@yielded/auth-persistence 0.1.0-beta.21 → 0.1.0-beta.23

package/dist/Adapter.d.mts

@@ -6,7 +6,7 @@ import { AnyEmailAddressMapping, AnyEmailRegistrationMapping, AnyEmailSignInMapp
 import { D1PasskeyMapping, PasskeyAdmissionTable, PasskeyCeremonyMapping, PasskeyChargeInsert, PasskeyChargeKind, PasskeyChargeTable, PasskeyClock, PasskeyColumn, PasskeyCredentialMapping, PasskeyCredentialOwnershipTable, PasskeyCredentialReadTable, PasskeyCredentialServices, PasskeyEnrollmentContextMapping, PasskeyEnrollmentContextServices, PasskeyFactorReadTable, PasskeyFlowInsert, PasskeyFlowState, PasskeyFlowTable, PasskeyHandleOwnershipTable, PasskeyHandleReadTable, PasskeyHandleReservationTable, PasskeyMappingSource, PasskeyModuleTable, PasskeyPersistenceMapping, PasskeyPersistenceServices, PasskeyPolicyGuard, PasskeySubjectIdCodec, PasskeySubjectReadTable, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyPersistenceLayer, passkeyPolicyGuard, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "./internal/models/passkey-model.mjs";
 import { PasskeyRegistrationCeremonyCapabilities, PasskeyRegistrationCeremonyMapping, PasskeyRegistrationCeremonyServices, PasskeyRegistrationIntentReadTable, requiredPasskeyRegistrationCeremonyConstraints } from "./internal/models/passkey-registration-ceremony-model.mjs";
 import { PasskeyCommandTable, PasskeyCredentialInsert, PasskeyInvalidationInput, PasskeyInvalidationMutation, PasskeyManagementMapping, PasskeyManagementServices, PasskeyRegistrationMapping, PasskeyRegistrationServices, PasskeyRegistrationWriter, PasskeyWriteTables, passkeyInvalidationMutation, requiredPasskeyManagementConstraints, requiredPasskeyRegistrationWriteConstraints } from "./internal/models/passkey-write-model.mjs";
-import { AnyPasswordPersistenceMapping, AnyPasswordRegistrationMapping, D1PasswordPersistenceMapping, PasswordAttemptAction, PasswordAttemptRecord, PasswordAttemptState, PasswordAttemptTable, PasswordAuthorityCredentialTable, PasswordChargeTable, PasswordCommandTable, PasswordConstraintClassifier, PasswordCredentialTable, PasswordD1Clock, PasswordIdentifierTable, PasswordPersistenceMapping, PasswordRateScopeKind, PasswordRateScopeTable, PasswordRegistrationConstraintClassifier, PasswordRegistrationIntent, PasswordRegistrationMapping, PasswordRegistrationProvisioning, PasswordRegistrationState, PasswordRegistrationTable, PasswordScopeKeys, PasswordSubjectTable, RequiredPasswordConstraints, RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "./internal/models/password-model.mjs";
+import { AnyPasswordPersistenceMapping, AnyPasswordRegistrationMapping, D1PasswordPersistenceMapping, PasswordAttemptAction, PasswordAttemptRecord, PasswordAttemptState, PasswordAttemptTable, PasswordAuthorityCredentialTable, PasswordCommandTable, PasswordConstraintClassifier, PasswordCredentialTable, PasswordD1Clock, PasswordIdentifierTable, PasswordPersistenceMapping, PasswordRegistrationConstraintClassifier, PasswordRegistrationIntent, PasswordRegistrationMapping, PasswordRegistrationProvisioning, PasswordRegistrationState, PasswordRegistrationTable, PasswordSubjectTable, RequiredPasswordConstraints, RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "./internal/models/password-model.mjs";
 import { AnyProofPersistenceMapping, D1ProofPersistenceMapping, ProofAbuseEventTable, ProofAction, ProofAuthorityInput, ProofAuthorityTables, ProofCommandDecision, ProofCommandKind, ProofCommandTable, ProofConstraintClassifier, ProofContinuationRecord, ProofContinuationTable, ProofD1Clock, ProofDeliveryState, ProofFailureEventTable, ProofGenerationState, ProofGenerationTable, ProofPersistenceMapping, ProofRateScopeTable, ProofRequestTable, ProofScopeKeys, ProofScopeKind, ProofSeriesTable, RequiredProofConstraints, requiredProofConstraints } from "./internal/models/proof-model.mjs";
 import { AuthenticationAuthorityMapping, D1AuthenticationAuthorityMapping, D1PendingAuthenticationMapping, D1SessionClockMapping, D1SignedSessionValidityMapping, D1StatefulSessionMapping, PendingAuthenticationMapping, PendingAuthenticationTables, RequiredPendingAuthenticationConstraints, RequiredSessionConstraints, RequiredSignedValidityConstraints, RequiredStatefulPendingConstraints, SessionAuthorityTables, SessionConstraintClassifier, SessionFlowTables, SessionIdCodec, SessionSubjectTables, SignedSessionValidityMapping, SignedSessionValidityTables, StatefulSessionMapping, StatefulSessionTables, requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints } from "./internal/models/session-model.mjs";
 import { D1SessionStepUpMapping, RequiredSessionStepUpConstraints, SessionStepUpIntentTables, SessionStepUpMapping, SessionStepUpSourceTables, requiredSessionStepUpConstraints } from "./internal/models/step-up-model.mjs";
@@ -18,6 +18,8 @@ import { CurrentPasskeyTransaction, PasskeyOwner } from "./internal/passkey/stat
 import { TransactionBound, TransactionCoordinatorError, TransactionExecution, TransactionTargetConfiguration, makeTransactionExecutionKernel } from "./internal/transaction-execution-kernel.mjs";
 import { PasskeyCoordinatorError, PasskeyExecution, PasskeyTargetConfiguration } from "./internal/passkey/target.mjs";
 import { PasskeyKernel, makePasskeyKernel } from "./internal/passkey-kernel.mjs";
+import { NativeSqlTables, SqlTable, makeNativeSqlTables, nativeSqlAlias } from "./internal/native-sql-table.mjs";
+import { samePasswordCredentialSnapshot } from "./internal/password-attempts.mjs";
 import { CurrentPasswordSql, PasswordSqlConfiguration, PasswordSqlDatabase, PasswordSqlQuery, makePasswordKernel } from "./internal/password-kernel.mjs";
 import { CurrentPasswordPreparedTransaction, PasswordPreparedJournalGuards, PasswordPreparedPostcondition, PasswordPreparedPostconditions } from "./internal/PasswordPreparedPostconditions.mjs";
 import { CurrentPhoneTransaction, makePhoneKernel } from "./internal/phone-kernel.mjs";
@@ -29,4 +31,4 @@ import { makeComposedPasskeys } from "./internal/passkeys.mjs";
 import { makeMappings } from "./internal/storage-mapping.mjs";
 import { PasswordRegistrationAuthority } from "./internal/registration-contract.mjs";
 import { PhysicalStorageTable, StorageValidation, validateStorage, validateStorageBatch, withStorageValidation } from "./internal/storage-validation.mjs";
-export { type AnyEmailAddressMapping, type AnyEmailRegistrationMapping, type AnyEmailSignInMapping, type AnyPasswordPersistenceMapping, type AnyPasswordRegistrationMapping, type AnyProofPersistenceMapping, type AuthenticationAuthorityMapping, type BoundPersistence, type ClaimsCodec, type CurrentAddress, CurrentEmailSql, CurrentPasskeyTransaction, CurrentPasswordPreparedTransaction, CurrentPasswordSql, CurrentPhoneTransaction, CurrentProofSql, CurrentSessionSql, type D1AuthenticationAuthorityMapping, type D1EmailAddressMapping, type D1EmailRegistrationMapping, type D1PasskeyMapping, type D1PasswordPersistenceMapping, type D1PendingAuthenticationMapping, type D1ProofPersistenceMapping, type D1SessionClockMapping, type D1SessionStepUpMapping, type D1SignedSessionValidityMapping, type D1StatefulSessionMapping, type Definition, type EmailAddressMapping, type EmailAuthorityCredentialTable, type EmailCommandTable, type EmailCredentialReadTable, type EmailCredentialTable, type EmailD1Clock, type EmailIdentifierReadTable, type EmailIdentifierTable, type EmailRegistrationAuthorityCredentialTable, type EmailRegistrationCredentialTable, type EmailRegistrationIdentifierTable, type EmailRegistrationIntent, type EmailRegistrationMapping, type EmailRegistrationProvisioning, type EmailRegistrationState, type EmailRegistrationTable, type EmailSignInMapping, type EmailSqlConfiguration, type EmailSqlDatabase, type EmailSqlQuery, type EmailSubjectReadTable, type EmailSubjectTable, type GuardedUpdate, NativeDatabase, type Observation, type PasskeyAdmissionTable, type PasskeyCeremonyMapping, type PasskeyChargeInsert, type PasskeyChargeKind, type PasskeyChargeTable, type PasskeyClock, type PasskeyColumn, type PasskeyCommandTable, type PasskeyCoordinatorError, type PasskeyCredentialInsert, type PasskeyCredentialMapping, type PasskeyCredentialOwnershipTable, type PasskeyCredentialReadTable, type PasskeyCredentialServices, type PasskeyEnrollmentContextMapping, type PasskeyEnrollmentContextServices, type PasskeyExecution, type PasskeyFactorReadTable, type PasskeyFlowInsert, type PasskeyFlowState, type PasskeyFlowTable, type PasskeyHandleOwnershipTable, type PasskeyHandleReadTable, type PasskeyHandleReservationTable, type PasskeyInvalidationInput, type PasskeyInvalidationMutation, type PasskeyKernel, type PasskeyManagementMapping, type PasskeyManagementServices, type PasskeyMappingSource, type PasskeyModuleTable, type PasskeyOwner, type PasskeyPersistenceMapping, type PasskeyPersistenceServices, type PasskeyPolicyGuard, type PasskeyRegistrationCeremonyCapabilities, type PasskeyRegistrationCeremonyMapping, type PasskeyRegistrationCeremonyServices, type PasskeyRegistrationIntentReadTable, type PasskeyRegistrationMapping, type PasskeyRegistrationServices, type PasskeyRegistrationWriter, type PasskeySubjectIdCodec, type PasskeySubjectReadTable, type PasskeyTargetConfiguration, type PasskeyWriteTables, type PasswordAttemptAction, type PasswordAttemptRecord, type PasswordAttemptState, type PasswordAttemptTable, type PasswordAuthorityCredentialTable, type PasswordChargeTable, type PasswordCommandTable, type PasswordConstraintClassifier, type PasswordCredentialTable, type PasswordD1Clock, type PasswordIdentifierTable, type PasswordPersistenceMapping, PasswordPreparedJournalGuards, type PasswordPreparedPostcondition, PasswordPreparedPostconditions, type PasswordRateScopeKind, type PasswordRateScopeTable, type PasswordRegistrationAuthority, type PasswordRegistrationConstraintClassifier, type PasswordRegistrationIntent, type PasswordRegistrationMapping, type PasswordRegistrationProvisioning, type PasswordRegistrationState, type PasswordRegistrationTable, type PasswordScopeKeys, type PasswordSqlConfiguration, type PasswordSqlDatabase, type PasswordSqlQuery, type PasswordSubjectTable, type PendingAuthenticationMapping, type PendingAuthenticationTables, type PersistenceApi, PersistenceConfigurationError, PersistenceMappingError, type PhysicalStorageTable, type ProofAbuseEventTable, type ProofAction, type ProofAuthorityInput, type ProofAuthorityTables, type ProofCommandDecision, type ProofCommandKind, type ProofCommandTable, type ProofConstraintClassifier, type ProofContinuationRecord, type ProofContinuationTable, type ProofD1Clock, type ProofDeliveryState, type ProofFailureEventTable, type ProofGenerationState, type ProofGenerationTable, type ProofPersistenceMapping, type ProofRateScopeTable, type ProofRequestTable, type ProofScopeKeys, type ProofScopeKind, type ProofSeriesTable, type ProofSqlConfiguration, type ProofSqlDatabase, type ProofSqlQuery, type QueryFailure, type QueryOperations, type RequiredEmailAddressConstraints, type RequiredEmailRegistrationConstraints, type RequiredEmailSignInConstraints, type RequiredPasswordConstraints, type RequiredPasswordRegistrationConstraints, type RequiredPendingAuthenticationConstraints, type RequiredProofConstraints, type RequiredSessionConstraints, type RequiredSessionStepUpConstraints, type RequiredSignedValidityConstraints, type RequiredStatefulPendingConstraints, type Row, type SessionAuthorityTables, type SessionConstraintClassifier, type SessionFlowTables, type SessionIdCodec, type SessionSqlDatabase, type SessionSqlOptions, type SessionStepUpIntentTables, type SessionStepUpMapping, type SessionStepUpSourceTables, type SessionSubjectTables, type SignedSessionValidityMapping, type SignedSessionValidityTables, type SqlColumn, type SqlExpression, type SqlFragment, type StatefulSessionMapping, type StatefulSessionTables, type StorageTable, type StorageValidation, type SubjectIdCodec, type TableModel, type TransactionBound, type TransactionCoordinatorError, type TransactionExecution, type TransactionNativeDatabase, type TransactionOwner, type TransactionTargetConfiguration, createPersistence, decodeStepUpIntent, encodeStepUpIntent, isMappedConstraintConflict, makeComposedPasskeys, makeEmailKernel, makePasskeyKernel, makePasswordKernel, makePhoneKernel, makeProofKernel, makeSessionKernel, makeMappings as makeStorageMappings, makeTransactionExecutionKernel, makeTransactionKernel, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyInvalidationMutation, passkeyPersistenceLayer, passkeyPolicyGuard, requireStandalone, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints, requiredPasskeyCredentialConstraints, requiredPasskeyManagementConstraints, requiredPasskeyPersistenceConstraints, requiredPasskeyRegistrationCeremonyConstraints, requiredPasskeyRegistrationWriteConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints, requiredPendingAuthenticationConstraints, requiredProofConstraints, requiredSessionConstraints, requiredSessionStepUpConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints, stepUpIntentLive, validateStepUpPlan, validateStorage, validateStorageBatch, withStorageValidation };
+export { type AnyEmailAddressMapping, type AnyEmailRegistrationMapping, type AnyEmailSignInMapping, type AnyPasswordPersistenceMapping, type AnyPasswordRegistrationMapping, type AnyProofPersistenceMapping, type AuthenticationAuthorityMapping, type BoundPersistence, type ClaimsCodec, type CurrentAddress, CurrentEmailSql, CurrentPasskeyTransaction, CurrentPasswordPreparedTransaction, CurrentPasswordSql, CurrentPhoneTransaction, CurrentProofSql, CurrentSessionSql, type D1AuthenticationAuthorityMapping, type D1EmailAddressMapping, type D1EmailRegistrationMapping, type D1PasskeyMapping, type D1PasswordPersistenceMapping, type D1PendingAuthenticationMapping, type D1ProofPersistenceMapping, type D1SessionClockMapping, type D1SessionStepUpMapping, type D1SignedSessionValidityMapping, type D1StatefulSessionMapping, type Definition, type EmailAddressMapping, type EmailAuthorityCredentialTable, type EmailCommandTable, type EmailCredentialReadTable, type EmailCredentialTable, type EmailD1Clock, type EmailIdentifierReadTable, type EmailIdentifierTable, type EmailRegistrationAuthorityCredentialTable, type EmailRegistrationCredentialTable, type EmailRegistrationIdentifierTable, type EmailRegistrationIntent, type EmailRegistrationMapping, type EmailRegistrationProvisioning, type EmailRegistrationState, type EmailRegistrationTable, type EmailSignInMapping, type EmailSqlConfiguration, type EmailSqlDatabase, type EmailSqlQuery, type EmailSubjectReadTable, type EmailSubjectTable, type GuardedUpdate, NativeDatabase, type NativeSqlTables, type Observation, type PasskeyAdmissionTable, type PasskeyCeremonyMapping, type PasskeyChargeInsert, type PasskeyChargeKind, type PasskeyChargeTable, type PasskeyClock, type PasskeyColumn, type PasskeyCommandTable, type PasskeyCoordinatorError, type PasskeyCredentialInsert, type PasskeyCredentialMapping, type PasskeyCredentialOwnershipTable, type PasskeyCredentialReadTable, type PasskeyCredentialServices, type PasskeyEnrollmentContextMapping, type PasskeyEnrollmentContextServices, type PasskeyExecution, type PasskeyFactorReadTable, type PasskeyFlowInsert, type PasskeyFlowState, type PasskeyFlowTable, type PasskeyHandleOwnershipTable, type PasskeyHandleReadTable, type PasskeyHandleReservationTable, type PasskeyInvalidationInput, type PasskeyInvalidationMutation, type PasskeyKernel, type PasskeyManagementMapping, type PasskeyManagementServices, type PasskeyMappingSource, type PasskeyModuleTable, type PasskeyOwner, type PasskeyPersistenceMapping, type PasskeyPersistenceServices, type PasskeyPolicyGuard, type PasskeyRegistrationCeremonyCapabilities, type PasskeyRegistrationCeremonyMapping, type PasskeyRegistrationCeremonyServices, type PasskeyRegistrationIntentReadTable, type PasskeyRegistrationMapping, type PasskeyRegistrationServices, type PasskeyRegistrationWriter, type PasskeySubjectIdCodec, type PasskeySubjectReadTable, type PasskeyTargetConfiguration, type PasskeyWriteTables, type PasswordAttemptAction, type PasswordAttemptRecord, type PasswordAttemptState, type PasswordAttemptTable, type PasswordAuthorityCredentialTable, type PasswordCommandTable, type PasswordConstraintClassifier, type PasswordCredentialTable, type PasswordD1Clock, type PasswordIdentifierTable, type PasswordPersistenceMapping, PasswordPreparedJournalGuards, type PasswordPreparedPostcondition, PasswordPreparedPostconditions, type PasswordRegistrationAuthority, type PasswordRegistrationConstraintClassifier, type PasswordRegistrationIntent, type PasswordRegistrationMapping, type PasswordRegistrationProvisioning, type PasswordRegistrationState, type PasswordRegistrationTable, type PasswordSqlConfiguration, type PasswordSqlDatabase, type PasswordSqlQuery, type PasswordSubjectTable, type PendingAuthenticationMapping, type PendingAuthenticationTables, type PersistenceApi, PersistenceConfigurationError, PersistenceMappingError, type PhysicalStorageTable, type ProofAbuseEventTable, type ProofAction, type ProofAuthorityInput, type ProofAuthorityTables, type ProofCommandDecision, type ProofCommandKind, type ProofCommandTable, type ProofConstraintClassifier, type ProofContinuationRecord, type ProofContinuationTable, type ProofD1Clock, type ProofDeliveryState, type ProofFailureEventTable, type ProofGenerationState, type ProofGenerationTable, type ProofPersistenceMapping, type ProofRateScopeTable, type ProofRequestTable, type ProofScopeKeys, type ProofScopeKind, type ProofSeriesTable, type ProofSqlConfiguration, type ProofSqlDatabase, type ProofSqlQuery, type QueryFailure, type QueryOperations, type RequiredEmailAddressConstraints, type RequiredEmailRegistrationConstraints, type RequiredEmailSignInConstraints, type RequiredPasswordConstraints, type RequiredPasswordRegistrationConstraints, type RequiredPendingAuthenticationConstraints, type RequiredProofConstraints, type RequiredSessionConstraints, type RequiredSessionStepUpConstraints, type RequiredSignedValidityConstraints, type RequiredStatefulPendingConstraints, type Row, type SessionAuthorityTables, type SessionConstraintClassifier, type SessionFlowTables, type SessionIdCodec, type SessionSqlDatabase, type SessionSqlOptions, type SessionStepUpIntentTables, type SessionStepUpMapping, type SessionStepUpSourceTables, type SessionSubjectTables, type SignedSessionValidityMapping, type SignedSessionValidityTables, type SqlColumn, type SqlExpression, type SqlFragment, type SqlTable, type StatefulSessionMapping, type StatefulSessionTables, type StorageTable, type StorageValidation, type SubjectIdCodec, type TableModel, type TransactionBound, type TransactionCoordinatorError, type TransactionExecution, type TransactionNativeDatabase, type TransactionOwner, type TransactionTargetConfiguration, createPersistence, decodeStepUpIntent, encodeStepUpIntent, isMappedConstraintConflict, makeComposedPasskeys, makeEmailKernel, makeNativeSqlTables, makePasskeyKernel, makePasswordKernel, makePhoneKernel, makeProofKernel, makeSessionKernel, makeMappings as makeStorageMappings, makeTransactionExecutionKernel, makeTransactionKernel, nativeSqlAlias, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyInvalidationMutation, passkeyPersistenceLayer, passkeyPolicyGuard, requireStandalone, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints, requiredPasskeyCredentialConstraints, requiredPasskeyManagementConstraints, requiredPasskeyPersistenceConstraints, requiredPasskeyRegistrationCeremonyConstraints, requiredPasskeyRegistrationWriteConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints, requiredPendingAuthenticationConstraints, requiredProofConstraints, requiredSessionConstraints, requiredSessionStepUpConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints, samePasswordCredentialSnapshot, stepUpIntentLive, validateStepUpPlan, validateStorage, validateStorageBatch, withStorageValidation };

package/dist/Adapter.mjs

@@ -1,5 +1,6 @@
 import { PersistenceConfigurationError } from "./internal/configuration.mjs";
 import { PersistenceMappingError, isMappedConstraintConflict } from "./internal/mapping-error.mjs";
+import { makeNativeSqlTables, nativeSqlAlias } from "./internal/native-sql-table.mjs";
 import { passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyPersistenceLayer, passkeyPolicyGuard, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "./internal/models/passkey-model.mjs";
 import { passkeyInvalidationMutation, requiredPasskeyManagementConstraints, requiredPasskeyRegistrationWriteConstraints } from "./internal/models/passkey-write-model.mjs";
 import { requiredPasskeyRegistrationCeremonyConstraints } from "./internal/models/passkey-registration-ceremony-model.mjs";
@@ -15,6 +16,7 @@ import { makeComposedPasskeys } from "./internal/passkeys.mjs";
 import { requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints } from "./internal/models/email-model.mjs";
 import { CurrentEmailSql, makeEmailKernel } from "./internal/email-kernel.mjs";
 import { requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "./internal/models/password-model.mjs";
+import { samePasswordCredentialSnapshot } from "./internal/password-attempts.mjs";
 import { CurrentPasswordSql, makePasswordKernel } from "./internal/password-kernel.mjs";
 import { CurrentPhoneTransaction, makePhoneKernel } from "./internal/phone-kernel.mjs";
 import { decodeStepUpIntent, encodeStepUpIntent, stepUpIntentLive, validateStepUpPlan } from "./internal/step-up-state.mjs";
@@ -24,4 +26,4 @@ import { validateStorage, validateStorageBatch, withStorageValidation } from "./
 import { createPersistence } from "./internal/persistence.mjs";
 import { requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints } from "./internal/models/session-model.mjs";
 import { requiredSessionStepUpConstraints } from "./internal/models/step-up-model.mjs";
-export { CurrentEmailSql, CurrentPasskeyTransaction, CurrentPasswordPreparedTransaction, CurrentPasswordSql, CurrentPhoneTransaction, CurrentProofSql, CurrentSessionSql, NativeDatabase, PasswordPreparedJournalGuards, PasswordPreparedPostconditions, PersistenceConfigurationError, PersistenceMappingError, createPersistence, decodeStepUpIntent, encodeStepUpIntent, isMappedConstraintConflict, makeComposedPasskeys, makeEmailKernel, makePasskeyKernel, makePasswordKernel, makePhoneKernel, makeProofKernel, makeSessionKernel, makeMappings as makeStorageMappings, makeTransactionExecutionKernel, makeTransactionKernel, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyInvalidationMutation, passkeyPersistenceLayer, passkeyPolicyGuard, requireStandalone, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints, requiredPasskeyCredentialConstraints, requiredPasskeyManagementConstraints, requiredPasskeyPersistenceConstraints, requiredPasskeyRegistrationCeremonyConstraints, requiredPasskeyRegistrationWriteConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints, requiredPendingAuthenticationConstraints, requiredProofConstraints, requiredSessionConstraints, requiredSessionStepUpConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints, stepUpIntentLive, validateStepUpPlan, validateStorage, validateStorageBatch, withStorageValidation };
+export { CurrentEmailSql, CurrentPasskeyTransaction, CurrentPasswordPreparedTransaction, CurrentPasswordSql, CurrentPhoneTransaction, CurrentProofSql, CurrentSessionSql, NativeDatabase, PasswordPreparedJournalGuards, PasswordPreparedPostconditions, PersistenceConfigurationError, PersistenceMappingError, createPersistence, decodeStepUpIntent, encodeStepUpIntent, isMappedConstraintConflict, makeComposedPasskeys, makeEmailKernel, makeNativeSqlTables, makePasskeyKernel, makePasswordKernel, makePhoneKernel, makeProofKernel, makeSessionKernel, makeMappings as makeStorageMappings, makeTransactionExecutionKernel, makeTransactionKernel, nativeSqlAlias, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyInvalidationMutation, passkeyPersistenceLayer, passkeyPolicyGuard, requireStandalone, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints, requiredPasskeyCredentialConstraints, requiredPasskeyManagementConstraints, requiredPasskeyPersistenceConstraints, requiredPasskeyRegistrationCeremonyConstraints, requiredPasskeyRegistrationWriteConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints, requiredPendingAuthenticationConstraints, requiredProofConstraints, requiredSessionConstraints, requiredSessionStepUpConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints, samePasswordCredentialSnapshot, stepUpIntentLive, validateStepUpPlan, validateStorage, validateStorageBatch, withStorageValidation };

package/dist/internal/authority-snapshot.mjs

@@ -0,0 +1,53 @@
+import { sqlMapping } from "./native-sql-table.mjs";
+import { NativeDatabase } from "./transaction-kernel.mjs";
+import { Effect, Schema } from "effect";
+import { AuthenticationRevision, StaleAuthentication } from "@yielded/auth/Sessions";
+//#region src/internal/authority-snapshot.ts
+/** One unlocked statement reads the subject and requested credentials: a coherent
+* preflight view, or a commit owner's view where writers are already serialized.
+* Row-locking commit owners lock and revalidate through their ordered reads.
+*/
+const makeAuthoritySnapshot = (tables, mapping) => Effect.fnUntraced(function* (subjectId, credentialIds) {
+	const sql = (yield* NativeDatabase).$client.withoutTransforms();
+	if (new Set(credentialIds).size !== credentialIds.length) return yield* StaleAuthentication.make({});
+	const { s, c } = yield* sqlMapping(() => ({
+		s: tables(mapping.subject.table).as("auth_subject"),
+		c: tables(mapping.credential.table).as("auth_credential")
+	}));
+	const nativeId = yield* sqlMapping(() => mapping.subjectId.toNative(subjectId)).pipe(Effect.flatten);
+	const requested = [...credentialIds].sort((a, b) => a.localeCompare(b));
+	const rows = yield* sqlMapping(() => sql`select ${s.fields("s_")}
+      ${requested.length === 0 ? sql.literal("") : sql`, ${c.fields("c_")}`}
+      from ${s.name}
+      ${requested.length === 0 ? sql.literal("") : sql`inner join ${c.name} on
+        ${c.column(mapping.credential.subjectId)} = ${c.value(mapping.credential.subjectId, nativeId)}
+        and ${sql.or(requested.map((id) => sql`${c.column(mapping.credential.credentialId)} = ${c.value(mapping.credential.credentialId, id)}`))}`}
+      where ${s.column(mapping.subject.id)} = ${s.value(mapping.subject.id, nativeId)}`).pipe(Effect.flatten);
+	const first = rows[0];
+	if (first === void 0 || rows.length !== Math.max(1, requested.length)) return yield* StaleAuthentication.make({});
+	const subject = yield* sqlMapping(() => s.decode(first, "s_"));
+	if (!(yield* sqlMapping(() => mapping.subject.isActiveStatus(subject[mapping.subject.status])))) return yield* StaleAuthentication.make({});
+	const credentials = yield* sqlMapping(() => requested.length === 0 ? [] : rows.map((row) => c.decode(row, "c_")));
+	if (yield* sqlMapping(() => credentials.some((row) => mapping.credential.status !== void 0 && mapping.credential.isActiveStatus?.(row[mapping.credential.status]) !== true))) return yield* StaleAuthentication.make({});
+	const revision = yield* Schema.decodeUnknownEffect(AuthenticationRevision)({
+		subjectId,
+		securityRevision: subject[mapping.subject.securityRevision],
+		credentials: credentials.map((row) => ({
+			credentialId: row[mapping.credential.credentialId],
+			revision: row[mapping.credential.revision]
+		}))
+	});
+	const sorted = [...revision.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId));
+	if (sorted.some((item, index) => item.credentialId !== requested[index])) return yield* StaleAuthentication.make({});
+	return {
+		subject,
+		revision: {
+			...revision,
+			credentials: sorted
+		}
+	};
+});
+//#endregion
+export { makeAuthoritySnapshot };
+
+//# sourceMappingURL=authority-snapshot.mjs.map

package/dist/internal/authority-snapshot.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-snapshot.mjs","names":[],"sources":["../../src/internal/authority-snapshot.ts"],"sourcesContent":["import type { SubjectId } from \"@yielded/auth/Schema\";\nimport { AuthenticationRevision, StaleAuthentication } from \"@yielded/auth/Sessions\";\nimport { Effect, Schema } from \"effect\";\n\nimport type { SessionAuthorityTables } from \"./models/session-model\";\nimport { sqlMapping, type NativeSqlTables } from \"./native-sql-table\";\nimport type { AnyTableModel } from \"./query-operations\";\nimport { NativeDatabase } from \"./transaction-kernel\";\n\n/** One unlocked statement reads the subject and requested credentials: a coherent\n * preflight view, or a commit owner's view where writers are already serialized.\n * Row-locking commit owners lock and revalidate through their ordered reads.\n */\nexport const makeAuthoritySnapshot = (\n  tables: NativeSqlTables,\n  mapping: SessionAuthorityTables<AnyTableModel, AnyTableModel, unknown>,\n) =>\n  Effect.fnUntraced(function* (subjectId: SubjectId, credentialIds: ReadonlyArray<string>) {\n    const sql = (yield* NativeDatabase).$client.withoutTransforms();\n\n    if (new Set(credentialIds).size !== credentialIds.length)\n      return yield* StaleAuthentication.make({});\n\n    const { s, c } = yield* sqlMapping(() => ({\n      s: tables(mapping.subject.table).as(\"auth_subject\"),\n      c: tables(mapping.credential.table).as(\"auth_credential\"),\n    }));\n\n    const nativeId = yield* sqlMapping(() => mapping.subjectId.toNative(subjectId)).pipe(\n      Effect.flatten,\n    );\n\n    const requested = [...credentialIds].sort((a, b) => a.localeCompare(b));\n\n    const rows = yield* sqlMapping(\n      () => sql<Record<string, unknown>>`select ${s.fields(\"s_\")}\n      ${requested.length === 0 ? sql.literal(\"\") : sql`, ${c.fields(\"c_\")}`}\n      from ${s.name}\n      ${\n        requested.length === 0\n          ? sql.literal(\"\")\n          : sql`inner join ${c.name} on\n        ${c.column(mapping.credential.subjectId)} = ${c.value(mapping.credential.subjectId, nativeId)}\n        and ${sql.or(requested.map((id) => sql`${c.column(mapping.credential.credentialId)} = ${c.value(mapping.credential.credentialId, id)}`))}`\n      }\n      where ${s.column(mapping.subject.id)} = ${s.value(mapping.subject.id, nativeId)}`,\n    ).pipe(Effect.flatten);\n\n    const first = rows[0];\n\n    if (first === undefined || rows.length !== Math.max(1, requested.length))\n      return yield* StaleAuthentication.make({});\n\n    const subject = yield* sqlMapping(() => s.decode(first, \"s_\"));\n\n    if (!(yield* sqlMapping(() => mapping.subject.isActiveStatus(subject[mapping.subject.status]))))\n      return yield* StaleAuthentication.make({});\n\n    const credentials = yield* sqlMapping(() =>\n      requested.length === 0 ? [] : rows.map((row) => c.decode(row, \"c_\")),\n    );\n\n    if (\n      yield* sqlMapping(() =>\n        credentials.some(\n          (row) =>\n            mapping.credential.status !== undefined &&\n            mapping.credential.isActiveStatus?.(row[mapping.credential.status]) !== true,\n        ),\n      )\n    )\n      return yield* StaleAuthentication.make({});\n\n    const revision = yield* Schema.decodeUnknownEffect(AuthenticationRevision)({\n      subjectId,\n      securityRevision: subject[mapping.subject.securityRevision],\n      credentials: credentials.map((row) => ({\n        credentialId: row[mapping.credential.credentialId],\n        revision: row[mapping.credential.revision],\n      })),\n    });\n\n    const sorted = [...revision.credentials].sort((a, b) =>\n      a.credentialId.localeCompare(b.credentialId),\n    );\n\n    if (sorted.some((item, index) => item.credentialId !== requested[index]))\n      return yield* StaleAuthentication.make({});\n\n    return { subject, revision: { ...revision, credentials: sorted } };\n  });\n"],"mappings":";;;;;;;;;AAaA,MAAa,yBACX,QACA,YAEA,OAAO,WAAW,WAAW,WAAsB,eAAsC;CACvF,MAAM,OAAO,OAAO,eAAA,CAAgB,QAAQ,kBAAkB;CAE9D,IAAI,IAAI,IAAI,aAAa,CAAC,CAAC,SAAS,cAAc,QAChD,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAE3C,MAAM,EAAE,GAAG,MAAM,OAAO,kBAAkB;EACxC,GAAG,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,GAAG,cAAc;EAClD,GAAG,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,GAAG,iBAAiB;CAC1D,EAAE;CAEF,MAAM,WAAW,OAAO,iBAAiB,QAAQ,UAAU,SAAS,SAAS,CAAC,CAAC,CAAC,KAC9E,OAAO,OACT;CAEA,MAAM,YAAY,CAAC,GAAG,aAAa,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;CAEtE,MAAM,OAAO,OAAO,iBACZ,GAA4B,UAAU,EAAE,OAAO,IAAI,EAAE;QACzD,UAAU,WAAW,IAAI,IAAI,QAAQ,EAAE,IAAI,GAAG,KAAK,EAAE,OAAO,IAAI,IAAI;aAC/D,EAAE,KAAK;QAEZ,UAAU,WAAW,IACjB,IAAI,QAAQ,EAAE,IACd,GAAG,cAAc,EAAE,KAAK;UAC1B,EAAE,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;cACxF,IAAI,GAAG,UAAU,KAAK,OAAO,GAAG,GAAG,EAAE,OAAO,QAAQ,WAAW,YAAY,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,cAAc,EAAE,GAAG,CAAC,IACxI;cACO,EAAE,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,GAChF,CAAC,CAAC,KAAK,OAAO,OAAO;CAErB,MAAM,QAAQ,KAAK;CAEnB,IAAI,UAAU,KAAA,KAAa,KAAK,WAAW,KAAK,IAAI,GAAG,UAAU,MAAM,GACrE,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAE3C,MAAM,UAAU,OAAO,iBAAiB,EAAE,OAAO,OAAO,IAAI,CAAC;CAE7D,IAAI,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,CAAC,IAC3F,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAE3C,MAAM,cAAc,OAAO,iBACzB,UAAU,WAAW,IAAI,CAAC,IAAI,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,CACrE;CAEA,IACE,OAAO,iBACL,YAAY,MACT,QACC,QAAQ,WAAW,WAAW,KAAA,KAC9B,QAAQ,WAAW,iBAAiB,IAAI,QAAQ,WAAW,OAAO,MAAM,IAC5E,CACF,GAEA,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAE3C,MAAM,WAAW,OAAO,OAAO,oBAAoB,sBAAsB,CAAC,CAAC;EACzE;EACA,kBAAkB,QAAQ,QAAQ,QAAQ;EAC1C,aAAa,YAAY,KAAK,SAAS;GACrC,cAAc,IAAI,QAAQ,WAAW;GACrC,UAAU,IAAI,QAAQ,WAAW;EACnC,EAAE;CACJ,CAAC;CAED,MAAM,SAAS,CAAC,GAAG,SAAS,WAAW,CAAC,CAAC,MAAM,GAAG,MAChD,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;CAEA,IAAI,OAAO,MAAM,MAAM,UAAU,KAAK,iBAAiB,UAAU,MAAM,GACrE,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAE3C,OAAO;EAAE;EAAS,UAAU;GAAE,GAAG;GAAU,aAAa;EAAO;CAAE;AACnE,CAAC"}

package/dist/internal/configuration.d.mts

@@ -98,7 +98,7 @@ type UsesProofs<A extends {
   readonly strategies: Readonly<Record<string, Strategy>>;
 }> = Enabled<A, "phone"> | Enabled<A, "email"> | ManagedPassword<A>;
 export type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> = AuthenticationAuthority | KeyId<A["sessions"]["StatefulSessionPersistence"]> | KeyId<A["sessions"]["SessionRepository"]> | (Enabled<A, "password"> extends never ? never : PasswordPersistence) | KeyId<RegistrationKey<ManagedPassword<A>>> | (Enabled<A, "passkey"> extends never ? never : PasskeyPersistence | PasskeyCredentials) | (ManagedPasskey<A> extends never ? never : PasskeyManagementPersistence | PasskeyEnrollmentContext) | (Enabled<A, "email"> extends never ? never : EmailAddressPersistence) | (UsesProofs<A> extends never ? never : ProofPersistence) | (Enabled<A, "phone"> extends never ? never : PhoneAdmission | PhoneSignInTargets);
-export type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> = "identifiers" | "credentials" | "sessions" | "sessionFlows" | (Enabled<A, "password"> extends never ? never : "passwords" | "passwordAttempts" | "passwordScopes" | "passwordCharges" | "passwordCommands") | (ManagedPassword<A> extends never ? never : "passwordRegistrations") | (Enabled<A, "phone"> extends never ? never : "phoneState") | (Enabled<A, "email"> extends never ? never : "emailCredentials" | "emailCommands") | (Enabled<A, "passkey"> extends never ? never : "passkeyCredentials" | "passkeyOwnership" | "passkeyHandles" | "passkeyModules" | "passkeyFlows" | "passkeyAdmissions" | "passkeyCharges") | (ManagedPasskey<A> extends never ? never : "passkeyCommands") | (UsesProofs<A> extends never ? never : ProofRoles);
+export type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> = "identifiers" | "credentials" | "sessions" | "sessionFlows" | (Enabled<A, "password"> extends never ? never : "passwords" | "passwordAttempts" | "passwordCommands") | (ManagedPassword<A> extends never ? never : "passwordRegistrations") | (Enabled<A, "phone"> extends never ? never : "phoneState") | (Enabled<A, "email"> extends never ? never : "emailCredentials" | "emailCommands") | (Enabled<A, "passkey"> extends never ? never : "passkeyCredentials" | "passkeyOwnership" | "passkeyHandles" | "passkeyModules" | "passkeyFlows" | "passkeyAdmissions" | "passkeyCharges") | (ManagedPasskey<A> extends never ? never : "passkeyCommands") | (UsesProofs<A> extends never ? never : ProofRoles);
 export interface SubjectOptions<T extends object, NativeId> {
   readonly table: T;
   readonly id: string;

package/dist/internal/configuration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.mjs","names":[],"sources":["../../src/internal/configuration.ts"],"sourcesContent":["import type { EmailAction, EmailAddressPersistence } from \"@yielded/auth/Email\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasskeyActionChallenge,\n  PasskeyConfig,\n  PasskeyCredentials,\n  PasskeyEnrollmentContext,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  PasskeyPersistence,\n  PasskeyConfigurationError,\n} from \"@yielded/auth/Passkey\";\nimport type {\n  PasswordAction,\n  PasswordPersistence,\n  PasswordUnavailable,\n} from \"@yielded/auth/Password\";\nimport type { PhoneAdmission, PhoneSignInTargets } from \"@yielded/auth/PhoneOtp\";\nimport type { ProofPersistence } from \"@yielded/auth/Proofs\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type {\n  AuthenticationAuthority,\n  AuthenticationRequirement,\n  make as makeSessions,\n} from \"@yielded/auth/Sessions\";\nimport { type Context, type Crypto, type Effect, type Layer, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { StorageRole } from \"./storage-tables\";\n\nexport class PersistenceConfigurationError extends Schema.TaggedError<PersistenceConfigurationError>()(\n  \"PersistenceConfigurationError\",\n  { reason: Schema.String },\n) {}\n\nexport type ClaimsCodec = Schema.Codec<unknown, unknown, never, never>;\n\nexport interface PasskeyFeature {\n  readonly kind: \"passkey\";\n  readonly moduleId: string;\n  readonly policy: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError, PasskeyConfig>;\n  readonly management?: boolean;\n  readonly managementPolicy?: PasskeyManagementPolicy;\n}\n\nexport interface Strategy {\n  readonly strategy: object;\n  readonly persistence?:\n    | PasskeyFeature\n    | {\n        readonly kind: \"password\" | \"phone\" | \"email\";\n        readonly moduleId: string;\n        readonly lifecycle?: boolean;\n        readonly management?: boolean;\n        readonly addresses?: boolean;\n      };\n  readonly RegistrationAuthority?: Context.Key<unknown, unknown>;\n}\n\nexport interface Definition<C extends ClaimsCodec, Id extends string> {\n  readonly namespace: string;\n  readonly claims: C;\n  readonly sessionMode?: string | undefined;\n  readonly sessions: ReturnType<typeof makeSessions<C, Id>>;\n  readonly strategies: Readonly<Record<string, Strategy>>;\n}\n\ntype KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;\ntype Enabled<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n  Kind extends \"password\" | \"phone\" | \"email\" | \"passkey\",\n> = Extract<A[\"strategies\"][keyof A[\"strategies\"]], { persistence: { kind: Kind } }>;\n\ntype ManagedPassword<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"password\">, { persistence: { management: true } }>;\n\ntype ManagedPasskey<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"passkey\">, { persistence: { management: true } }>;\n\nexport type PasskeyRequirement<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n> = Enabled<A, \"passkey\"> extends never ? never : PasskeyConfig;\n\ntype RegistrationKey<S> = S extends { readonly RegistrationAuthority: infer K } ? K : never;\ntype Registration<S> =\n  RegistrationKey<S> extends Context.Key<infer _Id, infer Service>\n    ? Service extends { readonly register: (input: infer Input, ...args: never[]) => unknown }\n      ? Input extends { readonly registration: infer Value }\n        ? Value\n        : never\n      : never\n    : never;\n\nexport interface ProvisioningId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceProvisioning\";\n}\n\nexport type Provisioning<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = {\n  readonly [\n    K in keyof A[\"strategies\"] as A[\"strategies\"][K] extends {\n      persistence: { kind: \"password\"; management: true };\n    }\n      ? K\n      : never\n  ]: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration<A[\"strategies\"][K]>;\n  }) => Effect.Effect<SubjectId, PasswordUnavailable>;\n};\n\nexport type ProvisioningRequirement<\n  A extends { readonly namespace: string; readonly strategies: Readonly<Record<string, Strategy>> },\n> = ManagedPassword<A> extends never ? never : ProvisioningId<A[\"namespace\"]>;\n\ntype ProofRoles =\n  | \"proofRequests\"\n  | \"proofSeries\"\n  | \"proofGenerations\"\n  | \"proofContinuations\"\n  | \"proofScopes\"\n  | \"proofAbuse\"\n  | \"proofFailures\"\n  | \"proofCommands\";\n\ntype UsesProofs<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  | Enabled<A, \"phone\">\n  | Enabled<A, \"email\">\n  | ManagedPassword<A>;\n\nexport type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | AuthenticationAuthority\n  | KeyId<A[\"sessions\"][\"StatefulSessionPersistence\"]>\n  | KeyId<A[\"sessions\"][\"SessionRepository\"]>\n  | (Enabled<A, \"password\"> extends never ? never : PasswordPersistence)\n  | KeyId<RegistrationKey<ManagedPassword<A>>>\n  | (Enabled<A, \"passkey\"> extends never ? never : PasskeyPersistence | PasskeyCredentials)\n  | (ManagedPasskey<A> extends never\n      ? never\n      : PasskeyManagementPersistence | PasskeyEnrollmentContext)\n  | (Enabled<A, \"email\"> extends never ? never : EmailAddressPersistence)\n  | (UsesProofs<A> extends never ? never : ProofPersistence)\n  | (Enabled<A, \"phone\"> extends never ? never : PhoneAdmission | PhoneSignInTargets);\n\nexport type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | \"identifiers\"\n  | \"credentials\"\n  | \"sessions\"\n  | \"sessionFlows\"\n  | (Enabled<A, \"password\"> extends never\n      ? never\n      :\n          | \"passwords\"\n          | \"passwordAttempts\"\n          | \"passwordScopes\"\n          | \"passwordCharges\"\n          | \"passwordCommands\")\n  | (ManagedPassword<A> extends never ? never : \"passwordRegistrations\")\n  | (Enabled<A, \"phone\"> extends never ? never : \"phoneState\")\n  | (Enabled<A, \"email\"> extends never ? never : \"emailCredentials\" | \"emailCommands\")\n  | (Enabled<A, \"passkey\"> extends never\n      ? never\n      :\n          | \"passkeyCredentials\"\n          | \"passkeyOwnership\"\n          | \"passkeyHandles\"\n          | \"passkeyModules\"\n          | \"passkeyFlows\"\n          | \"passkeyAdmissions\"\n          | \"passkeyCharges\")\n  | (ManagedPasskey<A> extends never ? never : \"passkeyCommands\")\n  | (UsesProofs<A> extends never ? never : ProofRoles);\n\nexport interface SubjectOptions<T extends object, NativeId> {\n  readonly table: T;\n  readonly id: string;\n  readonly status: string;\n  readonly activeValue: unknown;\n  readonly securityRevision: string;\n  readonly idCodec: Schema.Codec<SubjectId, NativeId>;\n  readonly requirements: (\n    row: Readonly<Record<string, unknown>>,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Defaults to sign-in requirements. Recovery can have a distinct application policy. */\n  readonly actionRequirements?: (\n    row: Readonly<Record<string, unknown>>,\n    action: PasswordAction | EmailAction | PasskeyActionChallenge[\"action\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n}\n\n/** Codecs at the application-owned subject and timestamp boundary. */\nexport interface SubjectMapping {\n  readonly table: object;\n  readonly id: string;\n  readonly status: string;\n  readonly securityRevision: string;\n  readonly activeValue: unknown;\n  readonly requirements: SubjectOptions<object, unknown>[\"requirements\"];\n  readonly actionRequirements: NonNullable<SubjectOptions<object, unknown>[\"actionRequirements\"]>;\n  readonly toSubject: (value: unknown) => Effect.Effect<SubjectId, PersistenceMappingError>;\n  readonly toNative: (value: SubjectId) => Effect.Effect<unknown, PersistenceMappingError>;\n  readonly toSubjectSync: (value: unknown) => SubjectId;\n  readonly toNativeSync: (value: SubjectId) => unknown;\n}\n\nexport interface MappingInput {\n  readonly tables: Partial<Record<StorageRole, object>>;\n  readonly subjects: SubjectMapping;\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly decodeInstantSync: (value: unknown) => number;\n}\n\nexport interface StorageLayout<\n  T extends object,\n  Role extends StorageRole = StorageRole,\n> extends MappingInput {\n  readonly namespace: string;\n  readonly schema: Readonly<Record<Role, T>>;\n}\n\nexport interface ConfigId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceConfig\";\n}\n\nexport interface TimestampOptions<Instant> {\n  readonly type: \"text\" | \"integer\";\n  readonly codec: Schema.Codec<number, Instant>;\n}\n\nexport interface BoundPersistence<\n  T extends object,\n  R,\n  C extends ClaimsCodec,\n  Id extends string,\n  A extends Definition<C, Id>,\n> {\n  readonly Config: Context.Service<ConfigId<A[\"namespace\"]>, StorageLayout<T, Roles<C, Id, A>>> & {\n    readonly layer: (\n      value: StorageLayout<T, Roles<C, Id, A>>,\n    ) => Layer.Layer<ConfigId<A[\"namespace\"]>>;\n  };\n  /** Create only the application subject. Runs inside the owning auth SQL transaction;\n   * use that SqlClient (including Drizzle over it), and return the new subject ID.\n   * Do not perform external side effects or open an independent transaction here.\n   */\n  readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;\n  readonly layer: Layer.Layer<\n    Ports<C, Id, A>,\n    PersistenceConfigurationError,\n    | Crypto.Crypto\n    | ConfigId<A[\"namespace\"]>\n    | ProvisioningRequirement<A>\n    | PasskeyRequirement<A>\n    | SqlClient.SqlClient\n    | R\n  >;\n  readonly managed: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n    /** Stable SQL identifier prefix; reuse the deployed prefix for existing tables. */\n    readonly prefix: string;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n  readonly map: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables: Readonly<Record<Roles<C, Id, A>, T>>;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n}\n\n/** Shared configuration shape. The backend chooses table types and service requirements. */\nexport interface PersistenceApi<T extends object, R = never> {\n  readonly make: <\n    C extends ClaimsCodec,\n    const Id extends string,\n    const A extends Definition<C, Id>,\n  >(\n    auth: A & Definition<C, Id>,\n  ) => BoundPersistence<T, R, C, Id, A>;\n}\n"],"mappings":";;AAgCA,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA,EAAE,QAAQ,OAAO,OAAO,CAC1B,CAAC,CAAC,CAAC"}
+{"version":3,"file":"configuration.mjs","names":[],"sources":["../../src/internal/configuration.ts"],"sourcesContent":["import type { EmailAction, EmailAddressPersistence } from \"@yielded/auth/Email\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasskeyActionChallenge,\n  PasskeyConfig,\n  PasskeyCredentials,\n  PasskeyEnrollmentContext,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  PasskeyPersistence,\n  PasskeyConfigurationError,\n} from \"@yielded/auth/Passkey\";\nimport type {\n  PasswordAction,\n  PasswordPersistence,\n  PasswordUnavailable,\n} from \"@yielded/auth/Password\";\nimport type { PhoneAdmission, PhoneSignInTargets } from \"@yielded/auth/PhoneOtp\";\nimport type { ProofPersistence } from \"@yielded/auth/Proofs\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type {\n  AuthenticationAuthority,\n  AuthenticationRequirement,\n  make as makeSessions,\n} from \"@yielded/auth/Sessions\";\nimport { type Context, type Crypto, type Effect, type Layer, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { StorageRole } from \"./storage-tables\";\n\nexport class PersistenceConfigurationError extends Schema.TaggedError<PersistenceConfigurationError>()(\n  \"PersistenceConfigurationError\",\n  { reason: Schema.String },\n) {}\n\nexport type ClaimsCodec = Schema.Codec<unknown, unknown, never, never>;\n\nexport interface PasskeyFeature {\n  readonly kind: \"passkey\";\n  readonly moduleId: string;\n  readonly policy: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError, PasskeyConfig>;\n  readonly management?: boolean;\n  readonly managementPolicy?: PasskeyManagementPolicy;\n}\n\nexport interface Strategy {\n  readonly strategy: object;\n  readonly persistence?:\n    | PasskeyFeature\n    | {\n        readonly kind: \"password\" | \"phone\" | \"email\";\n        readonly moduleId: string;\n        readonly lifecycle?: boolean;\n        readonly management?: boolean;\n        readonly addresses?: boolean;\n      };\n  readonly RegistrationAuthority?: Context.Key<unknown, unknown>;\n}\n\nexport interface Definition<C extends ClaimsCodec, Id extends string> {\n  readonly namespace: string;\n  readonly claims: C;\n  readonly sessionMode?: string | undefined;\n  readonly sessions: ReturnType<typeof makeSessions<C, Id>>;\n  readonly strategies: Readonly<Record<string, Strategy>>;\n}\n\ntype KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;\ntype Enabled<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n  Kind extends \"password\" | \"phone\" | \"email\" | \"passkey\",\n> = Extract<A[\"strategies\"][keyof A[\"strategies\"]], { persistence: { kind: Kind } }>;\n\ntype ManagedPassword<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"password\">, { persistence: { management: true } }>;\n\ntype ManagedPasskey<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"passkey\">, { persistence: { management: true } }>;\n\nexport type PasskeyRequirement<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n> = Enabled<A, \"passkey\"> extends never ? never : PasskeyConfig;\n\ntype RegistrationKey<S> = S extends { readonly RegistrationAuthority: infer K } ? K : never;\ntype Registration<S> =\n  RegistrationKey<S> extends Context.Key<infer _Id, infer Service>\n    ? Service extends { readonly register: (input: infer Input, ...args: never[]) => unknown }\n      ? Input extends { readonly registration: infer Value }\n        ? Value\n        : never\n      : never\n    : never;\n\nexport interface ProvisioningId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceProvisioning\";\n}\n\nexport type Provisioning<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = {\n  readonly [\n    K in keyof A[\"strategies\"] as A[\"strategies\"][K] extends {\n      persistence: { kind: \"password\"; management: true };\n    }\n      ? K\n      : never\n  ]: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration<A[\"strategies\"][K]>;\n  }) => Effect.Effect<SubjectId, PasswordUnavailable>;\n};\n\nexport type ProvisioningRequirement<\n  A extends { readonly namespace: string; readonly strategies: Readonly<Record<string, Strategy>> },\n> = ManagedPassword<A> extends never ? never : ProvisioningId<A[\"namespace\"]>;\n\ntype ProofRoles =\n  | \"proofRequests\"\n  | \"proofSeries\"\n  | \"proofGenerations\"\n  | \"proofContinuations\"\n  | \"proofScopes\"\n  | \"proofAbuse\"\n  | \"proofFailures\"\n  | \"proofCommands\";\n\ntype UsesProofs<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  | Enabled<A, \"phone\">\n  | Enabled<A, \"email\">\n  | ManagedPassword<A>;\n\nexport type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | AuthenticationAuthority\n  | KeyId<A[\"sessions\"][\"StatefulSessionPersistence\"]>\n  | KeyId<A[\"sessions\"][\"SessionRepository\"]>\n  | (Enabled<A, \"password\"> extends never ? never : PasswordPersistence)\n  | KeyId<RegistrationKey<ManagedPassword<A>>>\n  | (Enabled<A, \"passkey\"> extends never ? never : PasskeyPersistence | PasskeyCredentials)\n  | (ManagedPasskey<A> extends never\n      ? never\n      : PasskeyManagementPersistence | PasskeyEnrollmentContext)\n  | (Enabled<A, \"email\"> extends never ? never : EmailAddressPersistence)\n  | (UsesProofs<A> extends never ? never : ProofPersistence)\n  | (Enabled<A, \"phone\"> extends never ? never : PhoneAdmission | PhoneSignInTargets);\n\nexport type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | \"identifiers\"\n  | \"credentials\"\n  | \"sessions\"\n  | \"sessionFlows\"\n  | (Enabled<A, \"password\"> extends never\n      ? never\n      : \"passwords\" | \"passwordAttempts\" | \"passwordCommands\")\n  | (ManagedPassword<A> extends never ? never : \"passwordRegistrations\")\n  | (Enabled<A, \"phone\"> extends never ? never : \"phoneState\")\n  | (Enabled<A, \"email\"> extends never ? never : \"emailCredentials\" | \"emailCommands\")\n  | (Enabled<A, \"passkey\"> extends never\n      ? never\n      :\n          | \"passkeyCredentials\"\n          | \"passkeyOwnership\"\n          | \"passkeyHandles\"\n          | \"passkeyModules\"\n          | \"passkeyFlows\"\n          | \"passkeyAdmissions\"\n          | \"passkeyCharges\")\n  | (ManagedPasskey<A> extends never ? never : \"passkeyCommands\")\n  | (UsesProofs<A> extends never ? never : ProofRoles);\n\nexport interface SubjectOptions<T extends object, NativeId> {\n  readonly table: T;\n  readonly id: string;\n  readonly status: string;\n  readonly activeValue: unknown;\n  readonly securityRevision: string;\n  readonly idCodec: Schema.Codec<SubjectId, NativeId>;\n  readonly requirements: (\n    row: Readonly<Record<string, unknown>>,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Defaults to sign-in requirements. Recovery can have a distinct application policy. */\n  readonly actionRequirements?: (\n    row: Readonly<Record<string, unknown>>,\n    action: PasswordAction | EmailAction | PasskeyActionChallenge[\"action\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n}\n\n/** Codecs at the application-owned subject and timestamp boundary. */\nexport interface SubjectMapping {\n  readonly table: object;\n  readonly id: string;\n  readonly status: string;\n  readonly securityRevision: string;\n  readonly activeValue: unknown;\n  readonly requirements: SubjectOptions<object, unknown>[\"requirements\"];\n  readonly actionRequirements: NonNullable<SubjectOptions<object, unknown>[\"actionRequirements\"]>;\n  readonly toSubject: (value: unknown) => Effect.Effect<SubjectId, PersistenceMappingError>;\n  readonly toNative: (value: SubjectId) => Effect.Effect<unknown, PersistenceMappingError>;\n  readonly toSubjectSync: (value: unknown) => SubjectId;\n  readonly toNativeSync: (value: SubjectId) => unknown;\n}\n\nexport interface MappingInput {\n  readonly tables: Partial<Record<StorageRole, object>>;\n  readonly subjects: SubjectMapping;\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly decodeInstantSync: (value: unknown) => number;\n}\n\nexport interface StorageLayout<\n  T extends object,\n  Role extends StorageRole = StorageRole,\n> extends MappingInput {\n  readonly namespace: string;\n  readonly schema: Readonly<Record<Role, T>>;\n}\n\nexport interface ConfigId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceConfig\";\n}\n\nexport interface TimestampOptions<Instant> {\n  readonly type: \"text\" | \"integer\";\n  readonly codec: Schema.Codec<number, Instant>;\n}\n\nexport interface BoundPersistence<\n  T extends object,\n  R,\n  C extends ClaimsCodec,\n  Id extends string,\n  A extends Definition<C, Id>,\n> {\n  readonly Config: Context.Service<ConfigId<A[\"namespace\"]>, StorageLayout<T, Roles<C, Id, A>>> & {\n    readonly layer: (\n      value: StorageLayout<T, Roles<C, Id, A>>,\n    ) => Layer.Layer<ConfigId<A[\"namespace\"]>>;\n  };\n  /** Create only the application subject. Runs inside the owning auth SQL transaction;\n   * use that SqlClient (including Drizzle over it), and return the new subject ID.\n   * Do not perform external side effects or open an independent transaction here.\n   */\n  readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;\n  readonly layer: Layer.Layer<\n    Ports<C, Id, A>,\n    PersistenceConfigurationError,\n    | Crypto.Crypto\n    | ConfigId<A[\"namespace\"]>\n    | ProvisioningRequirement<A>\n    | PasskeyRequirement<A>\n    | SqlClient.SqlClient\n    | R\n  >;\n  readonly managed: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n    /** Stable SQL identifier prefix; reuse the deployed prefix for existing tables. */\n    readonly prefix: string;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n  readonly map: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables: Readonly<Record<Roles<C, Id, A>, T>>;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n}\n\n/** Shared configuration shape. The backend chooses table types and service requirements. */\nexport interface PersistenceApi<T extends object, R = never> {\n  readonly make: <\n    C extends ClaimsCodec,\n    const Id extends string,\n    const A extends Definition<C, Id>,\n  >(\n    auth: A & Definition<C, Id>,\n  ) => BoundPersistence<T, R, C, Id, A>;\n}\n"],"mappings":";;AAgCA,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA,EAAE,QAAQ,OAAO,OAAO,CAC1B,CAAC,CAAC,CAAC"}

package/dist/internal/models/password-model.d.mts

@@ -9,12 +9,6 @@ import { LoginIdentifier, RecoveryReference } from "@yielded/auth/Identity";
 type ColumnKey<T extends TableModel> = T["column"];
 export type PasswordAttemptAction = "sign-in" | "change";
 export type PasswordAttemptState = "pending" | "verified" | "rejected";
-export type PasswordRateScopeKind = "action" | "identifier" | "subject";
-export interface PasswordScopeKeys {
-  readonly action: string;
-  readonly identifier: string;
-  readonly subject?: string;
-}
 export interface PasswordSubjectTable<Subject extends TableModel, _NativeSubjectId> {
   readonly table: Subject["table"];
   readonly id: ColumnKey<Subject>;
@@ -127,38 +121,6 @@ export interface PasswordAttemptTable<Attempt extends TableModel, NativeSubjectI
     readonly state: "pending";
   }) => Attempt["insert"];
 }
-export interface PasswordRateScopeTable<RateScope extends TableModel> {
-  readonly table: RateScope["table"];
-  readonly moduleId: ColumnKey<RateScope>;
-  readonly action: ColumnKey<RateScope>;
-  readonly scopeKind: ColumnKey<RateScope>;
-  readonly scopeKey: ColumnKey<RateScope>;
-  readonly encodeInsert: (input: {
-    readonly moduleId: string;
-    readonly action: PasswordAttemptAction;
-    readonly scopeKind: PasswordRateScopeKind;
-    readonly scopeKey: string;
-  }) => RateScope["insert"];
-}
-export interface PasswordChargeTable<Charge extends TableModel> {
-  readonly table: Charge["table"];
-  readonly moduleId: ColumnKey<Charge>;
-  readonly action: ColumnKey<Charge>;
-  readonly scopeKind: ColumnKey<Charge>;
-  readonly scopeKey: ColumnKey<Charge>;
-  readonly attemptId: ColumnKey<Charge>;
-  readonly occurredAt: ColumnKey<Charge>;
-  readonly retentionUntil: ColumnKey<Charge>;
-  readonly encodeInsert: (input: {
-    readonly moduleId: string;
-    readonly action: PasswordAttemptAction;
-    readonly scopeKind: PasswordRateScopeKind;
-    readonly scopeKey: string;
-    readonly attemptId: PasswordAttemptId;
-    readonly occurredAtMillis: number;
-    readonly retentionUntilMillis: number;
-  }) => Charge["insert"];
-}
 export interface PasswordCommandTable<Command extends TableModel> {
   readonly table: Command["table"];
   readonly moduleId: ColumnKey<Command>;
@@ -182,16 +144,12 @@ export interface RequiredPasswordConstraints {
   readonly credentialSubject: "unique(credential.moduleId,credential.subjectId)";
   readonly credentialId: "unique(credential.moduleId,credential.credentialId)";
   readonly attempt: "unique(attempt.moduleId,attempt.attemptId)";
-  readonly rateScope: "unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)";
-  readonly charge: "unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)";
   readonly command: "unique(command.moduleId,command.commandId)";
 }
 export declare const requiredPasswordConstraints: RequiredPasswordConstraints;
 export interface PasswordConstraintClassifier {
   /** Match only the mapped command uniqueness constraint. */
   readonly isCommandConflict: (cause: unknown) => boolean;
-  /** Match only the mapped rate-scope uniqueness constraint. */
-  readonly isRateScopeConflict: (cause: unknown) => boolean;
 }
 export interface PasswordD1Clock<Expression extends SqlExpression = SqlExpression> {
   readonly engineNow: Expression;
@@ -199,24 +157,16 @@ export interface PasswordD1Clock<Expression extends SqlExpression = SqlExpressio
   readonly engineInstantMinus: (millis: number) => Expression;
   readonly engineInstantPlus: (millis: number) => Expression;
 }
-export interface PasswordPersistenceMapping<Subject extends TableModel, Identifier extends TableModel, Credential extends TableModel, AuthorityCredential extends TableModel, Attempt extends TableModel, RateScope extends TableModel, Charge extends TableModel, Command extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> extends PasswordConstraintClassifier {
+export interface PasswordPersistenceMapping<Subject extends TableModel, Identifier extends TableModel, Credential extends TableModel, AuthorityCredential extends TableModel, Attempt extends TableModel, Command extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> extends PasswordConstraintClassifier {
   readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;
   readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;
   readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;
   /** Every factor revision named by action evidence, including non-password factors. */
   readonly authorityCredential: PasswordAuthorityCredentialTable<AuthorityCredential, NativeSubjectId>;
   readonly attempt: PasswordAttemptTable<Attempt, NativeSubjectId>;
-  readonly rateScope: PasswordRateScopeTable<RateScope>;
-  readonly charge: PasswordChargeTable<Charge>;
   readonly command: PasswordCommandTable<Command>;
   readonly subjectId: SubjectIdCodec<NativeSubjectId>;
   readonly constraints: RequiredPasswordConstraints;
-  readonly scopeKeys: (input: {
-    readonly moduleId: string;
-    readonly action: PasswordAttemptAction;
-    readonly identifier: LoginIdentifier;
-    readonly subjectId?: string;
-  }) => PasswordScopeKeys;
   readonly encodeInstant: (epochMillis: number) => unknown;
   readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;
   readonly allocateAttemptId?: Effect.Effect<PasswordAttemptId, PersistenceMappingError>;
@@ -230,7 +180,7 @@ export interface PasswordPersistenceMapping<Subject extends TableModel, Identifi
   readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
   readonly d1?: PasswordD1Clock<Expression>;
 }
-export type D1PasswordPersistenceMapping<Subject extends TableModel, Identifier extends TableModel, Credential extends TableModel, AuthorityCredential extends TableModel, Attempt extends TableModel, RateScope extends TableModel, Charge extends TableModel, Command extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> = PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, NativeSubjectId, Expression> & {
+export type D1PasswordPersistenceMapping<Subject extends TableModel, Identifier extends TableModel, Credential extends TableModel, AuthorityCredential extends TableModel, Attempt extends TableModel, Command extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> = PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, Command, NativeSubjectId, Expression> & {
   readonly d1: PasswordD1Clock<Expression>;
   readonly subject: PasswordSubjectTable<Subject, NativeSubjectId> & {
     readonly d1ActiveStatusValue: unknown;
@@ -322,7 +272,7 @@ export type PasswordRegistrationMapping<Registration, Subject extends TableModel
   readonly allocateRecoveryReference?: Effect.Effect<typeof RecoveryReference.Type, PersistenceMappingError>;
   readonly allocateRecoveryReferenceSync?: () => typeof RecoveryReference.Type;
 });
-export type AnyPasswordPersistenceMapping<Expression extends SqlExpression = SqlExpression> = PasswordPersistenceMapping<AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, unknown, Expression>;
+export type AnyPasswordPersistenceMapping<Expression extends SqlExpression = SqlExpression> = PasswordPersistenceMapping<AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, unknown, Expression>;
 export type AnyPasswordRegistrationMapping<Registration = unknown, Expression extends SqlExpression = SqlExpression> = PasswordRegistrationMapping<Registration, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, unknown, Expression>;
 //#endregion
 //# sourceMappingURL=password-model.d.mts.map

package/dist/internal/models/password-model.mjs

@@ -6,8 +6,6 @@ const requiredPasswordConstraints = {
 	credentialSubject: "unique(credential.moduleId,credential.subjectId)",
 	credentialId: "unique(credential.moduleId,credential.credentialId)",
 	attempt: "unique(attempt.moduleId,attempt.attemptId)",
-	rateScope: "unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)",
-	charge: "unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)",
 	command: "unique(command.moduleId,command.commandId)"
 };
 const requiredPasswordRegistrationConstraints = {

package/dist/internal/models/password-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password-model.mjs","names":[],"sources":["../../../src/internal/models/password-model.ts"],"sourcesContent":["import { type RecoveryReference, type LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasswordAction,\n  PasswordAttemptId,\n  PasswordCredentialSnapshot,\n  PasswordReplacement,\n  PasswordRegistrationDecision,\n  EncodedPasswordHash,\n} from \"@yielded/auth/Password\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport type { Effect, Redacted } from \"effect\";\n\nimport type { AnyTableModel, TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./common\";\n\ntype ColumnKey<T extends Table> = T[\"column\"];\n\nexport type PasswordAttemptAction = \"sign-in\" | \"change\";\n\nexport type PasswordAttemptState = \"pending\" | \"verified\" | \"rejected\";\n\nexport type PasswordRateScopeKind = \"action\" | \"identifier\" | \"subject\";\n\nexport interface PasswordScopeKeys {\n  readonly action: string;\n  readonly identifier: string;\n  readonly subject?: string;\n}\n\nexport interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {\n  readonly table: Subject[\"table\"];\n  readonly id: ColumnKey<Subject>;\n  readonly status: ColumnKey<Subject>;\n  readonly securityRevision: ColumnKey<Subject>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly decodeRequirement: (\n    row: Subject[\"select\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Current policy for this exact credential mutation, decoded under the subject lock. */\n  readonly decodeActionRequirement: (\n    row: Subject[\"select\"],\n    action: PasswordAction,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  readonly nextSecurityRevision?: (\n    current: SecurityRevision,\n  ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  /** Required only by D1 conditional statements. */\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface PasswordIdentifierTable<\n  Identifier extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: Identifier[\"table\"];\n  readonly namespace: ColumnKey<Identifier>;\n  readonly value: ColumnKey<Identifier>;\n  readonly subjectId: ColumnKey<Identifier>;\n  readonly verifiedAt: ColumnKey<Identifier>;\n  readonly bindingRevision: ColumnKey<Identifier>;\n  /** Consumer-owned current login/recovery eligibility, including row status. */\n  readonly isCurrent: (row: Identifier[\"select\"]) => boolean;\n  /** Required by D1 so current ownership/eligibility is rechecked in the batch. */\n  readonly d1CurrentCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n  }) => Expression;\n  readonly encodeInitialInsert: (\n    identifier: LoginIdentifier,\n    subjectId: NativeSubjectId,\n    bindingRevision: SecurityRevision,\n  ) => Identifier[\"insert\"];\n}\n\nexport interface PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {\n  readonly table: Credential[\"table\"];\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly revision: ColumnKey<Credential>;\n  readonly status?: ColumnKey<Credential>;\n  readonly isActiveStatus?: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n  readonly encodeInsert: (input: {\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => Credential[\"insert\"];\n  readonly encodeRevision: (revision: SecurityRevision) => Partial<Credential[\"insert\"]>;\n}\n\nexport interface PasswordCredentialTable<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> {\n  readonly table: Credential[\"table\"];\n  readonly moduleId: ColumnKey<Credential>;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly credentialRevision: ColumnKey<Credential>;\n  readonly verifierVersion: ColumnKey<Credential>;\n  readonly verifier: ColumnKey<Credential>;\n  readonly normalization: ColumnKey<Credential>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly replacement: PasswordReplacement;\n  }) => Credential[\"insert\"];\n  readonly encodeVerifier: (\n    verifier: Redacted.Redacted<EncodedPasswordHash>,\n    verifierVersion: SecurityRevision,\n  ) => Partial<Credential[\"insert\"]>;\n  readonly encodeReplacement: (input: {\n    readonly replacement: PasswordReplacement;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n  }) => Partial<Credential[\"insert\"]>;\n  readonly decode: (input: {\n    readonly moduleId: string;\n    readonly subject: Subject[\"select\"];\n    readonly identifier: Identifier[\"select\"];\n    readonly credential: Credential[\"select\"];\n  }) => Effect.Effect<PasswordCredentialSnapshot, PersistenceMappingError>;\n}\n\nexport interface PasswordAttemptRecord {\n  readonly moduleId: string;\n  readonly action: PasswordAttemptAction;\n  readonly attemptId: PasswordAttemptId;\n  readonly identifier: LoginIdentifier;\n  readonly subjectId?: string;\n  readonly credentialId?: string;\n  readonly securityRevision?: SecurityRevision;\n  readonly credentialRevision?: SecurityRevision;\n  readonly verifierVersion?: SecurityRevision;\n  readonly identifierBindingRevision?: SecurityRevision;\n  readonly admittedAtMillis: number;\n  readonly deadlineMillis: number;\n  readonly retentionUntilMillis: number;\n}\n\nexport interface PasswordAttemptTable<Attempt extends Table, NativeSubjectId> {\n  readonly table: Attempt[\"table\"];\n  readonly moduleId: ColumnKey<Attempt>;\n  readonly action: ColumnKey<Attempt>;\n  readonly attemptId: ColumnKey<Attempt>;\n  readonly identifierNamespace: ColumnKey<Attempt>;\n  readonly identifierValue: ColumnKey<Attempt>;\n  readonly subjectId: ColumnKey<Attempt>;\n  readonly credentialId: ColumnKey<Attempt>;\n  readonly securityRevision: ColumnKey<Attempt>;\n  readonly credentialRevision: ColumnKey<Attempt>;\n  readonly verifierVersion: ColumnKey<Attempt>;\n  readonly identifierBindingRevision: ColumnKey<Attempt>;\n  readonly admittedAt: ColumnKey<Attempt>;\n  readonly deadline: ColumnKey<Attempt>;\n  readonly retentionUntil: ColumnKey<Attempt>;\n  readonly state: ColumnKey<Attempt>;\n  readonly encodeInsert: (\n    record: PasswordAttemptRecord,\n    input: {\n      readonly nativeSubjectId?: NativeSubjectId;\n      readonly state: \"pending\";\n    },\n  ) => Attempt[\"insert\"];\n}\n\nexport interface PasswordRateScopeTable<RateScope extends Table> {\n  readonly table: RateScope[\"table\"];\n  readonly moduleId: ColumnKey<RateScope>;\n  readonly action: ColumnKey<RateScope>;\n  readonly scopeKind: ColumnKey<RateScope>;\n  readonly scopeKey: ColumnKey<RateScope>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly action: PasswordAttemptAction;\n    readonly scopeKind: PasswordRateScopeKind;\n    readonly scopeKey: string;\n  }) => RateScope[\"insert\"];\n}\n\nexport interface PasswordChargeTable<Charge extends Table> {\n  readonly table: Charge[\"table\"];\n  readonly moduleId: ColumnKey<Charge>;\n  readonly action: ColumnKey<Charge>;\n  readonly scopeKind: ColumnKey<Charge>;\n  readonly scopeKey: ColumnKey<Charge>;\n  readonly attemptId: ColumnKey<Charge>;\n  readonly occurredAt: ColumnKey<Charge>;\n  readonly retentionUntil: ColumnKey<Charge>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly action: PasswordAttemptAction;\n    readonly scopeKind: PasswordRateScopeKind;\n    readonly scopeKey: string;\n    readonly attemptId: PasswordAttemptId;\n    readonly occurredAtMillis: number;\n    readonly retentionUntilMillis: number;\n  }) => Charge[\"insert\"];\n}\n\nexport interface PasswordCommandTable<Command extends Table> {\n  readonly table: Command[\"table\"];\n  readonly moduleId: ColumnKey<Command>;\n  readonly commandId: ColumnKey<Command>;\n  readonly action: ColumnKey<Command>;\n  readonly bindingDigest: ColumnKey<Command>;\n  readonly decision: ColumnKey<Command>;\n  readonly retentionUntil: ColumnKey<Command>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly action: string;\n    readonly bindingDigest: string;\n    readonly decision: \"changed\";\n    readonly retentionUntilMillis: number;\n  }) => Command[\"insert\"];\n}\n\nexport interface RequiredPasswordConstraints {\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n  readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n  readonly credentialId: \"unique(credential.moduleId,credential.credentialId)\";\n  readonly attempt: \"unique(attempt.moduleId,attempt.attemptId)\";\n  readonly rateScope: \"unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)\";\n  readonly charge: \"unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)\";\n  readonly command: \"unique(command.moduleId,command.commandId)\";\n}\n\nexport const requiredPasswordConstraints: RequiredPasswordConstraints = {\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n  credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n  credentialId: \"unique(credential.moduleId,credential.credentialId)\",\n  attempt: \"unique(attempt.moduleId,attempt.attemptId)\",\n  rateScope: \"unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)\",\n  charge: \"unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)\",\n  command: \"unique(command.moduleId,command.commandId)\",\n};\n\nexport interface PasswordConstraintClassifier {\n  /** Match only the mapped command uniqueness constraint. */\n  readonly isCommandConflict: (cause: unknown) => boolean;\n  /** Match only the mapped rate-scope uniqueness constraint. */\n  readonly isRateScopeConflict: (cause: unknown) => boolean;\n}\n\nexport interface PasswordD1Clock<Expression extends SqlExpression = SqlExpression> {\n  readonly engineNow: Expression;\n  readonly engineNowMillis: Expression;\n  readonly engineInstantMinus: (millis: number) => Expression;\n  readonly engineInstantPlus: (millis: number) => Expression;\n}\n\nexport interface PasswordPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  RateScope extends Table,\n  Charge extends Table,\n  Command extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> extends PasswordConstraintClassifier {\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;\n  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  /** Every factor revision named by action evidence, including non-password factors. */\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly attempt: PasswordAttemptTable<Attempt, NativeSubjectId>;\n  readonly rateScope: PasswordRateScopeTable<RateScope>;\n  readonly charge: PasswordChargeTable<Charge>;\n  readonly command: PasswordCommandTable<Command>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredPasswordConstraints;\n  readonly scopeKeys: (input: {\n    readonly moduleId: string;\n    readonly action: PasswordAttemptAction;\n    readonly identifier: LoginIdentifier;\n    readonly subjectId?: string;\n  }) => PasswordScopeKeys;\n  readonly encodeInstant: (epochMillis: number) => unknown;\n  readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly allocateAttemptId?: Effect.Effect<PasswordAttemptId, PersistenceMappingError>;\n  readonly allocateAttemptIdSync?: () => PasswordAttemptId;\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n  readonly commandRetentionMillis: number;\n  /** All semantic replacements still bump subject revision. This flag only declares bearer invalidation latency. */\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n  readonly d1?: PasswordD1Clock<Expression>;\n}\n\nexport type D1PasswordPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  RateScope extends Table,\n  Charge extends Table,\n  Command extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordPersistenceMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Attempt,\n  RateScope,\n  Charge,\n  Command,\n  NativeSubjectId,\n  Expression\n> & {\n  readonly d1: PasswordD1Clock<Expression>;\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId> & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression> & {\n    readonly d1CurrentCondition: (input: {\n      readonly identifier: LoginIdentifier;\n      readonly nativeSubjectId: NativeSubjectId;\n    }) => Expression;\n  };\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  > & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n};\n\nexport type PasswordRegistrationState = \"pending\" | \"created\";\n\nexport interface PasswordRegistrationIntent<Registration> {\n  readonly moduleId: string;\n  readonly requestId: string;\n  readonly identifier: LoginIdentifier;\n  readonly registration: Registration;\n  readonly replacement: PasswordReplacement;\n}\n\nexport interface PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> {\n  readonly table: Request[\"table\"];\n  readonly moduleId: ColumnKey<Request>;\n  readonly requestId: ColumnKey<Request>;\n  readonly state: ColumnKey<Request>;\n  readonly subjectId: ColumnKey<Request>;\n  readonly recoveryReference: ColumnKey<Request>;\n  readonly encodeInsert: (\n    input: PasswordRegistrationIntent<Registration>,\n    state: {\n      readonly state: PasswordRegistrationState;\n      readonly nativeSubjectId?: NativeSubjectId;\n      readonly recoveryReference?: typeof RecoveryReference.Type;\n    },\n  ) => Request[\"insert\"];\n  /** Replay projection must never expose a stored subject or decode protected intent. */\n  readonly decodeReplay: (row: Request[\"select\"]) => Effect.Effect<\n    Exclude<\n      PasswordRegistrationDecision,\n      {\n        readonly _tag: \"Created\";\n      }\n    >,\n    PersistenceMappingError\n  >;\n}\n\nexport interface PasswordRegistrationProvisioning<\n  Registration,\n  Subject extends Table,\n  NativeSubjectId,\n> {\n  readonly encodeSubjectInsert: (\n    input: PasswordRegistrationIntent<Registration>,\n    values: {\n      readonly nativeSubjectId: NativeSubjectId | undefined;\n      readonly securityRevision: SecurityRevision;\n    },\n  ) => Subject[\"insert\"];\n  readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n  readonly allocateSubjectIdSync?: () => NativeSubjectId;\n  /** Interactive targets use this for database-generated/autoincrement keys. */\n  readonly decodeGeneratedId?: (\n    rows: ReadonlyArray<unknown>,\n  ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n}\n\nexport interface RequiredPasswordRegistrationConstraints {\n  readonly request: \"unique(registration.moduleId,registration.requestId)\";\n  readonly recoveryReference: \"unique(registration.recoveryReference)\";\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n}\n\nexport const requiredPasswordRegistrationConstraints: RequiredPasswordRegistrationConstraints = {\n  request: \"unique(registration.moduleId,registration.requestId)\",\n  recoveryReference: \"unique(registration.recoveryReference)\",\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n};\n\nexport interface PasswordRegistrationConstraintClassifier {\n  readonly isRequestConflict: (cause: unknown) => boolean;\n  readonly isIdentifierConflict: (cause: unknown) => boolean;\n  readonly isCredentialConflict: (cause: unknown) => boolean;\n}\n\nexport type PasswordRegistrationMapping<\n  Registration,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Request extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordRegistrationConstraintClassifier & {\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;\n  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly registration: PasswordRegistrationTable<Registration, Request, NativeSubjectId>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredPasswordRegistrationConstraints;\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n} & (\n    | {\n        readonly mode: \"atomic\";\n        readonly provisioning: PasswordRegistrationProvisioning<\n          Registration,\n          Subject,\n          NativeSubjectId\n        > &\n          (\n            | {\n                readonly idMode: \"allocated\";\n                readonly allocateSubjectId: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n              }\n            | {\n                readonly idMode: \"synchronous\";\n                readonly allocateSubjectIdSync: () => NativeSubjectId;\n              }\n            | {\n                readonly idMode: \"generated\";\n                readonly decodeGeneratedId: (\n                  rows: ReadonlyArray<unknown>,\n                ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n              }\n          );\n      }\n    | {\n        readonly mode: \"pending\";\n        readonly allocateRecoveryReference?: Effect.Effect<\n          typeof RecoveryReference.Type,\n          PersistenceMappingError\n        >;\n        readonly allocateRecoveryReferenceSync?: () => typeof RecoveryReference.Type;\n      }\n  );\n\nexport type AnyPasswordPersistenceMapping<Expression extends SqlExpression = SqlExpression> =\n  PasswordPersistenceMapping<\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    unknown,\n    Expression\n  >;\n\nexport type AnyPasswordRegistrationMapping<\n  Registration = unknown,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordRegistrationMapping<\n  Registration,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  Expression\n>;\n"],"mappings":";;AA4OA,MAAa,8BAA2D;CACtE,YAAY;CACZ,qBAAqB;CACrB,mBAAmB;CACnB,cAAc;CACd,SAAS;CACT,WAAW;CACX,QAAQ;CACR,SAAS;AACX;AAwKA,MAAa,0CAAmF;CAC9F,SAAS;CACT,mBAAmB;CACnB,YAAY;CACZ,mBAAmB;CACnB,qBAAqB;AACvB"}
+{"version":3,"file":"password-model.mjs","names":[],"sources":["../../../src/internal/models/password-model.ts"],"sourcesContent":["import { type RecoveryReference, type LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasswordAction,\n  PasswordAttemptId,\n  PasswordCredentialSnapshot,\n  PasswordReplacement,\n  PasswordRegistrationDecision,\n  EncodedPasswordHash,\n} from \"@yielded/auth/Password\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport type { Effect, Redacted } from \"effect\";\n\nimport type { AnyTableModel, TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./common\";\n\ntype ColumnKey<T extends Table> = T[\"column\"];\n\nexport type PasswordAttemptAction = \"sign-in\" | \"change\";\n\nexport type PasswordAttemptState = \"pending\" | \"verified\" | \"rejected\";\n\nexport interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {\n  readonly table: Subject[\"table\"];\n  readonly id: ColumnKey<Subject>;\n  readonly status: ColumnKey<Subject>;\n  readonly securityRevision: ColumnKey<Subject>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly decodeRequirement: (\n    row: Subject[\"select\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Current policy for this exact credential mutation, decoded under the subject lock. */\n  readonly decodeActionRequirement: (\n    row: Subject[\"select\"],\n    action: PasswordAction,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  readonly nextSecurityRevision?: (\n    current: SecurityRevision,\n  ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  /** Required only by D1 conditional statements. */\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface PasswordIdentifierTable<\n  Identifier extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: Identifier[\"table\"];\n  readonly namespace: ColumnKey<Identifier>;\n  readonly value: ColumnKey<Identifier>;\n  readonly subjectId: ColumnKey<Identifier>;\n  readonly verifiedAt: ColumnKey<Identifier>;\n  readonly bindingRevision: ColumnKey<Identifier>;\n  /** Consumer-owned current login/recovery eligibility, including row status. */\n  readonly isCurrent: (row: Identifier[\"select\"]) => boolean;\n  /** Required by D1 so current ownership/eligibility is rechecked in the batch. */\n  readonly d1CurrentCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n  }) => Expression;\n  readonly encodeInitialInsert: (\n    identifier: LoginIdentifier,\n    subjectId: NativeSubjectId,\n    bindingRevision: SecurityRevision,\n  ) => Identifier[\"insert\"];\n}\n\nexport interface PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {\n  readonly table: Credential[\"table\"];\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly revision: ColumnKey<Credential>;\n  readonly status?: ColumnKey<Credential>;\n  readonly isActiveStatus?: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n  readonly encodeInsert: (input: {\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => Credential[\"insert\"];\n  readonly encodeRevision: (revision: SecurityRevision) => Partial<Credential[\"insert\"]>;\n}\n\nexport interface PasswordCredentialTable<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> {\n  readonly table: Credential[\"table\"];\n  readonly moduleId: ColumnKey<Credential>;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly credentialRevision: ColumnKey<Credential>;\n  readonly verifierVersion: ColumnKey<Credential>;\n  readonly verifier: ColumnKey<Credential>;\n  readonly normalization: ColumnKey<Credential>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly replacement: PasswordReplacement;\n  }) => Credential[\"insert\"];\n  readonly encodeVerifier: (\n    verifier: Redacted.Redacted<EncodedPasswordHash>,\n    verifierVersion: SecurityRevision,\n  ) => Partial<Credential[\"insert\"]>;\n  readonly encodeReplacement: (input: {\n    readonly replacement: PasswordReplacement;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n  }) => Partial<Credential[\"insert\"]>;\n  readonly decode: (input: {\n    readonly moduleId: string;\n    readonly subject: Subject[\"select\"];\n    readonly identifier: Identifier[\"select\"];\n    readonly credential: Credential[\"select\"];\n  }) => Effect.Effect<PasswordCredentialSnapshot, PersistenceMappingError>;\n}\n\nexport interface PasswordAttemptRecord {\n  readonly moduleId: string;\n  readonly action: PasswordAttemptAction;\n  readonly attemptId: PasswordAttemptId;\n  readonly identifier: LoginIdentifier;\n  readonly subjectId?: string;\n  readonly credentialId?: string;\n  readonly securityRevision?: SecurityRevision;\n  readonly credentialRevision?: SecurityRevision;\n  readonly verifierVersion?: SecurityRevision;\n  readonly identifierBindingRevision?: SecurityRevision;\n  readonly admittedAtMillis: number;\n  readonly deadlineMillis: number;\n  readonly retentionUntilMillis: number;\n}\n\nexport interface PasswordAttemptTable<Attempt extends Table, NativeSubjectId> {\n  readonly table: Attempt[\"table\"];\n  readonly moduleId: ColumnKey<Attempt>;\n  readonly action: ColumnKey<Attempt>;\n  readonly attemptId: ColumnKey<Attempt>;\n  readonly identifierNamespace: ColumnKey<Attempt>;\n  readonly identifierValue: ColumnKey<Attempt>;\n  readonly subjectId: ColumnKey<Attempt>;\n  readonly credentialId: ColumnKey<Attempt>;\n  readonly securityRevision: ColumnKey<Attempt>;\n  readonly credentialRevision: ColumnKey<Attempt>;\n  readonly verifierVersion: ColumnKey<Attempt>;\n  readonly identifierBindingRevision: ColumnKey<Attempt>;\n  readonly admittedAt: ColumnKey<Attempt>;\n  readonly deadline: ColumnKey<Attempt>;\n  readonly retentionUntil: ColumnKey<Attempt>;\n  readonly state: ColumnKey<Attempt>;\n  readonly encodeInsert: (\n    record: PasswordAttemptRecord,\n    input: {\n      readonly nativeSubjectId?: NativeSubjectId;\n      readonly state: \"pending\";\n    },\n  ) => Attempt[\"insert\"];\n}\n\nexport interface PasswordCommandTable<Command extends Table> {\n  readonly table: Command[\"table\"];\n  readonly moduleId: ColumnKey<Command>;\n  readonly commandId: ColumnKey<Command>;\n  readonly action: ColumnKey<Command>;\n  readonly bindingDigest: ColumnKey<Command>;\n  readonly decision: ColumnKey<Command>;\n  readonly retentionUntil: ColumnKey<Command>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly action: string;\n    readonly bindingDigest: string;\n    readonly decision: \"changed\";\n    readonly retentionUntilMillis: number;\n  }) => Command[\"insert\"];\n}\n\nexport interface RequiredPasswordConstraints {\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n  readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n  readonly credentialId: \"unique(credential.moduleId,credential.credentialId)\";\n  readonly attempt: \"unique(attempt.moduleId,attempt.attemptId)\";\n  readonly command: \"unique(command.moduleId,command.commandId)\";\n}\n\nexport const requiredPasswordConstraints: RequiredPasswordConstraints = {\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n  credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n  credentialId: \"unique(credential.moduleId,credential.credentialId)\",\n  attempt: \"unique(attempt.moduleId,attempt.attemptId)\",\n  command: \"unique(command.moduleId,command.commandId)\",\n};\n\nexport interface PasswordConstraintClassifier {\n  /** Match only the mapped command uniqueness constraint. */\n  readonly isCommandConflict: (cause: unknown) => boolean;\n}\n\nexport interface PasswordD1Clock<Expression extends SqlExpression = SqlExpression> {\n  readonly engineNow: Expression;\n  readonly engineNowMillis: Expression;\n  readonly engineInstantMinus: (millis: number) => Expression;\n  readonly engineInstantPlus: (millis: number) => Expression;\n}\n\nexport interface PasswordPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  Command extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> extends PasswordConstraintClassifier {\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;\n  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  /** Every factor revision named by action evidence, including non-password factors. */\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly attempt: PasswordAttemptTable<Attempt, NativeSubjectId>;\n  readonly command: PasswordCommandTable<Command>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredPasswordConstraints;\n  readonly encodeInstant: (epochMillis: number) => unknown;\n  readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly allocateAttemptId?: Effect.Effect<PasswordAttemptId, PersistenceMappingError>;\n  readonly allocateAttemptIdSync?: () => PasswordAttemptId;\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n  readonly commandRetentionMillis: number;\n  /** All semantic replacements still bump subject revision. This flag only declares bearer invalidation latency. */\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n  readonly d1?: PasswordD1Clock<Expression>;\n}\n\nexport type D1PasswordPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  Command extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordPersistenceMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Attempt,\n  Command,\n  NativeSubjectId,\n  Expression\n> & {\n  readonly d1: PasswordD1Clock<Expression>;\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId> & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression> & {\n    readonly d1CurrentCondition: (input: {\n      readonly identifier: LoginIdentifier;\n      readonly nativeSubjectId: NativeSubjectId;\n    }) => Expression;\n  };\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  > & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n};\n\nexport type PasswordRegistrationState = \"pending\" | \"created\";\n\nexport interface PasswordRegistrationIntent<Registration> {\n  readonly moduleId: string;\n  readonly requestId: string;\n  readonly identifier: LoginIdentifier;\n  readonly registration: Registration;\n  readonly replacement: PasswordReplacement;\n}\n\nexport interface PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> {\n  readonly table: Request[\"table\"];\n  readonly moduleId: ColumnKey<Request>;\n  readonly requestId: ColumnKey<Request>;\n  readonly state: ColumnKey<Request>;\n  readonly subjectId: ColumnKey<Request>;\n  readonly recoveryReference: ColumnKey<Request>;\n  readonly encodeInsert: (\n    input: PasswordRegistrationIntent<Registration>,\n    state: {\n      readonly state: PasswordRegistrationState;\n      readonly nativeSubjectId?: NativeSubjectId;\n      readonly recoveryReference?: typeof RecoveryReference.Type;\n    },\n  ) => Request[\"insert\"];\n  /** Replay projection must never expose a stored subject or decode protected intent. */\n  readonly decodeReplay: (row: Request[\"select\"]) => Effect.Effect<\n    Exclude<\n      PasswordRegistrationDecision,\n      {\n        readonly _tag: \"Created\";\n      }\n    >,\n    PersistenceMappingError\n  >;\n}\n\nexport interface PasswordRegistrationProvisioning<\n  Registration,\n  Subject extends Table,\n  NativeSubjectId,\n> {\n  readonly encodeSubjectInsert: (\n    input: PasswordRegistrationIntent<Registration>,\n    values: {\n      readonly nativeSubjectId: NativeSubjectId | undefined;\n      readonly securityRevision: SecurityRevision;\n    },\n  ) => Subject[\"insert\"];\n  readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n  readonly allocateSubjectIdSync?: () => NativeSubjectId;\n  /** Interactive targets use this for database-generated/autoincrement keys. */\n  readonly decodeGeneratedId?: (\n    rows: ReadonlyArray<unknown>,\n  ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n}\n\nexport interface RequiredPasswordRegistrationConstraints {\n  readonly request: \"unique(registration.moduleId,registration.requestId)\";\n  readonly recoveryReference: \"unique(registration.recoveryReference)\";\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n}\n\nexport const requiredPasswordRegistrationConstraints: RequiredPasswordRegistrationConstraints = {\n  request: \"unique(registration.moduleId,registration.requestId)\",\n  recoveryReference: \"unique(registration.recoveryReference)\",\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n};\n\nexport interface PasswordRegistrationConstraintClassifier {\n  readonly isRequestConflict: (cause: unknown) => boolean;\n  readonly isIdentifierConflict: (cause: unknown) => boolean;\n  readonly isCredentialConflict: (cause: unknown) => boolean;\n}\n\nexport type PasswordRegistrationMapping<\n  Registration,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Request extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordRegistrationConstraintClassifier & {\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;\n  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly registration: PasswordRegistrationTable<Registration, Request, NativeSubjectId>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredPasswordRegistrationConstraints;\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n} & (\n    | {\n        readonly mode: \"atomic\";\n        readonly provisioning: PasswordRegistrationProvisioning<\n          Registration,\n          Subject,\n          NativeSubjectId\n        > &\n          (\n            | {\n                readonly idMode: \"allocated\";\n                readonly allocateSubjectId: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n              }\n            | {\n                readonly idMode: \"synchronous\";\n                readonly allocateSubjectIdSync: () => NativeSubjectId;\n              }\n            | {\n                readonly idMode: \"generated\";\n                readonly decodeGeneratedId: (\n                  rows: ReadonlyArray<unknown>,\n                ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n              }\n          );\n      }\n    | {\n        readonly mode: \"pending\";\n        readonly allocateRecoveryReference?: Effect.Effect<\n          typeof RecoveryReference.Type,\n          PersistenceMappingError\n        >;\n        readonly allocateRecoveryReferenceSync?: () => typeof RecoveryReference.Type;\n      }\n  );\n\nexport type AnyPasswordPersistenceMapping<Expression extends SqlExpression = SqlExpression> =\n  PasswordPersistenceMapping<\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    unknown,\n    Expression\n  >;\n\nexport type AnyPasswordRegistrationMapping<\n  Registration = unknown,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordRegistrationMapping<\n  Registration,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  Expression\n>;\n"],"mappings":";;AAgMA,MAAa,8BAA2D;CACtE,YAAY;CACZ,qBAAqB;CACrB,mBAAmB;CACnB,cAAc;CACd,SAAS;CACT,SAAS;AACX;AAwJA,MAAa,0CAAmF;CAC9F,SAAS;CACT,mBAAmB;CACnB,YAAY;CACZ,mBAAmB;CACnB,qBAAqB;AACvB"}

package/dist/internal/native-sql-table.d.mts

@@ -0,0 +1,30 @@
+import "./mapping-error.mjs";
+import { Effect } from "effect";
+import * as Statement$1 from "effect/sql/Statement";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/native-sql-table.d.ts
+/** Physical SQL representation only. Semantic row codecs and policy remain in
+ * the owning mapping. Execute assembled statements without name/result transforms. */
+export interface SqlTable {
+  readonly name: Statement$1.Fragment;
+  /** Alias reads only; writes continue to target the original physical table. */
+  readonly as: (alias: string) => SqlTable;
+  readonly column: (key: string) => Statement$1.Fragment;
+  /** Project every column under an ordinal alias, using a distinct prefix per table. */
+  readonly fields: (prefix: string) => Statement$1.Fragment;
+  readonly decode: (row: Readonly<Record<string, unknown>>, prefix: string) => Record<string, unknown>;
+  readonly value: (key: string, value: unknown) => Statement$1.Fragment;
+  /** Complete INSERT prefix; append conflict/returning clauses in the owning operation. */
+  readonly insert: (values: Readonly<Record<string, unknown>>) => Statement$1.Fragment;
+  /** Complete UPDATE ... SET prefix; the owning operation supplies its predicate. */
+  readonly update: (values: Readonly<Record<string, unknown>>) => Statement$1.Fragment;
+}
+export type NativeSqlTables = (table: object) => SqlTable;
+/** Prefixes are short ASCII identifiers so ordinal aliases cannot be truncated
+ * by PostgreSQL. Callers distinguish tables by prefix, never by physical names. */
+export declare const nativeSqlAlias: (prefix: string, index: number) => string;
+/** Cache physical metadata only; insert/update materialize values and hooks at
+ * each call. Construction acquires no client and owns no transaction. */
+export declare const makeNativeSqlTables: (client: SqlClient, convert?: (client: SqlClient, table: object) => SqlTable) => NativeSqlTables;
+//#endregion
+//# sourceMappingURL=native-sql-table.d.mts.map

package/dist/internal/native-sql-table.mjs

@@ -0,0 +1,104 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { Table, identifier } from "./sql-table.mjs";
+import { Effect } from "effect";
+import * as Statement$1 from "effect/sql/Statement";
+//#region src/internal/native-sql-table.ts
+/** Capture synchronous mapping callbacks without changing SQL execution errors. */
+const sqlMapping = (thunk) => Effect.try({
+	try: thunk,
+	catch: (cause) => PersistenceMappingError.make({
+		operation: "mapping",
+		cause
+	})
+});
+/** Prefixes are short ASCII identifiers so ordinal aliases cannot be truncated
+* by PostgreSQL. Callers distinguish tables by prefix, never by physical names. */
+const nativeSqlAlias = (prefix, index) => {
+	if (!/^[A-Za-z_][A-Za-z0-9_]{0,39}$/.test(prefix)) throw PersistenceMappingError.make({
+		operation: "mapping",
+		cause: "Invalid SQL alias prefix"
+	});
+	return `${prefix}${index}`;
+};
+const directTable = (client, physical) => {
+	if (!(physical instanceof Table)) throw PersistenceMappingError.make({
+		operation: "mapping",
+		cause: "Expected a SQL table"
+	});
+	const quote = (name) => {
+		if (name.includes("\0")) throw PersistenceMappingError.make({
+			operation: "mapping",
+			cause: "NUL in SQL identifier"
+		});
+		return client.literal(identifier(name));
+	};
+	const name = physical.schema === void 0 ? quote(physical.name) : client`${quote(physical.schema)}.${quote(physical.name)}`;
+	const columns = Object.entries(physical.columns);
+	const getColumn = (key) => {
+		const column = Object.hasOwn(physical.columns, key) ? physical.columns[key] : void 0;
+		if (column === void 0) throw PersistenceMappingError.make({
+			operation: "column",
+			cause: "Missing SQL column"
+		});
+		return column;
+	};
+	const value = (key, input) => {
+		const mapped = getColumn(key);
+		if (Statement$1.isFragment(input)) return input;
+		const encoded = input === null ? null : mapped.mapToDriverValue(input);
+		return Statement$1.fragment([Statement$1.parameter(typeof encoded === "boolean" ? client.onDialectOrElse({
+			sqlite: () => Number(encoded),
+			orElse: () => encoded
+		}) : encoded)]);
+	};
+	const entries = (values) => Object.entries(values).filter(([key, input]) => Object.hasOwn(physical.columns, key) && input !== void 0);
+	const bind = (alias) => {
+		const reference = alias === void 0 ? name : quote(alias);
+		const column = (key) => client`${reference}.${quote(getColumn(key).options.name)}`;
+		return {
+			name: alias === void 0 ? name : client`${name} AS ${reference}`,
+			as: bind,
+			column,
+			value,
+			fields: (prefix) => client.join(", ", false)(columns.map(([key], index) => client`${column(key)} AS ${quote(nativeSqlAlias(prefix, index))}`)),
+			decode: (row, prefix) => Object.fromEntries(columns.map(([key, field], index) => {
+				const alias = nativeSqlAlias(prefix, index);
+				if (!Object.hasOwn(row, alias)) throw PersistenceMappingError.make({
+					operation: "decode",
+					cause: "Missing SQL projection field"
+				});
+				return [key, field.decode(row[alias])];
+			})),
+			insert: (values) => {
+				const fields = entries(values);
+				if (fields.length === 0) return client`INSERT INTO ${name} DEFAULT VALUES`;
+				return client`INSERT INTO ${name} (${client.join(", ", false)(fields.map(([key]) => quote(getColumn(key).options.name)))}) VALUES (${client.join(", ", false)(fields.map(([key, input]) => value(key, input)))})`;
+			},
+			update: (values) => {
+				const fields = entries(values);
+				if (fields.length === 0) throw PersistenceMappingError.make({
+					operation: "mapping",
+					cause: "Empty SQL update"
+				});
+				return client`UPDATE ${name} SET ${client.join(", ", false)(fields.map(([key, input]) => client`${quote(getColumn(key).options.name)} = ${value(key, input)}`))}`;
+			}
+		};
+	};
+	return bind();
+};
+/** Cache physical metadata only; insert/update materialize values and hooks at
+* each call. Construction acquires no client and owns no transaction. */
+const makeNativeSqlTables = (client, convert = directTable) => {
+	const tables = /* @__PURE__ */ new WeakMap();
+	return (table) => {
+		const existing = tables.get(table);
+		if (existing !== void 0) return existing;
+		const mapped = convert(client, table);
+		tables.set(table, mapped);
+		return mapped;
+	};
+};
+//#endregion
+export { makeNativeSqlTables, nativeSqlAlias, sqlMapping };
+
+//# sourceMappingURL=native-sql-table.mjs.map