EAAE,aAAa,KAAK,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,EAAE,UAAU;0BACpE,EAAE,SAAS,KAAK,EAAE,mBAAmB,OAAO,EAAE,OAAO,KAAK,KAAK;yBAChE,MAAM,aAAa,EAAE,MAAM,EAAE,UAAU,KAAK,EAAE,UAAU;0BACvD,EAAE,OAAO,KAAK,KAAK,OAAO,EAAE,UAAU;0BACtC,EAAE,UAAU,KAAK,UAAU,OAAO,EAAE,aAAa,MAAM,SAAS;0BAChE,QAAQ,EAAE,UAAU,eAAe,EAAE;kBAC7C;OACF;OAEA,OAAO,GAAG,GAAG,YAAY,KAAK,GAAG;MACnC,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,wBAAwB,KAAK;OAAE,WAAW;OAAW;MAAM,CAAC,CAC9D,CACF;KACJ;IACF;IACA,SAAS;KAAE,GAAG,OAAO,iBAAiB;KAAG,eAAe,WAAW,EAAE,GAAG,MAAM;IAAG;IACjF,uBAAuB;IACvB,cAAc;KACZ,QAAQ;MACN,SAAS;MACT,kBAAkB;MAClB,uBAAuB;MACvB,2BAA2B;KAC7B;KACA,WAAW,CAAC;KACZ,gBAAgB,EAAE,WAAW,uBAC3B,GAAG,wBAAwB,QAAQ,SAAS,GAAG,EAAE,IAAI,KAAK,UAAU,OAAO,GAAG,EAAE,kBAAkB,KAAK,iBAAiB;IAC5H;GACF;EACF;EAEA,OAAO;GAAE;GAAM;GAAM;GAAY;EAAM;CACzC;CAkQA,OAhQiD,OAAO,GAAG,0BAA0B,CAAC,CACpF,WAAW,EAAE,SAAS,WAAW,SAAS,UAAU,mBAAmB;EACrE,MAAM,SAAS,OAAO,UAAU;EAEhC,MAAM,WAAW,OAAO,OAAO,QAAQ,WAAW,YAChD,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,QAAQ;GAY9B,OAAO;IAAE;IAAS;IAAQ,SAAA,OAXH,OAAO,aAAa,UAAU,CAAC,CAAC,MAAM;IAW1B,gBAAA,OATL,OAC5B,OAAO,OAAO,aAAa,QAAQ,CAAC,CAAC;KACnC;KACA,GAAI,QAAQ,qBAAqB,KAAA,IAC7B,CAAC,IACD,EAAE,YAAY,QAAQ,iBAAiB;IAC7C,CAAC,CACH;GAEkD;EACpD,CAAC,CACH;EAEA,MAAM,IAAI,OAAO,OAAO,IAAI;GAC1B,WACE,SACE,SACA,WACA,SACA,iBACA,SAAS,SAAS,EAAE,SAAS,aAAc,QAAQ,aAAa,CAAC,IAAI,OAAO,QAAS,CACvF;GACF,aAAa,mBAAmB,gCAAgC;EAClE,CAAC;EAED,MAAM,gBAA4C;GAChD,MAAM;GACN;GACA,SAAS,YAAY;GACrB,uBAAuB,kBAAkB,aAAa,OAAO,kBAAkB;EACjF;EAEA,MAAM,SAAS,OAAO;EACtB,MAAM,SAAS,EAAE,MAAM,gBAAgB;EACvC,MAAM,UAAU,gBAAgB,MAAM;EACtC,MAAM,YAAY,EAAE,MAAM,mBAAmB;EAC7C,MAAM,KAAK,gBAAgB,SAAS;EAoCpC,IAAI,EAAC,OAhCqB,OACvB,OAAO;GACN,UAAU,QAAQ;GAClB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GAExB,UAAU,GAAG,kCAAkC,UAAU;oBAC/C,IAAI,GAAG,GAAG,gBAAgB,SAAS,GAAG,GAAG,GAAG,UAAU,QAAQ,QAAQ,CAAC,EAAE;;EAErF,CAAC,CAAC,CACD,KAAK,MAAM,CAAC,CACZ,MACC,QACE,QAAQ,UACR,SAAS,KAAK,EAAE,cAAc,QAAQ,QAAQ,CAChD,CACF,CAAC,CACA,KACC,OAAO,QAAQ,OAAO,oBAAoB,OAAO,MAAM,mBAAmB,CAAC,CAAC,GAC5E,OAAO,KAAK,SACV,SAAS,OAAO,EAAE,SAAS,qBACzB,KAAK,MACF,QACC,IAAI,aAAa,QAAQ,YACzB,IAAI,UACJ,IAAI,aAAa,aACjB,IAAI,mBAAmB,cAC3B,CACF,CACF,CACF,IAGA,OAAO,OAAO,gBACZ,OAAO,IAAI,aAAa;GACtB,IAAI,YAAY,MACd,OAAO,MAAM,yCAAyC,GAAG,UAAU,WAAW;GAChF,KAAK,MAAM,EAAE,SAAS,QAAQ,SAAS,oBAAoB,UAAU;IACnE,OAAO,OACJ,OAAO,MAAM,CAAC,CACd,OAAO;KACN,UAAU,QAAQ;KAClB,QAAQ;KACR,QAAQ;KACR;IACF,CAAC,CAAC,CACD,oBAAoB;IAEvB,MAAM,OAAO,OAAO,OACjB,OAAO,CAAC,CACR,KAAK,MAAM,CAAC,CACZ,MAAM,GAAG,QAAQ,UAAU,QAAQ,QAAQ,CAAC;IAE/C,MAAM,MAAM,OAAO,OAAO,oBAAoB,SAAS,CAAC,CAAC,KAAK,EAAE;IAEhE,IAAI,CAAC,IAAI,QACP,OAAO,OAAO,mBAAmB,kBAAkB,QAAQ,SAAS,aAAa;IACnF,IAAI,IAAI,mBAAmB,gBAAgB;KACzC,MAAM,WAAW,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,IAAI,MAAM;KAElE,IAAI,OAAO,cAAc,SAAS,YAChC,OAAO,OAAO,mBACZ,oDAAoD,QAAQ,UAC9D;KACF,OAAO,OACJ,OAAO,MAAM,CAAC,CACd,IAAI;MAAE,QAAQ;MAAS;KAAe,CAAC,CAAC,CACxC,MACC,IACE,GAAG,QAAQ,UAAU,QAAQ,QAAQ,GACrC,GAAG,QAAQ,gBAAgB,IAAI,cAAc,GAC7C,GAAG,QAAQ,QAAQ,IAAI,CACzB,CACF;KAEF,MAAM,UAAU,OAAO,OACpB,OAAO,CAAC,CACR,KAAK,MAAM,CAAC,CACZ,MAAM,GAAG,QAAQ,UAAU,QAAQ,QAAQ,CAAC;KAE/C,MAAM,UAAU,OAAO,OAAO,oBAAoB,SAAS,CAAC,CAAC,QAAQ,EAAE;KAEvE,IAAI,CAAC,QAAQ,UAAU,QAAQ,mBAAmB,gBAChD,OAAO,OAAO,mBACZ,4CAA4C,QAAQ,UACtD;IACJ;IACA,OAAO,OACJ,OAAO,EAAE,MAAM,mBAAmB,CAAC,CAAC,CACpC,OAAO;KACN,gBAAgB;KAChB,UAAU,QAAQ;KAClB,SAAS;KACT,aAAa;IACf,CAAC,CAAC,CACD,oBAAoB;GACzB;EACF,CAAC,CACH;EAEF,MAAM,aAAa,OAAO,6BACxB,EAAE,MACF,aACF;EAEA,MAAM,8BAAc,IAAI,IAA2C;EACnE,MAAM,2BAAW,IAAI,IAAqD;EAC1E,MAAM,6BAAa,IAAI,IAAiD;EAExE,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,YAAY;GACtB,MAAM,UAAU,OAAO,OAAO,IAAI;IAChC,WAAW,EAAE,WAAW,OAAO;IAC/B,aACE,mBAAmB,0CAA0C,QAAQ,UAAU;GACnF,CAAC;GAED,MAAM,WAAW,OAAO,4BACtB,SACA,aACF;GAEA,YAAY,IAAI,QAAQ,UAAU,SAAS,kBAAkB;GAC7D,SAAS,IAAI,QAAQ,UAAU,SAAS,4BAA4B;GACpE,WAAW,IACT,QAAQ,WACP,OAAO,mCACN,SACA,aACF,EAAA,CAAG,wBACL;EACF,OACE,YAAY,IACV,QAAQ,WACP,OAAO,6BACN,EAAE,KAAK,OAAO,GACd,aACF,EAAA,CAAG,kBACL;EAIJ,MAAM,WAAc,UAAkC,aAAqB;GACzE,MAAM,QAAQ,SAAS,IAAI,QAAQ;GAEnC,OAAO,UAAU,KAAA,IAAY,OAAO,KAAK,YAAY,CAAC,IAAI,OAAO,QAAQ,KAAK;EAChF;EAEA,IAAI,UAAkC,QAAQ,KAC5C,oBACA,WAAW,kBACb,CAAC,CAAC,KACA,QAAQ,IAAI,oBAAoB;GAC9B,QAAQ,OAAO,YACb,OAAO,QAAQ,QAAQ,aAAa,MAAM,SAAS,QAAQ,IAAI,MAC7D,EAAE,MAAM,OAAO,OAAO,CACxB;GACF,UAAU,UACR,OAAO,QAAQ,QAAQ,aAAa,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,KAAK,CAAC;GAC9E,QAAQ,OAAO,YACb,OAAO,QAAQ,QAAQ,aAAa,MAAM,SAAS,QAAQ,IAAI,MAC7D,EAAE,MAAM,OAAO,OAAO,CACxB;GACF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,aAAa,MAAM,MAAM,SAAS,QAAQ,IAAI,MACnE,EAAE,OAAO,OAAO,OAAO,CACzB;GACF,UAAU,OAAO,YACf,OAAO,QAAQ,QAAQ,aAAa,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;EACzF,CAAC,CACH;EAEA,IAAI,SAAS,OAAO,GAClB,UAAU,QAAQ,KAChB,QAAQ,IAAI,0BAA0B,EACpC,UAAU,UACR,OAAO,QAAQ,QAAQ,YAAY,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,KAAK,CAAC,EAC/E,CAAC,GACD,QAAQ,IAAI,8BAA8B;GACxC,kBAAkB,OAAO,YACvB,OAAO,QAAQ,QAAQ,UAAU,MAAM,SAAS,QAAQ,IAAI,MAC1D,EAAE,gBAAgB,OAAO,OAAO,CAClC;GACF,qBAAqB,OAAO,YAC1B,OAAO,QAAQ,QAAQ,UAAU,MAAM,MAAM,SAAS,QAAQ,IAAI,MAChE,EAAE,mBAAmB,OAAO,OAAO,CACrC;GACF,OAAO,UACL,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,KAAK,KAAK,CAAC;GACxE,gBAAgB,UACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,cAAc,KAAK,CAAC;GACjF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;GACnF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;EACrF,CAAC,CACH;EAEF,OAAO;CACT,GACA,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,mBAAmB,yCAAyC,CAClE,CAGQ;AACZ"}

package/dist/internal/password-kernel.d.mts

@@ -203,8 +203,8 @@ export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFrag
       nativeSubjectId: any;
       subject: any;
       identifier: any;
-      credential?: never;
       snapshot?: never;
+      readonly credential?: never;
     } | {
       nativeSubjectId: any;
       subject: any;

package/dist/internal/persistence.d.mts

@@ -3,7 +3,7 @@ import { QueryOperations } from "./query-operations.mjs";
 import { CurrentProofSql } from "./proof-kernel.mjs";
 import { StorageTable } from "./storage-tables.mjs";
 import { MappingInput, PasskeyFeature, PersistenceApi, PersistenceConfigurationError } from "./configuration.mjs";
-import { Context, Effect } from "effect";
+import { Context, Crypto, Effect } from "effect";
 import { SqlClient } from "effect/sql";
 import { PasskeyConfig } from "@yielded/auth/Passkey";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
@@ -19,7 +19,7 @@ export interface Backend<T extends object, R> {
     readonly dialect: "pg" | "sqlite";
     readonly features: ReadonlyArray<PasskeyFeature>;
     readonly passwordModules: ReadonlyArray<string>;
-  }) => Effect.Effect<Context.Context<never>, PersistenceConfigurationError, PasskeyConfig | LifecycleHooks | SqlClient.SqlClient | NativeDatabase | CurrentProofSql>;
+  }) => Effect.Effect<Context.Context<never>, PersistenceConfigurationError, PasskeyConfig | LifecycleHooks | SqlClient.SqlClient | NativeDatabase | CurrentProofSql | Crypto.Crypto>;
 }
 export declare const createPersistence: <T extends object, R>(backend: Backend<T, R>) => PersistenceApi<T, R>;
 //#endregion

package/dist/internal/persistence.mjs

@@ -1,4 +1,5 @@
 import { PersistenceConfigurationError } from "./configuration.mjs";
+import { randomId } from "./crypto.mjs";
 import { PersistenceMappingError } from "./mapping-error.mjs";
 import { requireStandalone } from "./standalone.mjs";
 import { NativeDatabase, makeTransactionKernel } from "./transaction-kernel.mjs";
@@ -11,10 +12,9 @@ import { CurrentPhoneTransaction, makePhoneKernel } from "./phone-kernel.mjs";
 import { makeRegistrationAuthority } from "./registration.mjs";
 import { CurrentSessionSql, makeSessionKernel } from "./session-kernel.mjs";
 import { makeMappings } from "./storage-mapping.mjs";
-import { validateStorage } from "./storage-validation.mjs";
+import { validateStorageBatch, withStorageValidation } from "./storage-validation.mjs";
 import { Context, Effect, Layer, Schema } from "effect";
 import { SqlClient } from "effect/sql";
-import { digest, randomId } from "@yielded/auth-crypto";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
 import { AuthenticationAuthority, SessionUnavailable } from "@yielded/auth/Sessions";
 import { hooksLayer } from "@yielded/auth/Persistence";
@@ -87,7 +87,8 @@ const createPersistence = (backend) => {
 			]) if (description.columns[key] === void 0) throw configError(`Missing subject column ${key}`);
 			if (subject.activeValue === void 0) throw configError("An explicit active subject value is required");
 			if (idColumn === void 0 || idColumn.type === "boolean") throw configError("Subject ID must map a text or integer column");
-			const prefix = options.prefix ?? `auth_${digest(auth.namespace).slice(0, 12).replaceAll("-", "_")}`;
+			const prefix = options.prefix;
+			if (managed && (prefix === void 0 || !/^[A-Za-z_][A-Za-z0-9_]{0,100}$/.test(prefix))) throw configError("Managed persistence requires an explicit SQL table prefix");
 			const schema = { ...options.tables };
 			for (const role of roles) if (schema[role] === void 0 && managed) {
 				const definition = tableDefinition(role, `${prefix}_${role}`, idColumn.type);
@@ -144,16 +145,24 @@ const createPersistence = (backend) => {
 				if (auth.sessionMode !== "stateful") return yield* configError("The composed layer currently requires stateful sessions");
 				if (features.some((feature) => feature === void 0 || "lifecycle" in feature && feature.lifecycle || feature.kind === "email" && !feature.addresses)) return yield* configError("Use explicit services for strategies without composed persistence support");
 				if (storage.namespace !== auth.namespace) return yield* configError("Persistence configuration belongs to a different Auth definition");
+				const validations = [];
 				for (const role of roles) {
 					const table = storage.schema[role];
 					if (table === void 0) return yield* configError(`Missing ${role} table`);
 					const description = backend.describe(table);
 					const columns = description.columns;
 					for (const name of Object.keys(storageTables[role].columns)) if (columns[name] === void 0) return yield* configError(`Missing ${role}.${name} column`);
-					yield* validateStorage(dialect, description, storageTables[role].unique);
+					validations.push({
+						table: description,
+						required: storageTables[role].unique
+					});
 				}
-				yield* validateStorage(dialect, backend.describe(storage.subjects.table), [[storage.subjects.id]]);
-				const mappings = makeMappings(storage);
+				validations.push({
+					table: backend.describe(storage.subjects.table),
+					required: [[storage.subjects.id]]
+				});
+				yield* validateStorageBatch(dialect, validations);
+				const mappings = yield* makeMappings(storage);
 				const standalone = (error) => requireStandalone(error, client.transactionService);
 				const native = database;
 				const options = {
@@ -274,7 +283,7 @@ const createPersistence = (backend) => {
 					context = Context.merge(context, yield* services.pipe(Effect.provideService(NativeDatabase, native), Effect.provideService(CurrentProofSql, native)));
 				}
 				return context;
-			}).pipe(Effect.mapError((error) => Schema.is(PersistenceConfigurationError)(error) ? error : configError("Cannot acquire SQL persistence")))).pipe(Layer.provide(hooksLayer)),
+			}).pipe(withStorageValidation, Effect.mapError((error) => Schema.is(PersistenceConfigurationError)(error) ? error : configError("Cannot acquire SQL persistence")))).pipe(Layer.provide(hooksLayer)),
 			managed: (options) => layout(options, true),
 			map: (options) => layout(options, false)
 		};

package/dist/internal/persistence.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"persistence.mjs","names":[],"sources":["../../src/internal/persistence.ts"],"sourcesContent":["import { digest, randomId } from \"@yielded/auth-crypto\";\nimport { EmailAddressPersistence, EmailUnavailable } from \"@yielded/auth/Email\";\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport type { PasskeyConfig } from \"@yielded/auth/Passkey\";\nimport { PasswordPersistence, PasswordUnavailable } from \"@yielded/auth/Password\";\nimport { hooksLayer } from \"@yielded/auth/Persistence\";\nimport { PhoneAdmission, PhoneSignInTargets, PhoneOtpUnavailable } from \"@yielded/auth/PhoneOtp\";\nimport { ProofPersistence, ProofUnavailable } from \"@yielded/auth/Proofs\";\nimport { AuthenticationAuthority, SessionUnavailable } from \"@yielded/auth/Sessions\";\nimport { Context, Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport {\n  PersistenceConfigurationError,\n  type ClaimsCodec,\n  type ConfigId,\n  type Definition,\n  type PersistenceApi,\n  type Ports,\n  type Roles,\n  type Provisioning,\n  type ProvisioningRequirement,\n  type StorageLayout,\n  type SubjectMapping,\n  type SubjectOptions,\n  type PasskeyFeature,\n  type PasskeyRequirement,\n  type MappingInput,\n} from \"./configuration\";\nimport { makeEmailKernel, CurrentEmailSql, type EmailSqlDatabase } from \"./email-kernel\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n  makePasswordKernel,\n  CurrentPasswordSql,\n  type PasswordSqlDatabase,\n} from \"./password-kernel\";\nimport { makePhoneKernel, CurrentPhoneTransaction } from \"./phone-kernel\";\nimport {\n  makeProofKernel,\n  CurrentProofSql,\n  type ProofSqlDatabase,\n  type ProofSqlQuery,\n} from \"./proof-kernel\";\nimport type { QueryOperations } from \"./query-operations\";\nimport { makeRegistrationAuthority } from \"./registration\";\nimport { makeSessionKernel, CurrentSessionSql, type SessionSqlDatabase } from \"./session-kernel\";\nimport { requireStandalone } from \"./standalone\";\nimport { makeMappings } from \"./storage-mapping\";\nimport {\n  tableDefinition,\n  storageTables,\n  type StorageRole,\n  type StorageTable,\n} from \"./storage-tables\";\nimport { validateStorage } from \"./storage-validation\";\nimport { makeTransactionExecutionKernel } from \"./transaction-execution-kernel\";\nimport {\n  makeTransactionKernel,\n  NativeDatabase,\n  type TransactionNativeDatabase,\n} from \"./transaction-kernel\";\n\nexport interface Backend<T extends object, R> {\n  readonly makeTable: (definition: StorageTable) => T;\n  readonly describe: (table: T) => StorageTable;\n  readonly acquire: Effect.Effect<object, PersistenceConfigurationError, R | SqlClient.SqlClient>;\n  readonly operations: QueryOperations;\n  readonly passkeys: (input: {\n    readonly storage: MappingInput;\n    readonly namespace: string;\n    readonly dialect: \"pg\" | \"sqlite\";\n    readonly features: ReadonlyArray<PasskeyFeature>;\n    readonly passwordModules: ReadonlyArray<string>;\n  }) => Effect.Effect<\n    Context.Context<never>,\n    PersistenceConfigurationError,\n    PasskeyConfig | LifecycleHooks | SqlClient.SqlClient | NativeDatabase | CurrentProofSql\n  >;\n}\n\nconst configError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\nconst mappingError = (cause: unknown) =>\n  PersistenceMappingError.make({ operation: \"mapping\", cause });\n\nconst timestampKeys = new Set([\n  \"verifiedAt\",\n  \"createdAt\",\n  \"lastIssueAt\",\n  \"issuedAt\",\n  \"expiresAt\",\n  \"absoluteExpiresAt\",\n  \"retentionUntil\",\n  \"claimDeadline\",\n  \"retryAt\",\n  \"admittedAt\",\n  \"deadline\",\n  \"occurredAt\",\n  \"dedupUntil\",\n]);\n\nexport const createPersistence = <T extends object, R>(\n  backend: Backend<T, R>,\n): PersistenceApi<T, R> => {\n  const proofKernel = makeProofKernel(backend.operations);\n  const passwordKernel = makePasswordKernel(backend.operations, proofKernel);\n  const emailKernel = makeEmailKernel(backend.operations, proofKernel);\n  const sessionKernel = makeSessionKernel(backend.operations);\n  const transactionKernel = makeTransactionKernel(backend.operations);\n  const executionKernel = makeTransactionExecutionKernel(transactionKernel);\n  const phoneKernel = makePhoneKernel(backend.operations, transactionKernel);\n\n  const make = <C extends ClaimsCodec, const Id extends string, const A extends Definition<C, Id>>(\n    auth: A & Definition<C, Id>,\n  ) => {\n    const features = Object.values(auth.strategies).map((strategy) => strategy.persistence);\n    const phone = features.some((feature) => feature?.kind === \"phone\");\n    const password = features.some((feature) => feature?.kind === \"password\");\n\n    const passkeys = features.filter(\n      (feature): feature is PasskeyFeature => feature?.kind === \"passkey\",\n    );\n\n    const management = features.some(\n      (feature) => feature?.kind === \"password\" && feature.management,\n    );\n\n    const email = features.some((feature) => feature?.kind === \"email\" && feature.addresses);\n    const proofs = phone || management || email;\n\n    const roles: StorageRole[] = [\"identifiers\", \"credentials\", \"sessions\", \"sessionFlows\"];\n\n    if (password)\n      roles.push(\n        \"passwords\",\n        \"passwordAttempts\",\n        \"passwordScopes\",\n        \"passwordCharges\",\n        \"passwordCommands\",\n      );\n    if (management) roles.push(\"passwordRegistrations\");\n    if (email) roles.push(\"emailCredentials\", \"emailCommands\");\n    if (phone) roles.push(\"phoneState\");\n    if (passkeys.length > 0)\n      roles.push(\n        \"passkeyCredentials\",\n        \"passkeyOwnership\",\n        \"passkeyHandles\",\n        \"passkeyModules\",\n        \"passkeyFlows\",\n        \"passkeyAdmissions\",\n        \"passkeyCharges\",\n      );\n    if (passkeys.some((feature) => feature.management)) roles.push(\"passkeyCommands\");\n    if (proofs)\n      roles.push(\n        \"proofRequests\",\n        \"proofSeries\",\n        \"proofGenerations\",\n        \"proofContinuations\",\n        \"proofScopes\",\n        \"proofAbuse\",\n        \"proofFailures\",\n        \"proofCommands\",\n      );\n\n    const ConfigKey = Context.Service<\n      ConfigId<A[\"namespace\"]>,\n      StorageLayout<T, Roles<C, Id, A>>\n    >()(`@yielded/auth-persistence/${auth.namespace}/Config`);\n\n    const Config = Object.assign(ConfigKey, {\n      layer: (value: StorageLayout<T, Roles<C, Id, A>>) => Layer.succeed(ConfigKey, value),\n    });\n\n    const ProvisioningKey = Context.Service<ProvisioningRequirement<A>, Provisioning<A>>()(\n      `@yielded/auth-persistence/${auth.namespace}/Provisioning`,\n    );\n\n    const layout = <N, Instant>(\n      options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables?: Partial<Record<StorageRole, T>>;\n        readonly prefix?: string;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      },\n      managed: boolean,\n    ): StorageLayout<T, Roles<C, Id, A>> => {\n      const subject = options.subjects;\n\n      if (passkeys.length > 0 && options.timestamps !== undefined)\n        throw configError(\n          \"Composed passkey storage uses integer milliseconds; use an explicit passkey adapter for a custom timestamp representation\",\n        );\n      const description = backend.describe(subject.table);\n      const idColumn = description.columns[subject.id];\n\n      for (const key of [subject.id, subject.status, subject.securityRevision]) {\n        if (description.columns[key] === undefined)\n          throw configError(`Missing subject column ${key}`);\n      }\n      if (subject.activeValue === undefined)\n        throw configError(\"An explicit active subject value is required\");\n\n      if (idColumn === undefined || idColumn.type === \"boolean\")\n        throw configError(\"Subject ID must map a text or integer column\");\n\n      const prefix =\n        options.prefix ?? `auth_${digest(auth.namespace).slice(0, 12).replaceAll(\"-\", \"_\")}`;\n\n      const schema: Partial<Record<StorageRole, T>> = { ...options.tables };\n\n      for (const role of roles) {\n        if (schema[role] === undefined && managed) {\n          const definition = tableDefinition(role, `${prefix}_${role}`, idColumn.type);\n\n          const adjusted =\n            options.timestamps === undefined\n              ? definition\n              : {\n                  ...definition,\n                  columns: Object.fromEntries(\n                    Object.entries(definition.columns).map(([key, column]) => [\n                      key,\n                      timestampKeys.has(key)\n                        ? { ...column, type: options.timestamps?.type ?? column.type }\n                        : column,\n                    ]),\n                  ),\n                };\n\n          schema[role] = backend.makeTable(adjusted);\n        }\n      }\n      for (const role of roles) {\n        if (schema[role] === undefined) throw configError(`Missing ${role} table`);\n      }\n      const instantCodec = options.timestamps?.codec;\n\n      const decodeInstant =\n        instantCodec === undefined\n          ? Schema.decodeUnknownEffect(Schema.Int)\n          : Schema.decodeUnknownEffect(instantCodec);\n\n      const decodeInstantSync =\n        instantCodec === undefined\n          ? Schema.decodeUnknownSync(Schema.Int)\n          : Schema.decodeUnknownSync(instantCodec);\n\n      const subjects: SubjectMapping = {\n        table: subject.table,\n        id: subject.id,\n        status: subject.status,\n        securityRevision: subject.securityRevision,\n        activeValue: subject.activeValue,\n        requirements: subject.requirements,\n        actionRequirements: subject.actionRequirements ?? subject.requirements,\n        toSubject: (id) =>\n          Schema.decodeUnknownEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),\n        toNative: (id) =>\n          Schema.encodeEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),\n        toSubjectSync: Schema.decodeUnknownSync(subject.idCodec),\n        toNativeSync: Schema.encodeSync(subject.idCodec),\n      };\n\n      return Object.freeze({\n        namespace: auth.namespace,\n        schema: Object.freeze(schema) as Readonly<Record<Roles<C, Id, A>, T>>,\n        tables: schema,\n        subjects,\n        encodeInstant:\n          instantCodec === undefined ? (millis: number) => millis : Schema.encodeSync(instantCodec),\n        decodeInstant: (value: unknown) => decodeInstant(value).pipe(Effect.mapError(mappingError)),\n        decodeInstantSync,\n      });\n    };\n\n    const services = Layer.effectContext(\n      Effect.gen(function* () {\n        const storage = yield* ConfigKey;\n        const hooks = yield* LifecycleHooks;\n        const client = yield* SqlClient.SqlClient;\n        const database = yield* backend.acquire;\n\n        const dialect = client.onDialectOrElse({\n          pg: () => \"pg\" as const,\n          sqlite: () => \"sqlite\" as const,\n          orElse: () => undefined,\n        });\n\n        if (dialect === undefined)\n          return yield* configError(\"Use an explicit adapter for this SQL dialect\");\n        if (auth.sessionMode !== \"stateful\")\n          return yield* configError(\"The composed layer currently requires stateful sessions\");\n        if (\n          features.some(\n            (feature) =>\n              feature === undefined ||\n              (\"lifecycle\" in feature && feature.lifecycle) ||\n              (feature.kind === \"email\" && !feature.addresses),\n          )\n        )\n          return yield* configError(\n            \"Use explicit services for strategies without composed persistence support\",\n          );\n        if (storage.namespace !== auth.namespace)\n          return yield* configError(\n            \"Persistence configuration belongs to a different Auth definition\",\n          );\n        for (const role of roles) {\n          const table = (storage.schema as Partial<Record<StorageRole, T>>)[role];\n\n          if (table === undefined) return yield* configError(`Missing ${role} table`);\n          const description = backend.describe(table);\n          const columns = description.columns;\n\n          for (const name of Object.keys(storageTables[role].columns)) {\n            if (columns[name] === undefined)\n              return yield* configError(`Missing ${role}.${name} column`);\n          }\n          yield* validateStorage(dialect, description, storageTables[role].unique);\n        }\n        yield* validateStorage(dialect, backend.describe(storage.subjects.table as T), [\n          [storage.subjects.id],\n        ]);\n        const mappings = makeMappings(storage);\n\n        const standalone = <E>(error: () => E) =>\n          requireStandalone(error, client.transactionService);\n\n        // Backend validation owns the foreign query-builder shape, never the decoded rows.\n        const native = database as ProofSqlDatabase &\n          PasswordSqlDatabase &\n          EmailSqlDatabase &\n          SessionSqlDatabase &\n          TransactionNativeDatabase;\n\n        const options = {\n          mode: \"interactive\" as const,\n          locking: dialect === \"pg\",\n          standaloneGuard: standalone(() => SessionUnavailable.make({})),\n        };\n\n        const sessionMapping = mappings.sessions(auth.claims);\n\n        const sessionServices = yield* sessionKernel\n          .makeSqlStatefulSessions(sessionMapping, options)\n          .pipe(\n            Effect.provideService(CurrentSessionSql, native),\n            Effect.provideService(NativeDatabase, native),\n          );\n\n        const authority = yield* sessionKernel\n          .makeSqlAuthenticationAuthority<C[\"Type\"]>(\n            { ...mappings.authority(), isConstraintConflict: () => false },\n            options,\n          )\n          .pipe(\n            Effect.provideService(CurrentSessionSql, native),\n            Effect.provideService(NativeDatabase, native),\n          );\n\n        let context: Context.Context<never> = Context.make(AuthenticationAuthority, authority).pipe(\n          Context.add(\n            auth.sessions.StatefulSessionPersistence,\n            sessionServices.statefulSessionPersistence,\n          ),\n          Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository),\n        );\n\n        const proofConfiguration = proofs\n          ? {\n              mapping: mappings.proofs(),\n              configuration: {\n                mode: \"interactive\" as const,\n                locking: dialect === \"pg\",\n                standaloneGuard: standalone(() => ProofUnavailable.make({})),\n                insertIfAbsent: (query: ProofSqlQuery) => query.onConflictDoNothing(),\n              },\n            }\n          : undefined;\n\n        if (proofConfiguration !== undefined) {\n          context = Context.add(\n            context,\n            ProofPersistence,\n            yield* proofKernel\n              .makeSqlProofPersistence(proofConfiguration.mapping, proofConfiguration.configuration)\n              .pipe(\n                Effect.provideService(CurrentProofSql, native),\n                Effect.provideService(NativeDatabase, native),\n              ),\n          );\n        }\n\n        if (password) {\n          const persistence = yield* passwordKernel\n            .makeSqlPasswordPersistence(mappings.passwords(), {\n              mode: \"interactive\",\n              locking: dialect === \"pg\",\n              standaloneGuard: standalone(() => PasswordUnavailable.make({})),\n              insertIfAbsent: (query) => query.onConflictDoNothing(),\n              ...(proofConfiguration === undefined ? {} : { proof: proofConfiguration }),\n            })\n            .pipe(\n              Effect.provideService(CurrentPasswordSql, native),\n              Effect.provideService(NativeDatabase, native),\n            );\n\n          context = Context.add(context, PasswordPersistence, persistence);\n        }\n        for (const [name, strategy] of Object.entries(auth.strategies)) {\n          if (strategy.persistence?.kind !== \"password\" || !strategy.persistence.management)\n            continue;\n          const key = strategy.RegistrationAuthority;\n\n          if (key === undefined)\n            return yield* configError(`Missing subject provisioning for ${name}`);\n\n          const registration = yield* makeRegistrationAuthority(\n            mappings,\n            backend.operations,\n            standalone(() => PasswordUnavailable.make({})),\n            ProvisioningKey,\n            name,\n          ).pipe(Effect.provideService(CurrentPasswordSql, native));\n\n          context = Context.add(context, key, registration);\n        }\n        if (email) {\n          context = Context.add(\n            context,\n            EmailAddressPersistence,\n            yield* emailKernel\n              .makeSqlEmailAddressPersistence(mappings.emails(), {\n                mode: \"interactive\",\n                locking: dialect === \"pg\",\n                standaloneGuard: standalone(() => EmailUnavailable.make({})),\n                ...(proofConfiguration === undefined ? {} : { proof: proofConfiguration }),\n              })\n              .pipe(\n                Effect.provideService(CurrentEmailSql, native),\n                Effect.provideService(NativeDatabase, native),\n              ),\n          );\n        }\n        if (phone) {\n          const { column, eq } = backend.operations;\n\n          const mapping = (moduleId: string) => ({\n            moduleId,\n            subject: {\n              table: storage.subjects.table,\n              id: storage.subjects.id,\n              securityRevision: storage.subjects.securityRevision,\n              activeCondition: eq(\n                column(storage.subjects.table, storage.subjects.status),\n                storage.subjects.activeValue,\n              ),\n            },\n            subjectIds: {\n              toNative: storage.subjects.toNativeSync,\n              toSubject: storage.subjects.toSubjectSync,\n            },\n            identifier: {\n              table: mappings.table(\"identifiers\"),\n              namespace: \"namespace\",\n              value: \"value\",\n              subjectId: \"subjectId\",\n              revision: \"revision\",\n              verifiedAt: \"verifiedAt\",\n              activeCondition: eq(column(mappings.table(\"identifiers\"), \"active\"), true),\n            },\n            credential: {\n              table: mappings.table(\"credentials\"),\n              id: \"credentialId\",\n              subjectId: \"subjectId\",\n              revision: \"revision\",\n              activeCondition: eq(column(mappings.table(\"credentials\"), \"active\"), true),\n            },\n            state: {\n              table: mappings.table(\"phoneState\"),\n              scope: \"scope\",\n              state: \"state\",\n              version: \"version\",\n              encodeInsert: (row: object) => row,\n            },\n            admission: {\n              windowMillis: 60_000,\n              networkRequests: 10,\n              networkAttempts: 100,\n              maximumMessages: 10,\n              requestRetentionMillis: 86_400_000,\n            },\n            engineNowMillis: backend.operations\n              .sql`${dialect === \"pg\" ? backend.operations.sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)` : backend.operations.sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`}`,\n            encodeInstant: storage.encodeInstant,\n          });\n\n          const execution = yield* executionKernel\n            .makeTransactionExecution(\n              CurrentPhoneTransaction,\n              {\n                mode: \"interactive\",\n                dialect,\n                locking: dialect === \"pg\",\n                standaloneGuard: () => standalone(() => PhoneOtpUnavailable.make({})),\n              },\n              () => PhoneOtpUnavailable.make({}),\n              randomId,\n            )\n            .pipe(Effect.provideService(NativeDatabase, native));\n\n          const run = <Value, E, Requirements>(\n            work: Effect.Effect<Value, E, Requirements>,\n            mutation = true,\n          ) =>\n            execution.admit.pipe(\n              Effect.andThen(execution.run(work, mutation)),\n              Effect.provideService(LifecycleHooks, hooks),\n            );\n\n          const allowed = (moduleId: string) =>\n            features.some((feature) => feature?.kind === \"phone\" && feature.moduleId === moduleId);\n\n          const admission = PhoneAdmission.of({\n            admit: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.admitPhone(mapping(request.moduleId), request))\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n            cleanup: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.cleanupPhoneAdmission(mapping(request.moduleId), request))\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n          });\n\n          const targets = PhoneSignInTargets.of({\n            lookup: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.lookupPhone(mapping(request.moduleId), request), false)\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n          });\n\n          context = context.pipe(\n            Context.add(PhoneAdmission, admission),\n            Context.add(PhoneSignInTargets, targets),\n          );\n        }\n\n        if (passkeys.length > 0) {\n          // Auth capability metadata determines whether PasskeyConfig is required.\n          const services = backend.passkeys({\n            storage,\n            namespace: auth.namespace,\n            dialect,\n            features: passkeys,\n            passwordModules: features.flatMap((feature) =>\n              feature?.kind === \"password\" ? [feature.moduleId] : [],\n            ),\n          }) as Effect.Effect<\n            Context.Context<never>,\n            PersistenceConfigurationError,\n            | PasskeyRequirement<A>\n            | LifecycleHooks\n            | SqlClient.SqlClient\n            | NativeDatabase\n            | CurrentProofSql\n          >;\n\n          context = Context.merge(\n            context,\n            yield* services.pipe(\n              Effect.provideService(NativeDatabase, native),\n              Effect.provideService(CurrentProofSql, native),\n            ),\n          );\n        }\n\n        // The checked capability metadata above determines exactly these service keys.\n        return context as Context.Context<Ports<C, Id, A>>;\n      }).pipe(\n        Effect.mapError((error) =>\n          Schema.is(PersistenceConfigurationError)(error)\n            ? error\n            : configError(\"Cannot acquire SQL persistence\"),\n        ),\n      ),\n    ).pipe(Layer.provide(hooksLayer));\n\n    return {\n      Config,\n      Provisioning: ProvisioningKey,\n      layer: services,\n      managed: <N, Instant = number>(options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n        readonly prefix?: string;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      }) => layout(options, true),\n      map: <N, Instant = number>(options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables: Partial<Record<StorageRole, T>>;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      }) => layout(options, false),\n    };\n  };\n\n  return { make };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAgFA,MAAM,eAAe,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;AAErF,MAAM,gBAAgB,UACpB,wBAAwB,KAAK;CAAE,WAAW;CAAW;AAAM,CAAC;AAE9D,MAAM,gCAAgB,IAAI,IAAI;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAa,qBACX,YACyB;CACzB,MAAM,cAAc,gBAAgB,QAAQ,UAAU;CACtD,MAAM,iBAAiB,mBAAmB,QAAQ,YAAY,WAAW;CACzE,MAAM,cAAc,gBAAgB,QAAQ,YAAY,WAAW;CACnE,MAAM,gBAAgB,kBAAkB,QAAQ,UAAU;CAC1D,MAAM,oBAAoB,sBAAsB,QAAQ,UAAU;CAClE,MAAM,kBAAkB,+BAA+B,iBAAiB;CACxE,MAAM,cAAc,gBAAgB,QAAQ,YAAY,iBAAiB;CAEzE,MAAM,QACJ,SACG;EACH,MAAM,WAAW,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,KAAK,aAAa,SAAS,WAAW;EACtF,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,OAAO;EAClE,MAAM,WAAW,SAAS,MAAM,YAAY,SAAS,SAAS,UAAU;EAExE,MAAM,WAAW,SAAS,QACvB,YAAuC,SAAS,SAAS,SAC5D;EAEA,MAAM,aAAa,SAAS,MACzB,YAAY,SAAS,SAAS,cAAc,QAAQ,UACvD;EAEA,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,WAAW,QAAQ,SAAS;EACvF,MAAM,SAAS,SAAS,cAAc;EAEtC,MAAM,QAAuB;GAAC;GAAe;GAAe;GAAY;EAAc;EAEtF,IAAI,UACF,MAAM,KACJ,aACA,oBACA,kBACA,mBACA,kBACF;EACF,IAAI,YAAY,MAAM,KAAK,uBAAuB;EAClD,IAAI,OAAO,MAAM,KAAK,oBAAoB,eAAe;EACzD,IAAI,OAAO,MAAM,KAAK,YAAY;EAClC,IAAI,SAAS,SAAS,GACpB,MAAM,KACJ,sBACA,oBACA,kBACA,kBACA,gBACA,qBACA,gBACF;EACF,IAAI,SAAS,MAAM,YAAY,QAAQ,UAAU,GAAG,MAAM,KAAK,iBAAiB;EAChF,IAAI,QACF,MAAM,KACJ,iBACA,eACA,oBACA,sBACA,eACA,cACA,iBACA,eACF;EAEF,MAAM,YAAY,QAAQ,QAGxB,CAAC,CAAC,6BAA6B,KAAK,UAAU,QAAQ;EAExD,MAAM,SAAS,OAAO,OAAO,WAAW,EACtC,QAAQ,UAA6C,MAAM,QAAQ,WAAW,KAAK,EACrF,CAAC;EAED,MAAM,kBAAkB,QAAQ,QAAqD,CAAC,CACpF,6BAA6B,KAAK,UAAU,cAC9C;EAEA,MAAM,UACJ,SASA,YACsC;GACtC,MAAM,UAAU,QAAQ;GAExB,IAAI,SAAS,SAAS,KAAK,QAAQ,eAAe,KAAA,GAChD,MAAM,YACJ,2HACF;GACF,MAAM,cAAc,QAAQ,SAAS,QAAQ,KAAK;GAClD,MAAM,WAAW,YAAY,QAAQ,QAAQ;GAE7C,KAAK,MAAM,OAAO;IAAC,QAAQ;IAAI,QAAQ;IAAQ,QAAQ;GAAgB,GACrE,IAAI,YAAY,QAAQ,SAAS,KAAA,GAC/B,MAAM,YAAY,0BAA0B,KAAK;GAErD,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,MAAM,YAAY,8CAA8C;GAElE,IAAI,aAAa,KAAA,KAAa,SAAS,SAAS,WAC9C,MAAM,YAAY,8CAA8C;GAElE,MAAM,SACJ,QAAQ,UAAU,QAAQ,OAAO,KAAK,SAAS,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,WAAW,KAAK,GAAG;GAEnF,MAAM,SAA0C,EAAE,GAAG,QAAQ,OAAO;GAEpE,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,UAAU,KAAA,KAAa,SAAS;IACzC,MAAM,aAAa,gBAAgB,MAAM,GAAG,OAAO,GAAG,QAAQ,SAAS,IAAI;IAE3E,MAAM,WACJ,QAAQ,eAAe,KAAA,IACnB,aACA;KACE,GAAG;KACH,SAAS,OAAO,YACd,OAAO,QAAQ,WAAW,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CACxD,KACA,cAAc,IAAI,GAAG,IACjB;MAAE,GAAG;MAAQ,MAAM,QAAQ,YAAY,QAAQ,OAAO;KAAK,IAC3D,MACN,CAAC,CACH;IACF;IAEN,OAAO,QAAQ,QAAQ,UAAU,QAAQ;GAC3C;GAEF,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,UAAU,KAAA,GAAW,MAAM,YAAY,WAAW,KAAK,OAAO;GAE3E,MAAM,eAAe,QAAQ,YAAY;GAEzC,MAAM,gBACJ,iBAAiB,KAAA,IACb,OAAO,oBAAoB,OAAO,GAAG,IACrC,OAAO,oBAAoB,YAAY;GAE7C,MAAM,oBACJ,iBAAiB,KAAA,IACb,OAAO,kBAAkB,OAAO,GAAG,IACnC,OAAO,kBAAkB,YAAY;GAE3C,MAAM,WAA2B;IAC/B,OAAO,QAAQ;IACf,IAAI,QAAQ;IACZ,QAAQ,QAAQ;IAChB,kBAAkB,QAAQ;IAC1B,aAAa,QAAQ;IACrB,cAAc,QAAQ;IACtB,oBAAoB,QAAQ,sBAAsB,QAAQ;IAC1D,YAAY,OACV,OAAO,oBAAoB,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IACpF,WAAW,OACT,OAAO,aAAa,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IAC7E,eAAe,OAAO,kBAAkB,QAAQ,OAAO;IACvD,cAAc,OAAO,WAAW,QAAQ,OAAO;GACjD;GAEA,OAAO,OAAO,OAAO;IACnB,WAAW,KAAK;IAChB,QAAQ,OAAO,OAAO,MAAM;IAC5B,QAAQ;IACR;IACA,eACE,iBAAiB,KAAA,KAAa,WAAmB,SAAS,OAAO,WAAW,YAAY;IAC1F,gBAAgB,UAAmB,cAAc,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IAC1F;GACF,CAAC;EACH;EA0TA,OAAO;GACL;GACA,cAAc;GACd,OA3Te,MAAM,cACrB,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IACvB,MAAM,QAAQ,OAAO;IACrB,MAAM,SAAS,OAAO,UAAU;IAChC,MAAM,WAAW,OAAO,QAAQ;IAEhC,MAAM,UAAU,OAAO,gBAAgB;KACrC,UAAU;KACV,cAAc;KACd,cAAc,KAAA;IAChB,CAAC;IAED,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,YAAY,8CAA8C;IAC1E,IAAI,KAAK,gBAAgB,YACvB,OAAO,OAAO,YAAY,yDAAyD;IACrF,IACE,SAAS,MACN,YACC,YAAY,KAAA,KACX,eAAe,WAAW,QAAQ,aAClC,QAAQ,SAAS,WAAW,CAAC,QAAQ,SAC1C,GAEA,OAAO,OAAO,YACZ,2EACF;IACF,IAAI,QAAQ,cAAc,KAAK,WAC7B,OAAO,OAAO,YACZ,kEACF;IACF,KAAK,MAAM,QAAQ,OAAO;KACxB,MAAM,QAAS,QAAQ,OAA2C;KAElE,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,YAAY,WAAW,KAAK,OAAO;KAC1E,MAAM,cAAc,QAAQ,SAAS,KAAK;KAC1C,MAAM,UAAU,YAAY;KAE5B,KAAK,MAAM,QAAQ,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,GACxD,IAAI,QAAQ,UAAU,KAAA,GACpB,OAAO,OAAO,YAAY,WAAW,KAAK,GAAG,KAAK,QAAQ;KAE9D,OAAO,gBAAgB,SAAS,aAAa,cAAc,KAAK,CAAC,MAAM;IACzE;IACA,OAAO,gBAAgB,SAAS,QAAQ,SAAS,QAAQ,SAAS,KAAU,GAAG,CAC7E,CAAC,QAAQ,SAAS,EAAE,CACtB,CAAC;IACD,MAAM,WAAW,aAAa,OAAO;IAErC,MAAM,cAAiB,UACrB,kBAAkB,OAAO,OAAO,kBAAkB;IAGpD,MAAM,SAAS;IAMf,MAAM,UAAU;KACd,MAAM;KACN,SAAS,YAAY;KACrB,iBAAiB,iBAAiB,mBAAmB,KAAK,CAAC,CAAC,CAAC;IAC/D;IAEA,MAAM,iBAAiB,SAAS,SAAS,KAAK,MAAM;IAEpD,MAAM,kBAAkB,OAAO,cAC5B,wBAAwB,gBAAgB,OAAO,CAAC,CAChD,KACC,OAAO,eAAe,mBAAmB,MAAM,GAC/C,OAAO,eAAe,gBAAgB,MAAM,CAC9C;IAEF,MAAM,YAAY,OAAO,cACtB,+BACC;KAAE,GAAG,SAAS,UAAU;KAAG,4BAA4B;IAAM,GAC7D,OACF,CAAC,CACA,KACC,OAAO,eAAe,mBAAmB,MAAM,GAC/C,OAAO,eAAe,gBAAgB,MAAM,CAC9C;IAEF,IAAI,UAAkC,QAAQ,KAAK,yBAAyB,SAAS,CAAC,CAAC,KACrF,QAAQ,IACN,KAAK,SAAS,4BACd,gBAAgB,0BAClB,GACA,QAAQ,IAAI,KAAK,SAAS,mBAAmB,gBAAgB,iBAAiB,CAChF;IAEA,MAAM,qBAAqB,SACvB;KACE,SAAS,SAAS,OAAO;KACzB,eAAe;MACb,MAAM;MACN,SAAS,YAAY;MACrB,iBAAiB,iBAAiB,iBAAiB,KAAK,CAAC,CAAC,CAAC;MAC3D,iBAAiB,UAAyB,MAAM,oBAAoB;KACtE;IACF,IACA,KAAA;IAEJ,IAAI,uBAAuB,KAAA,GACzB,UAAU,QAAQ,IAChB,SACA,kBACA,OAAO,YACJ,wBAAwB,mBAAmB,SAAS,mBAAmB,aAAa,CAAC,CACrF,KACC,OAAO,eAAe,iBAAiB,MAAM,GAC7C,OAAO,eAAe,gBAAgB,MAAM,CAC9C,CACJ;IAGF,IAAI,UAAU;KACZ,MAAM,cAAc,OAAO,eACxB,2BAA2B,SAAS,UAAU,GAAG;MAChD,MAAM;MACN,SAAS,YAAY;MACrB,iBAAiB,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC;MAC9D,iBAAiB,UAAU,MAAM,oBAAoB;MACrD,GAAI,uBAAuB,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,mBAAmB;KAC1E,CAAC,CAAC,CACD,KACC,OAAO,eAAe,oBAAoB,MAAM,GAChD,OAAO,eAAe,gBAAgB,MAAM,CAC9C;KAEF,UAAU,QAAQ,IAAI,SAAS,qBAAqB,WAAW;IACjE;IACA,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,KAAK,UAAU,GAAG;KAC9D,IAAI,SAAS,aAAa,SAAS,cAAc,CAAC,SAAS,YAAY,YACrE;KACF,MAAM,MAAM,SAAS;KAErB,IAAI,QAAQ,KAAA,GACV,OAAO,OAAO,YAAY,oCAAoC,MAAM;KAEtE,MAAM,eAAe,OAAO,0BAC1B,UACA,QAAQ,YACR,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC,GAC7C,iBACA,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,MAAM,CAAC;KAExD,UAAU,QAAQ,IAAI,SAAS,KAAK,YAAY;IAClD;IACA,IAAI,OACF,UAAU,QAAQ,IAChB,SACA,yBACA,OAAO,YACJ,+BAA+B,SAAS,OAAO,GAAG;KACjD,MAAM;KACN,SAAS,YAAY;KACrB,iBAAiB,iBAAiB,iBAAiB,KAAK,CAAC,CAAC,CAAC;KAC3D,GAAI,uBAAuB,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,mBAAmB;IAC1E,CAAC,CAAC,CACD,KACC,OAAO,eAAe,iBAAiB,MAAM,GAC7C,OAAO,eAAe,gBAAgB,MAAM,CAC9C,CACJ;IAEF,IAAI,OAAO;KACT,MAAM,EAAE,QAAQ,OAAO,QAAQ;KAE/B,MAAM,WAAW,cAAsB;MACrC;MACA,SAAS;OACP,OAAO,QAAQ,SAAS;OACxB,IAAI,QAAQ,SAAS;OACrB,kBAAkB,QAAQ,SAAS;OACnC,iBAAiB,GACf,OAAO,QAAQ,SAAS,OAAO,QAAQ,SAAS,MAAM,GACtD,QAAQ,SAAS,WACnB;MACF;MACA,YAAY;OACV,UAAU,QAAQ,SAAS;OAC3B,WAAW,QAAQ,SAAS;MAC9B;MACA,YAAY;OACV,OAAO,SAAS,MAAM,aAAa;OACnC,WAAW;OACX,OAAO;OACP,WAAW;OACX,UAAU;OACV,YAAY;OACZ,iBAAiB,GAAG,OAAO,SAAS,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI;MAC3E;MACA,YAAY;OACV,OAAO,SAAS,MAAM,aAAa;OACnC,IAAI;OACJ,WAAW;OACX,UAAU;OACV,iBAAiB,GAAG,OAAO,SAAS,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI;MAC3E;MACA,OAAO;OACL,OAAO,SAAS,MAAM,YAAY;OAClC,OAAO;OACP,OAAO;OACP,SAAS;OACT,eAAe,QAAgB;MACjC;MACA,WAAW;OACT,cAAc;OACd,iBAAiB;OACjB,iBAAiB;OACjB,iBAAiB;OACjB,wBAAwB;MAC1B;MACA,iBAAiB,QAAQ,WACtB,GAAG,GAAG,YAAY,OAAO,QAAQ,WAAW,GAAG,iEAAiE,QAAQ,WAAW,GAAG;MACzI,eAAe,QAAQ;KACzB;KAEA,MAAM,YAAY,OAAO,gBACtB,yBACC,yBACA;MACE,MAAM;MACN;MACA,SAAS,YAAY;MACrB,uBAAuB,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC;KACtE,SACM,oBAAoB,KAAK,CAAC,CAAC,GACjC,QACF,CAAC,CACA,KAAK,OAAO,eAAe,gBAAgB,MAAM,CAAC;KAErD,MAAM,OACJ,MACA,WAAW,SAEX,UAAU,MAAM,KACd,OAAO,QAAQ,UAAU,IAAI,MAAM,QAAQ,CAAC,GAC5C,OAAO,eAAe,gBAAgB,KAAK,CAC7C;KAEF,MAAM,WAAW,aACf,SAAS,MAAM,YAAY,SAAS,SAAS,WAAW,QAAQ,aAAa,QAAQ;KAEvF,MAAM,YAAY,eAAe,GAAG;MAClC,QAAQ,YACN,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,WAAW,QAAQ,QAAQ,QAAQ,GAAG,OAAO,CAAC,IAC9D,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC;MAC9C,UAAU,YACR,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,sBAAsB,QAAQ,QAAQ,QAAQ,GAAG,OAAO,CAAC,IACzE,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC;KAChD,CAAC;KAED,MAAM,UAAU,mBAAmB,GAAG,EACpC,SAAS,YACP,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,YAAY,QAAQ,QAAQ,QAAQ,GAAG,OAAO,GAAG,KAAK,IACtE,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC,EAChD,CAAC;KAED,UAAU,QAAQ,KAChB,QAAQ,IAAI,gBAAgB,SAAS,GACrC,QAAQ,IAAI,oBAAoB,OAAO,CACzC;IACF;IAEA,IAAI,SAAS,SAAS,GAAG;KAEvB,MAAM,WAAW,QAAQ,SAAS;MAChC;MACA,WAAW,KAAK;MAChB;MACA,UAAU;MACV,iBAAiB,SAAS,SAAS,YACjC,SAAS,SAAS,aAAa,CAAC,QAAQ,QAAQ,IAAI,CAAC,CACvD;KACF,CAAC;KAUD,UAAU,QAAQ,MAChB,SACA,OAAO,SAAS,KACd,OAAO,eAAe,gBAAgB,MAAM,GAC5C,OAAO,eAAe,iBAAiB,MAAM,CAC/C,CACF;IACF;IAGA,OAAO;GACT,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,YAAY,gCAAgC,CAClD,CACF,CACF,CAAC,CAAC,KAAK,MAAM,QAAQ,UAAU,CAKf;GACd,UAA+B,YAQzB,OAAO,SAAS,IAAI;GAC1B,MAA2B,YAOrB,OAAO,SAAS,KAAK;EAC7B;CACF;CAEA,OAAO,EAAE,KAAK;AAChB"}
+{"version":3,"file":"persistence.mjs","names":[],"sources":["../../src/internal/persistence.ts"],"sourcesContent":["import { EmailAddressPersistence, EmailUnavailable } from \"@yielded/auth/Email\";\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport type { PasskeyConfig } from \"@yielded/auth/Passkey\";\nimport { PasswordPersistence, PasswordUnavailable } from \"@yielded/auth/Password\";\nimport { hooksLayer } from \"@yielded/auth/Persistence\";\nimport { PhoneAdmission, PhoneSignInTargets, PhoneOtpUnavailable } from \"@yielded/auth/PhoneOtp\";\nimport { ProofPersistence, ProofUnavailable } from \"@yielded/auth/Proofs\";\nimport { AuthenticationAuthority, SessionUnavailable } from \"@yielded/auth/Sessions\";\nimport { Context, type Crypto, Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport {\n  PersistenceConfigurationError,\n  type ClaimsCodec,\n  type ConfigId,\n  type Definition,\n  type PersistenceApi,\n  type Ports,\n  type Roles,\n  type Provisioning,\n  type ProvisioningRequirement,\n  type StorageLayout,\n  type SubjectMapping,\n  type SubjectOptions,\n  type PasskeyFeature,\n  type PasskeyRequirement,\n  type MappingInput,\n} from \"./configuration\";\nimport { randomId } from \"./crypto\";\nimport { makeEmailKernel, CurrentEmailSql, type EmailSqlDatabase } from \"./email-kernel\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n  makePasswordKernel,\n  CurrentPasswordSql,\n  type PasswordSqlDatabase,\n} from \"./password-kernel\";\nimport { makePhoneKernel, CurrentPhoneTransaction } from \"./phone-kernel\";\nimport {\n  makeProofKernel,\n  CurrentProofSql,\n  type ProofSqlDatabase,\n  type ProofSqlQuery,\n} from \"./proof-kernel\";\nimport type { QueryOperations } from \"./query-operations\";\nimport { makeRegistrationAuthority } from \"./registration\";\nimport { makeSessionKernel, CurrentSessionSql, type SessionSqlDatabase } from \"./session-kernel\";\nimport { requireStandalone } from \"./standalone\";\nimport { makeMappings } from \"./storage-mapping\";\nimport {\n  tableDefinition,\n  storageTables,\n  type StorageRole,\n  type StorageTable,\n} from \"./storage-tables\";\nimport {\n  validateStorageBatch,\n  withStorageValidation,\n  type StorageValidation,\n} from \"./storage-validation\";\nimport { makeTransactionExecutionKernel } from \"./transaction-execution-kernel\";\nimport {\n  makeTransactionKernel,\n  NativeDatabase,\n  type TransactionNativeDatabase,\n} from \"./transaction-kernel\";\n\nexport interface Backend<T extends object, R> {\n  readonly makeTable: (definition: StorageTable) => T;\n  readonly describe: (table: T) => StorageTable;\n  readonly acquire: Effect.Effect<object, PersistenceConfigurationError, R | SqlClient.SqlClient>;\n  readonly operations: QueryOperations;\n  readonly passkeys: (input: {\n    readonly storage: MappingInput;\n    readonly namespace: string;\n    readonly dialect: \"pg\" | \"sqlite\";\n    readonly features: ReadonlyArray<PasskeyFeature>;\n    readonly passwordModules: ReadonlyArray<string>;\n  }) => Effect.Effect<\n    Context.Context<never>,\n    PersistenceConfigurationError,\n    | PasskeyConfig\n    | LifecycleHooks\n    | SqlClient.SqlClient\n    | NativeDatabase\n    | CurrentProofSql\n    | Crypto.Crypto\n  >;\n}\n\nconst configError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\nconst mappingError = (cause: unknown) =>\n  PersistenceMappingError.make({ operation: \"mapping\", cause });\n\nconst timestampKeys = new Set([\n  \"verifiedAt\",\n  \"createdAt\",\n  \"lastIssueAt\",\n  \"issuedAt\",\n  \"expiresAt\",\n  \"absoluteExpiresAt\",\n  \"retentionUntil\",\n  \"claimDeadline\",\n  \"retryAt\",\n  \"admittedAt\",\n  \"deadline\",\n  \"occurredAt\",\n  \"dedupUntil\",\n]);\n\nexport const createPersistence = <T extends object, R>(\n  backend: Backend<T, R>,\n): PersistenceApi<T, R> => {\n  const proofKernel = makeProofKernel(backend.operations);\n  const passwordKernel = makePasswordKernel(backend.operations, proofKernel);\n  const emailKernel = makeEmailKernel(backend.operations, proofKernel);\n  const sessionKernel = makeSessionKernel(backend.operations);\n  const transactionKernel = makeTransactionKernel(backend.operations);\n  const executionKernel = makeTransactionExecutionKernel(transactionKernel);\n  const phoneKernel = makePhoneKernel(backend.operations, transactionKernel);\n\n  const make = <C extends ClaimsCodec, const Id extends string, const A extends Definition<C, Id>>(\n    auth: A & Definition<C, Id>,\n  ) => {\n    const features = Object.values(auth.strategies).map((strategy) => strategy.persistence);\n    const phone = features.some((feature) => feature?.kind === \"phone\");\n    const password = features.some((feature) => feature?.kind === \"password\");\n\n    const passkeys = features.filter(\n      (feature): feature is PasskeyFeature => feature?.kind === \"passkey\",\n    );\n\n    const management = features.some(\n      (feature) => feature?.kind === \"password\" && feature.management,\n    );\n\n    const email = features.some((feature) => feature?.kind === \"email\" && feature.addresses);\n    const proofs = phone || management || email;\n\n    const roles: StorageRole[] = [\"identifiers\", \"credentials\", \"sessions\", \"sessionFlows\"];\n\n    if (password)\n      roles.push(\n        \"passwords\",\n        \"passwordAttempts\",\n        \"passwordScopes\",\n        \"passwordCharges\",\n        \"passwordCommands\",\n      );\n    if (management) roles.push(\"passwordRegistrations\");\n    if (email) roles.push(\"emailCredentials\", \"emailCommands\");\n    if (phone) roles.push(\"phoneState\");\n    if (passkeys.length > 0)\n      roles.push(\n        \"passkeyCredentials\",\n        \"passkeyOwnership\",\n        \"passkeyHandles\",\n        \"passkeyModules\",\n        \"passkeyFlows\",\n        \"passkeyAdmissions\",\n        \"passkeyCharges\",\n      );\n    if (passkeys.some((feature) => feature.management)) roles.push(\"passkeyCommands\");\n    if (proofs)\n      roles.push(\n        \"proofRequests\",\n        \"proofSeries\",\n        \"proofGenerations\",\n        \"proofContinuations\",\n        \"proofScopes\",\n        \"proofAbuse\",\n        \"proofFailures\",\n        \"proofCommands\",\n      );\n\n    const ConfigKey = Context.Service<\n      ConfigId<A[\"namespace\"]>,\n      StorageLayout<T, Roles<C, Id, A>>\n    >()(`@yielded/auth-persistence/${auth.namespace}/Config`);\n\n    const Config = Object.assign(ConfigKey, {\n      layer: (value: StorageLayout<T, Roles<C, Id, A>>) => Layer.succeed(ConfigKey, value),\n    });\n\n    const ProvisioningKey = Context.Service<ProvisioningRequirement<A>, Provisioning<A>>()(\n      `@yielded/auth-persistence/${auth.namespace}/Provisioning`,\n    );\n\n    const layout = <N, Instant>(\n      options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables?: Partial<Record<StorageRole, T>>;\n        readonly prefix?: string;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      },\n      managed: boolean,\n    ): StorageLayout<T, Roles<C, Id, A>> => {\n      const subject = options.subjects;\n\n      if (passkeys.length > 0 && options.timestamps !== undefined)\n        throw configError(\n          \"Composed passkey storage uses integer milliseconds; use an explicit passkey adapter for a custom timestamp representation\",\n        );\n      const description = backend.describe(subject.table);\n      const idColumn = description.columns[subject.id];\n\n      for (const key of [subject.id, subject.status, subject.securityRevision]) {\n        if (description.columns[key] === undefined)\n          throw configError(`Missing subject column ${key}`);\n      }\n      if (subject.activeValue === undefined)\n        throw configError(\"An explicit active subject value is required\");\n\n      if (idColumn === undefined || idColumn.type === \"boolean\")\n        throw configError(\"Subject ID must map a text or integer column\");\n\n      const prefix = options.prefix;\n\n      if (managed && (prefix === undefined || !/^[A-Za-z_][A-Za-z0-9_]{0,100}$/.test(prefix)))\n        throw configError(\"Managed persistence requires an explicit SQL table prefix\");\n\n      const schema: Partial<Record<StorageRole, T>> = { ...options.tables };\n\n      for (const role of roles) {\n        if (schema[role] === undefined && managed) {\n          const definition = tableDefinition(role, `${prefix}_${role}`, idColumn.type);\n\n          const adjusted =\n            options.timestamps === undefined\n              ? definition\n              : {\n                  ...definition,\n                  columns: Object.fromEntries(\n                    Object.entries(definition.columns).map(([key, column]) => [\n                      key,\n                      timestampKeys.has(key)\n                        ? { ...column, type: options.timestamps?.type ?? column.type }\n                        : column,\n                    ]),\n                  ),\n                };\n\n          schema[role] = backend.makeTable(adjusted);\n        }\n      }\n      for (const role of roles) {\n        if (schema[role] === undefined) throw configError(`Missing ${role} table`);\n      }\n      const instantCodec = options.timestamps?.codec;\n\n      const decodeInstant =\n        instantCodec === undefined\n          ? Schema.decodeUnknownEffect(Schema.Int)\n          : Schema.decodeUnknownEffect(instantCodec);\n\n      const decodeInstantSync =\n        instantCodec === undefined\n          ? Schema.decodeUnknownSync(Schema.Int)\n          : Schema.decodeUnknownSync(instantCodec);\n\n      const subjects: SubjectMapping = {\n        table: subject.table,\n        id: subject.id,\n        status: subject.status,\n        securityRevision: subject.securityRevision,\n        activeValue: subject.activeValue,\n        requirements: subject.requirements,\n        actionRequirements: subject.actionRequirements ?? subject.requirements,\n        toSubject: (id) =>\n          Schema.decodeUnknownEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),\n        toNative: (id) =>\n          Schema.encodeEffect(subject.idCodec)(id).pipe(Effect.mapError(mappingError)),\n        toSubjectSync: Schema.decodeUnknownSync(subject.idCodec),\n        toNativeSync: Schema.encodeSync(subject.idCodec),\n      };\n\n      return Object.freeze({\n        namespace: auth.namespace,\n        schema: Object.freeze(schema) as Readonly<Record<Roles<C, Id, A>, T>>,\n        tables: schema,\n        subjects,\n        encodeInstant:\n          instantCodec === undefined ? (millis: number) => millis : Schema.encodeSync(instantCodec),\n        decodeInstant: (value: unknown) => decodeInstant(value).pipe(Effect.mapError(mappingError)),\n        decodeInstantSync,\n      });\n    };\n\n    const services = Layer.effectContext(\n      Effect.gen(function* () {\n        const storage = yield* ConfigKey;\n        const hooks = yield* LifecycleHooks;\n        const client = yield* SqlClient.SqlClient;\n        const database = yield* backend.acquire;\n\n        const dialect = client.onDialectOrElse({\n          pg: () => \"pg\" as const,\n          sqlite: () => \"sqlite\" as const,\n          orElse: () => undefined,\n        });\n\n        if (dialect === undefined)\n          return yield* configError(\"Use an explicit adapter for this SQL dialect\");\n        if (auth.sessionMode !== \"stateful\")\n          return yield* configError(\"The composed layer currently requires stateful sessions\");\n        if (\n          features.some(\n            (feature) =>\n              feature === undefined ||\n              (\"lifecycle\" in feature && feature.lifecycle) ||\n              (feature.kind === \"email\" && !feature.addresses),\n          )\n        )\n          return yield* configError(\n            \"Use explicit services for strategies without composed persistence support\",\n          );\n        if (storage.namespace !== auth.namespace)\n          return yield* configError(\n            \"Persistence configuration belongs to a different Auth definition\",\n          );\n        const validations: StorageValidation[] = [];\n\n        for (const role of roles) {\n          const table = (storage.schema as Partial<Record<StorageRole, T>>)[role];\n\n          if (table === undefined) return yield* configError(`Missing ${role} table`);\n          const description = backend.describe(table);\n          const columns = description.columns;\n\n          for (const name of Object.keys(storageTables[role].columns)) {\n            if (columns[name] === undefined)\n              return yield* configError(`Missing ${role}.${name} column`);\n          }\n          validations.push({ table: description, required: storageTables[role].unique });\n        }\n        validations.push({\n          table: backend.describe(storage.subjects.table as T),\n          required: [[storage.subjects.id]],\n        });\n        yield* validateStorageBatch(dialect, validations);\n        const mappings = yield* makeMappings(storage);\n\n        const standalone = <E>(error: () => E) =>\n          requireStandalone(error, client.transactionService);\n\n        // Backend validation owns the foreign query-builder shape, never the decoded rows.\n        const native = database as ProofSqlDatabase &\n          PasswordSqlDatabase &\n          EmailSqlDatabase &\n          SessionSqlDatabase &\n          TransactionNativeDatabase;\n\n        const options = {\n          mode: \"interactive\" as const,\n          locking: dialect === \"pg\",\n          standaloneGuard: standalone(() => SessionUnavailable.make({})),\n        };\n\n        const sessionMapping = mappings.sessions(auth.claims);\n\n        const sessionServices = yield* sessionKernel\n          .makeSqlStatefulSessions(sessionMapping, options)\n          .pipe(\n            Effect.provideService(CurrentSessionSql, native),\n            Effect.provideService(NativeDatabase, native),\n          );\n\n        const authority = yield* sessionKernel\n          .makeSqlAuthenticationAuthority<C[\"Type\"]>(\n            { ...mappings.authority(), isConstraintConflict: () => false },\n            options,\n          )\n          .pipe(\n            Effect.provideService(CurrentSessionSql, native),\n            Effect.provideService(NativeDatabase, native),\n          );\n\n        let context: Context.Context<never> = Context.make(AuthenticationAuthority, authority).pipe(\n          Context.add(\n            auth.sessions.StatefulSessionPersistence,\n            sessionServices.statefulSessionPersistence,\n          ),\n          Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository),\n        );\n\n        const proofConfiguration = proofs\n          ? {\n              mapping: mappings.proofs(),\n              configuration: {\n                mode: \"interactive\" as const,\n                locking: dialect === \"pg\",\n                standaloneGuard: standalone(() => ProofUnavailable.make({})),\n                insertIfAbsent: (query: ProofSqlQuery) => query.onConflictDoNothing(),\n              },\n            }\n          : undefined;\n\n        if (proofConfiguration !== undefined) {\n          context = Context.add(\n            context,\n            ProofPersistence,\n            yield* proofKernel\n              .makeSqlProofPersistence(proofConfiguration.mapping, proofConfiguration.configuration)\n              .pipe(\n                Effect.provideService(CurrentProofSql, native),\n                Effect.provideService(NativeDatabase, native),\n              ),\n          );\n        }\n\n        if (password) {\n          const persistence = yield* passwordKernel\n            .makeSqlPasswordPersistence(mappings.passwords(), {\n              mode: \"interactive\",\n              locking: dialect === \"pg\",\n              standaloneGuard: standalone(() => PasswordUnavailable.make({})),\n              insertIfAbsent: (query) => query.onConflictDoNothing(),\n              ...(proofConfiguration === undefined ? {} : { proof: proofConfiguration }),\n            })\n            .pipe(\n              Effect.provideService(CurrentPasswordSql, native),\n              Effect.provideService(NativeDatabase, native),\n            );\n\n          context = Context.add(context, PasswordPersistence, persistence);\n        }\n        for (const [name, strategy] of Object.entries(auth.strategies)) {\n          if (strategy.persistence?.kind !== \"password\" || !strategy.persistence.management)\n            continue;\n          const key = strategy.RegistrationAuthority;\n\n          if (key === undefined)\n            return yield* configError(`Missing subject provisioning for ${name}`);\n\n          const registration = yield* makeRegistrationAuthority(\n            mappings,\n            backend.operations,\n            standalone(() => PasswordUnavailable.make({})),\n            ProvisioningKey,\n            name,\n          ).pipe(Effect.provideService(CurrentPasswordSql, native));\n\n          context = Context.add(context, key, registration);\n        }\n        if (email) {\n          context = Context.add(\n            context,\n            EmailAddressPersistence,\n            yield* emailKernel\n              .makeSqlEmailAddressPersistence(mappings.emails(), {\n                mode: \"interactive\",\n                locking: dialect === \"pg\",\n                standaloneGuard: standalone(() => EmailUnavailable.make({})),\n                ...(proofConfiguration === undefined ? {} : { proof: proofConfiguration }),\n              })\n              .pipe(\n                Effect.provideService(CurrentEmailSql, native),\n                Effect.provideService(NativeDatabase, native),\n              ),\n          );\n        }\n        if (phone) {\n          const { column, eq } = backend.operations;\n\n          const mapping = (moduleId: string) => ({\n            moduleId,\n            subject: {\n              table: storage.subjects.table,\n              id: storage.subjects.id,\n              securityRevision: storage.subjects.securityRevision,\n              activeCondition: eq(\n                column(storage.subjects.table, storage.subjects.status),\n                storage.subjects.activeValue,\n              ),\n            },\n            subjectIds: {\n              toNative: storage.subjects.toNativeSync,\n              toSubject: storage.subjects.toSubjectSync,\n            },\n            identifier: {\n              table: mappings.table(\"identifiers\"),\n              namespace: \"namespace\",\n              value: \"value\",\n              subjectId: \"subjectId\",\n              revision: \"revision\",\n              verifiedAt: \"verifiedAt\",\n              activeCondition: eq(column(mappings.table(\"identifiers\"), \"active\"), true),\n            },\n            credential: {\n              table: mappings.table(\"credentials\"),\n              id: \"credentialId\",\n              subjectId: \"subjectId\",\n              revision: \"revision\",\n              activeCondition: eq(column(mappings.table(\"credentials\"), \"active\"), true),\n            },\n            state: {\n              table: mappings.table(\"phoneState\"),\n              scope: \"scope\",\n              state: \"state\",\n              version: \"version\",\n              encodeInsert: (row: object) => row,\n            },\n            admission: {\n              windowMillis: 60_000,\n              networkRequests: 10,\n              networkAttempts: 100,\n              maximumMessages: 10,\n              requestRetentionMillis: 86_400_000,\n            },\n            engineNowMillis: backend.operations\n              .sql`${dialect === \"pg\" ? backend.operations.sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)` : backend.operations.sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`}`,\n            encodeInstant: storage.encodeInstant,\n          });\n\n          const execution = yield* executionKernel\n            .makeTransactionExecution(\n              CurrentPhoneTransaction,\n              {\n                mode: \"interactive\",\n                dialect,\n                locking: dialect === \"pg\",\n                standaloneGuard: () => standalone(() => PhoneOtpUnavailable.make({})),\n              },\n              () => PhoneOtpUnavailable.make({}),\n              randomId,\n            )\n            .pipe(Effect.provideService(NativeDatabase, native));\n\n          const run = <Value, E, Requirements>(\n            work: Effect.Effect<Value, E, Requirements>,\n            mutation = true,\n          ) =>\n            execution.admit.pipe(\n              Effect.andThen(execution.run(work, mutation)),\n              Effect.provideService(LifecycleHooks, hooks),\n            );\n\n          const allowed = (moduleId: string) =>\n            features.some((feature) => feature?.kind === \"phone\" && feature.moduleId === moduleId);\n\n          const admission = PhoneAdmission.of({\n            admit: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.admitPhone(mapping(request.moduleId), request))\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n            cleanup: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.cleanupPhoneAdmission(mapping(request.moduleId), request))\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n          });\n\n          const targets = PhoneSignInTargets.of({\n            lookup: (request) =>\n              allowed(request.moduleId)\n                ? run(phoneKernel.lookupPhone(mapping(request.moduleId), request), false)\n                : Effect.fail(PhoneOtpUnavailable.make({})),\n          });\n\n          context = context.pipe(\n            Context.add(PhoneAdmission, admission),\n            Context.add(PhoneSignInTargets, targets),\n          );\n        }\n\n        if (passkeys.length > 0) {\n          // Auth capability metadata determines whether PasskeyConfig is required.\n          const services = backend.passkeys({\n            storage,\n            namespace: auth.namespace,\n            dialect,\n            features: passkeys,\n            passwordModules: features.flatMap((feature) =>\n              feature?.kind === \"password\" ? [feature.moduleId] : [],\n            ),\n          }) as Effect.Effect<\n            Context.Context<never>,\n            PersistenceConfigurationError,\n            | PasskeyRequirement<A>\n            | Crypto.Crypto\n            | LifecycleHooks\n            | SqlClient.SqlClient\n            | NativeDatabase\n            | CurrentProofSql\n          >;\n\n          context = Context.merge(\n            context,\n            yield* services.pipe(\n              Effect.provideService(NativeDatabase, native),\n              Effect.provideService(CurrentProofSql, native),\n            ),\n          );\n        }\n\n        // The checked capability metadata above determines exactly these service keys.\n        return context as Context.Context<Ports<C, Id, A>>;\n      }).pipe(\n        withStorageValidation,\n        Effect.mapError((error) =>\n          Schema.is(PersistenceConfigurationError)(error)\n            ? error\n            : configError(\"Cannot acquire SQL persistence\"),\n        ),\n      ),\n    ).pipe(Layer.provide(hooksLayer));\n\n    return {\n      Config,\n      Provisioning: ProvisioningKey,\n      layer: services,\n      managed: <N, Instant = number>(options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n        readonly prefix?: string;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      }) => layout(options, true),\n      map: <N, Instant = number>(options: {\n        readonly subjects: SubjectOptions<T, N>;\n        readonly tables: Partial<Record<StorageRole, T>>;\n        readonly timestamps?: {\n          readonly type: \"text\" | \"integer\";\n          readonly codec: Schema.Codec<number, Instant>;\n        };\n      }) => layout(options, false),\n    };\n  };\n\n  return { make };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAyFA,MAAM,eAAe,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;AAErF,MAAM,gBAAgB,UACpB,wBAAwB,KAAK;CAAE,WAAW;CAAW;AAAM,CAAC;AAE9D,MAAM,gCAAgB,IAAI,IAAI;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAa,qBACX,YACyB;CACzB,MAAM,cAAc,gBAAgB,QAAQ,UAAU;CACtD,MAAM,iBAAiB,mBAAmB,QAAQ,YAAY,WAAW;CACzE,MAAM,cAAc,gBAAgB,QAAQ,YAAY,WAAW;CACnE,MAAM,gBAAgB,kBAAkB,QAAQ,UAAU;CAC1D,MAAM,oBAAoB,sBAAsB,QAAQ,UAAU;CAClE,MAAM,kBAAkB,+BAA+B,iBAAiB;CACxE,MAAM,cAAc,gBAAgB,QAAQ,YAAY,iBAAiB;CAEzE,MAAM,QACJ,SACG;EACH,MAAM,WAAW,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,KAAK,aAAa,SAAS,WAAW;EACtF,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,OAAO;EAClE,MAAM,WAAW,SAAS,MAAM,YAAY,SAAS,SAAS,UAAU;EAExE,MAAM,WAAW,SAAS,QACvB,YAAuC,SAAS,SAAS,SAC5D;EAEA,MAAM,aAAa,SAAS,MACzB,YAAY,SAAS,SAAS,cAAc,QAAQ,UACvD;EAEA,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,WAAW,QAAQ,SAAS;EACvF,MAAM,SAAS,SAAS,cAAc;EAEtC,MAAM,QAAuB;GAAC;GAAe;GAAe;GAAY;EAAc;EAEtF,IAAI,UACF,MAAM,KACJ,aACA,oBACA,kBACA,mBACA,kBACF;EACF,IAAI,YAAY,MAAM,KAAK,uBAAuB;EAClD,IAAI,OAAO,MAAM,KAAK,oBAAoB,eAAe;EACzD,IAAI,OAAO,MAAM,KAAK,YAAY;EAClC,IAAI,SAAS,SAAS,GACpB,MAAM,KACJ,sBACA,oBACA,kBACA,kBACA,gBACA,qBACA,gBACF;EACF,IAAI,SAAS,MAAM,YAAY,QAAQ,UAAU,GAAG,MAAM,KAAK,iBAAiB;EAChF,IAAI,QACF,MAAM,KACJ,iBACA,eACA,oBACA,sBACA,eACA,cACA,iBACA,eACF;EAEF,MAAM,YAAY,QAAQ,QAGxB,CAAC,CAAC,6BAA6B,KAAK,UAAU,QAAQ;EAExD,MAAM,SAAS,OAAO,OAAO,WAAW,EACtC,QAAQ,UAA6C,MAAM,QAAQ,WAAW,KAAK,EACrF,CAAC;EAED,MAAM,kBAAkB,QAAQ,QAAqD,CAAC,CACpF,6BAA6B,KAAK,UAAU,cAC9C;EAEA,MAAM,UACJ,SASA,YACsC;GACtC,MAAM,UAAU,QAAQ;GAExB,IAAI,SAAS,SAAS,KAAK,QAAQ,eAAe,KAAA,GAChD,MAAM,YACJ,2HACF;GACF,MAAM,cAAc,QAAQ,SAAS,QAAQ,KAAK;GAClD,MAAM,WAAW,YAAY,QAAQ,QAAQ;GAE7C,KAAK,MAAM,OAAO;IAAC,QAAQ;IAAI,QAAQ;IAAQ,QAAQ;GAAgB,GACrE,IAAI,YAAY,QAAQ,SAAS,KAAA,GAC/B,MAAM,YAAY,0BAA0B,KAAK;GAErD,IAAI,QAAQ,gBAAgB,KAAA,GAC1B,MAAM,YAAY,8CAA8C;GAElE,IAAI,aAAa,KAAA,KAAa,SAAS,SAAS,WAC9C,MAAM,YAAY,8CAA8C;GAElE,MAAM,SAAS,QAAQ;GAEvB,IAAI,YAAY,WAAW,KAAA,KAAa,CAAC,iCAAiC,KAAK,MAAM,IACnF,MAAM,YAAY,2DAA2D;GAE/E,MAAM,SAA0C,EAAE,GAAG,QAAQ,OAAO;GAEpE,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,UAAU,KAAA,KAAa,SAAS;IACzC,MAAM,aAAa,gBAAgB,MAAM,GAAG,OAAO,GAAG,QAAQ,SAAS,IAAI;IAE3E,MAAM,WACJ,QAAQ,eAAe,KAAA,IACnB,aACA;KACE,GAAG;KACH,SAAS,OAAO,YACd,OAAO,QAAQ,WAAW,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CACxD,KACA,cAAc,IAAI,GAAG,IACjB;MAAE,GAAG;MAAQ,MAAM,QAAQ,YAAY,QAAQ,OAAO;KAAK,IAC3D,MACN,CAAC,CACH;IACF;IAEN,OAAO,QAAQ,QAAQ,UAAU,QAAQ;GAC3C;GAEF,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,UAAU,KAAA,GAAW,MAAM,YAAY,WAAW,KAAK,OAAO;GAE3E,MAAM,eAAe,QAAQ,YAAY;GAEzC,MAAM,gBACJ,iBAAiB,KAAA,IACb,OAAO,oBAAoB,OAAO,GAAG,IACrC,OAAO,oBAAoB,YAAY;GAE7C,MAAM,oBACJ,iBAAiB,KAAA,IACb,OAAO,kBAAkB,OAAO,GAAG,IACnC,OAAO,kBAAkB,YAAY;GAE3C,MAAM,WAA2B;IAC/B,OAAO,QAAQ;IACf,IAAI,QAAQ;IACZ,QAAQ,QAAQ;IAChB,kBAAkB,QAAQ;IAC1B,aAAa,QAAQ;IACrB,cAAc,QAAQ;IACtB,oBAAoB,QAAQ,sBAAsB,QAAQ;IAC1D,YAAY,OACV,OAAO,oBAAoB,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IACpF,WAAW,OACT,OAAO,aAAa,QAAQ,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IAC7E,eAAe,OAAO,kBAAkB,QAAQ,OAAO;IACvD,cAAc,OAAO,WAAW,QAAQ,OAAO;GACjD;GAEA,OAAO,OAAO,OAAO;IACnB,WAAW,KAAK;IAChB,QAAQ,OAAO,OAAO,MAAM;IAC5B,QAAQ;IACR;IACA,eACE,iBAAiB,KAAA,KAAa,WAAmB,SAAS,OAAO,WAAW,YAAY;IAC1F,gBAAgB,UAAmB,cAAc,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,CAAC;IAC1F;GACF,CAAC;EACH;EAgUA,OAAO;GACL;GACA,cAAc;GACd,OAjUe,MAAM,cACrB,OAAO,IAAI,aAAa;IACtB,MAAM,UAAU,OAAO;IACvB,MAAM,QAAQ,OAAO;IACrB,MAAM,SAAS,OAAO,UAAU;IAChC,MAAM,WAAW,OAAO,QAAQ;IAEhC,MAAM,UAAU,OAAO,gBAAgB;KACrC,UAAU;KACV,cAAc;KACd,cAAc,KAAA;IAChB,CAAC;IAED,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,YAAY,8CAA8C;IAC1E,IAAI,KAAK,gBAAgB,YACvB,OAAO,OAAO,YAAY,yDAAyD;IACrF,IACE,SAAS,MACN,YACC,YAAY,KAAA,KACX,eAAe,WAAW,QAAQ,aAClC,QAAQ,SAAS,WAAW,CAAC,QAAQ,SAC1C,GAEA,OAAO,OAAO,YACZ,2EACF;IACF,IAAI,QAAQ,cAAc,KAAK,WAC7B,OAAO,OAAO,YACZ,kEACF;IACF,MAAM,cAAmC,CAAC;IAE1C,KAAK,MAAM,QAAQ,OAAO;KACxB,MAAM,QAAS,QAAQ,OAA2C;KAElE,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,YAAY,WAAW,KAAK,OAAO;KAC1E,MAAM,cAAc,QAAQ,SAAS,KAAK;KAC1C,MAAM,UAAU,YAAY;KAE5B,KAAK,MAAM,QAAQ,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,GACxD,IAAI,QAAQ,UAAU,KAAA,GACpB,OAAO,OAAO,YAAY,WAAW,KAAK,GAAG,KAAK,QAAQ;KAE9D,YAAY,KAAK;MAAE,OAAO;MAAa,UAAU,cAAc,KAAK,CAAC;KAAO,CAAC;IAC/E;IACA,YAAY,KAAK;KACf,OAAO,QAAQ,SAAS,QAAQ,SAAS,KAAU;KACnD,UAAU,CAAC,CAAC,QAAQ,SAAS,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,qBAAqB,SAAS,WAAW;IAChD,MAAM,WAAW,OAAO,aAAa,OAAO;IAE5C,MAAM,cAAiB,UACrB,kBAAkB,OAAO,OAAO,kBAAkB;IAGpD,MAAM,SAAS;IAMf,MAAM,UAAU;KACd,MAAM;KACN,SAAS,YAAY;KACrB,iBAAiB,iBAAiB,mBAAmB,KAAK,CAAC,CAAC,CAAC;IAC/D;IAEA,MAAM,iBAAiB,SAAS,SAAS,KAAK,MAAM;IAEpD,MAAM,kBAAkB,OAAO,cAC5B,wBAAwB,gBAAgB,OAAO,CAAC,CAChD,KACC,OAAO,eAAe,mBAAmB,MAAM,GAC/C,OAAO,eAAe,gBAAgB,MAAM,CAC9C;IAEF,MAAM,YAAY,OAAO,cACtB,+BACC;KAAE,GAAG,SAAS,UAAU;KAAG,4BAA4B;IAAM,GAC7D,OACF,CAAC,CACA,KACC,OAAO,eAAe,mBAAmB,MAAM,GAC/C,OAAO,eAAe,gBAAgB,MAAM,CAC9C;IAEF,IAAI,UAAkC,QAAQ,KAAK,yBAAyB,SAAS,CAAC,CAAC,KACrF,QAAQ,IACN,KAAK,SAAS,4BACd,gBAAgB,0BAClB,GACA,QAAQ,IAAI,KAAK,SAAS,mBAAmB,gBAAgB,iBAAiB,CAChF;IAEA,MAAM,qBAAqB,SACvB;KACE,SAAS,SAAS,OAAO;KACzB,eAAe;MACb,MAAM;MACN,SAAS,YAAY;MACrB,iBAAiB,iBAAiB,iBAAiB,KAAK,CAAC,CAAC,CAAC;MAC3D,iBAAiB,UAAyB,MAAM,oBAAoB;KACtE;IACF,IACA,KAAA;IAEJ,IAAI,uBAAuB,KAAA,GACzB,UAAU,QAAQ,IAChB,SACA,kBACA,OAAO,YACJ,wBAAwB,mBAAmB,SAAS,mBAAmB,aAAa,CAAC,CACrF,KACC,OAAO,eAAe,iBAAiB,MAAM,GAC7C,OAAO,eAAe,gBAAgB,MAAM,CAC9C,CACJ;IAGF,IAAI,UAAU;KACZ,MAAM,cAAc,OAAO,eACxB,2BAA2B,SAAS,UAAU,GAAG;MAChD,MAAM;MACN,SAAS,YAAY;MACrB,iBAAiB,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC;MAC9D,iBAAiB,UAAU,MAAM,oBAAoB;MACrD,GAAI,uBAAuB,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,mBAAmB;KAC1E,CAAC,CAAC,CACD,KACC,OAAO,eAAe,oBAAoB,MAAM,GAChD,OAAO,eAAe,gBAAgB,MAAM,CAC9C;KAEF,UAAU,QAAQ,IAAI,SAAS,qBAAqB,WAAW;IACjE;IACA,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,KAAK,UAAU,GAAG;KAC9D,IAAI,SAAS,aAAa,SAAS,cAAc,CAAC,SAAS,YAAY,YACrE;KACF,MAAM,MAAM,SAAS;KAErB,IAAI,QAAQ,KAAA,GACV,OAAO,OAAO,YAAY,oCAAoC,MAAM;KAEtE,MAAM,eAAe,OAAO,0BAC1B,UACA,QAAQ,YACR,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC,GAC7C,iBACA,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,oBAAoB,MAAM,CAAC;KAExD,UAAU,QAAQ,IAAI,SAAS,KAAK,YAAY;IAClD;IACA,IAAI,OACF,UAAU,QAAQ,IAChB,SACA,yBACA,OAAO,YACJ,+BAA+B,SAAS,OAAO,GAAG;KACjD,MAAM;KACN,SAAS,YAAY;KACrB,iBAAiB,iBAAiB,iBAAiB,KAAK,CAAC,CAAC,CAAC;KAC3D,GAAI,uBAAuB,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,mBAAmB;IAC1E,CAAC,CAAC,CACD,KACC,OAAO,eAAe,iBAAiB,MAAM,GAC7C,OAAO,eAAe,gBAAgB,MAAM,CAC9C,CACJ;IAEF,IAAI,OAAO;KACT,MAAM,EAAE,QAAQ,OAAO,QAAQ;KAE/B,MAAM,WAAW,cAAsB;MACrC;MACA,SAAS;OACP,OAAO,QAAQ,SAAS;OACxB,IAAI,QAAQ,SAAS;OACrB,kBAAkB,QAAQ,SAAS;OACnC,iBAAiB,GACf,OAAO,QAAQ,SAAS,OAAO,QAAQ,SAAS,MAAM,GACtD,QAAQ,SAAS,WACnB;MACF;MACA,YAAY;OACV,UAAU,QAAQ,SAAS;OAC3B,WAAW,QAAQ,SAAS;MAC9B;MACA,YAAY;OACV,OAAO,SAAS,MAAM,aAAa;OACnC,WAAW;OACX,OAAO;OACP,WAAW;OACX,UAAU;OACV,YAAY;OACZ,iBAAiB,GAAG,OAAO,SAAS,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI;MAC3E;MACA,YAAY;OACV,OAAO,SAAS,MAAM,aAAa;OACnC,IAAI;OACJ,WAAW;OACX,UAAU;OACV,iBAAiB,GAAG,OAAO,SAAS,MAAM,aAAa,GAAG,QAAQ,GAAG,IAAI;MAC3E;MACA,OAAO;OACL,OAAO,SAAS,MAAM,YAAY;OAClC,OAAO;OACP,OAAO;OACP,SAAS;OACT,eAAe,QAAgB;MACjC;MACA,WAAW;OACT,cAAc;OACd,iBAAiB;OACjB,iBAAiB;OACjB,iBAAiB;OACjB,wBAAwB;MAC1B;MACA,iBAAiB,QAAQ,WACtB,GAAG,GAAG,YAAY,OAAO,QAAQ,WAAW,GAAG,iEAAiE,QAAQ,WAAW,GAAG;MACzI,eAAe,QAAQ;KACzB;KAEA,MAAM,YAAY,OAAO,gBACtB,yBACC,yBACA;MACE,MAAM;MACN;MACA,SAAS,YAAY;MACrB,uBAAuB,iBAAiB,oBAAoB,KAAK,CAAC,CAAC,CAAC;KACtE,SACM,oBAAoB,KAAK,CAAC,CAAC,GACjC,QACF,CAAC,CACA,KAAK,OAAO,eAAe,gBAAgB,MAAM,CAAC;KAErD,MAAM,OACJ,MACA,WAAW,SAEX,UAAU,MAAM,KACd,OAAO,QAAQ,UAAU,IAAI,MAAM,QAAQ,CAAC,GAC5C,OAAO,eAAe,gBAAgB,KAAK,CAC7C;KAEF,MAAM,WAAW,aACf,SAAS,MAAM,YAAY,SAAS,SAAS,WAAW,QAAQ,aAAa,QAAQ;KAEvF,MAAM,YAAY,eAAe,GAAG;MAClC,QAAQ,YACN,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,WAAW,QAAQ,QAAQ,QAAQ,GAAG,OAAO,CAAC,IAC9D,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC;MAC9C,UAAU,YACR,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,sBAAsB,QAAQ,QAAQ,QAAQ,GAAG,OAAO,CAAC,IACzE,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC;KAChD,CAAC;KAED,MAAM,UAAU,mBAAmB,GAAG,EACpC,SAAS,YACP,QAAQ,QAAQ,QAAQ,IACpB,IAAI,YAAY,YAAY,QAAQ,QAAQ,QAAQ,GAAG,OAAO,GAAG,KAAK,IACtE,OAAO,KAAK,oBAAoB,KAAK,CAAC,CAAC,CAAC,EAChD,CAAC;KAED,UAAU,QAAQ,KAChB,QAAQ,IAAI,gBAAgB,SAAS,GACrC,QAAQ,IAAI,oBAAoB,OAAO,CACzC;IACF;IAEA,IAAI,SAAS,SAAS,GAAG;KAEvB,MAAM,WAAW,QAAQ,SAAS;MAChC;MACA,WAAW,KAAK;MAChB;MACA,UAAU;MACV,iBAAiB,SAAS,SAAS,YACjC,SAAS,SAAS,aAAa,CAAC,QAAQ,QAAQ,IAAI,CAAC,CACvD;KACF,CAAC;KAWD,UAAU,QAAQ,MAChB,SACA,OAAO,SAAS,KACd,OAAO,eAAe,gBAAgB,MAAM,GAC5C,OAAO,eAAe,iBAAiB,MAAM,CAC/C,CACF;IACF;IAGA,OAAO;GACT,CAAC,CAAC,CAAC,KACD,uBACA,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,YAAY,gCAAgC,CAClD,CACF,CACF,CAAC,CAAC,KAAK,MAAM,QAAQ,UAAU,CAKf;GACd,UAA+B,YAQzB,OAAO,SAAS,IAAI;GAC1B,MAA2B,YAOrB,OAAO,SAAS,KAAK;EAC7B;CACF;CAEA,OAAO,EAAE,KAAK;AAChB"}

package/dist/internal/phone-kernel.d.mts

@@ -77,7 +77,7 @@ export declare const makePhoneKernel: <Fragment extends SqlFragment = SqlFragmen
     subject: Observation | null;
     subjectRow: Row | undefined;
     targetIdentifier: Observation;
-  }, PhoneOtpUnavailable, CurrentPhoneTransaction>;
+  }, PhoneOtpUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPhoneTransaction>;
   lookupPhone: (mapping: any, input: {
     readonly moduleId: string;
     readonly phoneNumber: any;
@@ -111,7 +111,7 @@ export declare const makePhoneKernel: <Fragment extends SqlFragment = SqlFragmen
         readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
       }[];
     };
-  }>, PhoneOtpUnavailable, CurrentPhoneTransaction>;
+  }>, PhoneOtpUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPhoneTransaction>;
   admitPhone: (mapping: any, input: {
     readonly moduleId: string;
     readonly action: "request" | "attempt";
@@ -119,7 +119,7 @@ export declare const makePhoneKernel: <Fragment extends SqlFragment = SqlFragmen
     readonly fingerprint: string;
     readonly networkKey: string;
     readonly replayLifetimeMillis: number;
-  }) => Effect.Effect<boolean, PhoneOtpUnavailable, CurrentPhoneTransaction>;
+  }) => Effect.Effect<boolean, PhoneOtpUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPhoneTransaction>;
   preparePhoneMutation: (mapping: any, input: PhoneMutation) => Effect.Effect<{
     decision: {
       readonly _tag: "Rejected";
@@ -146,9 +146,9 @@ export declare const makePhoneKernel: <Fragment extends SqlFragment = SqlFragmen
         };
       };
     };
-    mutate: Effect.Effect<boolean, PhoneOtpUnavailable, CurrentPhoneTransaction>;
+    mutate: Effect.Effect<boolean, PhoneOtpUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPhoneTransaction>;
     appliedCondition: Fragment;
-  }, PhoneOtpUnavailable, CurrentPhoneTransaction>;
+  }, PhoneOtpUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPhoneTransaction>;
   cleanupPhoneAdmission: (mapping: any, input: {
     readonly moduleId: string;
     readonly limit: number;