@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/src/internal/storage-plans.ts

@@ -3,10 +3,6 @@ import { Predicate, Schema } from "effect";
 // These are mapping contracts, not a parser for arbitrary constraint declarations.
 // Role aliases are explicit because their documentation names differ from mapping fields.
 const uniquePlans: Readonly<Record<string, readonly [string, ReadonlyArray<string>]>> = {
-  "unique(abuseEvent.moduleId,abuseEvent.action,abuseEvent.scopeKind,abuseEvent.scopeKey,abuseEvent.commandId)":
-    ["abuseEvent", ["moduleId", "action", "scopeKind", "scopeKey", "commandId"]],
-  "unique(admission.moduleId)": ["admission", ["moduleId"]],
-  "unique(attempt.moduleId,attempt.attemptId)": ["attempt", ["moduleId", "attemptId"]],
   "unique(authority.subjectId,authority.credentialId)": [
     "authority",
     ["subjectId", "credentialId"],
@@ -15,26 +11,10 @@ const uniquePlans: Readonly<Record<string, readonly [string, ReadonlyArray<strin
     "authorityCredential",
     ["subjectId", "credentialId"],
   ],
-  "unique(command.moduleId,command.commandId)": ["command", ["moduleId", "commandId"]],
-  "unique(connectedAdmission.admissionId)": ["admission", ["admissionId"]],
-  "unique(connectedClient.clientKey)": ["client", ["clientKey"]],
-  "unique(connectedCohort.cohortKey)": ["cohort", ["cohortKey"]],
-  "unique(connectedCommand.moduleId,connectedCommand.commandId)": [
-    "command",
-    ["moduleId", "commandId"],
-  ],
-  "unique(connectedFlow.moduleId,connectedFlow.commandId)": ["flow", ["moduleId", "commandId"]],
-  "unique(connectedFlow.moduleId,connectedFlow.flowId)": ["flow", ["moduleId", "flowId"]],
-  "unique(connectedFlow.stateDigest)": ["flow", ["stateDigest"]],
   "unique(connectedGrant.moduleId,connectedGrant.grantId)": ["grant", ["moduleId", "grantId"]],
-  "unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.activeIdentityKey)":
-    ["grant", ["moduleId", "subjectId", "profileKey", "activeIdentityKey"]],
+  "unique(connectedGrant.moduleId,connectedGrant.subjectId,connectedGrant.profileKey,connectedGrant.identityKey)":
+    ["grant", ["moduleId", "subjectId", "profileKey", "identityKey"]],
   "unique(connectedRevocation.jobId)": ["job", ["jobId"]],
-  "unique(continuation.moduleId,continuation.continuationId)": [
-    "continuation",
-    ["moduleId", "continuationId"],
-  ],
-  "unique(continuation.moduleId,continuation.digest)": ["continuation", ["moduleId", "digest"]],
   "unique(credential.credentialId)": ["credential", ["credentialId"]],
   "unique(credential.identityKey)": ["credential", ["identityKey"]],
   "unique(credential.moduleId,credential.credentialId)": [
@@ -42,73 +22,36 @@ const uniquePlans: Readonly<Record<string, readonly [string, ReadonlyArray<strin
     ["moduleId", "credentialId"],
   ],
   "unique(credential.moduleId,credential.subjectId)": ["credential", ["moduleId", "subjectId"]],
-  "unique(emailCommand.moduleId,emailCommand.commandId)": ["command", ["moduleId", "commandId"]],
   "unique(emailCredential.moduleId,emailCredential.credentialId)": [
     "credential",
     ["moduleId", "credentialId"],
   ],
   "unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)":
     ["credential", ["moduleId", "identifierNamespace", "identifierValue"]],
-  "unique(emailRegistration.moduleId,emailRegistration.commandId)": [
-    "registration",
-    ["moduleId", "commandId"],
-  ],
-  "unique(emailRegistration.pendingReference)": ["registration", ["pendingReference"]],
-  "unique(failureEvent.moduleId,failureEvent.seriesKey,failureEvent.commandId)": [
-    "failureEvent",
-    ["moduleId", "seriesKey", "commandId"],
-  ],
-  "unique(flow.flowId)": ["flow", ["flowId"]],
-  "unique(flow.moduleId,flow.commandId)": ["flow", ["moduleId", "commandId"]],
   "unique(flow.moduleId,flow.flowId)": ["flow", ["moduleId", "flowId"]],
   "unique(flow.stateDigest)": ["flow", ["stateDigest"]],
-  "unique(generation.moduleId,generation.deliveryId)": ["generation", ["moduleId", "deliveryId"]],
-  "unique(generation.moduleId,generation.proofId)": ["generation", ["moduleId", "proofId"]],
   "unique(identifier.namespace,identifier.value)": ["identifier", ["namespace", "value"]],
-  "unique(intent.digest)": ["intent", ["digest"]],
-  "unique(intent.flowId)": ["intent", ["flowId"]],
-  "unique(intent.moduleId,intent.commandId)": ["intent", ["moduleId", "commandId"]],
   "unique(intent.moduleId,intent.flowId)": ["intent", ["moduleId", "flowId"]],
-  "unique(intent.moduleId,intent.intentId)": ["intent", ["moduleId", "intentId"]],
   "unique(intent.moduleId,intent.reference)": ["intent", ["moduleId", "reference"]],
   "unique(ownership.identityKey)": ["ownership", ["identityKey"]],
-  "unique(pending.digest)": ["pending", ["digest"]],
-  "unique(pending.flowId)": ["pending", ["flowId"]],
-  "unique(rateScope.moduleId,rateScope.purpose,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)":
-    ["rateScope", ["moduleId", "purpose", "action", "scopeKind", "scopeKey"]],
-  "unique(registration.moduleId,registration.requestId)": [
-    "registration",
-    ["moduleId", "requestId"],
-  ],
-  "unique(registration.recoveryReference)": ["registration", ["recoveryReference"]],
-  "unique(registrationCommand.moduleId,registrationCommand.commandId)": [
-    "command",
-    ["moduleId", "commandId"],
-  ],
-  "unique(request.moduleId,request.requestId)": ["request", ["moduleId", "requestId"]],
-  "unique(series.moduleId,series.purpose,series.scopeKey)": [
-    "series",
-    ["moduleId", "purpose", "scopeKey"],
+  "unique(proof.moduleId,proof.purpose,proof.seriesKey)": [
+    "proof",
+    ["moduleId", "purpose", "seriesKey"],
   ],
+  "unique(proof.moduleId,proof.proofId)": ["proof", ["moduleId", "proofId"]],
+  "unique(pending.digest)": ["pending", ["digest"]],
   "unique(session.digest)": ["session", ["digest"]],
-  "unique(tombstone.subjectId,tombstone.sessionId)": ["tombstone", ["subjectId", "sessionId"]],
-  "unique(tuple.identityKey)": ["ownership.tuple", ["identityKey"]],
-  "unique(unlinkCommand.moduleId,unlinkCommand.commandId)": ["command", ["moduleId", "commandId"]],
+  "unique(tombstone.moduleId,tombstone.subjectId,tombstone.sessionId)": [
+    "tombstone",
+    ["moduleId", "subjectId", "sessionId"],
+  ],
 };
 
 const arrayRoles: Readonly<Record<string, string>> = {
   credentialId: "credential",
+  credentialKey: "credential",
   factor: "authority",
-  credentialOwnership: "credentialOwnership",
-  handleOwnership: "handleOwnership",
-  boundSubjectHandle: "handleOwnership",
   flow: "flow",
-  command: "flow",
-  admission: "admission",
-  charge: "charge",
-  intentFlow: "intent",
-  intentCommand: "intent",
-  handle: "handle",
 };
 
 const nestedMappings = [
@@ -123,12 +66,7 @@ const nestedMappings = [
   "source",
 ];
 
-const constraintGroups = [
-  "constraints",
-  "tupleConstraints",
-  "registrationConstraints",
-  "managementConstraints",
-];
+const constraintGroups = ["constraints"];
 
 const MappingRecord = Schema.Record(Schema.String, Schema.Unknown);
 const record = Schema.decodeUnknownSync(MappingRecord);
@@ -171,8 +109,7 @@ export const storageKeyPlans = (
           keys = ["requestId"];
         } else throw new Error("Unknown storage constraint");
       } else if (Array.isArray(declaration) && declaration.every(Predicate.isString)) {
-        const mappedRole =
-          group === "managementConstraints" && name === "command" ? "command" : arrayRoles[name];
+        const mappedRole = arrayRoles[name];
 
         if (mappedRole === undefined) throw new Error("Unknown storage constraint");
         role = mappedRole;
@@ -188,9 +125,6 @@ export const storageKeyPlans = (
       let mapped = record(target);
 
       if (role === "pending" && mapped.table === undefined) mapped = record(mapped.pending);
-      // OAuth ownership can be integrated into its tuple authority or separate.
-      if (role === "ownership" && mapped.table === undefined)
-        mapped = record(mapped.external ?? mapped.tuple);
       if (!Predicate.isObject(mapped.table)) throw new Error("Missing storage table");
       const columns = columnsFor(mapped.table);
 

package/src/internal/storage-tables.ts

@@ -1,15 +1,16 @@
 import { Schema } from "effect";
 
-export const StorageColumn = Schema.Struct({
-  name: Schema.NonEmptyString,
-  type: Schema.Literals(["text", "integer", "boolean"]),
-  nullable: Schema.optionalKey(Schema.Boolean),
-});
-
 export const StorageTable = Schema.Struct({
   name: Schema.NonEmptyString,
   schema: Schema.optionalKey(Schema.NonEmptyString),
-  columns: Schema.Record(Schema.String, StorageColumn),
+  columns: Schema.Record(
+    Schema.String,
+    Schema.Struct({
+      name: Schema.NonEmptyString,
+      type: Schema.Literals(["text", "integer", "boolean"]),
+      nullable: Schema.optionalKey(Schema.Boolean),
+    }),
+  ),
   unique: Schema.Array(Schema.Array(Schema.String)),
 });
 
@@ -21,7 +22,7 @@ const boolean = { type: "boolean" as const };
 const optionalText = { ...text, nullable: true };
 const optionalInteger = { ...integer, nullable: true };
 
-const spec = <C extends Readonly<Record<string, Omit<typeof StorageColumn.Type, "name">>>>(
+const spec = <C extends Readonly<Record<string, Omit<StorageTable["columns"][string], "name">>>>(
   columns: C,
   unique: ReadonlyArray<ReadonlyArray<Extract<keyof C, string>>>,
 ) => ({ columns, unique });
@@ -33,6 +34,8 @@ export const storageTables = {
     {
       namespace: text,
       value: text,
+      moduleId: optionalText,
+      credentialId: optionalText,
       subjectId: text,
       revision: text,
       verifiedAt: optionalInteger,
@@ -58,18 +61,6 @@ export const storageTables = {
       ["moduleId", "credentialId"],
     ],
   ),
-  passwordCommands: spec(
-    {
-      moduleId: text,
-      commandId: text,
-      action: text,
-      bindingDigest: text,
-      decision: text,
-      retentionUntil: integer,
-    },
-    [["moduleId", "commandId"]],
-  ),
-  passwordRegistrations: spec({ moduleId: text, requestId: text }, [["moduleId", "requestId"]]),
   emailCredentials: spec(
     {
       moduleId: text,
@@ -85,11 +76,6 @@ export const storageTables = {
       ["moduleId", "identifierNamespace", "identifierValue"],
     ],
   ),
-  emailCommands: spec(
-    { moduleId: text, commandId: text, action: text, bindingDigest: text, retentionUntil: integer },
-    [["moduleId", "commandId"]],
-  ),
-  phoneState: spec({ scope: text, state: text, version: text }, [["scope"]]),
   passkeyCredentials: spec(
     {
       credentialId: text,
@@ -97,7 +83,6 @@ export const storageTables = {
       rpId: text,
       protocolCredentialId: text,
       credentialKey: text,
-      handleKey: text,
       userHandle: text,
       publicKey: text,
       algorithm: integer,
@@ -109,224 +94,48 @@ export const storageTables = {
       backupEligible: boolean,
       backupState: boolean,
       counter: integer,
-      maximumCounter: integer,
       name: text,
       createdAt: integer,
       lastUsedAt: optionalInteger,
     },
     [["credentialId"], ["credentialKey"]],
   ),
-  passkeyOwnership: spec(
-    {
-      credentialKey: text,
-      rpId: text,
-      protocolCredentialId: text,
-      subjectId: optionalText,
-      credentialId: optionalText,
-      state: text,
-      version: text,
-      reservationId: optionalText,
-    },
-    [["credentialKey"]],
-  ),
-  passkeyHandles: spec(
-    {
-      handleKey: text,
-      rpId: text,
-      userHandle: text,
-      subjectId: optionalText,
-      state: text,
-      version: text,
-      reservationId: optionalText,
-    },
-    [["handleKey"], ["rpId", "subjectId"]],
-  ),
-  passkeyModules: spec(
-    {
-      moduleId: text,
-      active: boolean,
-      policyRevision: text,
-      policy: text,
-    },
-    [["moduleId"]],
-  ),
   passkeyFlows: spec(
     {
       moduleId: text,
       flowId: text,
-      commandId: text,
       purpose: text,
-      state: text,
-      version: text,
-      generation: integer,
       snapshot: text,
-      policySnapshot: text,
       requestBindingVerifier: text,
       requestBindingExpiresAt: integer,
       issuedAt: integer,
       expiresAt: integer,
-      retentionUntil: integer,
-      claimId: optionalText,
-      claimedAt: optionalInteger,
-      claimExpiresAt: optionalInteger,
-      credentialSnapshot: optionalText,
-      subjectScope: optionalText,
-      targetScope: optionalText,
     },
-    [
-      ["moduleId", "flowId"],
-      ["moduleId", "commandId"],
-    ],
+    [["moduleId", "flowId"]],
   ),
-  passkeyAdmissions: spec(
+  proofs: spec(
     {
-      authorityScope: text,
       moduleId: text,
-      version: text,
-      ownerMarker: text,
-      admittedAt: optionalInteger,
-    },
-    [["authorityScope", "moduleId"]],
-  ),
-  passkeyCharges: spec(
-    {
-      moduleId: text,
-      flowId: text,
       purpose: text,
-      kind: text,
-      scope: text,
-      originalWindowMillis: integer,
-      admittedAt: optionalInteger,
-      retainUntil: optionalInteger,
-      version: text,
-      ownerMarker: text,
-    },
-    [["moduleId", "flowId", "kind"]],
-  ),
-  passkeyCommands: spec(
-    {
-      moduleId: text,
-      commandId: text,
-      subjectId: text,
-      credentialId: text,
-      intent: text,
-      decision: text,
-      retentionUntil: integer,
-      version: text,
-    },
-    [["moduleId", "commandId"]],
-  ),
-  proofRequests: spec(
-    {
-      moduleId: text,
-      requestId: text,
-      fingerprint: text,
-      proofId: text,
-      purpose: text,
-      keyId: text,
-      createdAt: integer,
-      retentionUntil: integer,
-      receipt: text,
-    },
-    [["moduleId", "requestId"]],
-  ),
-  proofSeries: spec(
-    {
-      moduleId: text,
-      purpose: text,
-      scopeKey: text,
-      activeProofId: optionalText,
-      lastIssueAt: optionalInteger,
-      version: text,
-    },
-    [["moduleId", "purpose", "scopeKey"]],
-  ),
-  proofGenerations: spec(
-    {
-      moduleId: text,
-      purpose: text,
-      proofId: text,
-      requestId: text,
       seriesKey: text,
-      deliveryId: text,
+      proofId: text,
       binding: text,
       verifierKeyId: text,
       verifierDigest: text,
       issuedAt: integer,
       expiresAt: integer,
-      version: text,
-      state: text,
-      sendCount: integer,
-      deliveryState: text,
-      claimVersion: optionalText,
-      claimDeadline: optionalInteger,
-      retryAt: optionalInteger,
-      deliveryRetryMillis: integer,
-      retentionUntil: integer,
-      fingerprint: text,
+      failedAttempts: integer,
     },
     [
+      ["moduleId", "purpose", "seriesKey"],
       ["moduleId", "proofId"],
-      ["moduleId", "deliveryId"],
-    ],
-  ),
-  proofContinuations: spec(
-    {
-      moduleId: text,
-      purpose: text,
-      continuationId: text,
-      digest: text,
-      proofId: text,
-      seriesKey: text,
-      binding: text,
-      expiresAt: integer,
-      consumed: boolean,
-      version: text,
-      retentionUntil: integer,
-    },
-    [
-      ["moduleId", "continuationId"],
-      ["moduleId", "digest"],
     ],
   ),
-  proofScopes: spec(
-    { moduleId: text, purpose: text, action: text, scopeKind: text, scopeKey: text },
-    [["moduleId", "purpose", "action", "scopeKind", "scopeKey"]],
-  ),
-  proofAbuse: spec(
-    {
-      moduleId: text,
-      purpose: text,
-      action: text,
-      scopeKind: text,
-      scopeKey: text,
-      commandId: text,
-      occurredAt: integer,
-      retentionUntil: integer,
-    },
-    [["moduleId", "action", "scopeKind", "scopeKey", "commandId"]],
-  ),
-  proofFailures: spec(
-    {
-      moduleId: text,
-      purpose: text,
-      seriesKey: text,
-      commandId: text,
-      occurredAt: integer,
-      retentionUntil: integer,
-    },
-    [["moduleId", "seriesKey", "commandId"]],
-  ),
-  proofCommands: spec(
-    { moduleId: text, commandId: text, kind: text, decision: text, retentionUntil: integer },
-    [["moduleId", "commandId"]],
-  ),
   sessions: spec(
     {
       sessionId: text,
       subjectId: text,
       digest: text,
-      version: text,
       securityRevision: text,
       issuedAt: integer,
       expiresAt: integer,
@@ -335,15 +144,22 @@ export const storageTables = {
     },
     [["sessionId"], ["digest"]],
   ),
-  sessionFlows: spec(
+  pending: spec(
     {
+      moduleId: text,
+      kind: text,
+      digest: text,
+      version: text,
       flowId: text,
       subjectId: text,
-      state: text,
-      pendingDigest: optionalText,
-      dedupUntil: integer,
+      bindingDigest: text,
+      snapshot: text,
+      expiresAt: integer,
+      attemptLimit: integer,
+      failedAttempts: integer,
+      consumed: boolean,
     },
-    [["flowId"]],
+    [["digest"]],
   ),
 } as const;
 

package/src/internal/storage-validation.ts

@@ -3,7 +3,6 @@ import { SqlClient } from "effect/sql/SqlClient";
 
 import { PersistenceConfigurationError } from "./configuration";
 import type { StorageTable } from "./storage-tables";
-import { NativeDatabase } from "./transaction-kernel";
 
 const Columns = Schema.Array(Schema.String);
 const Keys = Schema.Array(Columns);
@@ -41,63 +40,6 @@ export interface PhysicalStorageTable {
 export const qualifiedTableName = (table: Pick<StorageTable, "name" | "schema">) =>
   (table.schema === undefined ? "" : quote(table.schema) + ".") + quote(table.name);
 
-export interface PhysicalTextColumn {
-  readonly table: Pick<PhysicalStorageTable, "name" | "schema">;
-  readonly name: string;
-}
-
-const TextColumns = Schema.Array(Schema.Struct({ type: Schema.String, collation: Schema.String }));
-
-/** One acquisition-only read: presence/unique-key validation does not establish
- * equality compatibility. SQLite's pragma omits column collations, so only
- * ordinary TEXT tables with no COLLATE declaration qualify (default BINARY). */
-export const canJoinTextColumns = Effect.fnUntraced(function* (
-  left: PhysicalTextColumn | undefined,
-  right: PhysicalTextColumn | undefined,
-) {
-  if (left === undefined || right === undefined) return false;
-  const { $client } = yield* NativeDatabase;
-  const client = $client.withoutTransforms();
-  const columns = [left, right];
-
-  if (
-    client.onDialectOrElse({ sqlite: () => true, orElse: () => false }) &&
-    columns.some((c) => c.table.schema !== undefined && c.table.schema !== "main")
-  )
-    return false;
-
-  const query = client.onDialectOrElse({
-    pg: () => client`
-      select a.atttypid::text as type, a.attcollation::text as collation
-      from (values ${client.join(", ", false)(columns.map((c) => client`(${qualifiedTableName(c.table)}::text, ${c.name}::text)`))}) requested(relation, name)
-      join pg_attribute a on a.attrelid = to_regclass(requested.relation)
-        and a.attname = requested.name and a.attnum > 0 and not a.attisdropped
-      where a.atttypid in ('text'::regtype, 'varchar'::regtype)`,
-    sqlite: () => client`
-      with requested(relation, name) as (values ${client.join(", ", false)(columns.map((c) => client`(${c.table.name}, ${c.name})`))})
-      select 'text' as type, 'BINARY' as collation from requested
-      join sqlite_schema s on s.name = requested.relation and s.type = 'table'
-      join pragma_table_info(requested.relation) c on c.name = requested.name
-      where upper(c.type) = 'TEXT' and instr(lower(s.sql), 'collate') = 0`,
-    mysql: () => client`
-      select c.data_type as type, c.collation_name as collation
-      from (${client.join(" union all ", false)(columns.map((c) => client`select ${c.table.schema ?? null} as schema_name, ${c.table.name} as table_name, ${c.name} as column_name`))}) requested
-      join information_schema.columns c
-        on c.table_schema = coalesce(requested.schema_name, database())
-        and c.table_name = requested.table_name and c.column_name = requested.column_name
-      where c.data_type in ('varchar', 'text', 'tinytext', 'mediumtext', 'longtext')`,
-    orElse: () => Effect.succeed([]),
-  });
-
-  const rows = yield* query.pipe(Effect.flatMap(Schema.decodeUnknownEffect(TextColumns)));
-
-  return (
-    rows.length === 2 &&
-    rows[0]?.type === rows[1]?.type &&
-    rows[0]?.collation === rows[1]?.collation
-  );
-});
-
 const validateKeys = Effect.fnUntraced(function* (
   table: PhysicalStorageTable,
   required: ReadonlyArray<ReadonlyArray<string>>,

package/src/internal/table-model.ts

@@ -0,0 +1,24 @@
+import type { Fragment } from "effect/sql/Statement";
+
+import type { SqlExpression as DirectSqlExpression } from "./sql-expression";
+
+/** Adapter-owned table metadata. No driver or ORM type enters the shared models. */
+export interface TableModel {
+  readonly table: object;
+  readonly column: string;
+  readonly select: Record<string, unknown>;
+  readonly insert: Record<string, unknown>;
+}
+
+/** The owning adapter validates the physical table metadata; domain values
+ * remain subject to the mapping codecs. */
+export interface AnyTableModel extends TableModel {
+  // oxlint-disable-next-line no-explicit-any -- native table handle, never a domain value or an Effect error.
+  readonly table: any;
+}
+
+/** Opaque native SQL expression for explicit adapter mappings. */
+export type SqlExpression =
+  | Fragment
+  | DirectSqlExpression
+  | { readonly getSQL: () => SqlExpression };