@yielded/auth-persistence 0.1.0-beta.23 → 0.1.0-beta.25

package/README.md

@@ -9,10 +9,21 @@ Drizzle integrations live in `@yielded/auth-persistence-drizzle`; this package h
 no Drizzle dependency or exports. Core workflows and replaceable service contracts
 remain in `@yielded/auth`.
 
+`OAuthPersistence` supplies upstream provider sign-in, registration, login linking and
+unlinking, and retained grants through explicit table mappings on PostgreSQL and
+SQLite with interactive transactions. Provide `SqlClient`, Effect `Crypto`, and
+lifecycle hooks; applications own subjects, policies, keys, and migrations. See the
+[OAuth adapter reference](../../docs/src/content/docs/reference/adapters.md#oauth)
+and [runnable Effect SQL consumer](../../examples/persistence-sql).
+
 `OAuthServerPersistence` supplies independent, single-table consent and grant
 storage for [MCP authorization](../../docs/src/content/docs/guide/oauth.mdx#authorize-mcp-clients).
 Its conditional writes and monotonic revocation require standalone commits.
 
+`OAuthProxyPersistence` stores encrypted attempts for the
+[OAuth callback proxy](../../docs/src/content/docs/reference/oauth.md#callback-proxy)
+on SQLite/D1 or PostgreSQL. Its operations require standalone commits.
+
 Applications own subject provisioning, policy, claims, delivery, and their database
 connection and migration runner.
 

package/dist/Adapter.d.mts

@@ -6,11 +6,12 @@ import { AnyEmailAddressMapping, AnyEmailRegistrationMapping, AnyEmailSignInMapp
 import { D1PasskeyMapping, PasskeyAdmissionTable, PasskeyCeremonyMapping, PasskeyChargeInsert, PasskeyChargeKind, PasskeyChargeTable, PasskeyClock, PasskeyColumn, PasskeyCredentialMapping, PasskeyCredentialOwnershipTable, PasskeyCredentialReadTable, PasskeyCredentialServices, PasskeyEnrollmentContextMapping, PasskeyEnrollmentContextServices, PasskeyFactorReadTable, PasskeyFlowInsert, PasskeyFlowState, PasskeyFlowTable, PasskeyHandleOwnershipTable, PasskeyHandleReadTable, PasskeyHandleReservationTable, PasskeyMappingSource, PasskeyModuleTable, PasskeyPersistenceMapping, PasskeyPersistenceServices, PasskeyPolicyGuard, PasskeySubjectIdCodec, PasskeySubjectReadTable, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyPersistenceLayer, passkeyPolicyGuard, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "./internal/models/passkey-model.mjs";
 import { PasskeyRegistrationCeremonyCapabilities, PasskeyRegistrationCeremonyMapping, PasskeyRegistrationCeremonyServices, PasskeyRegistrationIntentReadTable, requiredPasskeyRegistrationCeremonyConstraints } from "./internal/models/passkey-registration-ceremony-model.mjs";
 import { PasskeyCommandTable, PasskeyCredentialInsert, PasskeyInvalidationInput, PasskeyInvalidationMutation, PasskeyManagementMapping, PasskeyManagementServices, PasskeyRegistrationMapping, PasskeyRegistrationServices, PasskeyRegistrationWriter, PasskeyWriteTables, passkeyInvalidationMutation, requiredPasskeyManagementConstraints, requiredPasskeyRegistrationWriteConstraints } from "./internal/models/passkey-write-model.mjs";
-import { AnyPasswordPersistenceMapping, AnyPasswordRegistrationMapping, D1PasswordPersistenceMapping, PasswordAttemptAction, PasswordAttemptRecord, PasswordAttemptState, PasswordAttemptTable, PasswordAuthorityCredentialTable, PasswordCommandTable, PasswordConstraintClassifier, PasswordCredentialTable, PasswordD1Clock, PasswordIdentifierTable, PasswordPersistenceMapping, PasswordRegistrationConstraintClassifier, PasswordRegistrationIntent, PasswordRegistrationMapping, PasswordRegistrationProvisioning, PasswordRegistrationState, PasswordRegistrationTable, PasswordSubjectTable, RequiredPasswordConstraints, RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "./internal/models/password-model.mjs";
+import { AnyPasswordPersistenceMapping, AnyPasswordRegistrationMapping, D1PasswordPersistenceMapping, PasswordAuthorityCredentialTable, PasswordCommandTable, PasswordConstraintClassifier, PasswordCredentialTable, PasswordD1Clock, PasswordIdentifierTable, PasswordPersistenceMapping, PasswordRegistrationConstraintClassifier, PasswordRegistrationIntent, PasswordRegistrationMapping, PasswordRegistrationProvisioning, PasswordRegistrationState, PasswordRegistrationTable, PasswordSubjectTable, RequiredPasswordConstraints, RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "./internal/models/password-model.mjs";
 import { AnyProofPersistenceMapping, D1ProofPersistenceMapping, ProofAbuseEventTable, ProofAction, ProofAuthorityInput, ProofAuthorityTables, ProofCommandDecision, ProofCommandKind, ProofCommandTable, ProofConstraintClassifier, ProofContinuationRecord, ProofContinuationTable, ProofD1Clock, ProofDeliveryState, ProofFailureEventTable, ProofGenerationState, ProofGenerationTable, ProofPersistenceMapping, ProofRateScopeTable, ProofRequestTable, ProofScopeKeys, ProofScopeKind, ProofSeriesTable, RequiredProofConstraints, requiredProofConstraints } from "./internal/models/proof-model.mjs";
 import { AuthenticationAuthorityMapping, D1AuthenticationAuthorityMapping, D1PendingAuthenticationMapping, D1SessionClockMapping, D1SignedSessionValidityMapping, D1StatefulSessionMapping, PendingAuthenticationMapping, PendingAuthenticationTables, RequiredPendingAuthenticationConstraints, RequiredSessionConstraints, RequiredSignedValidityConstraints, RequiredStatefulPendingConstraints, SessionAuthorityTables, SessionConstraintClassifier, SessionFlowTables, SessionIdCodec, SessionSubjectTables, SignedSessionValidityMapping, SignedSessionValidityTables, StatefulSessionMapping, StatefulSessionTables, requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints } from "./internal/models/session-model.mjs";
 import { D1SessionStepUpMapping, RequiredSessionStepUpConstraints, SessionStepUpIntentTables, SessionStepUpMapping, SessionStepUpSourceTables, requiredSessionStepUpConstraints } from "./internal/models/step-up-model.mjs";
 import { requireStandalone } from "./internal/standalone.mjs";
+import { OAuthProxySqlTable, makeOAuthProxyPersistence, oauthProxyColumns } from "./internal/oauth-proxy.mjs";
 import { decodeStepUpIntent, encodeStepUpIntent, stepUpIntentLive, validateStepUpPlan } from "./internal/step-up-state.mjs";
 import { CurrentProofSql, ProofSqlConfiguration, ProofSqlDatabase, ProofSqlQuery, makeProofKernel } from "./internal/proof-kernel.mjs";
 import { CurrentAddress, CurrentEmailSql, EmailSqlConfiguration, EmailSqlDatabase, EmailSqlQuery, makeEmailKernel } from "./internal/email-kernel.mjs";
@@ -18,17 +19,22 @@ import { CurrentPasskeyTransaction, PasskeyOwner } from "./internal/passkey/stat
 import { TransactionBound, TransactionCoordinatorError, TransactionExecution, TransactionTargetConfiguration, makeTransactionExecutionKernel } from "./internal/transaction-execution-kernel.mjs";
 import { PasskeyCoordinatorError, PasskeyExecution, PasskeyTargetConfiguration } from "./internal/passkey/target.mjs";
 import { PasskeyKernel, makePasskeyKernel } from "./internal/passkey-kernel.mjs";
+import { StorageTable } from "./internal/storage-tables.mjs";
+import { BoundPersistence, ClaimsCodec, Definition, PersistenceApi, PersistenceConfigurationError } from "./internal/configuration.mjs";
+import { PhysicalStorageTable, StorageValidation, validateStorage, validateStorageBatch, withStorageValidation } from "./internal/storage-validation.mjs";
 import { NativeSqlTables, SqlTable, makeNativeSqlTables, nativeSqlAlias } from "./internal/native-sql-table.mjs";
-import { samePasswordCredentialSnapshot } from "./internal/password-attempts.mjs";
+import { samePasswordCredentialSnapshot } from "./internal/password-credentials.mjs";
 import { CurrentPasswordSql, PasswordSqlConfiguration, PasswordSqlDatabase, PasswordSqlQuery, makePasswordKernel } from "./internal/password-kernel.mjs";
 import { CurrentPasswordPreparedTransaction, PasswordPreparedJournalGuards, PasswordPreparedPostcondition, PasswordPreparedPostconditions } from "./internal/PasswordPreparedPostconditions.mjs";
 import { CurrentPhoneTransaction, makePhoneKernel } from "./internal/phone-kernel.mjs";
 import { CurrentSessionSql, SessionSqlDatabase, SessionSqlOptions, makeSessionKernel } from "./internal/session-kernel.mjs";
-import { StorageTable } from "./internal/storage-tables.mjs";
-import { BoundPersistence, ClaimsCodec, Definition, PersistenceApi, PersistenceConfigurationError } from "./internal/configuration.mjs";
 import { createPersistence } from "./internal/persistence.mjs";
 import { makeComposedPasskeys } from "./internal/passkeys.mjs";
 import { makeMappings } from "./internal/storage-mapping.mjs";
 import { PasswordRegistrationAuthority } from "./internal/registration-contract.mjs";
-import { PhysicalStorageTable, StorageValidation, validateStorage, validateStorageBatch, withStorageValidation } from "./internal/storage-validation.mjs";
-export { type AnyEmailAddressMapping, type AnyEmailRegistrationMapping, type AnyEmailSignInMapping, type AnyPasswordPersistenceMapping, type AnyPasswordRegistrationMapping, type AnyProofPersistenceMapping, type AuthenticationAuthorityMapping, type BoundPersistence, type ClaimsCodec, type CurrentAddress, CurrentEmailSql, CurrentPasskeyTransaction, CurrentPasswordPreparedTransaction, CurrentPasswordSql, CurrentPhoneTransaction, CurrentProofSql, CurrentSessionSql, type D1AuthenticationAuthorityMapping, type D1EmailAddressMapping, type D1EmailRegistrationMapping, type D1PasskeyMapping, type D1PasswordPersistenceMapping, type D1PendingAuthenticationMapping, type D1ProofPersistenceMapping, type D1SessionClockMapping, type D1SessionStepUpMapping, type D1SignedSessionValidityMapping, type D1StatefulSessionMapping, type Definition, type EmailAddressMapping, type EmailAuthorityCredentialTable, type EmailCommandTable, type EmailCredentialReadTable, type EmailCredentialTable, type EmailD1Clock, type EmailIdentifierReadTable, type EmailIdentifierTable, type EmailRegistrationAuthorityCredentialTable, type EmailRegistrationCredentialTable, type EmailRegistrationIdentifierTable, type EmailRegistrationIntent, type EmailRegistrationMapping, type EmailRegistrationProvisioning, type EmailRegistrationState, type EmailRegistrationTable, type EmailSignInMapping, type EmailSqlConfiguration, type EmailSqlDatabase, type EmailSqlQuery, type EmailSubjectReadTable, type EmailSubjectTable, type GuardedUpdate, NativeDatabase, type NativeSqlTables, type Observation, type PasskeyAdmissionTable, type PasskeyCeremonyMapping, type PasskeyChargeInsert, type PasskeyChargeKind, type PasskeyChargeTable, type PasskeyClock, type PasskeyColumn, type PasskeyCommandTable, type PasskeyCoordinatorError, type PasskeyCredentialInsert, type PasskeyCredentialMapping, type PasskeyCredentialOwnershipTable, type PasskeyCredentialReadTable, type PasskeyCredentialServices, type PasskeyEnrollmentContextMapping, type PasskeyEnrollmentContextServices, type PasskeyExecution, type PasskeyFactorReadTable, type PasskeyFlowInsert, type PasskeyFlowState, type PasskeyFlowTable, type PasskeyHandleOwnershipTable, type PasskeyHandleReadTable, type PasskeyHandleReservationTable, type PasskeyInvalidationInput, type PasskeyInvalidationMutation, type PasskeyKernel, type PasskeyManagementMapping, type PasskeyManagementServices, type PasskeyMappingSource, type PasskeyModuleTable, type PasskeyOwner, type PasskeyPersistenceMapping, type PasskeyPersistenceServices, type PasskeyPolicyGuard, type PasskeyRegistrationCeremonyCapabilities, type PasskeyRegistrationCeremonyMapping, type PasskeyRegistrationCeremonyServices, type PasskeyRegistrationIntentReadTable, type PasskeyRegistrationMapping, type PasskeyRegistrationServices, type PasskeyRegistrationWriter, type PasskeySubjectIdCodec, type PasskeySubjectReadTable, type PasskeyTargetConfiguration, type PasskeyWriteTables, type PasswordAttemptAction, type PasswordAttemptRecord, type PasswordAttemptState, type PasswordAttemptTable, type PasswordAuthorityCredentialTable, type PasswordCommandTable, type PasswordConstraintClassifier, type PasswordCredentialTable, type PasswordD1Clock, type PasswordIdentifierTable, type PasswordPersistenceMapping, PasswordPreparedJournalGuards, type PasswordPreparedPostcondition, PasswordPreparedPostconditions, type PasswordRegistrationAuthority, type PasswordRegistrationConstraintClassifier, type PasswordRegistrationIntent, type PasswordRegistrationMapping, type PasswordRegistrationProvisioning, type PasswordRegistrationState, type PasswordRegistrationTable, type PasswordSqlConfiguration, type PasswordSqlDatabase, type PasswordSqlQuery, type PasswordSubjectTable, type PendingAuthenticationMapping, type PendingAuthenticationTables, type PersistenceApi, PersistenceConfigurationError, PersistenceMappingError, type PhysicalStorageTable, type ProofAbuseEventTable, type ProofAction, type ProofAuthorityInput, type ProofAuthorityTables, type ProofCommandDecision, type ProofCommandKind, type ProofCommandTable, type ProofConstraintClassifier, type ProofContinuationRecord, type ProofContinuationTable, type ProofD1Clock, type ProofDeliveryState, type ProofFailureEventTable, type ProofGenerationState, type ProofGenerationTable, type ProofPersistenceMapping, type ProofRateScopeTable, type ProofRequestTable, type ProofScopeKeys, type ProofScopeKind, type ProofSeriesTable, type ProofSqlConfiguration, type ProofSqlDatabase, type ProofSqlQuery, type QueryFailure, type QueryOperations, type RequiredEmailAddressConstraints, type RequiredEmailRegistrationConstraints, type RequiredEmailSignInConstraints, type RequiredPasswordConstraints, type RequiredPasswordRegistrationConstraints, type RequiredPendingAuthenticationConstraints, type RequiredProofConstraints, type RequiredSessionConstraints, type RequiredSessionStepUpConstraints, type RequiredSignedValidityConstraints, type RequiredStatefulPendingConstraints, type Row, type SessionAuthorityTables, type SessionConstraintClassifier, type SessionFlowTables, type SessionIdCodec, type SessionSqlDatabase, type SessionSqlOptions, type SessionStepUpIntentTables, type SessionStepUpMapping, type SessionStepUpSourceTables, type SessionSubjectTables, type SignedSessionValidityMapping, type SignedSessionValidityTables, type SqlColumn, type SqlExpression, type SqlFragment, type SqlTable, type StatefulSessionMapping, type StatefulSessionTables, type StorageTable, type StorageValidation, type SubjectIdCodec, type TableModel, type TransactionBound, type TransactionCoordinatorError, type TransactionExecution, type TransactionNativeDatabase, type TransactionOwner, type TransactionTargetConfiguration, createPersistence, decodeStepUpIntent, encodeStepUpIntent, isMappedConstraintConflict, makeComposedPasskeys, makeEmailKernel, makeNativeSqlTables, makePasskeyKernel, makePasswordKernel, makePhoneKernel, makeProofKernel, makeSessionKernel, makeMappings as makeStorageMappings, makeTransactionExecutionKernel, makeTransactionKernel, nativeSqlAlias, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyInvalidationMutation, passkeyPersistenceLayer, passkeyPolicyGuard, requireStandalone, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints, requiredPasskeyCredentialConstraints, requiredPasskeyManagementConstraints, requiredPasskeyPersistenceConstraints, requiredPasskeyRegistrationCeremonyConstraints, requiredPasskeyRegistrationWriteConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints, requiredPendingAuthenticationConstraints, requiredProofConstraints, requiredSessionConstraints, requiredSessionStepUpConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints, samePasswordCredentialSnapshot, stepUpIntentLive, validateStepUpPlan, validateStorage, validateStorageBatch, withStorageValidation };
+import { OAuthAccountsMapping, OAuthAction, OAuthAuthorityReadTable, OAuthAuthorityTable, OAuthCleanupDescriptor, OAuthCleanupTable, OAuthClock, OAuthCredentialReadTable, OAuthCredentialTable, OAuthD1Mapping, OAuthEligibilityDescriptor, OAuthEligibilityFact, OAuthEligibilityTable, OAuthFlowState, OAuthFlowTable, OAuthMetadataPolicy, OAuthOwnershipMutation, OAuthOwnershipReadTable, OAuthOwnershipTable, OAuthReferenceGuardDescriptor, OAuthReferenceGuardTable, OAuthRegistrationAuthority, OAuthRegistrationBase, OAuthRegistrationCommandTable, OAuthRegistrationEligibility, OAuthRegistrationGuardDescriptor, OAuthRegistrationGuardTable, OAuthRegistrationIntentMapping, OAuthRegistrationIntentTable, OAuthRegistrationMapping, OAuthRegistrationState, OAuthSignInMapping, OAuthSubjectReadTable, OAuthSubjectTable, OAuthTupleAuthorityTable, OAuthTupleState, OAuthUnlinkCommandTable, oauthCleanupTable, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationGuardTable, requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints } from "./internal/models/oauth-model.mjs";
+import { OAuthConnectedAction, OAuthConnectedAdmissionTable, OAuthConnectedAuthorityMapping, OAuthConnectedClientRegistrationTable, OAuthConnectedCohortTable, OAuthConnectedCommandTable, OAuthConnectedFlowTable, OAuthConnectedGrantTable, OAuthConnectedMapping, OAuthConnectedOrderCodec, OAuthConnectedOwnershipRead, OAuthConnectedPolicyGuard, OAuthConnectedPolicyGuardTable, OAuthConnectedPolicyInput, OAuthConnectedRevocationJobTable, OAuthConnectedRevocationMapping, OAuthConnectedSqlPolicy, OAuthConnectedSubjectTable, oauthConnectedPolicyGuard, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints } from "./internal/models/oauth-connected-model.mjs";
+import { OAuthCoordinatorError, OAuthExecution, OAuthTargetConfiguration } from "./internal/oauth/target.mjs";
+import { OAuthKernel, makeOAuthKernel } from "./internal/oauth-kernel.mjs";
+import { storageKeyPlans } from "./internal/storage-plans.mjs";
+export { type AnyEmailAddressMapping, type AnyEmailRegistrationMapping, type AnyEmailSignInMapping, type AnyPasswordPersistenceMapping, type AnyPasswordRegistrationMapping, type AnyProofPersistenceMapping, type AuthenticationAuthorityMapping, type BoundPersistence, type ClaimsCodec, type CurrentAddress, CurrentEmailSql, CurrentPasskeyTransaction, CurrentPasswordPreparedTransaction, CurrentPasswordSql, CurrentPhoneTransaction, CurrentProofSql, CurrentSessionSql, type D1AuthenticationAuthorityMapping, type D1EmailAddressMapping, type D1EmailRegistrationMapping, type D1PasskeyMapping, type D1PasswordPersistenceMapping, type D1PendingAuthenticationMapping, type D1ProofPersistenceMapping, type D1SessionClockMapping, type D1SessionStepUpMapping, type D1SignedSessionValidityMapping, type D1StatefulSessionMapping, type Definition, type EmailAddressMapping, type EmailAuthorityCredentialTable, type EmailCommandTable, type EmailCredentialReadTable, type EmailCredentialTable, type EmailD1Clock, type EmailIdentifierReadTable, type EmailIdentifierTable, type EmailRegistrationAuthorityCredentialTable, type EmailRegistrationCredentialTable, type EmailRegistrationIdentifierTable, type EmailRegistrationIntent, type EmailRegistrationMapping, type EmailRegistrationProvisioning, type EmailRegistrationState, type EmailRegistrationTable, type EmailSignInMapping, type EmailSqlConfiguration, type EmailSqlDatabase, type EmailSqlQuery, type EmailSubjectReadTable, type EmailSubjectTable, type GuardedUpdate, NativeDatabase, type NativeSqlTables, type OAuthAccountsMapping, type OAuthAction, type OAuthAuthorityReadTable, type OAuthAuthorityTable, type OAuthCleanupDescriptor, type OAuthCleanupTable, type OAuthClock, type OAuthConnectedAction, type OAuthConnectedAdmissionTable, type OAuthConnectedAuthorityMapping, type OAuthConnectedClientRegistrationTable, type OAuthConnectedCohortTable, type OAuthConnectedCommandTable, type OAuthConnectedFlowTable, type OAuthConnectedGrantTable, type OAuthConnectedMapping, type OAuthConnectedOrderCodec, type OAuthConnectedOwnershipRead, type OAuthConnectedPolicyGuard, type OAuthConnectedPolicyGuardTable, type OAuthConnectedPolicyInput, type OAuthConnectedRevocationJobTable, type OAuthConnectedRevocationMapping, type OAuthConnectedSqlPolicy, type OAuthConnectedSubjectTable, type OAuthCoordinatorError, type OAuthCredentialReadTable, type OAuthCredentialTable, type OAuthD1Mapping, type OAuthEligibilityDescriptor, type OAuthEligibilityFact, type OAuthEligibilityTable, type OAuthExecution, type OAuthFlowState, type OAuthFlowTable, type OAuthKernel, type OAuthMetadataPolicy, type OAuthOwnershipMutation, type OAuthOwnershipReadTable, type OAuthOwnershipTable, type OAuthProxySqlTable, type OAuthReferenceGuardDescriptor, type OAuthReferenceGuardTable, type OAuthRegistrationAuthority, type OAuthRegistrationBase, type OAuthRegistrationCommandTable, type OAuthRegistrationEligibility, type OAuthRegistrationGuardDescriptor, type OAuthRegistrationGuardTable, type OAuthRegistrationIntentMapping, type OAuthRegistrationIntentTable, type OAuthRegistrationMapping, type OAuthRegistrationState, type OAuthSignInMapping, type OAuthSubjectReadTable, type OAuthSubjectTable, type OAuthTargetConfiguration, type OAuthTupleAuthorityTable, type OAuthTupleState, type OAuthUnlinkCommandTable, type Observation, type PasskeyAdmissionTable, type PasskeyCeremonyMapping, type PasskeyChargeInsert, type PasskeyChargeKind, type PasskeyChargeTable, type PasskeyClock, type PasskeyColumn, type PasskeyCommandTable, type PasskeyCoordinatorError, type PasskeyCredentialInsert, type PasskeyCredentialMapping, type PasskeyCredentialOwnershipTable, type PasskeyCredentialReadTable, type PasskeyCredentialServices, type PasskeyEnrollmentContextMapping, type PasskeyEnrollmentContextServices, type PasskeyExecution, type PasskeyFactorReadTable, type PasskeyFlowInsert, type PasskeyFlowState, type PasskeyFlowTable, type PasskeyHandleOwnershipTable, type PasskeyHandleReadTable, type PasskeyHandleReservationTable, type PasskeyInvalidationInput, type PasskeyInvalidationMutation, type PasskeyKernel, type PasskeyManagementMapping, type PasskeyManagementServices, type PasskeyMappingSource, type PasskeyModuleTable, type PasskeyOwner, type PasskeyPersistenceMapping, type PasskeyPersistenceServices, type PasskeyPolicyGuard, type PasskeyRegistrationCeremonyCapabilities, type PasskeyRegistrationCeremonyMapping, type PasskeyRegistrationCeremonyServices, type PasskeyRegistrationIntentReadTable, type PasskeyRegistrationMapping, type PasskeyRegistrationServices, type PasskeyRegistrationWriter, type PasskeySubjectIdCodec, type PasskeySubjectReadTable, type PasskeyTargetConfiguration, type PasskeyWriteTables, type PasswordAuthorityCredentialTable, type PasswordCommandTable, type PasswordConstraintClassifier, type PasswordCredentialTable, type PasswordD1Clock, type PasswordIdentifierTable, type PasswordPersistenceMapping, PasswordPreparedJournalGuards, type PasswordPreparedPostcondition, PasswordPreparedPostconditions, type PasswordRegistrationAuthority, type PasswordRegistrationConstraintClassifier, type PasswordRegistrationIntent, type PasswordRegistrationMapping, type PasswordRegistrationProvisioning, type PasswordRegistrationState, type PasswordRegistrationTable, type PasswordSqlConfiguration, type PasswordSqlDatabase, type PasswordSqlQuery, type PasswordSubjectTable, type PendingAuthenticationMapping, type PendingAuthenticationTables, type PersistenceApi, PersistenceConfigurationError, PersistenceMappingError, type PhysicalStorageTable, type ProofAbuseEventTable, type ProofAction, type ProofAuthorityInput, type ProofAuthorityTables, type ProofCommandDecision, type ProofCommandKind, type ProofCommandTable, type ProofConstraintClassifier, type ProofContinuationRecord, type ProofContinuationTable, type ProofD1Clock, type ProofDeliveryState, type ProofFailureEventTable, type ProofGenerationState, type ProofGenerationTable, type ProofPersistenceMapping, type ProofRateScopeTable, type ProofRequestTable, type ProofScopeKeys, type ProofScopeKind, type ProofSeriesTable, type ProofSqlConfiguration, type ProofSqlDatabase, type ProofSqlQuery, type QueryFailure, type QueryOperations, type RequiredEmailAddressConstraints, type RequiredEmailRegistrationConstraints, type RequiredEmailSignInConstraints, type RequiredPasswordConstraints, type RequiredPasswordRegistrationConstraints, type RequiredPendingAuthenticationConstraints, type RequiredProofConstraints, type RequiredSessionConstraints, type RequiredSessionStepUpConstraints, type RequiredSignedValidityConstraints, type RequiredStatefulPendingConstraints, type Row, type SessionAuthorityTables, type SessionConstraintClassifier, type SessionFlowTables, type SessionIdCodec, type SessionSqlDatabase, type SessionSqlOptions, type SessionStepUpIntentTables, type SessionStepUpMapping, type SessionStepUpSourceTables, type SessionSubjectTables, type SignedSessionValidityMapping, type SignedSessionValidityTables, type SqlColumn, type SqlExpression, type SqlFragment, type SqlTable, type StatefulSessionMapping, type StatefulSessionTables, type StorageTable, type StorageValidation, type SubjectIdCodec, type TableModel, type TransactionBound, type TransactionCoordinatorError, type TransactionExecution, type TransactionNativeDatabase, type TransactionOwner, type TransactionTargetConfiguration, createPersistence, decodeStepUpIntent, encodeStepUpIntent, isMappedConstraintConflict, makeComposedPasskeys, makeEmailKernel, makeNativeSqlTables, makeOAuthKernel, makeOAuthProxyPersistence, makePasskeyKernel, makePasswordKernel, makePhoneKernel, makeProofKernel, makeSessionKernel, makeMappings as makeStorageMappings, makeTransactionExecutionKernel, makeTransactionKernel, nativeSqlAlias, oauthCleanupTable, oauthConnectedPolicyGuard, oauthEligibilityTable, oauthProxyColumns, oauthReferenceGuardTable, oauthRegistrationGuardTable, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyInvalidationMutation, passkeyPersistenceLayer, passkeyPolicyGuard, requireStandalone, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints, requiredOAuthAccountsConstraints, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints, requiredPasskeyCredentialConstraints, requiredPasskeyManagementConstraints, requiredPasskeyPersistenceConstraints, requiredPasskeyRegistrationCeremonyConstraints, requiredPasskeyRegistrationWriteConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints, requiredPendingAuthenticationConstraints, requiredProofConstraints, requiredSessionConstraints, requiredSessionStepUpConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints, samePasswordCredentialSnapshot, stepUpIntentLive, storageKeyPlans, validateStepUpPlan, validateStorage, validateStorageBatch, withStorageValidation };

package/dist/Adapter.mjs

@@ -16,14 +16,19 @@ import { makeComposedPasskeys } from "./internal/passkeys.mjs";
 import { requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints } from "./internal/models/email-model.mjs";
 import { CurrentEmailSql, makeEmailKernel } from "./internal/email-kernel.mjs";
 import { requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "./internal/models/password-model.mjs";
-import { samePasswordCredentialSnapshot } from "./internal/password-attempts.mjs";
+import { samePasswordCredentialSnapshot } from "./internal/password-credentials.mjs";
 import { CurrentPasswordSql, makePasswordKernel } from "./internal/password-kernel.mjs";
 import { CurrentPhoneTransaction, makePhoneKernel } from "./internal/phone-kernel.mjs";
 import { decodeStepUpIntent, encodeStepUpIntent, stepUpIntentLive, validateStepUpPlan } from "./internal/step-up-state.mjs";
+import { validateStorage, validateStorageBatch, withStorageValidation } from "./internal/storage-validation.mjs";
 import { CurrentSessionSql, makeSessionKernel } from "./internal/session-kernel.mjs";
 import { makeMappings } from "./internal/storage-mapping.mjs";
-import { validateStorage, validateStorageBatch, withStorageValidation } from "./internal/storage-validation.mjs";
 import { createPersistence } from "./internal/persistence.mjs";
+import { makeOAuthProxyPersistence, oauthProxyColumns } from "./internal/oauth-proxy.mjs";
+import { oauthCleanupTable, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationGuardTable, requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints } from "./internal/models/oauth-model.mjs";
+import { makeOAuthKernel } from "./internal/oauth-kernel.mjs";
+import { storageKeyPlans } from "./internal/storage-plans.mjs";
+import { oauthConnectedPolicyGuard, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints } from "./internal/models/oauth-connected-model.mjs";
 import { requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints } from "./internal/models/session-model.mjs";
 import { requiredSessionStepUpConstraints } from "./internal/models/step-up-model.mjs";
-export { CurrentEmailSql, CurrentPasskeyTransaction, CurrentPasswordPreparedTransaction, CurrentPasswordSql, CurrentPhoneTransaction, CurrentProofSql, CurrentSessionSql, NativeDatabase, PasswordPreparedJournalGuards, PasswordPreparedPostconditions, PersistenceConfigurationError, PersistenceMappingError, createPersistence, decodeStepUpIntent, encodeStepUpIntent, isMappedConstraintConflict, makeComposedPasskeys, makeEmailKernel, makeNativeSqlTables, makePasskeyKernel, makePasswordKernel, makePhoneKernel, makeProofKernel, makeSessionKernel, makeMappings as makeStorageMappings, makeTransactionExecutionKernel, makeTransactionKernel, nativeSqlAlias, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyInvalidationMutation, passkeyPersistenceLayer, passkeyPolicyGuard, requireStandalone, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints, requiredPasskeyCredentialConstraints, requiredPasskeyManagementConstraints, requiredPasskeyPersistenceConstraints, requiredPasskeyRegistrationCeremonyConstraints, requiredPasskeyRegistrationWriteConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints, requiredPendingAuthenticationConstraints, requiredProofConstraints, requiredSessionConstraints, requiredSessionStepUpConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints, samePasswordCredentialSnapshot, stepUpIntentLive, validateStepUpPlan, validateStorage, validateStorageBatch, withStorageValidation };
+export { CurrentEmailSql, CurrentPasskeyTransaction, CurrentPasswordPreparedTransaction, CurrentPasswordSql, CurrentPhoneTransaction, CurrentProofSql, CurrentSessionSql, NativeDatabase, PasswordPreparedJournalGuards, PasswordPreparedPostconditions, PersistenceConfigurationError, PersistenceMappingError, createPersistence, decodeStepUpIntent, encodeStepUpIntent, isMappedConstraintConflict, makeComposedPasskeys, makeEmailKernel, makeNativeSqlTables, makeOAuthKernel, makeOAuthProxyPersistence, makePasskeyKernel, makePasswordKernel, makePhoneKernel, makeProofKernel, makeSessionKernel, makeMappings as makeStorageMappings, makeTransactionExecutionKernel, makeTransactionKernel, nativeSqlAlias, oauthCleanupTable, oauthConnectedPolicyGuard, oauthEligibilityTable, oauthProxyColumns, oauthReferenceGuardTable, oauthRegistrationGuardTable, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyInvalidationMutation, passkeyPersistenceLayer, passkeyPolicyGuard, requireStandalone, requiredEmailAddressConstraints, requiredEmailRegistrationConstraints, requiredEmailSignInConstraints, requiredOAuthAccountsConstraints, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints, requiredPasskeyCredentialConstraints, requiredPasskeyManagementConstraints, requiredPasskeyPersistenceConstraints, requiredPasskeyRegistrationCeremonyConstraints, requiredPasskeyRegistrationWriteConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints, requiredPendingAuthenticationConstraints, requiredProofConstraints, requiredSessionConstraints, requiredSessionStepUpConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints, samePasswordCredentialSnapshot, stepUpIntentLive, storageKeyPlans, validateStepUpPlan, validateStorage, validateStorageBatch, withStorageValidation };

package/dist/OAuthPersistence.d.mts

@@ -0,0 +1,87 @@
+import { AuthenticationAuthorityMapping } from "./internal/models/session-model.mjs";
+import { StorageTable } from "./internal/storage-tables.mjs";
+import { PersistenceConfigurationError } from "./internal/configuration.mjs";
+import { OAuthAction, OAuthD1Mapping, OAuthEligibilityFact, OAuthFlowState, OAuthRegistrationAuthority, OAuthRegistrationState, OAuthTupleState, requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints } from "./internal/models/oauth-model.mjs";
+import { OAuthConnectedAction, OAuthConnectedOrderCodec, OAuthConnectedPolicyInput, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints } from "./internal/models/oauth-connected-model.mjs";
+import { OAuthCoordinatorError, oauthAccountsPersistenceLayer as oauthAccountsPersistenceLayer$1, oauthRegistrationAuthorityLayer as oauthRegistrationAuthorityLayer$1, oauthRegistrationIntentsLayer as oauthRegistrationIntentsLayer$1, oauthSignInPersistenceLayer as oauthSignInPersistenceLayer$1 } from "./internal/oauth/target.mjs";
+import { Fragment, Table } from "./internal/sql-table.mjs";
+import { OAuthAccountsMapping, OAuthAuthorityReadTable, OAuthAuthorityTable, OAuthCleanupDescriptor, OAuthCleanupTable, OAuthClock, OAuthCredentialReadTable, OAuthCredentialTable, OAuthEligibilityDescriptor, OAuthEligibilityTable, OAuthFlowTable, OAuthMetadataPolicy, OAuthOwnershipMutation, OAuthOwnershipReadTable, OAuthOwnershipTable, OAuthReferenceGuardDescriptor, OAuthReferenceGuardTable, OAuthRegistrationBase, OAuthRegistrationCommandTable, OAuthRegistrationEligibility, OAuthRegistrationGuardDescriptor, OAuthRegistrationGuardTable, OAuthRegistrationIntentMapping, OAuthRegistrationIntentTable, OAuthRegistrationMapping, OAuthSignInMapping, OAuthSubjectReadTable, OAuthSubjectTable, OAuthTupleAuthorityTable, OAuthUnlinkCommandTable, SqlTableModel, oauthCleanupTable, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationGuardTable } from "./internal/sql-oauth-model.mjs";
+import { oauthConnectedPersistenceLayer as oauthConnectedPersistenceLayer$1, oauthConnectedRevocationsLayer as oauthConnectedRevocationsLayer$1 } from "./internal/oauth/connected-target.mjs";
+import { OAuthConnectedAdmissionTable, OAuthConnectedAuthorityMapping, OAuthConnectedClientRegistrationTable, OAuthConnectedCohortTable, OAuthConnectedCommandTable, OAuthConnectedFlowTable, OAuthConnectedGrantTable, OAuthConnectedMapping, OAuthConnectedOwnershipRead, OAuthConnectedPolicyGuard, OAuthConnectedPolicyGuardTable, OAuthConnectedRevocationJobTable, OAuthConnectedRevocationMapping, OAuthConnectedSqlPolicy, OAuthConnectedSubjectTable, oauthConnectedPolicyGuard } from "./internal/sql-oauth-connected-model.mjs";
+import { and, eq, sql } from "./internal/sql-query.mjs";
+import { Context, Crypto, Effect } from "effect";
+import { SqlClient } from "effect/sql";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { AuthenticationAuthority, SessionUnavailable } from "@yielded/auth/Sessions";
+import { OAuthAccountsPersistence, OAuthConnectedPersistence, OAuthConnectedRevocations, OAuthRegistrationIntents, OAuthSignInPersistence, OAuthUnavailable } from "@yielded/auth/OAuth";
+declare namespace OAuthPersistence_d_exports {
+  export { OAuthAccountsMapping, OAuthAction, OAuthAuthorityReadTable, OAuthAuthorityTable, OAuthCleanupDescriptor, OAuthCleanupTable, OAuthClock, OAuthConnectedAction, OAuthConnectedAdmissionTable, OAuthConnectedAuthorityMapping, OAuthConnectedClientRegistrationTable, OAuthConnectedCohortTable, OAuthConnectedCommandTable, OAuthConnectedFlowTable, OAuthConnectedGrantTable, OAuthConnectedMapping, OAuthConnectedOrderCodec, OAuthConnectedOwnershipRead, OAuthConnectedPolicyGuard, OAuthConnectedPolicyGuardTable, OAuthConnectedPolicyInput, OAuthConnectedRevocationJobTable, OAuthConnectedRevocationMapping, OAuthConnectedSqlPolicy, OAuthConnectedSubjectTable, OAuthCredentialReadTable, OAuthCredentialTable, OAuthD1Mapping, OAuthEligibilityDescriptor, OAuthEligibilityFact, OAuthEligibilityTable, OAuthFlowState, OAuthFlowTable, OAuthMetadataPolicy, OAuthOwnershipMutation, OAuthOwnershipReadTable, OAuthOwnershipTable, OAuthReferenceGuardDescriptor, OAuthReferenceGuardTable, OAuthRegistrationAuthority, OAuthRegistrationBase, OAuthRegistrationCommandTable, OAuthRegistrationEligibility, OAuthRegistrationGuardDescriptor, OAuthRegistrationGuardTable, OAuthRegistrationIntentMapping, OAuthRegistrationIntentTable, OAuthRegistrationMapping, OAuthRegistrationState, OAuthSignInMapping, OAuthSubjectReadTable, OAuthSubjectTable, OAuthTupleAuthorityTable, OAuthTupleState, OAuthUnlinkCommandTable, SqlTableModel, and, clock, coordinateOAuthAccounts, coordinateOAuthConnected, coordinateOAuthConnectedRevocations, coordinateOAuthRegistration, coordinateOAuthRegistrationIntents, coordinateOAuthSignIn, eq, makeAuthenticationAuthorityServices, makeOAuthAccountsServices, makeOAuthConnectedRevocationServices, makeOAuthConnectedServices, makeOAuthRegistrationIntentServices, makeOAuthRegistrationServices, makeOAuthSignInServices, oauthAccountsPersistenceLayer, oauthCleanupTable, oauthConnectedOwnershipReferences, oauthConnectedPersistenceLayer, oauthConnectedPolicyGuard, oauthConnectedRevocationsLayer, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationAuthorityLayer, oauthRegistrationGuardTable, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer, requiredOAuthAccountsConstraints, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints, sql, table };
+}
+/** Physical identifiers and representations only; applications own migrations. */
+export declare const table: (definition: StorageTable) => Table;
+/** Integer-millisecond engine clock, sampled after locks on either supported dialect. */
+export declare const clock: {
+  encodeInstant: (input: number, options?: import("effect/SchemaAST").ParseOptions) => number;
+  decodeInstant: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => number;
+  engineNowMillis: Fragment;
+};
+export declare const makeOAuthSignInServices: <N>(mapping: OAuthSignInMapping<Table, Table, Table, Table, Table, N>) => Effect.Effect<{
+  readonly oauthSignInPersistence: OAuthSignInPersistence["Service"];
+}, OAuthUnavailable | PersistenceConfigurationError, Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient>;
+/** Run auth and application SQL in one adapter-owned transaction and commit journal. */
+export declare const coordinateOAuthSignIn: <N, A, E, R>(options: {
+  readonly mapping: OAuthSignInMapping<Table, Table, Table, Table, Table, N>;
+}, body: Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E> | PersistenceConfigurationError, Exclude<R, OAuthSignInPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient>;
+export declare const makeOAuthRegistrationIntentServices: <N>(mapping: OAuthRegistrationIntentMapping<Table, Table, Table, Table, Table, Table, Table, N>) => Effect.Effect<{
+  readonly oauthRegistrationIntents: OAuthRegistrationIntents["Service"];
+}, OAuthUnavailable | PersistenceConfigurationError, Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient>;
+/** Run auth and application SQL in one adapter-owned transaction and commit journal. */
+export declare const coordinateOAuthRegistrationIntents: <N, A, E, R>(options: {
+  readonly mapping: OAuthRegistrationIntentMapping<Table, Table, Table, Table, Table, Table, Table, N>;
+}, body: Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E> | PersistenceConfigurationError, Exclude<R, OAuthRegistrationIntents> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient>;
+export declare const makeOAuthAccountsServices: <N>(mapping: OAuthAccountsMapping<Table, Table, Table, Table, Table, Table, Table, N>) => Effect.Effect<{
+  readonly oauthAccountsPersistence: OAuthAccountsPersistence["Service"];
+}, OAuthUnavailable | PersistenceConfigurationError, Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient>;
+/** Run auth and application SQL in one adapter-owned transaction and commit journal. */
+export declare const coordinateOAuthAccounts: <N, A, E, R>(options: {
+  readonly mapping: OAuthAccountsMapping<Table, Table, Table, Table, Table, Table, Table, N>;
+}, body: Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E> | PersistenceConfigurationError, Exclude<R, OAuthAccountsPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient>;
+export declare const makeOAuthConnectedServices: <N>(mapping: OAuthConnectedMapping<Table, Table, Table, Table, Table, Table, Table, Table, Table, Table, N, Table>) => Effect.Effect<{
+  readonly oauthConnectedPersistence: OAuthConnectedPersistence["Service"];
+}, OAuthUnavailable | PersistenceConfigurationError, Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient>;
+/** Run auth and application SQL in one adapter-owned transaction and commit journal. */
+export declare const coordinateOAuthConnected: <N, A, E, R>(options: {
+  readonly mapping: OAuthConnectedMapping<Table, Table, Table, Table, Table, Table, Table, Table, Table, Table, N, Table>;
+}, body: Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E> | PersistenceConfigurationError, Exclude<R, OAuthConnectedPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient>;
+export declare const makeOAuthConnectedRevocationServices: <N>(mapping: OAuthConnectedRevocationMapping<Table, Table, Table, Table, Table, Table, Table, N>) => Effect.Effect<{
+  readonly oauthConnectedRevocations: OAuthConnectedRevocations["Service"];
+}, OAuthUnavailable | PersistenceConfigurationError, Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient>;
+/** Run auth and application SQL in one adapter-owned transaction and commit journal. */
+export declare const coordinateOAuthConnectedRevocations: <N, A, E, R>(options: {
+  readonly mapping: OAuthConnectedRevocationMapping<Table, Table, Table, Table, Table, Table, Table, N>;
+}, body: Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E> | PersistenceConfigurationError, Exclude<R, OAuthConnectedRevocations> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient>;
+export declare const makeOAuthRegistrationServices: <Registration, N>(mapping: OAuthRegistrationMapping<Registration, Table, Table, Table, Table, Table, Table, Table, N>) => Effect.Effect<{
+  readonly registrationAuthority: OAuthRegistrationAuthority<Registration>;
+}, OAuthUnavailable | PersistenceConfigurationError, Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient>;
+export declare const coordinateOAuthRegistration: <Id, Registration, N, A, E, R>(options: {
+  readonly mapping: OAuthRegistrationMapping<NoInfer<Registration>, Table, Table, Table, Table, Table, Table, Table, N>;
+  readonly target: Context.Key<Id, OAuthRegistrationAuthority<Registration>>;
+}, body: Effect.Effect<A, E, R>) => Effect.Effect<A, OAuthCoordinatorError<E> | PersistenceConfigurationError, Exclude<R, Id> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient>;
+/** Include these guards when login ownership may also hold retained grants. */
+export declare const oauthConnectedOwnershipReferences: <N>(mapping: OAuthConnectedMapping<Table, Table, Table, Table, Table, Table, Table, Table, Table, Table, N, Table>, dialect: "pg" | "sqlite") => {
+  readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;
+  readonly connectedReference: (input: {
+    readonly identityKey: string;
+    readonly subjectId: N;
+  }) => Fragment;
+};
+export declare const oauthAccountsPersistenceLayer: typeof oauthAccountsPersistenceLayer$1, oauthSignInPersistenceLayer: typeof oauthSignInPersistenceLayer$1, oauthRegistrationIntentsLayer: typeof oauthRegistrationIntentsLayer$1, oauthRegistrationAuthorityLayer: typeof oauthRegistrationAuthorityLayer$1;
+export declare const oauthConnectedPersistenceLayer: typeof oauthConnectedPersistenceLayer$1, oauthConnectedRevocationsLayer: typeof oauthConnectedRevocationsLayer$1;
+/** Shared session issuance must validate the same subject and credential authority
+ * as OAuth. Supply this service when it is not already provided by session storage. */
+export declare const makeAuthenticationAuthorityServices: <Claims, N>(mapping: AuthenticationAuthorityMapping<Claims, SqlTableModel, SqlTableModel, SqlTableModel, SqlTableModel, N>) => Effect.Effect<{
+  readonly authenticationAuthority: AuthenticationAuthority["Service"];
+}, SessionUnavailable | PersistenceConfigurationError, LifecycleHooks | SqlClient.SqlClient>;
+//#endregion
+export { OAuthAccountsMapping, type OAuthAction, OAuthAuthorityReadTable, OAuthAuthorityTable, OAuthCleanupDescriptor, OAuthCleanupTable, OAuthClock, type OAuthConnectedAction, OAuthConnectedAdmissionTable, OAuthConnectedAuthorityMapping, OAuthConnectedClientRegistrationTable, OAuthConnectedCohortTable, OAuthConnectedCommandTable, OAuthConnectedFlowTable, OAuthConnectedGrantTable, OAuthConnectedMapping, type OAuthConnectedOrderCodec, OAuthConnectedOwnershipRead, OAuthConnectedPolicyGuard, OAuthConnectedPolicyGuardTable, type OAuthConnectedPolicyInput, OAuthConnectedRevocationJobTable, OAuthConnectedRevocationMapping, OAuthConnectedSqlPolicy, OAuthConnectedSubjectTable, OAuthCredentialReadTable, OAuthCredentialTable, type OAuthD1Mapping, OAuthEligibilityDescriptor, type OAuthEligibilityFact, OAuthEligibilityTable, type OAuthFlowState, OAuthFlowTable, OAuthMetadataPolicy, OAuthOwnershipMutation, OAuthOwnershipReadTable, OAuthOwnershipTable, OAuthPersistence_d_exports, OAuthReferenceGuardDescriptor, OAuthReferenceGuardTable, type OAuthRegistrationAuthority, OAuthRegistrationBase, OAuthRegistrationCommandTable, OAuthRegistrationEligibility, OAuthRegistrationGuardDescriptor, OAuthRegistrationGuardTable, OAuthRegistrationIntentMapping, OAuthRegistrationIntentTable, OAuthRegistrationMapping, type OAuthRegistrationState, OAuthSignInMapping, OAuthSubjectReadTable, OAuthSubjectTable, OAuthTupleAuthorityTable, type OAuthTupleState, OAuthUnlinkCommandTable, SqlTableModel, and, eq, oauthCleanupTable, oauthConnectedPolicyGuard, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationGuardTable, requiredOAuthAccountsConstraints, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints, sql };
+//# sourceMappingURL=OAuthPersistence.d.mts.map

package/dist/OAuthPersistence.mjs

@@ -0,0 +1,125 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { PersistenceConfigurationError } from "./internal/configuration.mjs";
+import { Fragment, Table } from "./internal/sql-table.mjs";
+import { makeNativeSqlTables } from "./internal/native-sql-table.mjs";
+import { requireStandalone } from "./internal/standalone.mjs";
+import { NativeDatabase } from "./internal/transaction-kernel.mjs";
+import { CurrentSessionSql, makeSessionKernel } from "./internal/session-kernel.mjs";
+import { and, eq, makeSqlDatabase, sql, sqlQueryOperations } from "./internal/sql-query.mjs";
+import { requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints } from "./internal/models/oauth-model.mjs";
+import { makeOAuthKernel } from "./internal/oauth-kernel.mjs";
+import { validateSqlStorage } from "./internal/sql-storage-validation.mjs";
+import { oauthCleanupTable, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationGuardTable } from "./internal/sql-oauth-model.mjs";
+import { requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints } from "./internal/models/oauth-connected-model.mjs";
+import { oauthConnectedPolicyGuard } from "./internal/sql-oauth-connected-model.mjs";
+import { Effect, Predicate, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import { SessionUnavailable } from "@yielded/auth/Sessions";
+import { OAuthAccountsPersistence, OAuthConnectedPersistence, OAuthConnectedRevocations, OAuthRegistrationIntents, OAuthSignInPersistence, OAuthUnavailable } from "@yielded/auth/OAuth";
+//#region src/OAuthPersistence.ts
+var OAuthPersistence_exports = /* @__PURE__ */ __exportAll({
+	and: () => and,
+	clock: () => clock,
+	coordinateOAuthAccounts: () => coordinateOAuthAccounts,
+	coordinateOAuthConnected: () => coordinateOAuthConnected,
+	coordinateOAuthConnectedRevocations: () => coordinateOAuthConnectedRevocations,
+	coordinateOAuthRegistration: () => coordinateOAuthRegistration,
+	coordinateOAuthRegistrationIntents: () => coordinateOAuthRegistrationIntents,
+	coordinateOAuthSignIn: () => coordinateOAuthSignIn,
+	eq: () => eq,
+	makeAuthenticationAuthorityServices: () => makeAuthenticationAuthorityServices,
+	makeOAuthAccountsServices: () => makeOAuthAccountsServices,
+	makeOAuthConnectedRevocationServices: () => makeOAuthConnectedRevocationServices,
+	makeOAuthConnectedServices: () => makeOAuthConnectedServices,
+	makeOAuthRegistrationIntentServices: () => makeOAuthRegistrationIntentServices,
+	makeOAuthRegistrationServices: () => makeOAuthRegistrationServices,
+	makeOAuthSignInServices: () => makeOAuthSignInServices,
+	oauthAccountsPersistenceLayer: () => oauthAccountsPersistenceLayer,
+	oauthCleanupTable: () => oauthCleanupTable,
+	oauthConnectedOwnershipReferences: () => oauthConnectedOwnershipReferences,
+	oauthConnectedPersistenceLayer: () => oauthConnectedPersistenceLayer,
+	oauthConnectedPolicyGuard: () => oauthConnectedPolicyGuard,
+	oauthConnectedRevocationsLayer: () => oauthConnectedRevocationsLayer,
+	oauthEligibilityTable: () => oauthEligibilityTable,
+	oauthReferenceGuardTable: () => oauthReferenceGuardTable,
+	oauthRegistrationAuthorityLayer: () => oauthRegistrationAuthorityLayer,
+	oauthRegistrationGuardTable: () => oauthRegistrationGuardTable,
+	oauthRegistrationIntentsLayer: () => oauthRegistrationIntentsLayer,
+	oauthSignInPersistenceLayer: () => oauthSignInPersistenceLayer,
+	requiredOAuthAccountsConstraints: () => requiredOAuthAccountsConstraints,
+	requiredOAuthConnectedConstraints: () => requiredOAuthConnectedConstraints,
+	requiredOAuthConnectedRevocationConstraints: () => requiredOAuthConnectedRevocationConstraints,
+	requiredOAuthRegistrationConstraints: () => requiredOAuthRegistrationConstraints,
+	requiredOAuthSignInConstraints: () => requiredOAuthSignInConstraints,
+	requiredOAuthTupleConstraints: () => requiredOAuthTupleConstraints,
+	sql: () => sql,
+	table: () => table
+});
+/** Physical identifiers and representations only; applications own migrations. */
+const table = (definition) => new Table(definition.name, definition.columns, definition.unique, definition.schema);
+/** Integer-millisecond engine clock, sampled after locks on either supported dialect. */
+const clock = {
+	encodeInstant: Schema.encodeSync(Schema.Int),
+	decodeInstant: Schema.decodeUnknownSync(Schema.Int),
+	engineNowMillis: new Fragment((compiler) => compiler.dialect === "pg" ? "cast(extract(epoch from clock_timestamp()) * 1000 as bigint)" : "cast(round((julianday('now') - 2440587.5) * 86400000) as integer)")
+};
+const operations = {
+	...sqlQueryOperations,
+	validateStorage: validateSqlStorage
+};
+const kernels = {
+	pg: makeOAuthKernel(operations, () => "pg"),
+	sqlite: makeOAuthKernel(operations, () => "sqlite")
+};
+const acquire = Effect.gen(function* () {
+	const client = yield* SqlClient.SqlClient;
+	const dialect = client.onDialectOrElse({
+		pg: () => "pg",
+		sqlite: () => "sqlite",
+		orElse: () => void 0
+	});
+	if (dialect === void 0 || Predicate.hasProperty(client, "~@effect/sql-d1/D1Client")) return yield* PersistenceConfigurationError.make({ reason: "OAuth persistence requires PostgreSQL or SQLite with interactive transactions" });
+	return {
+		database: yield* makeSqlDatabase(dialect),
+		configuration: {
+			mode: "interactive",
+			dialect,
+			locking: dialect === "pg",
+			standaloneGuard: (service) => requireStandalone(() => OAuthUnavailable.make({}), service)
+		},
+		kernel: kernels[dialect]
+	};
+});
+const using = (body) => Effect.flatMap(acquire, (input) => body(input).pipe(Effect.provideService(NativeDatabase, input.database)));
+const makeOAuthSignInServices = (mapping) => using(({ kernel, configuration }) => kernel.target.makeTargetOAuthSignInServices(mapping, configuration));
+/** Run auth and application SQL in one adapter-owned transaction and commit journal. */
+const coordinateOAuthSignIn = (options, body) => using(({ kernel, configuration, database }) => kernel.target.coordinateTargetOAuthSignIn(database, options.mapping, configuration, (_transaction, services) => Effect.provideService(body, OAuthSignInPersistence, services.oauthSignInPersistence)));
+const makeOAuthRegistrationIntentServices = (mapping) => using(({ kernel, configuration }) => kernel.target.makeTargetOAuthRegistrationIntentServices(mapping, configuration));
+/** Run auth and application SQL in one adapter-owned transaction and commit journal. */
+const coordinateOAuthRegistrationIntents = (options, body) => using(({ kernel, configuration, database }) => kernel.target.coordinateTargetOAuthRegistrationIntents(database, options.mapping, configuration, (_transaction, services) => Effect.provideService(body, OAuthRegistrationIntents, services.oauthRegistrationIntents)));
+const makeOAuthAccountsServices = (mapping) => using(({ kernel, configuration }) => kernel.target.makeTargetOAuthAccountsServices(mapping, configuration));
+/** Run auth and application SQL in one adapter-owned transaction and commit journal. */
+const coordinateOAuthAccounts = (options, body) => using(({ kernel, configuration, database }) => kernel.target.coordinateTargetOAuthAccounts(database, options.mapping, configuration, (_transaction, services) => Effect.provideService(body, OAuthAccountsPersistence, services.oauthAccountsPersistence)));
+const makeOAuthConnectedServices = (mapping) => using(({ kernel, configuration }) => kernel.connectedTarget.makeTargetOAuthConnectedServices(mapping, configuration));
+/** Run auth and application SQL in one adapter-owned transaction and commit journal. */
+const coordinateOAuthConnected = (options, body) => using(({ kernel, configuration, database }) => kernel.connectedTarget.coordinateTargetOAuthConnected(database, options.mapping, configuration, (_transaction, services) => Effect.provideService(body, OAuthConnectedPersistence, services.oauthConnectedPersistence)));
+const makeOAuthConnectedRevocationServices = (mapping) => using(({ kernel, configuration }) => kernel.connectedTarget.makeTargetOAuthConnectedRevocationServices(mapping, configuration));
+/** Run auth and application SQL in one adapter-owned transaction and commit journal. */
+const coordinateOAuthConnectedRevocations = (options, body) => using(({ kernel, configuration, database }) => kernel.connectedTarget.coordinateTargetOAuthConnectedRevocations(database, options.mapping, configuration, (_transaction, services) => Effect.provideService(body, OAuthConnectedRevocations, services.oauthConnectedRevocations)));
+const makeOAuthRegistrationServices = (mapping) => using(({ kernel, configuration }) => kernel.target.makeTargetOAuthRegistrationServices(mapping, configuration));
+const coordinateOAuthRegistration = (options, body) => using(({ kernel, configuration, database }) => kernel.target.coordinateTargetOAuthRegistration(database, options.mapping, configuration, (_transaction, services) => Effect.provideService(body, options.target, services.registrationAuthority)));
+/** Include these guards when login ownership may also hold retained grants. */
+const oauthConnectedOwnershipReferences = (mapping, dialect) => kernels[dialect].connectedReference.oauthConnectedOwnershipReferences(mapping);
+const { oauthAccountsPersistenceLayer, oauthSignInPersistenceLayer, oauthRegistrationIntentsLayer, oauthRegistrationAuthorityLayer } = kernels.sqlite.target;
+const { oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer } = kernels.sqlite.connectedTarget;
+/** Shared session issuance must validate the same subject and credential authority
+* as OAuth. Supply this service when it is not already provided by session storage. */
+const makeAuthenticationAuthorityServices = (mapping) => using(({ database, configuration }) => makeSessionKernel(operations, (client) => makeNativeSqlTables(client)).makeSqlAuthenticationAuthority(mapping, {
+	mode: "interactive",
+	locking: configuration.locking,
+	standaloneGuard: requireStandalone(() => SessionUnavailable.make({}), database.$client.transactionService)
+}).pipe(Effect.provideService(CurrentSessionSql, database), Effect.map((authenticationAuthority) => ({ authenticationAuthority }))));
+//#endregion
+export { OAuthPersistence_exports, and, clock, coordinateOAuthAccounts, coordinateOAuthConnected, coordinateOAuthConnectedRevocations, coordinateOAuthRegistration, coordinateOAuthRegistrationIntents, coordinateOAuthSignIn, eq, makeAuthenticationAuthorityServices, makeOAuthAccountsServices, makeOAuthConnectedRevocationServices, makeOAuthConnectedServices, makeOAuthRegistrationIntentServices, makeOAuthRegistrationServices, makeOAuthSignInServices, oauthAccountsPersistenceLayer, oauthCleanupTable, oauthConnectedOwnershipReferences, oauthConnectedPersistenceLayer, oauthConnectedPolicyGuard, oauthConnectedRevocationsLayer, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationAuthorityLayer, oauthRegistrationGuardTable, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer, requiredOAuthAccountsConstraints, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints, sql, table };
+
+//# sourceMappingURL=OAuthPersistence.mjs.map

package/dist/OAuthPersistence.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthPersistence.mjs","names":[],"sources":["../src/OAuthPersistence.ts"],"sourcesContent":["/** Direct Effect SQL persistence for upstream OAuth accounts. PostgreSQL and SQLite\n * require interactive transactions; provider exchanges occur outside coordinators. */\nimport type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthAccountsPersistence,\n  OAuthSignInPersistence,\n  OAuthRegistrationIntents,\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport type { AuthenticationAuthority } from \"@yielded/auth/Sessions\";\nimport { SessionUnavailable } from \"@yielded/auth/Sessions\";\nimport { type Context, type Crypto, Effect, Predicate, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { PersistenceConfigurationError } from \"./internal/configuration\";\nimport type { AuthenticationAuthorityMapping as AuthorityMapping } from \"./internal/models/session-model\";\nimport { makeNativeSqlTables } from \"./internal/native-sql-table\";\nimport { makeOAuthKernel } from \"./internal/oauth-kernel\";\nimport type { OAuthCoordinatorError, OAuthTargetConfiguration } from \"./internal/oauth/target\";\nimport {\n  CurrentSessionSql,\n  makeSessionKernel,\n  type SessionSqlDatabase,\n} from \"./internal/session-kernel\";\nimport type {\n  OAuthConnectedMapping,\n  OAuthConnectedRevocationMapping,\n} from \"./internal/sql-oauth-connected-model\";\nimport type {\n  SqlTableModel,\n  OAuthAccountsMapping,\n  OAuthSignInMapping,\n  OAuthRegistrationIntentMapping,\n  OAuthRegistrationMapping,\n  OAuthRegistrationAuthority,\n  OAuthReferenceGuardDescriptor,\n} from \"./internal/sql-oauth-model\";\nimport { makeSqlDatabase, sqlQueryOperations, sql } from \"./internal/sql-query\";\nimport { validateSqlStorage } from \"./internal/sql-storage-validation\";\nimport { Table, Fragment } from \"./internal/sql-table\";\nimport { requireStandalone } from \"./internal/standalone\";\nimport type { StorageTable } from \"./internal/storage-tables\";\nimport { NativeDatabase } from \"./internal/transaction-kernel\";\nimport type { TransactionNativeDatabase } from \"./internal/transaction-kernel\";\nexport * from \"./internal/sql-oauth-model\";\nexport * from \"./internal/sql-oauth-connected-model\";\nexport { sql };\nexport { and, eq } from \"./internal/sql-query\";\n\n/** Physical identifiers and representations only; applications own migrations. */\nexport const table = (definition: StorageTable) =>\n  new Table(definition.name, definition.columns, definition.unique, definition.schema);\n\n/** Integer-millisecond engine clock, sampled after locks on either supported dialect. */\nexport const clock = {\n  encodeInstant: Schema.encodeSync(Schema.Int),\n  decodeInstant: Schema.decodeUnknownSync(Schema.Int),\n  engineNowMillis: new Fragment((compiler) =>\n    compiler.dialect === \"pg\"\n      ? \"cast(extract(epoch from clock_timestamp()) * 1000 as bigint)\"\n      : \"cast(round((julianday('now') - 2440587.5) * 86400000) as integer)\",\n  ),\n};\n\nconst operations = { ...sqlQueryOperations, validateStorage: validateSqlStorage };\n\nconst kernels = {\n  pg: makeOAuthKernel(operations, () => \"pg\"),\n  sqlite: makeOAuthKernel(operations, () => \"sqlite\"),\n};\n\nconst acquire = Effect.gen(function* () {\n  const client = yield* SqlClient.SqlClient;\n\n  const dialect = client.onDialectOrElse({\n    pg: () => \"pg\" as const,\n    sqlite: () => \"sqlite\" as const,\n    orElse: () => undefined,\n  });\n\n  // D1 exposes the SQLite compiler but its public driver brand identifies a\n  // batch-only client. Keep the default package free of a D1 runtime dependency.\n  if (dialect === undefined || Predicate.hasProperty(client, \"~@effect/sql-d1/D1Client\"))\n    return yield* PersistenceConfigurationError.make({\n      reason: \"OAuth persistence requires PostgreSQL or SQLite with interactive transactions\",\n    });\n\n  const database = yield* makeSqlDatabase(dialect);\n\n  const configuration: OAuthTargetConfiguration = {\n    mode: \"interactive\",\n    dialect,\n    locking: dialect === \"pg\",\n    standaloneGuard: (service) => requireStandalone(() => OAuthUnavailable.make({}), service),\n  };\n\n  // Erase only the query-builder handle; batch methods are never selected by this adapter.\n  return {\n    database: database as unknown as TransactionNativeDatabase,\n    configuration,\n    kernel: kernels[dialect],\n  };\n});\n\nconst using = <A, E, R>(body: (input: Effect.Success<typeof acquire>) => Effect.Effect<A, E, R>) =>\n  Effect.flatMap(acquire, (input) =>\n    body(input).pipe(Effect.provideService(NativeDatabase, input.database)),\n  );\n\nexport const makeOAuthSignInServices = <N>(\n  mapping: OAuthSignInMapping<Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthSignInPersistence: OAuthSignInPersistence[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration }) =>\n    kernel.target.makeTargetOAuthSignInServices(mapping, configuration),\n  );\n\n/** Run auth and application SQL in one adapter-owned transaction and commit journal. */\nexport const coordinateOAuthSignIn = <N, A, E, R>(\n  options: { readonly mapping: OAuthSignInMapping<Table, Table, Table, Table, Table, N> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  OAuthCoordinatorError<E> | PersistenceConfigurationError,\n  Exclude<R, OAuthSignInPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration, database }) =>\n    kernel.target.coordinateTargetOAuthSignIn(\n      database,\n      options.mapping,\n      configuration,\n      (_transaction, services) =>\n        Effect.provideService(body, OAuthSignInPersistence, services.oauthSignInPersistence),\n    ),\n  );\n\nexport const makeOAuthRegistrationIntentServices = <N>(\n  mapping: OAuthRegistrationIntentMapping<Table, Table, Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthRegistrationIntents: OAuthRegistrationIntents[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration }) =>\n    kernel.target.makeTargetOAuthRegistrationIntentServices(mapping, configuration),\n  );\n\n/** Run auth and application SQL in one adapter-owned transaction and commit journal. */\nexport const coordinateOAuthRegistrationIntents = <N, A, E, R>(\n  options: {\n    readonly mapping: OAuthRegistrationIntentMapping<\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      N\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  OAuthCoordinatorError<E> | PersistenceConfigurationError,\n  Exclude<R, OAuthRegistrationIntents> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration, database }) =>\n    kernel.target.coordinateTargetOAuthRegistrationIntents(\n      database,\n      options.mapping,\n      configuration,\n      (_transaction, services) =>\n        Effect.provideService(body, OAuthRegistrationIntents, services.oauthRegistrationIntents),\n    ),\n  );\n\nexport const makeOAuthAccountsServices = <N>(\n  mapping: OAuthAccountsMapping<Table, Table, Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthAccountsPersistence: OAuthAccountsPersistence[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration }) =>\n    kernel.target.makeTargetOAuthAccountsServices(mapping, configuration),\n  );\n\n/** Run auth and application SQL in one adapter-owned transaction and commit journal. */\nexport const coordinateOAuthAccounts = <N, A, E, R>(\n  options: {\n    readonly mapping: OAuthAccountsMapping<Table, Table, Table, Table, Table, Table, Table, N>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  OAuthCoordinatorError<E> | PersistenceConfigurationError,\n  Exclude<R, OAuthAccountsPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration, database }) =>\n    kernel.target.coordinateTargetOAuthAccounts(\n      database,\n      options.mapping,\n      configuration,\n      (_transaction, services) =>\n        Effect.provideService(body, OAuthAccountsPersistence, services.oauthAccountsPersistence),\n    ),\n  );\n\nexport const makeOAuthConnectedServices = <N>(\n  mapping: OAuthConnectedMapping<\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    N,\n    Table\n  >,\n): Effect.Effect<\n  { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration }) =>\n    kernel.connectedTarget.makeTargetOAuthConnectedServices(mapping, configuration),\n  );\n\n/** Run auth and application SQL in one adapter-owned transaction and commit journal. */\nexport const coordinateOAuthConnected = <N, A, E, R>(\n  options: {\n    readonly mapping: OAuthConnectedMapping<\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      N,\n      Table\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  OAuthCoordinatorError<E> | PersistenceConfigurationError,\n  Exclude<R, OAuthConnectedPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration, database }) =>\n    kernel.connectedTarget.coordinateTargetOAuthConnected(\n      database,\n      options.mapping,\n      configuration,\n      (_transaction, services) =>\n        Effect.provideService(body, OAuthConnectedPersistence, services.oauthConnectedPersistence),\n    ),\n  );\n\nexport const makeOAuthConnectedRevocationServices = <N>(\n  mapping: OAuthConnectedRevocationMapping<Table, Table, Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration }) =>\n    kernel.connectedTarget.makeTargetOAuthConnectedRevocationServices(mapping, configuration),\n  );\n\n/** Run auth and application SQL in one adapter-owned transaction and commit journal. */\nexport const coordinateOAuthConnectedRevocations = <N, A, E, R>(\n  options: {\n    readonly mapping: OAuthConnectedRevocationMapping<\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      N\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  OAuthCoordinatorError<E> | PersistenceConfigurationError,\n  Exclude<R, OAuthConnectedRevocations> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration, database }) =>\n    kernel.connectedTarget.coordinateTargetOAuthConnectedRevocations(\n      database,\n      options.mapping,\n      configuration,\n      (_transaction, services) =>\n        Effect.provideService(body, OAuthConnectedRevocations, services.oauthConnectedRevocations),\n    ),\n  );\n\nexport const makeOAuthRegistrationServices = <Registration, N>(\n  mapping: OAuthRegistrationMapping<\n    Registration,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    N\n  >,\n): Effect.Effect<\n  { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration }) =>\n    kernel.target.makeTargetOAuthRegistrationServices<Registration>(mapping, configuration),\n  );\n\nexport const coordinateOAuthRegistration = <Id, Registration, N, A, E, R>(\n  options: {\n    readonly mapping: OAuthRegistrationMapping<\n      NoInfer<Registration>,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      N\n    >;\n    readonly target: Context.Key<Id, OAuthRegistrationAuthority<Registration>>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  OAuthCoordinatorError<E> | PersistenceConfigurationError,\n  Exclude<R, Id> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration, database }) =>\n    kernel.target.coordinateTargetOAuthRegistration<Registration, unknown, A, E, Exclude<R, Id>>(\n      database,\n      options.mapping,\n      configuration,\n      (_transaction, services) =>\n        Effect.provideService(body, options.target, services.registrationAuthority),\n    ),\n  );\n\n/** Include these guards when login ownership may also hold retained grants. */\nexport const oauthConnectedOwnershipReferences = <N>(\n  mapping: OAuthConnectedMapping<\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    N,\n    Table\n  >,\n  dialect: \"pg\" | \"sqlite\",\n) =>\n  // The selected compiler supplies Fragment handles; domain values retain their codecs.\n  kernels[dialect].connectedReference.oauthConnectedOwnershipReferences(mapping) as {\n    readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;\n    readonly connectedReference: (input: {\n      readonly identityKey: string;\n      readonly subjectId: N;\n    }) => Fragment;\n  };\n\nexport const {\n  oauthAccountsPersistenceLayer,\n  oauthSignInPersistenceLayer,\n  oauthRegistrationIntentsLayer,\n  oauthRegistrationAuthorityLayer,\n} = kernels.sqlite.target;\n\nexport const { oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer } =\n  kernels.sqlite.connectedTarget;\n\n/** Shared session issuance must validate the same subject and credential authority\n * as OAuth. Supply this service when it is not already provided by session storage. */\nexport const makeAuthenticationAuthorityServices = <Claims, N>(\n  mapping: AuthorityMapping<Claims, SqlTableModel, SqlTableModel, SqlTableModel, SqlTableModel, N>,\n): Effect.Effect<\n  { readonly authenticationAuthority: AuthenticationAuthority[\"Service\"] },\n  SessionUnavailable | PersistenceConfigurationError,\n  LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ database, configuration }) =>\n    makeSessionKernel(operations, (client) => makeNativeSqlTables(client))\n      .makeSqlAuthenticationAuthority(mapping, {\n        mode: \"interactive\",\n        locking: configuration.locking,\n        standaloneGuard: requireStandalone(\n          () => SessionUnavailable.make({}),\n          database.$client.transactionService,\n        ),\n      })\n      .pipe(\n        // Both kernels capture the same raw SQL query-builder handle and client.\n        Effect.provideService(CurrentSessionSql, database as unknown as SessionSqlDatabase),\n        Effect.map((authenticationAuthority) => ({ authenticationAuthority })),\n      ),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoDA,MAAa,SAAS,eACpB,IAAI,MAAM,WAAW,MAAM,WAAW,SAAS,WAAW,QAAQ,WAAW,MAAM;;AAGrF,MAAa,QAAQ;CACnB,eAAe,OAAO,WAAW,OAAO,GAAG;CAC3C,eAAe,OAAO,kBAAkB,OAAO,GAAG;CAClD,iBAAiB,IAAI,UAAU,aAC7B,SAAS,YAAY,OACjB,iEACA,mEACN;AACF;AAEA,MAAM,aAAa;CAAE,GAAG;CAAoB,iBAAiB;AAAmB;AAEhF,MAAM,UAAU;CACd,IAAI,gBAAgB,kBAAkB,IAAI;CAC1C,QAAQ,gBAAgB,kBAAkB,QAAQ;AACpD;AAEA,MAAM,UAAU,OAAO,IAAI,aAAa;CACtC,MAAM,SAAS,OAAO,UAAU;CAEhC,MAAM,UAAU,OAAO,gBAAgB;EACrC,UAAU;EACV,cAAc;EACd,cAAc,KAAA;CAChB,CAAC;CAID,IAAI,YAAY,KAAA,KAAa,UAAU,YAAY,QAAQ,0BAA0B,GACnF,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,gFACV,CAAC;CAYH,OAAO;EACL,UAAU,OAXY,gBAAgB,OAAO;EAY7C,eAAA;GATA,MAAM;GACN;GACA,SAAS,YAAY;GACrB,kBAAkB,YAAY,wBAAwB,iBAAiB,KAAK,CAAC,CAAC,GAAG,OAAO;EAM5E;EACZ,QAAQ,QAAQ;CAClB;AACF,CAAC;AAED,MAAM,SAAkB,SACtB,OAAO,QAAQ,UAAU,UACvB,KAAK,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,MAAM,QAAQ,CAAC,CACxE;AAEF,MAAa,2BACX,YAMA,OAAO,EAAE,QAAQ,oBACf,OAAO,OAAO,8BAA8B,SAAS,aAAa,CACpE;;AAGF,MAAa,yBACX,SACA,SAMA,OAAO,EAAE,QAAQ,eAAe,eAC9B,OAAO,OAAO,4BACZ,UACA,QAAQ,SACR,gBACC,cAAc,aACb,OAAO,eAAe,MAAM,wBAAwB,SAAS,sBAAsB,CACvF,CACF;AAEF,MAAa,uCACX,YAMA,OAAO,EAAE,QAAQ,oBACf,OAAO,OAAO,0CAA0C,SAAS,aAAa,CAChF;;AAGF,MAAa,sCACX,SAYA,SAMA,OAAO,EAAE,QAAQ,eAAe,eAC9B,OAAO,OAAO,yCACZ,UACA,QAAQ,SACR,gBACC,cAAc,aACb,OAAO,eAAe,MAAM,0BAA0B,SAAS,wBAAwB,CAC3F,CACF;AAEF,MAAa,6BACX,YAMA,OAAO,EAAE,QAAQ,oBACf,OAAO,OAAO,gCAAgC,SAAS,aAAa,CACtE;;AAGF,MAAa,2BACX,SAGA,SAMA,OAAO,EAAE,QAAQ,eAAe,eAC9B,OAAO,OAAO,8BACZ,UACA,QAAQ,SACR,gBACC,cAAc,aACb,OAAO,eAAe,MAAM,0BAA0B,SAAS,wBAAwB,CAC3F,CACF;AAEF,MAAa,8BACX,YAmBA,OAAO,EAAE,QAAQ,oBACf,OAAO,gBAAgB,iCAAiC,SAAS,aAAa,CAChF;;AAGF,MAAa,4BACX,SAgBA,SAMA,OAAO,EAAE,QAAQ,eAAe,eAC9B,OAAO,gBAAgB,+BACrB,UACA,QAAQ,SACR,gBACC,cAAc,aACb,OAAO,eAAe,MAAM,2BAA2B,SAAS,yBAAyB,CAC7F,CACF;AAEF,MAAa,wCACX,YAMA,OAAO,EAAE,QAAQ,oBACf,OAAO,gBAAgB,2CAA2C,SAAS,aAAa,CAC1F;;AAGF,MAAa,uCACX,SAYA,SAMA,OAAO,EAAE,QAAQ,eAAe,eAC9B,OAAO,gBAAgB,0CACrB,UACA,QAAQ,SACR,gBACC,cAAc,aACb,OAAO,eAAe,MAAM,2BAA2B,SAAS,yBAAyB,CAC7F,CACF;AAEF,MAAa,iCACX,YAgBA,OAAO,EAAE,QAAQ,oBACf,OAAO,OAAO,oCAAkD,SAAS,aAAa,CACxF;AAEF,MAAa,+BACX,SAcA,SAMA,OAAO,EAAE,QAAQ,eAAe,eAC9B,OAAO,OAAO,kCACZ,UACA,QAAQ,SACR,gBACC,cAAc,aACb,OAAO,eAAe,MAAM,QAAQ,QAAQ,SAAS,qBAAqB,CAC9E,CACF;;AAGF,MAAa,qCACX,SAcA,YAGA,QAAQ,QAAQ,CAAC,mBAAmB,kCAAkC,OAAO;AAQ/E,MAAa,EACX,+BACA,6BACA,+BACA,oCACE,QAAQ,OAAO;AAEnB,MAAa,EAAE,gCAAgC,mCAC7C,QAAQ,OAAO;;;AAIjB,MAAa,uCACX,YAMA,OAAO,EAAE,UAAU,oBACjB,kBAAkB,aAAa,WAAW,oBAAoB,MAAM,CAAC,CAAC,CACnE,+BAA+B,SAAS;CACvC,MAAM;CACN,SAAS,cAAc;CACvB,iBAAiB,wBACT,mBAAmB,KAAK,CAAC,CAAC,GAChC,SAAS,QAAQ,kBACnB;AACF,CAAC,CAAC,CACD,KAEC,OAAO,eAAe,mBAAmB,QAAyC,GAClF,OAAO,KAAK,6BAA6B,EAAE,wBAAwB,EAAE,CACvE,CACJ"}

package/dist/_virtual/_rolldown/runtime.mjs

@@ -0,0 +1,13 @@
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+export { __exportAll };

package/dist/index.d.mts

@@ -1,7 +1,9 @@
 import { PersistenceMappingError } from "./internal/mapping-error.mjs";
+import { OAuthProxyPersistence } from "./internal/oauth-proxy.mjs";
 import { StorageColumn, StorageTable } from "./internal/storage-tables.mjs";
 import { PersistenceConfigurationError } from "./internal/configuration.mjs";
+import { OAuthPersistence_d_exports } from "./OAuthPersistence.mjs";
 import { AuthPersistence } from "./internal/sql-persistence.mjs";
 import { OAuthServerPersistence } from "./internal/oauth-server.mjs";
 import { BrowserLoginPersistence } from "./internal/browser-login.mjs";
-export { AuthPersistence, BrowserLoginPersistence, OAuthServerPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };
+export { AuthPersistence, BrowserLoginPersistence, OAuthPersistence_d_exports as OAuthPersistence, OAuthProxyPersistence, OAuthServerPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };

package/dist/index.mjs

@@ -3,5 +3,7 @@ import { PersistenceMappingError } from "./internal/mapping-error.mjs";
 import { StorageColumn, StorageTable } from "./internal/storage-tables.mjs";
 import { AuthPersistence } from "./internal/sql-persistence.mjs";
 import { OAuthServerPersistence } from "./internal/oauth-server.mjs";
+import { OAuthProxyPersistence } from "./internal/oauth-proxy.mjs";
 import { BrowserLoginPersistence } from "./internal/browser-login.mjs";
-export { AuthPersistence, BrowserLoginPersistence, OAuthServerPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };
+import { OAuthPersistence_exports } from "./OAuthPersistence.mjs";
+export { AuthPersistence, BrowserLoginPersistence, OAuthPersistence_exports as OAuthPersistence, OAuthProxyPersistence, OAuthServerPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };

package/dist/internal/configuration.d.mts

@@ -98,7 +98,7 @@ type UsesProofs<A extends {
   readonly strategies: Readonly<Record<string, Strategy>>;
 }> = Enabled<A, "phone"> | Enabled<A, "email"> | ManagedPassword<A>;
 export type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> = AuthenticationAuthority | KeyId<A["sessions"]["StatefulSessionPersistence"]> | KeyId<A["sessions"]["SessionRepository"]> | (Enabled<A, "password"> extends never ? never : PasswordPersistence) | KeyId<RegistrationKey<ManagedPassword<A>>> | (Enabled<A, "passkey"> extends never ? never : PasskeyPersistence | PasskeyCredentials) | (ManagedPasskey<A> extends never ? never : PasskeyManagementPersistence | PasskeyEnrollmentContext) | (Enabled<A, "email"> extends never ? never : EmailAddressPersistence) | (UsesProofs<A> extends never ? never : ProofPersistence) | (Enabled<A, "phone"> extends never ? never : PhoneAdmission | PhoneSignInTargets);
-export type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> = "identifiers" | "credentials" | "sessions" | "sessionFlows" | (Enabled<A, "password"> extends never ? never : "passwords" | "passwordAttempts" | "passwordCommands") | (ManagedPassword<A> extends never ? never : "passwordRegistrations") | (Enabled<A, "phone"> extends never ? never : "phoneState") | (Enabled<A, "email"> extends never ? never : "emailCredentials" | "emailCommands") | (Enabled<A, "passkey"> extends never ? never : "passkeyCredentials" | "passkeyOwnership" | "passkeyHandles" | "passkeyModules" | "passkeyFlows" | "passkeyAdmissions" | "passkeyCharges") | (ManagedPasskey<A> extends never ? never : "passkeyCommands") | (UsesProofs<A> extends never ? never : ProofRoles);
+export type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> = "identifiers" | "credentials" | "sessions" | "sessionFlows" | (Enabled<A, "password"> extends never ? never : "passwords" | "passwordCommands") | (ManagedPassword<A> extends never ? never : "passwordRegistrations") | (Enabled<A, "phone"> extends never ? never : "phoneState") | (Enabled<A, "email"> extends never ? never : "emailCredentials" | "emailCommands") | (Enabled<A, "passkey"> extends never ? never : "passkeyCredentials" | "passkeyOwnership" | "passkeyHandles" | "passkeyModules" | "passkeyFlows" | "passkeyAdmissions" | "passkeyCharges") | (ManagedPasskey<A> extends never ? never : "passkeyCommands") | (UsesProofs<A> extends never ? never : ProofRoles);
 export interface SubjectOptions<T extends object, NativeId> {
   readonly table: T;
   readonly id: string;

package/dist/internal/configuration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.mjs","names":[],"sources":["../../src/internal/configuration.ts"],"sourcesContent":["import type { EmailAction, EmailAddressPersistence } from \"@yielded/auth/Email\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasskeyActionChallenge,\n  PasskeyConfig,\n  PasskeyCredentials,\n  PasskeyEnrollmentContext,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  PasskeyPersistence,\n  PasskeyConfigurationError,\n} from \"@yielded/auth/Passkey\";\nimport type {\n  PasswordAction,\n  PasswordPersistence,\n  PasswordUnavailable,\n} from \"@yielded/auth/Password\";\nimport type { PhoneAdmission, PhoneSignInTargets } from \"@yielded/auth/PhoneOtp\";\nimport type { ProofPersistence } from \"@yielded/auth/Proofs\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type {\n  AuthenticationAuthority,\n  AuthenticationRequirement,\n  make as makeSessions,\n} from \"@yielded/auth/Sessions\";\nimport { type Context, type Crypto, type Effect, type Layer, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { StorageRole } from \"./storage-tables\";\n\nexport class PersistenceConfigurationError extends Schema.TaggedError<PersistenceConfigurationError>()(\n  \"PersistenceConfigurationError\",\n  { reason: Schema.String },\n) {}\n\nexport type ClaimsCodec = Schema.Codec<unknown, unknown, never, never>;\n\nexport interface PasskeyFeature {\n  readonly kind: \"passkey\";\n  readonly moduleId: string;\n  readonly policy: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError, PasskeyConfig>;\n  readonly management?: boolean;\n  readonly managementPolicy?: PasskeyManagementPolicy;\n}\n\nexport interface Strategy {\n  readonly strategy: object;\n  readonly persistence?:\n    | PasskeyFeature\n    | {\n        readonly kind: \"password\" | \"phone\" | \"email\";\n        readonly moduleId: string;\n        readonly lifecycle?: boolean;\n        readonly management?: boolean;\n        readonly addresses?: boolean;\n      };\n  readonly RegistrationAuthority?: Context.Key<unknown, unknown>;\n}\n\nexport interface Definition<C extends ClaimsCodec, Id extends string> {\n  readonly namespace: string;\n  readonly claims: C;\n  readonly sessionMode?: string | undefined;\n  readonly sessions: ReturnType<typeof makeSessions<C, Id>>;\n  readonly strategies: Readonly<Record<string, Strategy>>;\n}\n\ntype KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;\ntype Enabled<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n  Kind extends \"password\" | \"phone\" | \"email\" | \"passkey\",\n> = Extract<A[\"strategies\"][keyof A[\"strategies\"]], { persistence: { kind: Kind } }>;\n\ntype ManagedPassword<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"password\">, { persistence: { management: true } }>;\n\ntype ManagedPasskey<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"passkey\">, { persistence: { management: true } }>;\n\nexport type PasskeyRequirement<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n> = Enabled<A, \"passkey\"> extends never ? never : PasskeyConfig;\n\ntype RegistrationKey<S> = S extends { readonly RegistrationAuthority: infer K } ? K : never;\ntype Registration<S> =\n  RegistrationKey<S> extends Context.Key<infer _Id, infer Service>\n    ? Service extends { readonly register: (input: infer Input, ...args: never[]) => unknown }\n      ? Input extends { readonly registration: infer Value }\n        ? Value\n        : never\n      : never\n    : never;\n\nexport interface ProvisioningId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceProvisioning\";\n}\n\nexport type Provisioning<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = {\n  readonly [\n    K in keyof A[\"strategies\"] as A[\"strategies\"][K] extends {\n      persistence: { kind: \"password\"; management: true };\n    }\n      ? K\n      : never\n  ]: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration<A[\"strategies\"][K]>;\n  }) => Effect.Effect<SubjectId, PasswordUnavailable>;\n};\n\nexport type ProvisioningRequirement<\n  A extends { readonly namespace: string; readonly strategies: Readonly<Record<string, Strategy>> },\n> = ManagedPassword<A> extends never ? never : ProvisioningId<A[\"namespace\"]>;\n\ntype ProofRoles =\n  | \"proofRequests\"\n  | \"proofSeries\"\n  | \"proofGenerations\"\n  | \"proofContinuations\"\n  | \"proofScopes\"\n  | \"proofAbuse\"\n  | \"proofFailures\"\n  | \"proofCommands\";\n\ntype UsesProofs<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  | Enabled<A, \"phone\">\n  | Enabled<A, \"email\">\n  | ManagedPassword<A>;\n\nexport type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | AuthenticationAuthority\n  | KeyId<A[\"sessions\"][\"StatefulSessionPersistence\"]>\n  | KeyId<A[\"sessions\"][\"SessionRepository\"]>\n  | (Enabled<A, \"password\"> extends never ? never : PasswordPersistence)\n  | KeyId<RegistrationKey<ManagedPassword<A>>>\n  | (Enabled<A, \"passkey\"> extends never ? never : PasskeyPersistence | PasskeyCredentials)\n  | (ManagedPasskey<A> extends never\n      ? never\n      : PasskeyManagementPersistence | PasskeyEnrollmentContext)\n  | (Enabled<A, \"email\"> extends never ? never : EmailAddressPersistence)\n  | (UsesProofs<A> extends never ? never : ProofPersistence)\n  | (Enabled<A, \"phone\"> extends never ? never : PhoneAdmission | PhoneSignInTargets);\n\nexport type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | \"identifiers\"\n  | \"credentials\"\n  | \"sessions\"\n  | \"sessionFlows\"\n  | (Enabled<A, \"password\"> extends never\n      ? never\n      : \"passwords\" | \"passwordAttempts\" | \"passwordCommands\")\n  | (ManagedPassword<A> extends never ? never : \"passwordRegistrations\")\n  | (Enabled<A, \"phone\"> extends never ? never : \"phoneState\")\n  | (Enabled<A, \"email\"> extends never ? never : \"emailCredentials\" | \"emailCommands\")\n  | (Enabled<A, \"passkey\"> extends never\n      ? never\n      :\n          | \"passkeyCredentials\"\n          | \"passkeyOwnership\"\n          | \"passkeyHandles\"\n          | \"passkeyModules\"\n          | \"passkeyFlows\"\n          | \"passkeyAdmissions\"\n          | \"passkeyCharges\")\n  | (ManagedPasskey<A> extends never ? never : \"passkeyCommands\")\n  | (UsesProofs<A> extends never ? never : ProofRoles);\n\nexport interface SubjectOptions<T extends object, NativeId> {\n  readonly table: T;\n  readonly id: string;\n  readonly status: string;\n  readonly activeValue: unknown;\n  readonly securityRevision: string;\n  readonly idCodec: Schema.Codec<SubjectId, NativeId>;\n  readonly requirements: (\n    row: Readonly<Record<string, unknown>>,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Defaults to sign-in requirements. Recovery can have a distinct application policy. */\n  readonly actionRequirements?: (\n    row: Readonly<Record<string, unknown>>,\n    action: PasswordAction | EmailAction | PasskeyActionChallenge[\"action\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n}\n\n/** Codecs at the application-owned subject and timestamp boundary. */\nexport interface SubjectMapping {\n  readonly table: object;\n  readonly id: string;\n  readonly status: string;\n  readonly securityRevision: string;\n  readonly activeValue: unknown;\n  readonly requirements: SubjectOptions<object, unknown>[\"requirements\"];\n  readonly actionRequirements: NonNullable<SubjectOptions<object, unknown>[\"actionRequirements\"]>;\n  readonly toSubject: (value: unknown) => Effect.Effect<SubjectId, PersistenceMappingError>;\n  readonly toNative: (value: SubjectId) => Effect.Effect<unknown, PersistenceMappingError>;\n  readonly toSubjectSync: (value: unknown) => SubjectId;\n  readonly toNativeSync: (value: SubjectId) => unknown;\n}\n\nexport interface MappingInput {\n  readonly tables: Partial<Record<StorageRole, object>>;\n  readonly subjects: SubjectMapping;\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly decodeInstantSync: (value: unknown) => number;\n}\n\nexport interface StorageLayout<\n  T extends object,\n  Role extends StorageRole = StorageRole,\n> extends MappingInput {\n  readonly namespace: string;\n  readonly schema: Readonly<Record<Role, T>>;\n}\n\nexport interface ConfigId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceConfig\";\n}\n\nexport interface TimestampOptions<Instant> {\n  readonly type: \"text\" | \"integer\";\n  readonly codec: Schema.Codec<number, Instant>;\n}\n\nexport interface BoundPersistence<\n  T extends object,\n  R,\n  C extends ClaimsCodec,\n  Id extends string,\n  A extends Definition<C, Id>,\n> {\n  readonly Config: Context.Service<ConfigId<A[\"namespace\"]>, StorageLayout<T, Roles<C, Id, A>>> & {\n    readonly layer: (\n      value: StorageLayout<T, Roles<C, Id, A>>,\n    ) => Layer.Layer<ConfigId<A[\"namespace\"]>>;\n  };\n  /** Create only the application subject. Runs inside the owning auth SQL transaction;\n   * use that SqlClient (including Drizzle over it), and return the new subject ID.\n   * Do not perform external side effects or open an independent transaction here.\n   */\n  readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;\n  readonly layer: Layer.Layer<\n    Ports<C, Id, A>,\n    PersistenceConfigurationError,\n    | Crypto.Crypto\n    | ConfigId<A[\"namespace\"]>\n    | ProvisioningRequirement<A>\n    | PasskeyRequirement<A>\n    | SqlClient.SqlClient\n    | R\n  >;\n  readonly managed: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n    /** Stable SQL identifier prefix; reuse the deployed prefix for existing tables. */\n    readonly prefix: string;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n  readonly map: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables: Readonly<Record<Roles<C, Id, A>, T>>;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n}\n\n/** Shared configuration shape. The backend chooses table types and service requirements. */\nexport interface PersistenceApi<T extends object, R = never> {\n  readonly make: <\n    C extends ClaimsCodec,\n    const Id extends string,\n    const A extends Definition<C, Id>,\n  >(\n    auth: A & Definition<C, Id>,\n  ) => BoundPersistence<T, R, C, Id, A>;\n}\n"],"mappings":";;AAgCA,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA,EAAE,QAAQ,OAAO,OAAO,CAC1B,CAAC,CAAC,CAAC"}
+{"version":3,"file":"configuration.mjs","names":[],"sources":["../../src/internal/configuration.ts"],"sourcesContent":["import type { EmailAction, EmailAddressPersistence } from \"@yielded/auth/Email\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasskeyActionChallenge,\n  PasskeyConfig,\n  PasskeyCredentials,\n  PasskeyEnrollmentContext,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  PasskeyPersistence,\n  PasskeyConfigurationError,\n} from \"@yielded/auth/Passkey\";\nimport type {\n  PasswordAction,\n  PasswordPersistence,\n  PasswordUnavailable,\n} from \"@yielded/auth/Password\";\nimport type { PhoneAdmission, PhoneSignInTargets } from \"@yielded/auth/PhoneOtp\";\nimport type { ProofPersistence } from \"@yielded/auth/Proofs\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type {\n  AuthenticationAuthority,\n  AuthenticationRequirement,\n  make as makeSessions,\n} from \"@yielded/auth/Sessions\";\nimport { type Context, type Crypto, type Effect, type Layer, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { StorageRole } from \"./storage-tables\";\n\nexport class PersistenceConfigurationError extends Schema.TaggedError<PersistenceConfigurationError>()(\n  \"PersistenceConfigurationError\",\n  { reason: Schema.String },\n) {}\n\nexport type ClaimsCodec = Schema.Codec<unknown, unknown, never, never>;\n\nexport interface PasskeyFeature {\n  readonly kind: \"passkey\";\n  readonly moduleId: string;\n  readonly policy: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError, PasskeyConfig>;\n  readonly management?: boolean;\n  readonly managementPolicy?: PasskeyManagementPolicy;\n}\n\nexport interface Strategy {\n  readonly strategy: object;\n  readonly persistence?:\n    | PasskeyFeature\n    | {\n        readonly kind: \"password\" | \"phone\" | \"email\";\n        readonly moduleId: string;\n        readonly lifecycle?: boolean;\n        readonly management?: boolean;\n        readonly addresses?: boolean;\n      };\n  readonly RegistrationAuthority?: Context.Key<unknown, unknown>;\n}\n\nexport interface Definition<C extends ClaimsCodec, Id extends string> {\n  readonly namespace: string;\n  readonly claims: C;\n  readonly sessionMode?: string | undefined;\n  readonly sessions: ReturnType<typeof makeSessions<C, Id>>;\n  readonly strategies: Readonly<Record<string, Strategy>>;\n}\n\ntype KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;\ntype Enabled<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n  Kind extends \"password\" | \"phone\" | \"email\" | \"passkey\",\n> = Extract<A[\"strategies\"][keyof A[\"strategies\"]], { persistence: { kind: Kind } }>;\n\ntype ManagedPassword<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"password\">, { persistence: { management: true } }>;\n\ntype ManagedPasskey<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"passkey\">, { persistence: { management: true } }>;\n\nexport type PasskeyRequirement<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n> = Enabled<A, \"passkey\"> extends never ? never : PasskeyConfig;\n\ntype RegistrationKey<S> = S extends { readonly RegistrationAuthority: infer K } ? K : never;\ntype Registration<S> =\n  RegistrationKey<S> extends Context.Key<infer _Id, infer Service>\n    ? Service extends { readonly register: (input: infer Input, ...args: never[]) => unknown }\n      ? Input extends { readonly registration: infer Value }\n        ? Value\n        : never\n      : never\n    : never;\n\nexport interface ProvisioningId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceProvisioning\";\n}\n\nexport type Provisioning<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = {\n  readonly [\n    K in keyof A[\"strategies\"] as A[\"strategies\"][K] extends {\n      persistence: { kind: \"password\"; management: true };\n    }\n      ? K\n      : never\n  ]: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration<A[\"strategies\"][K]>;\n  }) => Effect.Effect<SubjectId, PasswordUnavailable>;\n};\n\nexport type ProvisioningRequirement<\n  A extends { readonly namespace: string; readonly strategies: Readonly<Record<string, Strategy>> },\n> = ManagedPassword<A> extends never ? never : ProvisioningId<A[\"namespace\"]>;\n\ntype ProofRoles =\n  | \"proofRequests\"\n  | \"proofSeries\"\n  | \"proofGenerations\"\n  | \"proofContinuations\"\n  | \"proofScopes\"\n  | \"proofAbuse\"\n  | \"proofFailures\"\n  | \"proofCommands\";\n\ntype UsesProofs<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  | Enabled<A, \"phone\">\n  | Enabled<A, \"email\">\n  | ManagedPassword<A>;\n\nexport type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | AuthenticationAuthority\n  | KeyId<A[\"sessions\"][\"StatefulSessionPersistence\"]>\n  | KeyId<A[\"sessions\"][\"SessionRepository\"]>\n  | (Enabled<A, \"password\"> extends never ? never : PasswordPersistence)\n  | KeyId<RegistrationKey<ManagedPassword<A>>>\n  | (Enabled<A, \"passkey\"> extends never ? never : PasskeyPersistence | PasskeyCredentials)\n  | (ManagedPasskey<A> extends never\n      ? never\n      : PasskeyManagementPersistence | PasskeyEnrollmentContext)\n  | (Enabled<A, \"email\"> extends never ? never : EmailAddressPersistence)\n  | (UsesProofs<A> extends never ? never : ProofPersistence)\n  | (Enabled<A, \"phone\"> extends never ? never : PhoneAdmission | PhoneSignInTargets);\n\nexport type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | \"identifiers\"\n  | \"credentials\"\n  | \"sessions\"\n  | \"sessionFlows\"\n  | (Enabled<A, \"password\"> extends never ? never : \"passwords\" | \"passwordCommands\")\n  | (ManagedPassword<A> extends never ? never : \"passwordRegistrations\")\n  | (Enabled<A, \"phone\"> extends never ? never : \"phoneState\")\n  | (Enabled<A, \"email\"> extends never ? never : \"emailCredentials\" | \"emailCommands\")\n  | (Enabled<A, \"passkey\"> extends never\n      ? never\n      :\n          | \"passkeyCredentials\"\n          | \"passkeyOwnership\"\n          | \"passkeyHandles\"\n          | \"passkeyModules\"\n          | \"passkeyFlows\"\n          | \"passkeyAdmissions\"\n          | \"passkeyCharges\")\n  | (ManagedPasskey<A> extends never ? never : \"passkeyCommands\")\n  | (UsesProofs<A> extends never ? never : ProofRoles);\n\nexport interface SubjectOptions<T extends object, NativeId> {\n  readonly table: T;\n  readonly id: string;\n  readonly status: string;\n  readonly activeValue: unknown;\n  readonly securityRevision: string;\n  readonly idCodec: Schema.Codec<SubjectId, NativeId>;\n  readonly requirements: (\n    row: Readonly<Record<string, unknown>>,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Defaults to sign-in requirements. Recovery can have a distinct application policy. */\n  readonly actionRequirements?: (\n    row: Readonly<Record<string, unknown>>,\n    action: PasswordAction | EmailAction | PasskeyActionChallenge[\"action\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n}\n\n/** Codecs at the application-owned subject and timestamp boundary. */\nexport interface SubjectMapping {\n  readonly table: object;\n  readonly id: string;\n  readonly status: string;\n  readonly securityRevision: string;\n  readonly activeValue: unknown;\n  readonly requirements: SubjectOptions<object, unknown>[\"requirements\"];\n  readonly actionRequirements: NonNullable<SubjectOptions<object, unknown>[\"actionRequirements\"]>;\n  readonly toSubject: (value: unknown) => Effect.Effect<SubjectId, PersistenceMappingError>;\n  readonly toNative: (value: SubjectId) => Effect.Effect<unknown, PersistenceMappingError>;\n  readonly toSubjectSync: (value: unknown) => SubjectId;\n  readonly toNativeSync: (value: SubjectId) => unknown;\n}\n\nexport interface MappingInput {\n  readonly tables: Partial<Record<StorageRole, object>>;\n  readonly subjects: SubjectMapping;\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly decodeInstantSync: (value: unknown) => number;\n}\n\nexport interface StorageLayout<\n  T extends object,\n  Role extends StorageRole = StorageRole,\n> extends MappingInput {\n  readonly namespace: string;\n  readonly schema: Readonly<Record<Role, T>>;\n}\n\nexport interface ConfigId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceConfig\";\n}\n\nexport interface TimestampOptions<Instant> {\n  readonly type: \"text\" | \"integer\";\n  readonly codec: Schema.Codec<number, Instant>;\n}\n\nexport interface BoundPersistence<\n  T extends object,\n  R,\n  C extends ClaimsCodec,\n  Id extends string,\n  A extends Definition<C, Id>,\n> {\n  readonly Config: Context.Service<ConfigId<A[\"namespace\"]>, StorageLayout<T, Roles<C, Id, A>>> & {\n    readonly layer: (\n      value: StorageLayout<T, Roles<C, Id, A>>,\n    ) => Layer.Layer<ConfigId<A[\"namespace\"]>>;\n  };\n  /** Create only the application subject. Runs inside the owning auth SQL transaction;\n   * use that SqlClient (including Drizzle over it), and return the new subject ID.\n   * Do not perform external side effects or open an independent transaction here.\n   */\n  readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;\n  readonly layer: Layer.Layer<\n    Ports<C, Id, A>,\n    PersistenceConfigurationError,\n    | Crypto.Crypto\n    | ConfigId<A[\"namespace\"]>\n    | ProvisioningRequirement<A>\n    | PasskeyRequirement<A>\n    | SqlClient.SqlClient\n    | R\n  >;\n  readonly managed: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n    /** Stable SQL identifier prefix; reuse the deployed prefix for existing tables. */\n    readonly prefix: string;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n  readonly map: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables: Readonly<Record<Roles<C, Id, A>, T>>;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n}\n\n/** Shared configuration shape. The backend chooses table types and service requirements. */\nexport interface PersistenceApi<T extends object, R = never> {\n  readonly make: <\n    C extends ClaimsCodec,\n    const Id extends string,\n    const A extends Definition<C, Id>,\n  >(\n    auth: A & Definition<C, Id>,\n  ) => BoundPersistence<T, R, C, Id, A>;\n}\n"],"mappings":";;AAgCA,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA,EAAE,QAAQ,OAAO,OAAO,CAC1B,CAAC,CAAC,CAAC"}

package/dist/internal/email-kernel.d.mts

@@ -132,7 +132,7 @@ export declare const makeEmailKernel: <Fragment extends SqlFragment = SqlFragmen
     completion: import("@yielded/auth/Proofs").ProofCompletionPlan;
     invalidation?: Readonly<{
       trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-      existingSessions: "immediate" | "original-absolute-expiry";
+      existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
       maximumExposureMillis: number;
       oldAuthenticationEvidence: "rejected";
     }>;

package/dist/internal/email-kernel.mjs

@@ -279,7 +279,7 @@ const makeEmailKernel = (operations, proofs) => {
 	});
 	const validateEmailAuthority = Effect.fn("DrizzleEmail.validateAuthority")(function* (mapping, configuration, input, action) {
 		const confirmsExisting = action === "verify-address" && input.captured.targetIdentifierRevision !== void 0;
-		if (!input.captured.eligible || !completionMatches(input, action) || input.authorization.challenge.moduleId !== input.moduleId || input.authorization.challenge.action !== action || input.authorization.challenge.commandId !== input.commandId || !sameIdentifier(input.authorization.challenge.target, input.target) || input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId || !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) || input.authorization.challenge.targetIdentifierRevision !== input.captured.targetIdentifierRevision || input.authorization.evidence.flowId !== input.commandId || input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest || !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) || action === "verify-address" && input.captured.source !== void 0 || action === "change-address" && input.captured.source === void 0 || confirmsExisting !== (input.invalidation === void 0) || input.invalidation?.existingSessions === "immediate" && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
+		if (!input.captured.eligible || !completionMatches(input, action) || input.authorization.challenge.moduleId !== input.moduleId || input.authorization.challenge.action !== action || input.authorization.challenge.commandId !== input.commandId || !sameIdentifier(input.authorization.challenge.target, input.target) || input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId || !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) || input.authorization.challenge.targetIdentifierRevision !== input.captured.targetIdentifierRevision || input.authorization.evidence.flowId !== input.commandId || input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest || !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) || action === "verify-address" && input.captured.source !== void 0 || action === "change-address" && input.captured.source === void 0 || confirmsExisting !== (input.invalidation === void 0) || (input.invalidation?.existingSessions === "immediate" || input.invalidation?.existingSessions === "cache-expiry") && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
 		const current = yield* currentAddress(mapping, {
 			moduleId: input.moduleId,
 			subjectId: input.captured.revision.subjectId,