@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/internal/transaction-kernel.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"transaction-kernel.mjs","names":[],"sources":["../../src/internal/transaction-kernel.ts"],"sourcesContent":["import { type CommitJournal, type PreparedCommit } from \"@yielded/auth/Hooks\";\nimport { reportAuthFailure } from \"@yielded/auth/Persistence\";\n/* oxlint-disable no-explicit-any -- existing storage kernels erase foreign table shapes; domain errors remain typed. */\nimport { Cause, Context, Effect } from \"effect\";\nimport type * as SqlClient from \"effect/sql/SqlClient\";\nimport type { SqlError } from \"effect/sql/SqlError\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type {\n  SqlExpression as SQL,\n  QueryFailure,\n  QueryOperations,\n  SqlFragment,\n  SqlColumn,\n} from \"./query-operations\";\n\ntype Table = object;\n\nexport type Row = Record<string, any>;\n\n/** Only query-builder/table shapes are erased here. Installed native\n * queries have captured clients, and their error channel remains explicit. */\ntype NativeQuery<A> = Effect.Effect<A, QueryFailure | SqlError>;\n\nexport interface TransactionNativeDatabase {\n  readonly $client: SqlClient.SqlClient & {\n    readonly batch: (statements: ReadonlyArray<Statement<any>>) => Effect.Effect<any, SqlError>;\n  };\n  readonly transaction: <A, E, R>(\n    body: (transaction: any) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError, R>;\n}\n\n/** Captured root database for service construction and pre-transaction catalog checks.\n * Active transactions remain owned by their coordinator and journal. */\nexport class NativeDatabase extends Context.Service<NativeDatabase, TransactionNativeDatabase>()(\n  \"effect-auth/persistence/NativeDatabase\",\n) {}\n\nexport interface Observation {\n  readonly table: Table;\n  readonly where: SQL;\n  rows: ReadonlyArray<Row>;\n}\n\n/** Expressions deliberately do not replace observed values. Read only semantic\n * columns when telemetry changes atomically, and state the physical result. */\nexport interface GuardedUpdate {\n  readonly rows: number;\n  readonly postcondition: SQL;\n}\n\nexport interface TransactionOwner<Failure> {\n  readonly database: any;\n  readonly journal: CommitJournal;\n  readonly marker: string;\n  readonly batch: boolean;\n  readonly observations: Observation[];\n  readonly postconditions: Array<SQL | (() => SQL)>;\n  readonly statements: Statement<any>[];\n  readonly guards: PreparedCommit<void>[];\n  exact(table: Table, row: Row): SQL;\n  read(\n    table: Table,\n    where: SQL,\n    options?: {\n      readonly lock?: boolean;\n      readonly limit?: number;\n      readonly observe?: boolean;\n      readonly admissionOnly?: boolean;\n      readonly takeOnly?: boolean;\n      readonly orderBy?: any;\n      readonly columns?: ReadonlyArray<string>;\n    },\n  ): Effect.Effect<Observation, Failure>;\n  write(query: any): Effect.Effect<void, Failure>;\n  insert(\n    table: Table,\n    values: Row,\n    key: Row,\n    absent?: boolean,\n  ): Effect.Effect<Observation, Failure>;\n  update(table: Table, key: Row, values: Row): Effect.Effect<void, Failure>;\n  updateGuarded(\n    table: Table,\n    where: SQL,\n    values: Row,\n    guard: GuardedUpdate,\n  ): Effect.Effect<void, Failure>;\n  /** Internal SQL only, run once after application work and before final guards. */\n  finalUpdate(\n    table: Table,\n    where: SQL,\n    values: Row,\n    guard: GuardedUpdate,\n  ): Effect.Effect<void, Failure>;\n  remove(table: Table, key: Row): Effect.Effect<void, Failure>;\n  check(condition: SQL): Effect.Effect<boolean, Failure>;\n  now(clock: { readonly engineNowMillis: SQL }): Effect.Effect<number, Failure>;\n  finish(): Effect.Effect<void, Failure>;\n}\n\nexport const makeTransactionKernel = <\n  Fragment extends SqlFragment = SqlFragment,\n  Column extends SqlColumn = SqlColumn,\n>(\n  operations: QueryOperations<Fragment, Column>,\n) => {\n  const { eq, getTableColumns, isNull, sql, balancedD1And, compactD1GeneratedStatement } =\n    operations;\n\n  const isUnavailableCause = <Failure>(cause: Cause.Cause<unknown>, unavailable: () => Failure) => {\n    const expected = unavailable();\n\n    const tag =\n      typeof expected === \"object\" && expected !== null && \"_tag\" in expected\n        ? expected._tag\n        : undefined;\n\n    return (\n      tag !== undefined &&\n      cause.reasons.length > 0 &&\n      cause.reasons.every(\n        (reason) =>\n          Cause.isFailReason(reason) &&\n          typeof reason.error === \"object\" &&\n          reason.error !== null &&\n          \"_tag\" in reason.error &&\n          reason.error._tag === tag,\n      )\n    );\n  };\n\n  /** Report once, before an adapter replaces the raw cause with its public\n   * unavailable error. Already translated failures stay quiet at outer owners. */\n  const reportTransactionFailure = <A, E, R, Failure>(\n    effect: Effect.Effect<A, E, R>,\n    unavailable: () => Failure,\n  ): Effect.Effect<A, E, R> =>\n    Effect.catchCause(effect, (cause) =>\n      isUnavailableCause(cause, unavailable)\n        ? Effect.failCause(cause)\n        : reportAuthFailure(\"auth-persistence\", cause).pipe(\n            Effect.andThen(Effect.failCause(cause)),\n          ),\n    );\n\n  const both = (...parts: ReadonlyArray<SQL | undefined>) => balancedD1And(...parts) ?? sql`1 = 1`;\n\n  const makeTransactionRows = <Failure>(unavailable: () => Failure) => {\n    const invariant: (value: unknown) => asserts value = (value) => {\n      if (!value) throw unavailable();\n    };\n\n    const col = (table: Table, key: string) => {\n      const value = getTableColumns(table)[key];\n\n      invariant(value !== undefined);\n\n      return value;\n    };\n\n    const equal = (table: Table, values: Row) =>\n      both(\n        ...Object.entries(values).map(([key, value]) =>\n          value === null ? isNull(col(table, key)) : eq(col(table, key), value),\n        ),\n      );\n\n    /** Mapped driver values use plain data, Dates and binary views. Application\n     * identity classes are reconstructed by the mapped codecs, never cloned here. */\n    const copiedRow = (row: Row) => {\n      const seen = new WeakSet<object>();\n\n      const supported = (value: unknown): void => {\n        if (value === null || typeof value !== \"object\" || seen.has(value)) return;\n        seen.add(value);\n        if (value instanceof Date || value instanceof ArrayBuffer || ArrayBuffer.isView(value))\n          return;\n        invariant(\n          Array.isArray(value) ||\n            Object.getPrototypeOf(value) === Object.prototype ||\n            Object.getPrototypeOf(value) === null,\n        );\n        for (const item of Object.values(value)) supported(item);\n      };\n\n      supported(row);\n\n      return structuredClone(row);\n    };\n\n    const nativeKey = (value: unknown): string => {\n      const packed = (tag: string, text: string) => tag + text.length + \":\" + text;\n\n      if (value instanceof Date) return packed(\"date\", value.toISOString());\n      if (typeof value === \"bigint\") return packed(\"bigint\", value.toString());\n\n      const bytes =\n        value instanceof ArrayBuffer\n          ? new Uint8Array(value)\n          : ArrayBuffer.isView(value)\n            ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength)\n            : undefined;\n\n      if (bytes !== undefined) return packed(\"bytes\", Array.from(bytes).join(\",\"));\n      if (value === null || typeof value !== \"object\") return packed(typeof value, String(value));\n      if (Array.isArray(value)) return packed(\"array\", value.map(nativeKey).join(\"\"));\n      invariant(\n        Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null,\n      );\n\n      return packed(\n        \"object\",\n        Object.entries(value)\n          .sort(([a], [b]) => a.localeCompare(b))\n          .map(([name, item]) => nativeKey(name) + nativeKey(item))\n          .join(\"\"),\n      );\n    };\n\n    const matchesNativeRow = (table: Table, row: Row, key: Row) =>\n      Object.entries(key).every(([name, value]) => {\n        if (value === null || row[name] === null) return value === row[name];\n        const column = col(table, name);\n\n        return (\n          nativeKey(column.mapToDriverValue(row[name])) ===\n          nativeKey(column.mapToDriverValue(value))\n        );\n      });\n\n    return { col, equal, copiedRow, matchesNativeRow };\n  };\n\n  const makeTransactionOwner = <Failure>(\n    database: any,\n    journal: CommitJournal,\n    marker: string,\n    unavailable: () => Failure,\n    configuration: {\n      readonly client?: any;\n      readonly batch: boolean;\n      readonly locking: boolean;\n      readonly mysql: boolean;\n      readonly dialect: \"pg\" | \"mysql\" | \"sqlite\";\n    },\n  ): TransactionOwner<Failure> => {\n    const invariant: (value: unknown) => asserts value = (value) => {\n      if (!value) throw unavailable();\n    };\n\n    const { col, equal, matchesNativeRow } = makeTransactionRows(unavailable);\n    let phase: \"open\" | \"finishing\" | \"finished\" = \"open\";\n    let poisoned = false;\n    const open = () => invariant(phase === \"open\" && !poisoned);\n\n    const result = <A, E>(effect: Effect.Effect<A, E>) =>\n      effect.pipe(\n        (operation) => reportTransactionFailure(operation, unavailable),\n        Effect.mapError(unavailable),\n        Effect.catchDefect(() => Effect.fail(unavailable())),\n        Effect.onExit((exit) =>\n          Effect.sync(() => {\n            if (exit._tag === \"Failure\") poisoned = true;\n          }),\n        ),\n      );\n\n    const observations: Observation[] = [];\n    const statements: Statement<any>[] = [];\n    const postconditions: Array<SQL | (() => SQL)> = [];\n    const guards: PreparedCommit<void>[] = [];\n    const finalUpdates: Array<{ readonly query: any; readonly guard: GuardedUpdate }> = [];\n\n    const exactRow = (table: Table, row: Row) =>\n      both(\n        ...Object.entries(row).map(([key, value]) => {\n          if (typeof value !== \"string\") return equal(table, { [key]: value });\n\n          const column = col(table, key),\n            bound = sql.param(value, column);\n\n          return configuration.dialect === \"mysql\"\n            ? sql`binary ${column} = binary ${bound}`\n            : configuration.dialect === \"pg\"\n              ? sql`convert_to(cast(${column} as text), 'UTF8') = convert_to(cast(${bound} as text), 'UTF8')`\n              : sql`cast(${column} as blob) = cast(${bound} as blob)`;\n        }),\n      );\n\n    const toStatement = (query: any): Statement<any> => {\n      const rendered = query.toSQL();\n      const client = configuration.client ?? database.$client;\n\n      return compactD1GeneratedStatement(\n        client,\n        client.unsafe(rendered.sql, rendered.params),\n        unavailable,\n      );\n    };\n\n    const assertion = (condition: SQL) =>\n      database\n        .select({\n          value: sql`case when ${condition} then 1 else json_extract('[]', ${\"$[oauth-owner-\" + marker + \"]\"}) end`,\n        })\n        .from(sql`(select 1) as oauth_assertion`);\n\n    const observedConditions = (table: Table, where: SQL, rows: ReadonlyArray<Row>) => [\n      sql`(select count(*) from ${table} where ${where}) = ${rows.length}`,\n      ...rows.map(\n        (row) => sql`exists(select 1 from ${table} where ${both(where, exactRow(table, row))})`,\n      ),\n    ];\n\n    // All chunks remain inside the same native owner or atomic D1 batch. A single\n    // wide row is compacted; separate observations cannot accumulate unbounded\n    // bind parameters or expression depth in one final SELECT.\n    const chunks = (conditions: ReadonlyArray<SQL>) => {\n      const output: SQL[] = [];\n      let pending: SQL[] = [];\n\n      for (const condition of conditions) {\n        const candidate = [...pending, condition];\n        const rendered = assertion(both(...candidate)).toSQL();\n\n        if (\n          pending.length > 0 &&\n          (rendered.params.length > 96 || new TextEncoder().encode(rendered.sql).length > 48_000)\n        ) {\n          output.push(both(...pending));\n          pending = [condition];\n        } else pending = candidate;\n      }\n      if (pending.length > 0) output.push(both(...pending));\n\n      return output;\n    };\n\n    const appendAssertions = (conditions: ReadonlyArray<SQL>) => {\n      for (const condition of chunks(conditions))\n        statements.push(toStatement(assertion(condition)));\n    };\n\n    const observed = (table: Table, where: SQL, rows: ReadonlyArray<Row>) => {\n      const observation = { table, where, rows };\n\n      observations.push(observation);\n\n      return observation;\n    };\n\n    const queryCondition = (condition: SQL) =>\n      database\n        .select({\n          value: sql`case when ${condition} then 1 else 0 end`.mapWith(Number).as(\"value\"),\n        })\n        .from(sql`(select 1) as oauth_guard`);\n\n    const conditionHolds = (condition: SQL) =>\n      Effect.gen(function* () {\n        const query = queryCondition(condition);\n\n        const rows: ReadonlyArray<Row> = yield* configuration.dialect === \"sqlite\"\n          ? toStatement(query)\n          : (query as NativeQuery<Row[]>);\n\n        const row = rows[0];\n\n        invariant(rows.length === 1 && row !== undefined);\n\n        // SQLite executes the raw statement, before logical field decoding.\n        // This query projects one value; its alias belongs to the adapter compiler.\n        return Object.values(row)[0] === 1;\n      });\n\n    const guardedQuery = (table: Table, where: SQL, values: Row, guard: GuardedUpdate) => {\n      invariant(Number.isSafeInteger(guard.rows) && guard.rows > 0 && guard.rows <= 128);\n\n      return { query: database.update(table).set(values).where(where), guard: { ...guard } };\n    };\n\n    const applyGuarded = (entry: { readonly query: any; readonly guard: GuardedUpdate }) =>\n      Effect.gen(function* () {\n        if (configuration.batch) {\n          statements.push(toStatement(entry.query));\n          statements.push(toStatement(assertion(sql`changes() = ${entry.guard.rows}`)));\n          appendAssertions([entry.guard.postcondition]);\n        } else {\n          if (configuration.mysql) {\n            // mysql2 reports matched rows (FOUND_ROWS), including a telemetry no-op.\n            const changed = yield* entry.query as NativeQuery<{ readonly affectedRows: number }>;\n\n            invariant(changed.affectedRows === entry.guard.rows);\n          } else {\n            const changed = yield* entry.query.returning({ value: sql`1` }) as NativeQuery<\n              ReadonlyArray<Row>\n            >;\n\n            invariant(changed.length === entry.guard.rows);\n          }\n          invariant(yield* conditionHolds(entry.guard.postcondition));\n        }\n      });\n\n    const owner: TransactionOwner<Failure> = {\n      database,\n      journal,\n      marker,\n      batch: configuration.batch,\n      observations,\n      statements,\n      postconditions,\n      guards,\n      exact: exactRow,\n      read: (table, where, options = {}) =>\n        result(\n          Effect.gen(function* () {\n            open();\n            const limit = options.limit ?? 64;\n\n            let query = database\n              .select(\n                options.columns === undefined\n                  ? undefined\n                  : Object.fromEntries(options.columns.map((key) => [key, col(table, key)])),\n              )\n              .from(table)\n              .where(where)\n              .limit(options.takeOnly ? limit : limit + 1);\n\n            if (options.orderBy !== undefined) query = query.orderBy(options.orderBy);\n            if (options.lock !== false && configuration.locking) query = query.for(\"update\");\n            const rows: Row[] = yield* query as NativeQuery<Row[]>;\n\n            invariant(rows.length <= limit);\n            if (configuration.batch && (options.observe !== false || options.admissionOnly))\n              appendAssertions(observedConditions(table, where, rows));\n\n            return options.observe === false || options.admissionOnly\n              ? { table, where, rows }\n              : observed(table, where, rows);\n          }),\n        ),\n      write: (query) =>\n        result(\n          Effect.gen(function* () {\n            open();\n            if (configuration.batch) statements.push(toStatement(query));\n            else yield* query as NativeQuery<unknown>;\n          }),\n        ),\n      insert: (table, values, key, absent = false) =>\n        result(\n          Effect.gen(function* () {\n            open();\n            let query = database.insert(table).values(values);\n\n            if (absent)\n              query = configuration.mysql\n                ? query.onDuplicateKeyUpdate({\n                    set: { [Object.keys(key)[0]!]: col(table, Object.keys(key)[0]!) },\n                  })\n                : query.onConflictDoNothing();\n            yield* owner.write(query);\n            const where = equal(table, key);\n\n            if (configuration.batch) return observed(table, where, [values]);\n            const found = yield* owner.read(table, where, { limit: 1 });\n            const markerColumn = Object.keys(values).find((key) => values[key] === marker);\n\n            if (!absent || (markerColumn !== undefined && found.rows[0]?.[markerColumn] === marker))\n              invariant(\n                yield* owner.check(\n                  sql`exists(select 1 from ${table} where ${both(where, exactRow(table, values))})`,\n                ),\n              );\n\n            return found;\n          }),\n        ),\n      update: (table, key, values) =>\n        result(\n          Effect.gen(function* () {\n            open();\n            yield* owner.write(database.update(table).set(values).where(equal(table, key)));\n            for (const observation of observations)\n              if (observation.table === table)\n                observation.rows = observation.rows.map((row) =>\n                  matchesNativeRow(table, row, key) ? { ...row, ...values } : row,\n                );\n          }),\n        ),\n      updateGuarded: (table, where, values, guard) =>\n        result(\n          Effect.gen(function* () {\n            open();\n            const entry = guardedQuery(table, where, values, guard);\n\n            yield* applyGuarded(entry);\n            postconditions.push(entry.guard.postcondition);\n          }),\n        ),\n      finalUpdate: (table, where, values, guard) =>\n        result(\n          Effect.sync(() => {\n            open();\n            invariant(finalUpdates.length < 128);\n            finalUpdates.push(guardedQuery(table, where, values, guard));\n          }),\n        ),\n      remove: (table, key) =>\n        result(\n          Effect.gen(function* () {\n            open();\n            yield* owner.write(database.delete(table).where(equal(table, key)));\n            for (const observation of observations)\n              if (observation.table === table)\n                observation.rows = observation.rows.filter(\n                  (row) => !matchesNativeRow(table, row, key),\n                );\n          }),\n        ),\n      check: (condition) =>\n        result(\n          Effect.gen(function* () {\n            open();\n            const holds = yield* conditionHolds(condition);\n\n            if (configuration.batch)\n              statements.push(toStatement(assertion(holds ? condition : sql`not (${condition})`)));\n\n            return holds;\n          }),\n        ),\n      now: (clock) =>\n        result(\n          Effect.gen(function* () {\n            open();\n\n            const rows: Row[] = yield* database\n              .select({\n                value: sql`${clock.engineNowMillis}`.mapWith(Number),\n              })\n              .from(sql`(select 1) as oauth_clock`) as NativeQuery<Row[]>;\n\n            const value = rows[0]?.value;\n\n            invariant(Number.isSafeInteger(value) && value >= 0);\n\n            return value as number;\n          }),\n        ),\n      finish: () =>\n        result(\n          Effect.gen(function* () {\n            open();\n            phase = \"finishing\";\n            Object.freeze(observations);\n            Object.freeze(postconditions);\n            Object.freeze(guards);\n            Object.freeze(finalUpdates);\n\n            // Close registration before any late-bound SQL predicate is materialized.\n            // No callback is invoked after the first final write.\n            const conditions: SQL[] = observations.flatMap((observation) =>\n              observedConditions(observation.table, observation.where, observation.rows),\n            );\n\n            conditions.push(\n              ...postconditions.map((condition) =>\n                typeof condition === \"function\" ? condition() : condition,\n              ),\n            );\n            conditions.push(...finalUpdates.map((entry) => entry.guard.postcondition));\n            for (const guard of guards) {\n              const status = yield* Effect.result(guard.read);\n\n              invariant(status._tag === \"Failure\" && status.failure._tag === \"CommitPending\");\n            }\n            invariant(!poisoned);\n            for (const entry of finalUpdates) yield* applyGuarded(entry);\n            if (configuration.batch) appendAssertions(conditions);\n            else\n              for (const condition of chunks(conditions))\n                invariant(yield* conditionHolds(condition));\n            invariant(!poisoned);\n          }).pipe(\n            Effect.ensuring(\n              Effect.sync(() => {\n                phase = \"finished\";\n              }),\n            ),\n          ),\n        ),\n    };\n\n    return owner;\n  };\n\n  return { reportTransactionFailure, both, makeTransactionRows, makeTransactionOwner };\n};\n"],"mappings":";;;;;;AAmCA,IAAa,iBAAb,cAAoC,QAAQ,QAAmD,CAAC,CAC9F,wCACF,CAAC,CAAC,CAAC;AAiEH,MAAa,yBAIX,eACG;CACH,MAAM,EAAE,IAAI,iBAAiB,QAAQ,KAAK,eAAe,gCACvD;CAEF,MAAM,sBAA+B,OAA6B,gBAA+B;EAC/F,MAAM,WAAW,YAAY;EAE7B,MAAM,MACJ,OAAO,aAAa,YAAY,aAAa,QAAQ,UAAU,WAC3D,SAAS,OACT,KAAA;EAEN,OACE,QAAQ,KAAA,KACR,MAAM,QAAQ,SAAS,KACvB,MAAM,QAAQ,OACX,WACC,MAAM,aAAa,MAAM,KACzB,OAAO,OAAO,UAAU,YACxB,OAAO,UAAU,QACjB,UAAU,OAAO,SACjB,OAAO,MAAM,SAAS,GAC1B;CAEJ;;;CAIA,MAAM,4BACJ,QACA,gBAEA,OAAO,WAAW,SAAS,UACzB,mBAAmB,OAAO,WAAW,IACjC,OAAO,UAAU,KAAK,IACtB,kBAAkB,oBAAoB,KAAK,CAAC,CAAC,KAC3C,OAAO,QAAQ,OAAO,UAAU,KAAK,CAAC,CACxC,CACN;CAEF,MAAM,QAAQ,GAAG,UAA0C,cAAc,GAAG,KAAK,KAAK,GAAG;CAEzF,MAAM,uBAAgC,gBAA+B;EACnE,MAAM,aAAgD,UAAU;GAC9D,IAAI,CAAC,OAAO,MAAM,YAAY;EAChC;EAEA,MAAM,OAAO,OAAc,QAAgB;GACzC,MAAM,QAAQ,gBAAgB,KAAK,CAAC,CAAC;GAErC,UAAU,UAAU,KAAA,CAAS;GAE7B,OAAO;EACT;EAEA,MAAM,SAAS,OAAc,WAC3B,KACE,GAAG,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,WACnC,UAAU,OAAO,OAAO,IAAI,OAAO,GAAG,CAAC,IAAI,GAAG,IAAI,OAAO,GAAG,GAAG,KAAK,CACtE,CACF;;;EAIF,MAAM,aAAa,QAAa;GAC9B,MAAM,uBAAO,IAAI,QAAgB;GAEjC,MAAM,aAAa,UAAyB;IAC1C,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,KAAK,IAAI,KAAK,GAAG;IACpE,KAAK,IAAI,KAAK;IACd,IAAI,iBAAiB,QAAQ,iBAAiB,eAAe,YAAY,OAAO,KAAK,GACnF;IACF,UACE,MAAM,QAAQ,KAAK,KACjB,OAAO,eAAe,KAAK,MAAM,OAAO,aACxC,OAAO,eAAe,KAAK,MAAM,IACrC;IACA,KAAK,MAAM,QAAQ,OAAO,OAAO,KAAK,GAAG,UAAU,IAAI;GACzD;GAEA,UAAU,GAAG;GAEb,OAAO,gBAAgB,GAAG;EAC5B;EAEA,MAAM,aAAa,UAA2B;GAC5C,MAAM,UAAU,KAAa,SAAiB,MAAM,KAAK,SAAS,MAAM;GAExE,IAAI,iBAAiB,MAAM,OAAO,OAAO,QAAQ,MAAM,YAAY,CAAC;GACpE,IAAI,OAAO,UAAU,UAAU,OAAO,OAAO,UAAU,MAAM,SAAS,CAAC;GAEvE,MAAM,QACJ,iBAAiB,cACb,IAAI,WAAW,KAAK,IACpB,YAAY,OAAO,KAAK,IACtB,IAAI,WAAW,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,IAC/D,KAAA;GAER,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,SAAS,MAAM,KAAK,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC;GAC3E,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO,OAAO,OAAO,OAAO,OAAO,KAAK,CAAC;GAC1F,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC;GAC9E,UACE,OAAO,eAAe,KAAK,MAAM,OAAO,aAAa,OAAO,eAAe,KAAK,MAAM,IACxF;GAEA,OAAO,OACL,UACA,OAAO,QAAQ,KAAK,CAAC,CAClB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CACtC,KAAK,CAAC,MAAM,UAAU,UAAU,IAAI,IAAI,UAAU,IAAI,CAAC,CAAC,CACxD,KAAK,EAAE,CACZ;EACF;EAEA,MAAM,oBAAoB,OAAc,KAAU,QAChD,OAAO,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,WAAW;GAC3C,IAAI,UAAU,QAAQ,IAAI,UAAU,MAAM,OAAO,UAAU,IAAI;GAC/D,MAAM,SAAS,IAAI,OAAO,IAAI;GAE9B,OACE,UAAU,OAAO,iBAAiB,IAAI,KAAK,CAAC,MAC5C,UAAU,OAAO,iBAAiB,KAAK,CAAC;EAE5C,CAAC;EAEH,OAAO;GAAE;GAAK;GAAO;GAAW;EAAiB;CACnD;CAEA,MAAM,wBACJ,UACA,SACA,QACA,aACA,kBAO8B;EAC9B,MAAM,aAAgD,UAAU;GAC9D,IAAI,CAAC,OAAO,MAAM,YAAY;EAChC;EAEA,MAAM,EAAE,KAAK,OAAO,qBAAqB,oBAAoB,WAAW;EACxE,IAAI,QAA2C;EAC/C,IAAI,WAAW;EACf,MAAM,aAAa,UAAU,UAAU,UAAU,CAAC,QAAQ;EAE1D,MAAM,UAAgB,WACpB,OAAO,MACJ,cAAc,yBAAyB,WAAW,WAAW,GAC9D,OAAO,SAAS,WAAW,GAC3B,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,GACnD,OAAO,QAAQ,SACb,OAAO,WAAW;GAChB,IAAI,KAAK,SAAS,WAAW,WAAW;EAC1C,CAAC,CACH,CACF;EAEF,MAAM,eAA8B,CAAC;EACrC,MAAM,aAA+B,CAAC;EACtC,MAAM,iBAA2C,CAAC;EAClD,MAAM,SAAiC,CAAC;EACxC,MAAM,eAA8E,CAAC;EAErF,MAAM,YAAY,OAAc,QAC9B,KACE,GAAG,OAAO,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;GAC3C,IAAI,OAAO,UAAU,UAAU,OAAO,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC;GAEnE,MAAM,SAAS,IAAI,OAAO,GAAG,GAC3B,QAAQ,IAAI,MAAM,OAAO,MAAM;GAEjC,OAAO,cAAc,YAAY,UAC7B,GAAG,UAAU,OAAO,YAAY,UAChC,cAAc,YAAY,OACxB,GAAG,mBAAmB,OAAO,uCAAuC,MAAM,sBAC1E,GAAG,QAAQ,OAAO,mBAAmB,MAAM;EACnD,CAAC,CACH;EAEF,MAAM,eAAe,UAA+B;GAClD,MAAM,WAAW,MAAM,MAAM;GAC7B,MAAM,SAAS,cAAc,UAAU,SAAS;GAEhD,OAAO,4BACL,QACA,OAAO,OAAO,SAAS,KAAK,SAAS,MAAM,GAC3C,WACF;EACF;EAEA,MAAM,aAAa,cACjB,SACG,OAAO,EACN,OAAO,GAAG,aAAa,UAAU,kCAAkC,mBAAmB,SAAS,IAAI,OACrG,CAAC,CAAC,CACD,KAAK,GAAG,+BAA+B;EAE5C,MAAM,sBAAsB,OAAc,OAAY,SAA6B,CACjF,GAAG,yBAAyB,MAAM,SAAS,MAAM,MAAM,KAAK,UAC5D,GAAG,KAAK,KACL,QAAQ,GAAG,wBAAwB,MAAM,SAAS,KAAK,OAAO,SAAS,OAAO,GAAG,CAAC,EAAE,EACvF,CACF;EAKA,MAAM,UAAU,eAAmC;GACjD,MAAM,SAAgB,CAAC;GACvB,IAAI,UAAiB,CAAC;GAEtB,KAAK,MAAM,aAAa,YAAY;IAClC,MAAM,YAAY,CAAC,GAAG,SAAS,SAAS;IACxC,MAAM,WAAW,UAAU,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM;IAErD,IACE,QAAQ,SAAS,MAChB,SAAS,OAAO,SAAS,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS,GAAG,CAAC,CAAC,SAAS,OAChF;KACA,OAAO,KAAK,KAAK,GAAG,OAAO,CAAC;KAC5B,UAAU,CAAC,SAAS;IACtB,OAAO,UAAU;GACnB;GACA,IAAI,QAAQ,SAAS,GAAG,OAAO,KAAK,KAAK,GAAG,OAAO,CAAC;GAEpD,OAAO;EACT;EAEA,MAAM,oBAAoB,eAAmC;GAC3D,KAAK,MAAM,aAAa,OAAO,UAAU,GACvC,WAAW,KAAK,YAAY,UAAU,SAAS,CAAC,CAAC;EACrD;EAEA,MAAM,YAAY,OAAc,OAAY,SAA6B;GACvE,MAAM,cAAc;IAAE;IAAO;IAAO;GAAK;GAEzC,aAAa,KAAK,WAAW;GAE7B,OAAO;EACT;EAEA,MAAM,kBAAkB,cACtB,SACG,OAAO,EACN,OAAO,GAAG,aAAa,UAAU,oBAAoB,QAAQ,MAAM,CAAC,CAAC,GAAG,OAAO,EACjF,CAAC,CAAC,CACD,KAAK,GAAG,2BAA2B;EAExC,MAAM,kBAAkB,cACtB,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,eAAe,SAAS;GAEtC,MAAM,OAA2B,OAAO,cAAc,YAAY,WAC9D,YAAY,KAAK,IAChB;GAEL,MAAM,MAAM,KAAK;GAEjB,UAAU,KAAK,WAAW,KAAK,QAAQ,KAAA,CAAS;GAIhD,OAAO,OAAO,OAAO,GAAG,CAAC,CAAC,OAAO;EACnC,CAAC;EAEH,MAAM,gBAAgB,OAAc,OAAY,QAAa,UAAyB;GACpF,UAAU,OAAO,cAAc,MAAM,IAAI,KAAK,MAAM,OAAO,KAAK,MAAM,QAAQ,GAAG;GAEjF,OAAO;IAAE,OAAO,SAAS,OAAO,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,KAAK;IAAG,OAAO,EAAE,GAAG,MAAM;GAAE;EACvF;EAEA,MAAM,gBAAgB,UACpB,OAAO,IAAI,aAAa;GACtB,IAAI,cAAc,OAAO;IACvB,WAAW,KAAK,YAAY,MAAM,KAAK,CAAC;IACxC,WAAW,KAAK,YAAY,UAAU,GAAG,eAAe,MAAM,MAAM,MAAM,CAAC,CAAC;IAC5E,iBAAiB,CAAC,MAAM,MAAM,aAAa,CAAC;GAC9C,OAAO;IACL,IAAI,cAAc,OAAO;KAEvB,MAAM,UAAU,OAAO,MAAM;KAE7B,UAAU,QAAQ,iBAAiB,MAAM,MAAM,IAAI;IACrD,OAAO;KACL,MAAM,UAAU,OAAO,MAAM,MAAM,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;KAI9D,UAAU,QAAQ,WAAW,MAAM,MAAM,IAAI;IAC/C;IACA,UAAU,OAAO,eAAe,MAAM,MAAM,aAAa,CAAC;GAC5D;EACF,CAAC;EAEH,MAAM,QAAmC;GACvC;GACA;GACA;GACA,OAAO,cAAc;GACrB;GACA;GACA;GACA;GACA,OAAO;GACP,OAAO,OAAO,OAAO,UAAU,CAAC,MAC9B,OACE,OAAO,IAAI,aAAa;IACtB,KAAK;IACL,MAAM,QAAQ,QAAQ,SAAS;IAE/B,IAAI,QAAQ,SACT,OACC,QAAQ,YAAY,KAAA,IAChB,KAAA,IACA,OAAO,YAAY,QAAQ,QAAQ,KAAK,QAAQ,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,CAC7E,CAAC,CACA,KAAK,KAAK,CAAC,CACX,MAAM,KAAK,CAAC,CACZ,MAAM,QAAQ,WAAW,QAAQ,QAAQ,CAAC;IAE7C,IAAI,QAAQ,YAAY,KAAA,GAAW,QAAQ,MAAM,QAAQ,QAAQ,OAAO;IACxE,IAAI,QAAQ,SAAS,SAAS,cAAc,SAAS,QAAQ,MAAM,IAAI,QAAQ;IAC/E,MAAM,OAAc,OAAO;IAE3B,UAAU,KAAK,UAAU,KAAK;IAC9B,IAAI,cAAc,UAAU,QAAQ,YAAY,SAAS,QAAQ,gBAC/D,iBAAiB,mBAAmB,OAAO,OAAO,IAAI,CAAC;IAEzD,OAAO,QAAQ,YAAY,SAAS,QAAQ,gBACxC;KAAE;KAAO;KAAO;IAAK,IACrB,SAAS,OAAO,OAAO,IAAI;GACjC,CAAC,CACH;GACF,QAAQ,UACN,OACE,OAAO,IAAI,aAAa;IACtB,KAAK;IACL,IAAI,cAAc,OAAO,WAAW,KAAK,YAAY,KAAK,CAAC;SACtD,OAAO;GACd,CAAC,CACH;GACF,SAAS,OAAO,QAAQ,KAAK,SAAS,UACpC,OACE,OAAO,IAAI,aAAa;IACtB,KAAK;IACL,IAAI,QAAQ,SAAS,OAAO,KAAK,CAAC,CAAC,OAAO,MAAM;IAEhD,IAAI,QACF,QAAQ,cAAc,QAClB,MAAM,qBAAqB,EACzB,KAAK,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,KAAM,IAAI,OAAO,OAAO,KAAK,GAAG,CAAC,CAAC,EAAG,EAAE,EAClE,CAAC,IACD,MAAM,oBAAoB;IAChC,OAAO,MAAM,MAAM,KAAK;IACxB,MAAM,QAAQ,MAAM,OAAO,GAAG;IAE9B,IAAI,cAAc,OAAO,OAAO,SAAS,OAAO,OAAO,CAAC,MAAM,CAAC;IAC/D,MAAM,QAAQ,OAAO,MAAM,KAAK,OAAO,OAAO,EAAE,OAAO,EAAE,CAAC;IAC1D,MAAM,eAAe,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,QAAQ,OAAO,SAAS,MAAM;IAE7E,IAAI,CAAC,UAAW,iBAAiB,KAAA,KAAa,MAAM,KAAK,EAAE,GAAG,kBAAkB,QAC9E,UACE,OAAO,MAAM,MACX,GAAG,wBAAwB,MAAM,SAAS,KAAK,OAAO,SAAS,OAAO,MAAM,CAAC,EAAE,EACjF,CACF;IAEF,OAAO;GACT,CAAC,CACH;GACF,SAAS,OAAO,KAAK,WACnB,OACE,OAAO,IAAI,aAAa;IACtB,KAAK;IACL,OAAO,MAAM,MAAM,SAAS,OAAO,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC;IAC9E,KAAK,MAAM,eAAe,cACxB,IAAI,YAAY,UAAU,OACxB,YAAY,OAAO,YAAY,KAAK,KAAK,QACvC,iBAAiB,OAAO,KAAK,GAAG,IAAI;KAAE,GAAG;KAAK,GAAG;IAAO,IAAI,GAC9D;GACN,CAAC,CACH;GACF,gBAAgB,OAAO,OAAO,QAAQ,UACpC,OACE,OAAO,IAAI,aAAa;IACtB,KAAK;IACL,MAAM,QAAQ,aAAa,OAAO,OAAO,QAAQ,KAAK;IAEtD,OAAO,aAAa,KAAK;IACzB,eAAe,KAAK,MAAM,MAAM,aAAa;GAC/C,CAAC,CACH;GACF,cAAc,OAAO,OAAO,QAAQ,UAClC,OACE,OAAO,WAAW;IAChB,KAAK;IACL,UAAU,aAAa,SAAS,GAAG;IACnC,aAAa,KAAK,aAAa,OAAO,OAAO,QAAQ,KAAK,CAAC;GAC7D,CAAC,CACH;GACF,SAAS,OAAO,QACd,OACE,OAAO,IAAI,aAAa;IACtB,KAAK;IACL,OAAO,MAAM,MAAM,SAAS,OAAO,KAAK,CAAC,CAAC,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC;IAClE,KAAK,MAAM,eAAe,cACxB,IAAI,YAAY,UAAU,OACxB,YAAY,OAAO,YAAY,KAAK,QACjC,QAAQ,CAAC,iBAAiB,OAAO,KAAK,GAAG,CAC5C;GACN,CAAC,CACH;GACF,QAAQ,cACN,OACE,OAAO,IAAI,aAAa;IACtB,KAAK;IACL,MAAM,QAAQ,OAAO,eAAe,SAAS;IAE7C,IAAI,cAAc,OAChB,WAAW,KAAK,YAAY,UAAU,QAAQ,YAAY,GAAG,QAAQ,UAAU,EAAE,CAAC,CAAC;IAErF,OAAO;GACT,CAAC,CACH;GACF,MAAM,UACJ,OACE,OAAO,IAAI,aAAa;IACtB,KAAK;IAQL,MAAM,SAAQ,OANa,SACxB,OAAO,EACN,OAAO,GAAG,GAAG,MAAM,kBAAkB,QAAQ,MAAM,EACrD,CAAC,CAAC,CACD,KAAK,GAAG,2BAA2B,EAAA,CAEnB,EAAE,EAAE;IAEvB,UAAU,OAAO,cAAc,KAAK,KAAK,SAAS,CAAC;IAEnD,OAAO;GACT,CAAC,CACH;GACF,cACE,OACE,OAAO,IAAI,aAAa;IACtB,KAAK;IACL,QAAQ;IACR,OAAO,OAAO,YAAY;IAC1B,OAAO,OAAO,cAAc;IAC5B,OAAO,OAAO,MAAM;IACpB,OAAO,OAAO,YAAY;IAI1B,MAAM,aAAoB,aAAa,SAAS,gBAC9C,mBAAmB,YAAY,OAAO,YAAY,OAAO,YAAY,IAAI,CAC3E;IAEA,WAAW,KACT,GAAG,eAAe,KAAK,cACrB,OAAO,cAAc,aAAa,UAAU,IAAI,SAClD,CACF;IACA,WAAW,KAAK,GAAG,aAAa,KAAK,UAAU,MAAM,MAAM,aAAa,CAAC;IACzE,KAAK,MAAM,SAAS,QAAQ;KAC1B,MAAM,SAAS,OAAO,OAAO,OAAO,MAAM,IAAI;KAE9C,UAAU,OAAO,SAAS,aAAa,OAAO,QAAQ,SAAS,eAAe;IAChF;IACA,UAAU,CAAC,QAAQ;IACnB,KAAK,MAAM,SAAS,cAAc,OAAO,aAAa,KAAK;IAC3D,IAAI,cAAc,OAAO,iBAAiB,UAAU;SAElD,KAAK,MAAM,aAAa,OAAO,UAAU,GACvC,UAAU,OAAO,eAAe,SAAS,CAAC;IAC9C,UAAU,CAAC,QAAQ;GACrB,CAAC,CAAC,CAAC,KACD,OAAO,SACL,OAAO,WAAW;IAChB,QAAQ;GACV,CAAC,CACH,CACF,CACF;EACJ;EAEA,OAAO;CACT;CAEA,OAAO;EAAE;EAA0B;EAAM;EAAqB;CAAqB;AACrF"}

package/src/internal/PasswordPreparedPostconditions.ts

@@ -1,30 +0,0 @@
-import type { PreparedCommit } from "@yielded/auth/Hooks";
-import type { PasswordUnavailable } from "@yielded/auth/Password";
-import type { ProofUnavailable } from "@yielded/auth/Proofs";
-import { Context, type Effect } from "effect";
-
-import type { PasswordSqlDatabase } from "./password-kernel";
-
-/** Final reads resolve the current physical owner, never a released savepoint. */
-export class CurrentPasswordPreparedTransaction extends Context.Service<
-  CurrentPasswordPreparedTransaction,
-  PasswordSqlDatabase
->()("effect-auth/drizzle/CurrentPasswordPreparedTransaction") {}
-
-export type PasswordPreparedPostcondition = Effect.Effect<
-  void,
-  PasswordUnavailable | ProofUnavailable,
-  CurrentPasswordPreparedTransaction
->;
-
-/** Registration ends when the application owner returns, before final validation. */
-export class PasswordPreparedPostconditions extends Context.Service<
-  PasswordPreparedPostconditions,
-  { readonly register: (check: PasswordPreparedPostcondition) => boolean }
->()("effect-auth/drizzle/PasswordPreparedPostconditions") {}
-
-/** Journal registration closes with the prepared-password owner callback. */
-export class PasswordPreparedJournalGuards extends Context.Service<
-  PasswordPreparedJournalGuards,
-  { readonly register: (guard: PreparedCommit<void>) => boolean }
->()("effect-auth/drizzle/PasswordPreparedJournalGuards") {}

package/src/internal/authority-snapshot.ts

@@ -1,91 +0,0 @@
-import type { SubjectId } from "@yielded/auth/Schema";
-import { AuthenticationRevision, StaleAuthentication } from "@yielded/auth/Sessions";
-import { Effect, Schema } from "effect";
-
-import type { SessionAuthorityTables } from "./models/session-model";
-import { sqlMapping, type NativeSqlTables } from "./native-sql-table";
-import type { AnyTableModel } from "./query-operations";
-import { NativeDatabase } from "./transaction-kernel";
-
-/** One unlocked statement reads the subject and requested credentials: a coherent
- * preflight view, or a commit owner's view where writers are already serialized.
- * Row-locking commit owners lock and revalidate through their ordered reads.
- */
-export const makeAuthoritySnapshot = (
-  tables: NativeSqlTables,
-  mapping: SessionAuthorityTables<AnyTableModel, AnyTableModel, unknown>,
-) =>
-  Effect.fnUntraced(function* (subjectId: SubjectId, credentialIds: ReadonlyArray<string>) {
-    const sql = (yield* NativeDatabase).$client.withoutTransforms();
-
-    if (new Set(credentialIds).size !== credentialIds.length)
-      return yield* StaleAuthentication.make({});
-
-    const { s, c } = yield* sqlMapping(() => ({
-      s: tables(mapping.subject.table).as("auth_subject"),
-      c: tables(mapping.credential.table).as("auth_credential"),
-    }));
-
-    const nativeId = yield* sqlMapping(() => mapping.subjectId.toNative(subjectId)).pipe(
-      Effect.flatten,
-    );
-
-    const requested = [...credentialIds].sort((a, b) => a.localeCompare(b));
-
-    const rows = yield* sqlMapping(
-      () => sql<Record<string, unknown>>`select ${s.fields("s_")}
-      ${requested.length === 0 ? sql.literal("") : sql`, ${c.fields("c_")}`}
-      from ${s.name}
-      ${
-        requested.length === 0
-          ? sql.literal("")
-          : sql`inner join ${c.name} on
-        ${c.column(mapping.credential.subjectId)} = ${c.value(mapping.credential.subjectId, nativeId)}
-        and ${sql.or(requested.map((id) => sql`${c.column(mapping.credential.credentialId)} = ${c.value(mapping.credential.credentialId, id)}`))}`
-      }
-      where ${s.column(mapping.subject.id)} = ${s.value(mapping.subject.id, nativeId)}`,
-    ).pipe(Effect.flatten);
-
-    const first = rows[0];
-
-    if (first === undefined || rows.length !== Math.max(1, requested.length))
-      return yield* StaleAuthentication.make({});
-
-    const subject = yield* sqlMapping(() => s.decode(first, "s_"));
-
-    if (!(yield* sqlMapping(() => mapping.subject.isActiveStatus(subject[mapping.subject.status]))))
-      return yield* StaleAuthentication.make({});
-
-    const credentials = yield* sqlMapping(() =>
-      requested.length === 0 ? [] : rows.map((row) => c.decode(row, "c_")),
-    );
-
-    if (
-      yield* sqlMapping(() =>
-        credentials.some(
-          (row) =>
-            mapping.credential.status !== undefined &&
-            mapping.credential.isActiveStatus?.(row[mapping.credential.status]) !== true,
-        ),
-      )
-    )
-      return yield* StaleAuthentication.make({});
-
-    const revision = yield* Schema.decodeUnknownEffect(AuthenticationRevision)({
-      subjectId,
-      securityRevision: subject[mapping.subject.securityRevision],
-      credentials: credentials.map((row) => ({
-        credentialId: row[mapping.credential.credentialId],
-        revision: row[mapping.credential.revision],
-      })),
-    });
-
-    const sorted = [...revision.credentials].sort((a, b) =>
-      a.credentialId.localeCompare(b.credentialId),
-    );
-
-    if (sorted.some((item, index) => item.credentialId !== requested[index]))
-      return yield* StaleAuthentication.make({});
-
-    return { subject, revision: { ...revision, credentials: sorted } };
-  });