@yielded/auth-persistence 0.1.0-beta.22 → 0.1.0-beta.24

package/dist/internal/models/password-model.d.mts

@@ -3,18 +3,10 @@ import { AnyTableModel, SqlExpression, TableModel } from "../query-operations.mj
 import { SubjectIdCodec } from "./common.mjs";
 import { Effect, Redacted } from "effect";
 import { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
-import { EncodedPasswordHash, PasswordAction, PasswordAttemptId, PasswordCredentialSnapshot, PasswordRegistrationDecision, PasswordReplacement } from "@yielded/auth/Password";
+import { EncodedPasswordHash, PasswordAction, PasswordCredentialSnapshot, PasswordRegistrationDecision, PasswordReplacement } from "@yielded/auth/Password";
 import { LoginIdentifier, RecoveryReference } from "@yielded/auth/Identity";
 //#region src/internal/models/password-model.d.ts
 type ColumnKey<T extends TableModel> = T["column"];
-export type PasswordAttemptAction = "sign-in" | "change";
-export type PasswordAttemptState = "pending" | "verified" | "rejected";
-export type PasswordRateScopeKind = "action" | "identifier" | "subject";
-export interface PasswordScopeKeys {
-  readonly action: string;
-  readonly identifier: string;
-  readonly subject?: string;
-}
 export interface PasswordSubjectTable<Subject extends TableModel, _NativeSubjectId> {
   readonly table: Subject["table"];
   readonly id: ColumnKey<Subject>;
@@ -90,75 +82,6 @@ export interface PasswordCredentialTable<Subject extends TableModel, Identifier
     readonly credential: Credential["select"];
   }) => Effect.Effect<PasswordCredentialSnapshot, PersistenceMappingError>;
 }
-export interface PasswordAttemptRecord {
-  readonly moduleId: string;
-  readonly action: PasswordAttemptAction;
-  readonly attemptId: PasswordAttemptId;
-  readonly identifier: LoginIdentifier;
-  readonly subjectId?: string;
-  readonly credentialId?: string;
-  readonly securityRevision?: SecurityRevision;
-  readonly credentialRevision?: SecurityRevision;
-  readonly verifierVersion?: SecurityRevision;
-  readonly identifierBindingRevision?: SecurityRevision;
-  readonly admittedAtMillis: number;
-  readonly deadlineMillis: number;
-  readonly retentionUntilMillis: number;
-}
-export interface PasswordAttemptTable<Attempt extends TableModel, NativeSubjectId> {
-  readonly table: Attempt["table"];
-  readonly moduleId: ColumnKey<Attempt>;
-  readonly action: ColumnKey<Attempt>;
-  readonly attemptId: ColumnKey<Attempt>;
-  readonly identifierNamespace: ColumnKey<Attempt>;
-  readonly identifierValue: ColumnKey<Attempt>;
-  readonly subjectId: ColumnKey<Attempt>;
-  readonly credentialId: ColumnKey<Attempt>;
-  readonly securityRevision: ColumnKey<Attempt>;
-  readonly credentialRevision: ColumnKey<Attempt>;
-  readonly verifierVersion: ColumnKey<Attempt>;
-  readonly identifierBindingRevision: ColumnKey<Attempt>;
-  readonly admittedAt: ColumnKey<Attempt>;
-  readonly deadline: ColumnKey<Attempt>;
-  readonly retentionUntil: ColumnKey<Attempt>;
-  readonly state: ColumnKey<Attempt>;
-  readonly encodeInsert: (record: PasswordAttemptRecord, input: {
-    readonly nativeSubjectId?: NativeSubjectId;
-    readonly state: "pending";
-  }) => Attempt["insert"];
-}
-export interface PasswordRateScopeTable<RateScope extends TableModel> {
-  readonly table: RateScope["table"];
-  readonly moduleId: ColumnKey<RateScope>;
-  readonly action: ColumnKey<RateScope>;
-  readonly scopeKind: ColumnKey<RateScope>;
-  readonly scopeKey: ColumnKey<RateScope>;
-  readonly encodeInsert: (input: {
-    readonly moduleId: string;
-    readonly action: PasswordAttemptAction;
-    readonly scopeKind: PasswordRateScopeKind;
-    readonly scopeKey: string;
-  }) => RateScope["insert"];
-}
-export interface PasswordChargeTable<Charge extends TableModel> {
-  readonly table: Charge["table"];
-  readonly moduleId: ColumnKey<Charge>;
-  readonly action: ColumnKey<Charge>;
-  readonly scopeKind: ColumnKey<Charge>;
-  readonly scopeKey: ColumnKey<Charge>;
-  readonly attemptId: ColumnKey<Charge>;
-  readonly occurredAt: ColumnKey<Charge>;
-  readonly retentionUntil: ColumnKey<Charge>;
-  readonly encodeInsert: (input: {
-    readonly moduleId: string;
-    readonly action: PasswordAttemptAction;
-    readonly scopeKind: PasswordRateScopeKind;
-    readonly scopeKey: string;
-    readonly attemptId: PasswordAttemptId;
-    readonly occurredAtMillis: number;
-    readonly retentionUntilMillis: number;
-  }) => Charge["insert"];
-}
 export interface PasswordCommandTable<Command extends TableModel> {
   readonly table: Command["table"];
   readonly moduleId: ColumnKey<Command>;
@@ -181,17 +104,12 @@ export interface RequiredPasswordConstraints {
   readonly authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)";
   readonly credentialSubject: "unique(credential.moduleId,credential.subjectId)";
   readonly credentialId: "unique(credential.moduleId,credential.credentialId)";
-  readonly attempt: "unique(attempt.moduleId,attempt.attemptId)";
-  readonly rateScope: "unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)";
-  readonly charge: "unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)";
   readonly command: "unique(command.moduleId,command.commandId)";
 }
 export declare const requiredPasswordConstraints: RequiredPasswordConstraints;
 export interface PasswordConstraintClassifier {
   /** Match only the mapped command uniqueness constraint. */
   readonly isCommandConflict: (cause: unknown) => boolean;
-  /** Match only the mapped rate-scope uniqueness constraint. */
-  readonly isRateScopeConflict: (cause: unknown) => boolean;
 }
 export interface PasswordD1Clock<Expression extends SqlExpression = SqlExpression> {
   readonly engineNow: Expression;
@@ -199,28 +117,17 @@ export interface PasswordD1Clock<Expression extends SqlExpression = SqlExpressio
   readonly engineInstantMinus: (millis: number) => Expression;
   readonly engineInstantPlus: (millis: number) => Expression;
 }
-export interface PasswordPersistenceMapping<Subject extends TableModel, Identifier extends TableModel, Credential extends TableModel, AuthorityCredential extends TableModel, Attempt extends TableModel, RateScope extends TableModel, Charge extends TableModel, Command extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> extends PasswordConstraintClassifier {
+export interface PasswordPersistenceMapping<Subject extends TableModel, Identifier extends TableModel, Credential extends TableModel, AuthorityCredential extends TableModel, Command extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> extends PasswordConstraintClassifier {
   readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;
   readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;
   readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;
   /** Every factor revision named by action evidence, including non-password factors. */
   readonly authorityCredential: PasswordAuthorityCredentialTable<AuthorityCredential, NativeSubjectId>;
-  readonly attempt: PasswordAttemptTable<Attempt, NativeSubjectId>;
-  readonly rateScope: PasswordRateScopeTable<RateScope>;
-  readonly charge: PasswordChargeTable<Charge>;
   readonly command: PasswordCommandTable<Command>;
   readonly subjectId: SubjectIdCodec<NativeSubjectId>;
   readonly constraints: RequiredPasswordConstraints;
-  readonly scopeKeys: (input: {
-    readonly moduleId: string;
-    readonly action: PasswordAttemptAction;
-    readonly identifier: LoginIdentifier;
-    readonly subjectId?: string;
-  }) => PasswordScopeKeys;
   readonly encodeInstant: (epochMillis: number) => unknown;
   readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;
-  readonly allocateAttemptId?: Effect.Effect<PasswordAttemptId, PersistenceMappingError>;
-  readonly allocateAttemptIdSync?: () => PasswordAttemptId;
   readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;
   readonly allocateCredentialIdSync?: () => string;
   readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
@@ -230,7 +137,7 @@ export interface PasswordPersistenceMapping<Subject extends TableModel, Identifi
   readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
   readonly d1?: PasswordD1Clock<Expression>;
 }
-export type D1PasswordPersistenceMapping<Subject extends TableModel, Identifier extends TableModel, Credential extends TableModel, AuthorityCredential extends TableModel, Attempt extends TableModel, RateScope extends TableModel, Charge extends TableModel, Command extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> = PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, NativeSubjectId, Expression> & {
+export type D1PasswordPersistenceMapping<Subject extends TableModel, Identifier extends TableModel, Credential extends TableModel, AuthorityCredential extends TableModel, Command extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> = PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Command, NativeSubjectId, Expression> & {
   readonly d1: PasswordD1Clock<Expression>;
   readonly subject: PasswordSubjectTable<Subject, NativeSubjectId> & {
     readonly d1ActiveStatusValue: unknown;
@@ -322,7 +229,7 @@ export type PasswordRegistrationMapping<Registration, Subject extends TableModel
   readonly allocateRecoveryReference?: Effect.Effect<typeof RecoveryReference.Type, PersistenceMappingError>;
   readonly allocateRecoveryReferenceSync?: () => typeof RecoveryReference.Type;
 });
-export type AnyPasswordPersistenceMapping<Expression extends SqlExpression = SqlExpression> = PasswordPersistenceMapping<AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, unknown, Expression>;
+export type AnyPasswordPersistenceMapping<Expression extends SqlExpression = SqlExpression> = PasswordPersistenceMapping<AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, unknown, Expression>;
 export type AnyPasswordRegistrationMapping<Registration = unknown, Expression extends SqlExpression = SqlExpression> = PasswordRegistrationMapping<Registration, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, unknown, Expression>;
 //#endregion
 //# sourceMappingURL=password-model.d.mts.map

package/dist/internal/models/password-model.mjs

@@ -5,9 +5,6 @@ const requiredPasswordConstraints = {
 	authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)",
 	credentialSubject: "unique(credential.moduleId,credential.subjectId)",
 	credentialId: "unique(credential.moduleId,credential.credentialId)",
-	attempt: "unique(attempt.moduleId,attempt.attemptId)",
-	rateScope: "unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)",
-	charge: "unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)",
 	command: "unique(command.moduleId,command.commandId)"
 };
 const requiredPasswordRegistrationConstraints = {

package/dist/internal/models/password-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password-model.mjs","names":[],"sources":["../../../src/internal/models/password-model.ts"],"sourcesContent":["import { type RecoveryReference, type LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasswordAction,\n  PasswordAttemptId,\n  PasswordCredentialSnapshot,\n  PasswordReplacement,\n  PasswordRegistrationDecision,\n  EncodedPasswordHash,\n} from \"@yielded/auth/Password\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport type { Effect, Redacted } from \"effect\";\n\nimport type { AnyTableModel, TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./common\";\n\ntype ColumnKey<T extends Table> = T[\"column\"];\n\nexport type PasswordAttemptAction = \"sign-in\" | \"change\";\n\nexport type PasswordAttemptState = \"pending\" | \"verified\" | \"rejected\";\n\nexport type PasswordRateScopeKind = \"action\" | \"identifier\" | \"subject\";\n\nexport interface PasswordScopeKeys {\n  readonly action: string;\n  readonly identifier: string;\n  readonly subject?: string;\n}\n\nexport interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {\n  readonly table: Subject[\"table\"];\n  readonly id: ColumnKey<Subject>;\n  readonly status: ColumnKey<Subject>;\n  readonly securityRevision: ColumnKey<Subject>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly decodeRequirement: (\n    row: Subject[\"select\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Current policy for this exact credential mutation, decoded under the subject lock. */\n  readonly decodeActionRequirement: (\n    row: Subject[\"select\"],\n    action: PasswordAction,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  readonly nextSecurityRevision?: (\n    current: SecurityRevision,\n  ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  /** Required only by D1 conditional statements. */\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface PasswordIdentifierTable<\n  Identifier extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: Identifier[\"table\"];\n  readonly namespace: ColumnKey<Identifier>;\n  readonly value: ColumnKey<Identifier>;\n  readonly subjectId: ColumnKey<Identifier>;\n  readonly verifiedAt: ColumnKey<Identifier>;\n  readonly bindingRevision: ColumnKey<Identifier>;\n  /** Consumer-owned current login/recovery eligibility, including row status. */\n  readonly isCurrent: (row: Identifier[\"select\"]) => boolean;\n  /** Required by D1 so current ownership/eligibility is rechecked in the batch. */\n  readonly d1CurrentCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n  }) => Expression;\n  readonly encodeInitialInsert: (\n    identifier: LoginIdentifier,\n    subjectId: NativeSubjectId,\n    bindingRevision: SecurityRevision,\n  ) => Identifier[\"insert\"];\n}\n\nexport interface PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {\n  readonly table: Credential[\"table\"];\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly revision: ColumnKey<Credential>;\n  readonly status?: ColumnKey<Credential>;\n  readonly isActiveStatus?: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n  readonly encodeInsert: (input: {\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => Credential[\"insert\"];\n  readonly encodeRevision: (revision: SecurityRevision) => Partial<Credential[\"insert\"]>;\n}\n\nexport interface PasswordCredentialTable<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> {\n  readonly table: Credential[\"table\"];\n  readonly moduleId: ColumnKey<Credential>;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly credentialRevision: ColumnKey<Credential>;\n  readonly verifierVersion: ColumnKey<Credential>;\n  readonly verifier: ColumnKey<Credential>;\n  readonly normalization: ColumnKey<Credential>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly replacement: PasswordReplacement;\n  }) => Credential[\"insert\"];\n  readonly encodeVerifier: (\n    verifier: Redacted.Redacted<EncodedPasswordHash>,\n    verifierVersion: SecurityRevision,\n  ) => Partial<Credential[\"insert\"]>;\n  readonly encodeReplacement: (input: {\n    readonly replacement: PasswordReplacement;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n  }) => Partial<Credential[\"insert\"]>;\n  readonly decode: (input: {\n    readonly moduleId: string;\n    readonly subject: Subject[\"select\"];\n    readonly identifier: Identifier[\"select\"];\n    readonly credential: Credential[\"select\"];\n  }) => Effect.Effect<PasswordCredentialSnapshot, PersistenceMappingError>;\n}\n\nexport interface PasswordAttemptRecord {\n  readonly moduleId: string;\n  readonly action: PasswordAttemptAction;\n  readonly attemptId: PasswordAttemptId;\n  readonly identifier: LoginIdentifier;\n  readonly subjectId?: string;\n  readonly credentialId?: string;\n  readonly securityRevision?: SecurityRevision;\n  readonly credentialRevision?: SecurityRevision;\n  readonly verifierVersion?: SecurityRevision;\n  readonly identifierBindingRevision?: SecurityRevision;\n  readonly admittedAtMillis: number;\n  readonly deadlineMillis: number;\n  readonly retentionUntilMillis: number;\n}\n\nexport interface PasswordAttemptTable<Attempt extends Table, NativeSubjectId> {\n  readonly table: Attempt[\"table\"];\n  readonly moduleId: ColumnKey<Attempt>;\n  readonly action: ColumnKey<Attempt>;\n  readonly attemptId: ColumnKey<Attempt>;\n  readonly identifierNamespace: ColumnKey<Attempt>;\n  readonly identifierValue: ColumnKey<Attempt>;\n  readonly subjectId: ColumnKey<Attempt>;\n  readonly credentialId: ColumnKey<Attempt>;\n  readonly securityRevision: ColumnKey<Attempt>;\n  readonly credentialRevision: ColumnKey<Attempt>;\n  readonly verifierVersion: ColumnKey<Attempt>;\n  readonly identifierBindingRevision: ColumnKey<Attempt>;\n  readonly admittedAt: ColumnKey<Attempt>;\n  readonly deadline: ColumnKey<Attempt>;\n  readonly retentionUntil: ColumnKey<Attempt>;\n  readonly state: ColumnKey<Attempt>;\n  readonly encodeInsert: (\n    record: PasswordAttemptRecord,\n    input: {\n      readonly nativeSubjectId?: NativeSubjectId;\n      readonly state: \"pending\";\n    },\n  ) => Attempt[\"insert\"];\n}\n\nexport interface PasswordRateScopeTable<RateScope extends Table> {\n  readonly table: RateScope[\"table\"];\n  readonly moduleId: ColumnKey<RateScope>;\n  readonly action: ColumnKey<RateScope>;\n  readonly scopeKind: ColumnKey<RateScope>;\n  readonly scopeKey: ColumnKey<RateScope>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly action: PasswordAttemptAction;\n    readonly scopeKind: PasswordRateScopeKind;\n    readonly scopeKey: string;\n  }) => RateScope[\"insert\"];\n}\n\nexport interface PasswordChargeTable<Charge extends Table> {\n  readonly table: Charge[\"table\"];\n  readonly moduleId: ColumnKey<Charge>;\n  readonly action: ColumnKey<Charge>;\n  readonly scopeKind: ColumnKey<Charge>;\n  readonly scopeKey: ColumnKey<Charge>;\n  readonly attemptId: ColumnKey<Charge>;\n  readonly occurredAt: ColumnKey<Charge>;\n  readonly retentionUntil: ColumnKey<Charge>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly action: PasswordAttemptAction;\n    readonly scopeKind: PasswordRateScopeKind;\n    readonly scopeKey: string;\n    readonly attemptId: PasswordAttemptId;\n    readonly occurredAtMillis: number;\n    readonly retentionUntilMillis: number;\n  }) => Charge[\"insert\"];\n}\n\nexport interface PasswordCommandTable<Command extends Table> {\n  readonly table: Command[\"table\"];\n  readonly moduleId: ColumnKey<Command>;\n  readonly commandId: ColumnKey<Command>;\n  readonly action: ColumnKey<Command>;\n  readonly bindingDigest: ColumnKey<Command>;\n  readonly decision: ColumnKey<Command>;\n  readonly retentionUntil: ColumnKey<Command>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly action: string;\n    readonly bindingDigest: string;\n    readonly decision: \"changed\";\n    readonly retentionUntilMillis: number;\n  }) => Command[\"insert\"];\n}\n\nexport interface RequiredPasswordConstraints {\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n  readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n  readonly credentialId: \"unique(credential.moduleId,credential.credentialId)\";\n  readonly attempt: \"unique(attempt.moduleId,attempt.attemptId)\";\n  readonly rateScope: \"unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)\";\n  readonly charge: \"unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)\";\n  readonly command: \"unique(command.moduleId,command.commandId)\";\n}\n\nexport const requiredPasswordConstraints: RequiredPasswordConstraints = {\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n  credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n  credentialId: \"unique(credential.moduleId,credential.credentialId)\",\n  attempt: \"unique(attempt.moduleId,attempt.attemptId)\",\n  rateScope: \"unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)\",\n  charge: \"unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)\",\n  command: \"unique(command.moduleId,command.commandId)\",\n};\n\nexport interface PasswordConstraintClassifier {\n  /** Match only the mapped command uniqueness constraint. */\n  readonly isCommandConflict: (cause: unknown) => boolean;\n  /** Match only the mapped rate-scope uniqueness constraint. */\n  readonly isRateScopeConflict: (cause: unknown) => boolean;\n}\n\nexport interface PasswordD1Clock<Expression extends SqlExpression = SqlExpression> {\n  readonly engineNow: Expression;\n  readonly engineNowMillis: Expression;\n  readonly engineInstantMinus: (millis: number) => Expression;\n  readonly engineInstantPlus: (millis: number) => Expression;\n}\n\nexport interface PasswordPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  RateScope extends Table,\n  Charge extends Table,\n  Command extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> extends PasswordConstraintClassifier {\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;\n  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  /** Every factor revision named by action evidence, including non-password factors. */\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly attempt: PasswordAttemptTable<Attempt, NativeSubjectId>;\n  readonly rateScope: PasswordRateScopeTable<RateScope>;\n  readonly charge: PasswordChargeTable<Charge>;\n  readonly command: PasswordCommandTable<Command>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredPasswordConstraints;\n  readonly scopeKeys: (input: {\n    readonly moduleId: string;\n    readonly action: PasswordAttemptAction;\n    readonly identifier: LoginIdentifier;\n    readonly subjectId?: string;\n  }) => PasswordScopeKeys;\n  readonly encodeInstant: (epochMillis: number) => unknown;\n  readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly allocateAttemptId?: Effect.Effect<PasswordAttemptId, PersistenceMappingError>;\n  readonly allocateAttemptIdSync?: () => PasswordAttemptId;\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n  readonly commandRetentionMillis: number;\n  /** All semantic replacements still bump subject revision. This flag only declares bearer invalidation latency. */\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n  readonly d1?: PasswordD1Clock<Expression>;\n}\n\nexport type D1PasswordPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  RateScope extends Table,\n  Charge extends Table,\n  Command extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordPersistenceMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Attempt,\n  RateScope,\n  Charge,\n  Command,\n  NativeSubjectId,\n  Expression\n> & {\n  readonly d1: PasswordD1Clock<Expression>;\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId> & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression> & {\n    readonly d1CurrentCondition: (input: {\n      readonly identifier: LoginIdentifier;\n      readonly nativeSubjectId: NativeSubjectId;\n    }) => Expression;\n  };\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  > & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n};\n\nexport type PasswordRegistrationState = \"pending\" | \"created\";\n\nexport interface PasswordRegistrationIntent<Registration> {\n  readonly moduleId: string;\n  readonly requestId: string;\n  readonly identifier: LoginIdentifier;\n  readonly registration: Registration;\n  readonly replacement: PasswordReplacement;\n}\n\nexport interface PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> {\n  readonly table: Request[\"table\"];\n  readonly moduleId: ColumnKey<Request>;\n  readonly requestId: ColumnKey<Request>;\n  readonly state: ColumnKey<Request>;\n  readonly subjectId: ColumnKey<Request>;\n  readonly recoveryReference: ColumnKey<Request>;\n  readonly encodeInsert: (\n    input: PasswordRegistrationIntent<Registration>,\n    state: {\n      readonly state: PasswordRegistrationState;\n      readonly nativeSubjectId?: NativeSubjectId;\n      readonly recoveryReference?: typeof RecoveryReference.Type;\n    },\n  ) => Request[\"insert\"];\n  /** Replay projection must never expose a stored subject or decode protected intent. */\n  readonly decodeReplay: (row: Request[\"select\"]) => Effect.Effect<\n    Exclude<\n      PasswordRegistrationDecision,\n      {\n        readonly _tag: \"Created\";\n      }\n    >,\n    PersistenceMappingError\n  >;\n}\n\nexport interface PasswordRegistrationProvisioning<\n  Registration,\n  Subject extends Table,\n  NativeSubjectId,\n> {\n  readonly encodeSubjectInsert: (\n    input: PasswordRegistrationIntent<Registration>,\n    values: {\n      readonly nativeSubjectId: NativeSubjectId | undefined;\n      readonly securityRevision: SecurityRevision;\n    },\n  ) => Subject[\"insert\"];\n  readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n  readonly allocateSubjectIdSync?: () => NativeSubjectId;\n  /** Interactive targets use this for database-generated/autoincrement keys. */\n  readonly decodeGeneratedId?: (\n    rows: ReadonlyArray<unknown>,\n  ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n}\n\nexport interface RequiredPasswordRegistrationConstraints {\n  readonly request: \"unique(registration.moduleId,registration.requestId)\";\n  readonly recoveryReference: \"unique(registration.recoveryReference)\";\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n}\n\nexport const requiredPasswordRegistrationConstraints: RequiredPasswordRegistrationConstraints = {\n  request: \"unique(registration.moduleId,registration.requestId)\",\n  recoveryReference: \"unique(registration.recoveryReference)\",\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n};\n\nexport interface PasswordRegistrationConstraintClassifier {\n  readonly isRequestConflict: (cause: unknown) => boolean;\n  readonly isIdentifierConflict: (cause: unknown) => boolean;\n  readonly isCredentialConflict: (cause: unknown) => boolean;\n}\n\nexport type PasswordRegistrationMapping<\n  Registration,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Request extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordRegistrationConstraintClassifier & {\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;\n  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly registration: PasswordRegistrationTable<Registration, Request, NativeSubjectId>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredPasswordRegistrationConstraints;\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n} & (\n    | {\n        readonly mode: \"atomic\";\n        readonly provisioning: PasswordRegistrationProvisioning<\n          Registration,\n          Subject,\n          NativeSubjectId\n        > &\n          (\n            | {\n                readonly idMode: \"allocated\";\n                readonly allocateSubjectId: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n              }\n            | {\n                readonly idMode: \"synchronous\";\n                readonly allocateSubjectIdSync: () => NativeSubjectId;\n              }\n            | {\n                readonly idMode: \"generated\";\n                readonly decodeGeneratedId: (\n                  rows: ReadonlyArray<unknown>,\n                ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n              }\n          );\n      }\n    | {\n        readonly mode: \"pending\";\n        readonly allocateRecoveryReference?: Effect.Effect<\n          typeof RecoveryReference.Type,\n          PersistenceMappingError\n        >;\n        readonly allocateRecoveryReferenceSync?: () => typeof RecoveryReference.Type;\n      }\n  );\n\nexport type AnyPasswordPersistenceMapping<Expression extends SqlExpression = SqlExpression> =\n  PasswordPersistenceMapping<\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    unknown,\n    Expression\n  >;\n\nexport type AnyPasswordRegistrationMapping<\n  Registration = unknown,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordRegistrationMapping<\n  Registration,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  Expression\n>;\n"],"mappings":";;AA4OA,MAAa,8BAA2D;CACtE,YAAY;CACZ,qBAAqB;CACrB,mBAAmB;CACnB,cAAc;CACd,SAAS;CACT,WAAW;CACX,QAAQ;CACR,SAAS;AACX;AAwKA,MAAa,0CAAmF;CAC9F,SAAS;CACT,mBAAmB;CACnB,YAAY;CACZ,mBAAmB;CACnB,qBAAqB;AACvB"}
+{"version":3,"file":"password-model.mjs","names":[],"sources":["../../../src/internal/models/password-model.ts"],"sourcesContent":["import { type RecoveryReference, type LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasswordAction,\n  PasswordCredentialSnapshot,\n  PasswordReplacement,\n  PasswordRegistrationDecision,\n  EncodedPasswordHash,\n} from \"@yielded/auth/Password\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport type { Effect, Redacted } from \"effect\";\n\nimport type { AnyTableModel, TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./common\";\n\ntype ColumnKey<T extends Table> = T[\"column\"];\n\nexport interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {\n  readonly table: Subject[\"table\"];\n  readonly id: ColumnKey<Subject>;\n  readonly status: ColumnKey<Subject>;\n  readonly securityRevision: ColumnKey<Subject>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly decodeRequirement: (\n    row: Subject[\"select\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Current policy for this exact credential mutation, decoded under the subject lock. */\n  readonly decodeActionRequirement: (\n    row: Subject[\"select\"],\n    action: PasswordAction,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  readonly nextSecurityRevision?: (\n    current: SecurityRevision,\n  ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  /** Required only by D1 conditional statements. */\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface PasswordIdentifierTable<\n  Identifier extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: Identifier[\"table\"];\n  readonly namespace: ColumnKey<Identifier>;\n  readonly value: ColumnKey<Identifier>;\n  readonly subjectId: ColumnKey<Identifier>;\n  readonly verifiedAt: ColumnKey<Identifier>;\n  readonly bindingRevision: ColumnKey<Identifier>;\n  /** Consumer-owned current login/recovery eligibility, including row status. */\n  readonly isCurrent: (row: Identifier[\"select\"]) => boolean;\n  /** Required by D1 so current ownership/eligibility is rechecked in the batch. */\n  readonly d1CurrentCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n  }) => Expression;\n  readonly encodeInitialInsert: (\n    identifier: LoginIdentifier,\n    subjectId: NativeSubjectId,\n    bindingRevision: SecurityRevision,\n  ) => Identifier[\"insert\"];\n}\n\nexport interface PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {\n  readonly table: Credential[\"table\"];\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly revision: ColumnKey<Credential>;\n  readonly status?: ColumnKey<Credential>;\n  readonly isActiveStatus?: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n  readonly encodeInsert: (input: {\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => Credential[\"insert\"];\n  readonly encodeRevision: (revision: SecurityRevision) => Partial<Credential[\"insert\"]>;\n}\n\nexport interface PasswordCredentialTable<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> {\n  readonly table: Credential[\"table\"];\n  readonly moduleId: ColumnKey<Credential>;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly credentialRevision: ColumnKey<Credential>;\n  readonly verifierVersion: ColumnKey<Credential>;\n  readonly verifier: ColumnKey<Credential>;\n  readonly normalization: ColumnKey<Credential>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly replacement: PasswordReplacement;\n  }) => Credential[\"insert\"];\n  readonly encodeVerifier: (\n    verifier: Redacted.Redacted<EncodedPasswordHash>,\n    verifierVersion: SecurityRevision,\n  ) => Partial<Credential[\"insert\"]>;\n  readonly encodeReplacement: (input: {\n    readonly replacement: PasswordReplacement;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n  }) => Partial<Credential[\"insert\"]>;\n  readonly decode: (input: {\n    readonly moduleId: string;\n    readonly subject: Subject[\"select\"];\n    readonly identifier: Identifier[\"select\"];\n    readonly credential: Credential[\"select\"];\n  }) => Effect.Effect<PasswordCredentialSnapshot, PersistenceMappingError>;\n}\n\nexport interface PasswordCommandTable<Command extends Table> {\n  readonly table: Command[\"table\"];\n  readonly moduleId: ColumnKey<Command>;\n  readonly commandId: ColumnKey<Command>;\n  readonly action: ColumnKey<Command>;\n  readonly bindingDigest: ColumnKey<Command>;\n  readonly decision: ColumnKey<Command>;\n  readonly retentionUntil: ColumnKey<Command>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly action: string;\n    readonly bindingDigest: string;\n    readonly decision: \"changed\";\n    readonly retentionUntilMillis: number;\n  }) => Command[\"insert\"];\n}\n\nexport interface RequiredPasswordConstraints {\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n  readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n  readonly credentialId: \"unique(credential.moduleId,credential.credentialId)\";\n  readonly command: \"unique(command.moduleId,command.commandId)\";\n}\n\nexport const requiredPasswordConstraints: RequiredPasswordConstraints = {\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n  credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n  credentialId: \"unique(credential.moduleId,credential.credentialId)\",\n  command: \"unique(command.moduleId,command.commandId)\",\n};\n\nexport interface PasswordConstraintClassifier {\n  /** Match only the mapped command uniqueness constraint. */\n  readonly isCommandConflict: (cause: unknown) => boolean;\n}\n\nexport interface PasswordD1Clock<Expression extends SqlExpression = SqlExpression> {\n  readonly engineNow: Expression;\n  readonly engineNowMillis: Expression;\n  readonly engineInstantMinus: (millis: number) => Expression;\n  readonly engineInstantPlus: (millis: number) => Expression;\n}\n\nexport interface PasswordPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Command extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> extends PasswordConstraintClassifier {\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;\n  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  /** Every factor revision named by action evidence, including non-password factors. */\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly command: PasswordCommandTable<Command>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredPasswordConstraints;\n  readonly encodeInstant: (epochMillis: number) => unknown;\n  readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n  readonly commandRetentionMillis: number;\n  /** All semantic replacements still bump subject revision. This flag only declares bearer invalidation latency. */\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n  readonly d1?: PasswordD1Clock<Expression>;\n}\n\nexport type D1PasswordPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Command extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordPersistenceMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Command,\n  NativeSubjectId,\n  Expression\n> & {\n  readonly d1: PasswordD1Clock<Expression>;\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId> & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression> & {\n    readonly d1CurrentCondition: (input: {\n      readonly identifier: LoginIdentifier;\n      readonly nativeSubjectId: NativeSubjectId;\n    }) => Expression;\n  };\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  > & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n};\n\nexport type PasswordRegistrationState = \"pending\" | \"created\";\n\nexport interface PasswordRegistrationIntent<Registration> {\n  readonly moduleId: string;\n  readonly requestId: string;\n  readonly identifier: LoginIdentifier;\n  readonly registration: Registration;\n  readonly replacement: PasswordReplacement;\n}\n\nexport interface PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> {\n  readonly table: Request[\"table\"];\n  readonly moduleId: ColumnKey<Request>;\n  readonly requestId: ColumnKey<Request>;\n  readonly state: ColumnKey<Request>;\n  readonly subjectId: ColumnKey<Request>;\n  readonly recoveryReference: ColumnKey<Request>;\n  readonly encodeInsert: (\n    input: PasswordRegistrationIntent<Registration>,\n    state: {\n      readonly state: PasswordRegistrationState;\n      readonly nativeSubjectId?: NativeSubjectId;\n      readonly recoveryReference?: typeof RecoveryReference.Type;\n    },\n  ) => Request[\"insert\"];\n  /** Replay projection must never expose a stored subject or decode protected intent. */\n  readonly decodeReplay: (row: Request[\"select\"]) => Effect.Effect<\n    Exclude<\n      PasswordRegistrationDecision,\n      {\n        readonly _tag: \"Created\";\n      }\n    >,\n    PersistenceMappingError\n  >;\n}\n\nexport interface PasswordRegistrationProvisioning<\n  Registration,\n  Subject extends Table,\n  NativeSubjectId,\n> {\n  readonly encodeSubjectInsert: (\n    input: PasswordRegistrationIntent<Registration>,\n    values: {\n      readonly nativeSubjectId: NativeSubjectId | undefined;\n      readonly securityRevision: SecurityRevision;\n    },\n  ) => Subject[\"insert\"];\n  readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n  readonly allocateSubjectIdSync?: () => NativeSubjectId;\n  /** Interactive targets use this for database-generated/autoincrement keys. */\n  readonly decodeGeneratedId?: (\n    rows: ReadonlyArray<unknown>,\n  ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n}\n\nexport interface RequiredPasswordRegistrationConstraints {\n  readonly request: \"unique(registration.moduleId,registration.requestId)\";\n  readonly recoveryReference: \"unique(registration.recoveryReference)\";\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n}\n\nexport const requiredPasswordRegistrationConstraints: RequiredPasswordRegistrationConstraints = {\n  request: \"unique(registration.moduleId,registration.requestId)\",\n  recoveryReference: \"unique(registration.recoveryReference)\",\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n};\n\nexport interface PasswordRegistrationConstraintClassifier {\n  readonly isRequestConflict: (cause: unknown) => boolean;\n  readonly isIdentifierConflict: (cause: unknown) => boolean;\n  readonly isCredentialConflict: (cause: unknown) => boolean;\n}\n\nexport type PasswordRegistrationMapping<\n  Registration,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Request extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordRegistrationConstraintClassifier & {\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;\n  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly registration: PasswordRegistrationTable<Registration, Request, NativeSubjectId>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredPasswordRegistrationConstraints;\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n} & (\n    | {\n        readonly mode: \"atomic\";\n        readonly provisioning: PasswordRegistrationProvisioning<\n          Registration,\n          Subject,\n          NativeSubjectId\n        > &\n          (\n            | {\n                readonly idMode: \"allocated\";\n                readonly allocateSubjectId: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n              }\n            | {\n                readonly idMode: \"synchronous\";\n                readonly allocateSubjectIdSync: () => NativeSubjectId;\n              }\n            | {\n                readonly idMode: \"generated\";\n                readonly decodeGeneratedId: (\n                  rows: ReadonlyArray<unknown>,\n                ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n              }\n          );\n      }\n    | {\n        readonly mode: \"pending\";\n        readonly allocateRecoveryReference?: Effect.Effect<\n          typeof RecoveryReference.Type,\n          PersistenceMappingError\n        >;\n        readonly allocateRecoveryReferenceSync?: () => typeof RecoveryReference.Type;\n      }\n  );\n\nexport type AnyPasswordPersistenceMapping<Expression extends SqlExpression = SqlExpression> =\n  PasswordPersistenceMapping<\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    unknown,\n    Expression\n  >;\n\nexport type AnyPasswordRegistrationMapping<\n  Registration = unknown,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordRegistrationMapping<\n  Registration,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  Expression\n>;\n"],"mappings":";;AAgJA,MAAa,8BAA2D;CACtE,YAAY;CACZ,qBAAqB;CACrB,mBAAmB;CACnB,cAAc;CACd,SAAS;AACX;AAkJA,MAAa,0CAAmF;CAC9F,SAAS;CACT,mBAAmB;CACnB,YAAY;CACZ,mBAAmB;CACnB,qBAAqB;AACvB"}

package/dist/internal/native-sql-table.d.mts

@@ -0,0 +1,34 @@
+import "./mapping-error.mjs";
+import { PhysicalTextColumn } from "./storage-validation.mjs";
+import { Effect } from "effect";
+import * as Statement$1 from "effect/sql/Statement";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/native-sql-table.d.ts
+/** Physical SQL representation only. Semantic row codecs and policy remain in
+ * the owning mapping. Execute assembled statements without name/result transforms. */
+export interface SqlTable {
+  readonly name: Statement$1.Fragment;
+  /** Alias reads only; writes continue to target the original physical table. */
+  readonly as: (alias: string) => SqlTable;
+  readonly column: (key: string) => Statement$1.Fragment;
+  /** Optional codec-free text candidate. Physical type/collation compatibility
+   * must still be checked against the database before comparing columns. */
+  readonly unencodedTextColumn?: (key: string) => PhysicalTextColumn | undefined;
+  /** Project every column under an ordinal alias, using a distinct prefix per table. */
+  readonly fields: (prefix: string) => Statement$1.Fragment;
+  readonly decode: (row: Readonly<Record<string, unknown>>, prefix: string) => Record<string, unknown>;
+  readonly value: (key: string, value: unknown) => Statement$1.Fragment;
+  /** Complete INSERT prefix; append conflict/returning clauses in the owning operation. */
+  readonly insert: (values: Readonly<Record<string, unknown>>) => Statement$1.Fragment;
+  /** Complete UPDATE ... SET prefix; the owning operation supplies its predicate. */
+  readonly update: (values: Readonly<Record<string, unknown>>) => Statement$1.Fragment;
+}
+export type NativeSqlTables = (table: object) => SqlTable;
+/** Prefixes are short ASCII identifiers so ordinal aliases cannot be truncated
+ * by PostgreSQL. Callers distinguish tables by prefix, never by physical names. */
+export declare const nativeSqlAlias: (prefix: string, index: number) => string;
+/** Cache physical metadata only; insert/update materialize values and hooks at
+ * each call. Construction acquires no client and owns no transaction. */
+export declare const makeNativeSqlTables: (client: SqlClient, convert?: (client: SqlClient, table: object) => SqlTable) => NativeSqlTables;
+//#endregion
+//# sourceMappingURL=native-sql-table.d.mts.map

package/dist/internal/native-sql-table.mjs

@@ -0,0 +1,111 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { Table, identifier } from "./sql-table.mjs";
+import { Effect } from "effect";
+import * as Statement$1 from "effect/sql/Statement";
+//#region src/internal/native-sql-table.ts
+/** Capture synchronous mapping callbacks without changing SQL execution errors. */
+const sqlMapping = (thunk) => Effect.try({
+	try: thunk,
+	catch: (cause) => PersistenceMappingError.make({
+		operation: "mapping",
+		cause
+	})
+});
+/** Prefixes are short ASCII identifiers so ordinal aliases cannot be truncated
+* by PostgreSQL. Callers distinguish tables by prefix, never by physical names. */
+const nativeSqlAlias = (prefix, index) => {
+	if (!/^[A-Za-z_][A-Za-z0-9_]{0,39}$/.test(prefix)) throw PersistenceMappingError.make({
+		operation: "mapping",
+		cause: "Invalid SQL alias prefix"
+	});
+	return `${prefix}${index}`;
+};
+const directTable = (client, physical) => {
+	if (!(physical instanceof Table)) throw PersistenceMappingError.make({
+		operation: "mapping",
+		cause: "Expected a SQL table"
+	});
+	const quote = (name) => {
+		if (name.includes("\0")) throw PersistenceMappingError.make({
+			operation: "mapping",
+			cause: "NUL in SQL identifier"
+		});
+		return client.literal(identifier(name));
+	};
+	const name = physical.schema === void 0 ? quote(physical.name) : client`${quote(physical.schema)}.${quote(physical.name)}`;
+	const columns = Object.entries(physical.columns);
+	const getColumn = (key) => {
+		const column = Object.hasOwn(physical.columns, key) ? physical.columns[key] : void 0;
+		if (column === void 0) throw PersistenceMappingError.make({
+			operation: "column",
+			cause: "Missing SQL column"
+		});
+		return column;
+	};
+	const value = (key, input) => {
+		const mapped = getColumn(key);
+		if (Statement$1.isFragment(input)) return input;
+		const encoded = input === null ? null : mapped.mapToDriverValue(input);
+		return Statement$1.fragment([Statement$1.parameter(typeof encoded === "boolean" ? client.onDialectOrElse({
+			sqlite: () => Number(encoded),
+			orElse: () => encoded
+		}) : encoded)]);
+	};
+	const entries = (values) => Object.entries(values).filter(([key, input]) => Object.hasOwn(physical.columns, key) && input !== void 0);
+	const bind = (alias) => {
+		const reference = alias === void 0 ? name : quote(alias);
+		const column = (key) => client`${reference}.${quote(getColumn(key).options.name)}`;
+		return {
+			name: alias === void 0 ? name : client`${name} AS ${reference}`,
+			as: bind,
+			column,
+			unencodedTextColumn: (key) => getColumn(key).options.type === "text" ? {
+				table: {
+					name: physical.name,
+					...physical.schema === void 0 ? {} : { schema: physical.schema }
+				},
+				name: getColumn(key).options.name
+			} : void 0,
+			value,
+			fields: (prefix) => client.join(", ", false)(columns.map(([key], index) => client`${column(key)} AS ${quote(nativeSqlAlias(prefix, index))}`)),
+			decode: (row, prefix) => Object.fromEntries(columns.map(([key, field], index) => {
+				const alias = nativeSqlAlias(prefix, index);
+				if (!Object.hasOwn(row, alias)) throw PersistenceMappingError.make({
+					operation: "decode",
+					cause: "Missing SQL projection field"
+				});
+				return [key, field.decode(row[alias])];
+			})),
+			insert: (values) => {
+				const fields = entries(values);
+				if (fields.length === 0) return client`INSERT INTO ${name} DEFAULT VALUES`;
+				return client`INSERT INTO ${name} (${client.join(", ", false)(fields.map(([key]) => quote(getColumn(key).options.name)))}) VALUES (${client.join(", ", false)(fields.map(([key, input]) => value(key, input)))})`;
+			},
+			update: (values) => {
+				const fields = entries(values);
+				if (fields.length === 0) throw PersistenceMappingError.make({
+					operation: "mapping",
+					cause: "Empty SQL update"
+				});
+				return client`UPDATE ${name} SET ${client.join(", ", false)(fields.map(([key, input]) => client`${quote(getColumn(key).options.name)} = ${value(key, input)}`))}`;
+			}
+		};
+	};
+	return bind();
+};
+/** Cache physical metadata only; insert/update materialize values and hooks at
+* each call. Construction acquires no client and owns no transaction. */
+const makeNativeSqlTables = (client, convert = directTable) => {
+	const tables = /* @__PURE__ */ new WeakMap();
+	return (table) => {
+		const existing = tables.get(table);
+		if (existing !== void 0) return existing;
+		const mapped = convert(client, table);
+		tables.set(table, mapped);
+		return mapped;
+	};
+};
+//#endregion
+export { makeNativeSqlTables, nativeSqlAlias, sqlMapping };
+
+//# sourceMappingURL=native-sql-table.mjs.map

package/dist/internal/native-sql-table.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-sql-table.mjs","names":["Statement"],"sources":["../../src/internal/native-sql-table.ts"],"sourcesContent":["import { Effect } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\nimport * as Statement from \"effect/sql/Statement\";\n\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport { Table, identifier } from \"./sql-table\";\nimport type { PhysicalTextColumn } from \"./storage-validation\";\n\n/** Capture synchronous mapping callbacks without changing SQL execution errors. */\nexport const sqlMapping = <A>(thunk: () => A): Effect.Effect<A, PersistenceMappingError> =>\n  Effect.try({\n    try: thunk,\n    catch: (cause) => PersistenceMappingError.make({ operation: \"mapping\", cause }),\n  });\n\n/** Physical SQL representation only. Semantic row codecs and policy remain in\n * the owning mapping. Execute assembled statements without name/result transforms. */\nexport interface SqlTable {\n  readonly name: Statement.Fragment;\n  /** Alias reads only; writes continue to target the original physical table. */\n  readonly as: (alias: string) => SqlTable;\n  readonly column: (key: string) => Statement.Fragment;\n  /** Optional codec-free text candidate. Physical type/collation compatibility\n   * must still be checked against the database before comparing columns. */\n  readonly unencodedTextColumn?: (key: string) => PhysicalTextColumn | undefined;\n  /** Project every column under an ordinal alias, using a distinct prefix per table. */\n  readonly fields: (prefix: string) => Statement.Fragment;\n  readonly decode: (\n    row: Readonly<Record<string, unknown>>,\n    prefix: string,\n  ) => Record<string, unknown>;\n  readonly value: (key: string, value: unknown) => Statement.Fragment;\n  /** Complete INSERT prefix; append conflict/returning clauses in the owning operation. */\n  readonly insert: (values: Readonly<Record<string, unknown>>) => Statement.Fragment;\n  /** Complete UPDATE ... SET prefix; the owning operation supplies its predicate. */\n  readonly update: (values: Readonly<Record<string, unknown>>) => Statement.Fragment;\n}\n\nexport type NativeSqlTables = (table: object) => SqlTable;\n\n/** Prefixes are short ASCII identifiers so ordinal aliases cannot be truncated\n * by PostgreSQL. Callers distinguish tables by prefix, never by physical names. */\nexport const nativeSqlAlias = (prefix: string, index: number): string => {\n  if (!/^[A-Za-z_][A-Za-z0-9_]{0,39}$/.test(prefix))\n    throw PersistenceMappingError.make({ operation: \"mapping\", cause: \"Invalid SQL alias prefix\" });\n\n  return `${prefix}${index}`;\n};\n\nconst directTable = (client: SqlClient, physical: object): SqlTable => {\n  if (!(physical instanceof Table))\n    throw PersistenceMappingError.make({ operation: \"mapping\", cause: \"Expected a SQL table\" });\n\n  const quote = (name: string) => {\n    if (name.includes(\"\\0\"))\n      throw PersistenceMappingError.make({ operation: \"mapping\", cause: \"NUL in SQL identifier\" });\n\n    return client.literal(identifier(name));\n  };\n\n  const name =\n    physical.schema === undefined\n      ? quote(physical.name)\n      : client`${quote(physical.schema)}.${quote(physical.name)}`;\n\n  const columns = Object.entries(physical.columns);\n\n  const getColumn = (key: string) => {\n    const column = Object.hasOwn(physical.columns, key) ? physical.columns[key] : undefined;\n\n    if (column === undefined)\n      throw PersistenceMappingError.make({ operation: \"column\", cause: \"Missing SQL column\" });\n\n    return column;\n  };\n\n  const value = (key: string, input: unknown): Statement.Fragment => {\n    const mapped = getColumn(key);\n\n    if (Statement.isFragment(input)) return input;\n    const encoded = input === null ? null : mapped.mapToDriverValue(input);\n\n    return Statement.fragment([\n      Statement.parameter(\n        typeof encoded === \"boolean\"\n          ? client.onDialectOrElse({ sqlite: () => Number(encoded), orElse: () => encoded })\n          : encoded,\n      ),\n    ]);\n  };\n\n  const entries = (values: Readonly<Record<string, unknown>>) =>\n    Object.entries(values).filter(\n      ([key, input]) => Object.hasOwn(physical.columns, key) && input !== undefined,\n    );\n\n  const bind = (alias?: string): SqlTable => {\n    const reference = alias === undefined ? name : quote(alias);\n    const column = (key: string) => client`${reference}.${quote(getColumn(key).options.name)}`;\n\n    return {\n      name: alias === undefined ? name : client`${name} AS ${reference}`,\n      as: bind,\n      column,\n      unencodedTextColumn: (key) =>\n        getColumn(key).options.type === \"text\"\n          ? {\n              table: {\n                name: physical.name,\n                ...(physical.schema === undefined ? {} : { schema: physical.schema }),\n              },\n              name: getColumn(key).options.name,\n            }\n          : undefined,\n      value,\n      fields: (prefix) =>\n        client.join(\n          \", \",\n          false,\n        )(\n          columns.map(\n            ([key], index) => client`${column(key)} AS ${quote(nativeSqlAlias(prefix, index))}`,\n          ),\n        ),\n      decode: (row, prefix) =>\n        Object.fromEntries(\n          columns.map(([key, field], index) => {\n            const alias = nativeSqlAlias(prefix, index);\n\n            if (!Object.hasOwn(row, alias))\n              throw PersistenceMappingError.make({\n                operation: \"decode\",\n                cause: \"Missing SQL projection field\",\n              });\n\n            return [key, field.decode(row[alias])];\n          }),\n        ),\n      insert: (values) => {\n        const fields = entries(values);\n\n        if (fields.length === 0) return client`INSERT INTO ${name} DEFAULT VALUES`;\n\n        return client`INSERT INTO ${name} (${client.join(\", \", false)(fields.map(([key]) => quote(getColumn(key).options.name)))}) VALUES (${client.join(\", \", false)(fields.map(([key, input]) => value(key, input)))})`;\n      },\n      update: (values) => {\n        const fields = entries(values);\n\n        if (fields.length === 0)\n          throw PersistenceMappingError.make({ operation: \"mapping\", cause: \"Empty SQL update\" });\n\n        return client`UPDATE ${name} SET ${client.join(\", \", false)(fields.map(([key, input]) => client`${quote(getColumn(key).options.name)} = ${value(key, input)}`))}`;\n      },\n    };\n  };\n\n  return bind();\n};\n\n/** Cache physical metadata only; insert/update materialize values and hooks at\n * each call. Construction acquires no client and owns no transaction. */\nexport const makeNativeSqlTables = (\n  client: SqlClient,\n  convert: (client: SqlClient, table: object) => SqlTable = directTable,\n): NativeSqlTables => {\n  const tables = new WeakMap<object, SqlTable>();\n\n  return (table) => {\n    const existing = tables.get(table);\n\n    if (existing !== undefined) return existing;\n    const mapped = convert(client, table);\n\n    tables.set(table, mapped);\n\n    return mapped;\n  };\n};\n"],"mappings":";;;;;;AASA,MAAa,cAAiB,UAC5B,OAAO,IAAI;CACT,KAAK;CACL,QAAQ,UAAU,wBAAwB,KAAK;EAAE,WAAW;EAAW;CAAM,CAAC;AAChF,CAAC;;;AA6BH,MAAa,kBAAkB,QAAgB,UAA0B;CACvE,IAAI,CAAC,gCAAgC,KAAK,MAAM,GAC9C,MAAM,wBAAwB,KAAK;EAAE,WAAW;EAAW,OAAO;CAA2B,CAAC;CAEhG,OAAO,GAAG,SAAS;AACrB;AAEA,MAAM,eAAe,QAAmB,aAA+B;CACrE,IAAI,EAAE,oBAAoB,QACxB,MAAM,wBAAwB,KAAK;EAAE,WAAW;EAAW,OAAO;CAAuB,CAAC;CAE5F,MAAM,SAAS,SAAiB;EAC9B,IAAI,KAAK,SAAS,IAAI,GACpB,MAAM,wBAAwB,KAAK;GAAE,WAAW;GAAW,OAAO;EAAwB,CAAC;EAE7F,OAAO,OAAO,QAAQ,WAAW,IAAI,CAAC;CACxC;CAEA,MAAM,OACJ,SAAS,WAAW,KAAA,IAChB,MAAM,SAAS,IAAI,IACnB,MAAM,GAAG,MAAM,SAAS,MAAM,EAAE,GAAG,MAAM,SAAS,IAAI;CAE5D,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO;CAE/C,MAAM,aAAa,QAAgB;EACjC,MAAM,SAAS,OAAO,OAAO,SAAS,SAAS,GAAG,IAAI,SAAS,QAAQ,OAAO,KAAA;EAE9E,IAAI,WAAW,KAAA,GACb,MAAM,wBAAwB,KAAK;GAAE,WAAW;GAAU,OAAO;EAAqB,CAAC;EAEzF,OAAO;CACT;CAEA,MAAM,SAAS,KAAa,UAAuC;EACjE,MAAM,SAAS,UAAU,GAAG;EAE5B,IAAIA,YAAU,WAAW,KAAK,GAAG,OAAO;EACxC,MAAM,UAAU,UAAU,OAAO,OAAO,OAAO,iBAAiB,KAAK;EAErE,OAAOA,YAAU,SAAS,CACxBA,YAAU,UACR,OAAO,YAAY,YACf,OAAO,gBAAgB;GAAE,cAAc,OAAO,OAAO;GAAG,cAAc;EAAQ,CAAC,IAC/E,OACN,CACF,CAAC;CACH;CAEA,MAAM,WAAW,WACf,OAAO,QAAQ,MAAM,CAAC,CAAC,QACpB,CAAC,KAAK,WAAW,OAAO,OAAO,SAAS,SAAS,GAAG,KAAK,UAAU,KAAA,CACtE;CAEF,MAAM,QAAQ,UAA6B;EACzC,MAAM,YAAY,UAAU,KAAA,IAAY,OAAO,MAAM,KAAK;EAC1D,MAAM,UAAU,QAAgB,MAAM,GAAG,UAAU,GAAG,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,IAAI;EAEvF,OAAO;GACL,MAAM,UAAU,KAAA,IAAY,OAAO,MAAM,GAAG,KAAK,MAAM;GACvD,IAAI;GACJ;GACA,sBAAsB,QACpB,UAAU,GAAG,CAAC,CAAC,QAAQ,SAAS,SAC5B;IACE,OAAO;KACL,MAAM,SAAS;KACf,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,SAAS,OAAO;IACrE;IACA,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ;GAC/B,IACA,KAAA;GACN;GACA,SAAS,WACP,OAAO,KACL,MACA,KACF,CAAC,CACC,QAAQ,KACL,CAAC,MAAM,UAAU,MAAM,GAAG,OAAO,GAAG,EAAE,MAAM,MAAM,eAAe,QAAQ,KAAK,CAAC,GAClF,CACF;GACF,SAAS,KAAK,WACZ,OAAO,YACL,QAAQ,KAAK,CAAC,KAAK,QAAQ,UAAU;IACnC,MAAM,QAAQ,eAAe,QAAQ,KAAK;IAE1C,IAAI,CAAC,OAAO,OAAO,KAAK,KAAK,GAC3B,MAAM,wBAAwB,KAAK;KACjC,WAAW;KACX,OAAO;IACT,CAAC;IAEH,OAAO,CAAC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC;GACvC,CAAC,CACH;GACF,SAAS,WAAW;IAClB,MAAM,SAAS,QAAQ,MAAM;IAE7B,IAAI,OAAO,WAAW,GAAG,OAAO,MAAM,eAAe,KAAK;IAE1D,OAAO,MAAM,eAAe,KAAK,IAAI,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,SAAS,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,YAAY,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK,WAAW,MAAM,KAAK,KAAK,CAAC,CAAC,EAAE;GACjN;GACA,SAAS,WAAW;IAClB,MAAM,SAAS,QAAQ,MAAM;IAE7B,IAAI,OAAO,WAAW,GACpB,MAAM,wBAAwB,KAAK;KAAE,WAAW;KAAW,OAAO;IAAmB,CAAC;IAExF,OAAO,MAAM,UAAU,KAAK,OAAO,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK,WAAW,MAAM,GAAG,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,IAAI,EAAE,KAAK,MAAM,KAAK,KAAK,GAAG,CAAC;GAChK;EACF;CACF;CAEA,OAAO,KAAK;AACd;;;AAIA,MAAa,uBACX,QACA,UAA0D,gBACtC;CACpB,MAAM,yBAAS,IAAI,QAA0B;CAE7C,QAAQ,UAAU;EAChB,MAAM,WAAW,OAAO,IAAI,KAAK;EAEjC,IAAI,aAAa,KAAA,GAAW,OAAO;EACnC,MAAM,SAAS,QAAQ,QAAQ,KAAK;EAEpC,OAAO,IAAI,OAAO,MAAM;EAExB,OAAO;CACT;AACF"}

package/dist/internal/oauth/accounts.d.mts

@@ -0,0 +1,8 @@
+import "../mapping-error.mjs";
+import "./owner.mjs";
+import "./query-compiler.mjs";
+import "./flow.mjs";
+import "./registration.mjs";
+import { Context, Effect, Layer } from "effect";
+import { SecurityRevision } from "@yielded/auth/Sessions";
+import { OAuthAccountRevision, OAuthLinkAccess } from "@yielded/auth/OAuth";