@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/internal/models/passkey-write-model.d.mts

@@ -1,13 +1,12 @@
+import { SqlExpression, TableModel } from "../table-model.mjs";
 import { PersistenceMappingError } from "../mapping-error.mjs";
-import { SqlExpression, TableModel } from "../query-operations.mjs";
 import "./common.mjs";
-import { PasskeyColumn, PasskeyCredentialMapping, PasskeyFlowTable, PasskeyHandleReservationTable, PasskeyPersistenceMapping, PasskeyPersistenceServices } from "./passkey-model.mjs";
-import { PasskeyRegistrationIntentReadTable } from "./passkey-registration-ceremony-model.mjs";
+import { PasskeyColumn, PasskeyCredentialMapping, PasskeyFlowTable, PasskeyPersistenceMapping, PasskeyPersistenceServices } from "./passkey-model.mjs";
 import { Effect, Schema } from "effect";
-import { PasskeyActionAuthorization, PasskeyCeremony, PasskeyClaim, PasskeyCredential, PasskeyCredentialSummary, PasskeyIssueDecision, PasskeyManagementPersistence, PasskeyManagementPolicy, PasskeyMethodPolicy, PasskeyRegistrationResult, PasskeyRegistrationVerified, PasskeyRequirement, PasskeyRevision, PasskeyUnavailable, PreparePasskeyCommit } from "@yielded/auth/Passkey";
-import { TokenDigest } from "@yielded/auth/Schema";
 import { PreparedCommit } from "@yielded/auth/Hooks";
+import { PasskeyAccess, PasskeyActionAuthorization, PasskeyCeremony, PasskeyCredential, PasskeyCredentialSummary, PasskeyIssueDecision, PasskeyManagementPersistence, PasskeyManagementPolicy, PasskeyRegistrationResult, PasskeyRegistrationVerified, PasskeyRequirement, PasskeyRevision, PasskeyUnavailable, PreparePasskeyCommit } from "@yielded/auth/Passkey";
 import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
+import { TokenDigest } from "@yielded/auth/Schema";
 //#region src/internal/models/passkey-write-model.d.ts
 export interface PasskeyCredentialInsert<N> {
   readonly subjectId: N;
@@ -15,7 +14,7 @@ export interface PasskeyCredentialInsert<N> {
   readonly summary: PasskeyCredentialSummary;
   readonly marker: string;
 }
-export interface PasskeyWriteTables<S extends TableModel, C extends TableModel, F extends TableModel, O extends TableModel, H extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+export interface PasskeyWriteTables<S extends TableModel, C extends TableModel, F extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
   readonly credential: {
     readonly name: PasskeyColumn<C>;
     readonly createdAt: PasskeyColumn<C>;
@@ -31,21 +30,7 @@ export interface PasskeyWriteTables<S extends TableModel, C extends TableModel,
     readonly activeStatus: unknown;
     readonly removedStatus: unknown;
   };
-  readonly credentialOwnership: {
-    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => O["insert"];
-    readonly ownedState: unknown;
-    readonly removedState: unknown;
-  };
-  readonly handleOwnership: {
-    readonly encodeInsert: (input: {
-      readonly subjectId: N;
-      readonly rpId: string;
-      readonly userHandle: string;
-      readonly marker: string;
-    }) => H["insert"];
-    readonly ownedState: unknown;
-  };
-  /** All mutable policy dependencies must be subject columns or declared module guards. */
+  /** Mutable management policy dependencies belong to the locked subject row. */
   readonly policy: {
     readonly subjectColumns: ReadonlyArray<PasskeyColumn<S>>;
     readonly management: (row: Readonly<Partial<S["select"]>>) => PasskeyManagementPolicy;
@@ -75,27 +60,8 @@ export declare const passkeyInvalidationMutation: <T extends TableModel, N, Expr
   readonly values: (input: PasskeyInvalidationInput<N>) => Partial<T["insert"]>;
   readonly postcondition: (input: PasskeyInvalidationInput<N>) => Expression;
 }) => PasskeyInvalidationMutation<N, Expression>;
-export interface PasskeyCommandTable<T extends TableModel, N> {
-  readonly table: T["table"];
-  readonly moduleId: PasskeyColumn<T>;
-  readonly commandId: PasskeyColumn<T>;
-  readonly subjectId: PasskeyColumn<T>;
-  readonly credentialId: PasskeyColumn<T>;
-  readonly intent: PasskeyColumn<T>;
-  readonly decision: PasskeyColumn<T>;
-  readonly retentionUntil: PasskeyColumn<T>;
-  readonly version: PasskeyColumn<T>;
-  readonly encodeInsert: (input: {
-    readonly moduleId: string;
-    readonly commandId: string;
-    readonly subjectId: N;
-    readonly credentialId: string;
-  }) => T["insert"];
-}
-export interface PasskeyManagementMapping<S extends TableModel, C extends TableModel, F extends TableModel, O extends TableModel, H extends TableModel, M extends TableModel, Flow extends TableModel, A extends TableModel, Charge extends TableModel, Command extends TableModel, N, Expression extends SqlExpression = SqlExpression> extends PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, O, H, N, Expression>, M, Flow, A, Charge, N, Expression, C> {
-  readonly write: PasskeyWriteTables<S, C, F, O, H, N, Expression>;
-  readonly command: PasskeyCommandTable<Command, N>;
-  readonly managementConstraints: typeof requiredPasskeyManagementConstraints;
+export interface PasskeyManagementMapping<S extends TableModel, C extends TableModel, F extends TableModel, Flow extends TableModel, N, Expression extends SqlExpression = SqlExpression> extends PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, N, Expression>, Flow, N, Expression, C> {
+  readonly write: PasskeyWriteTables<S, C, F, N, Expression>;
   /** Removal must match the installed session strategy and change the subject revision; immediate sessions must consult that authority or be updated here. Enrollment preserves existing authentication. */
   readonly invalidation: {
     readonly window: SessionInvalidationWindow;
@@ -103,9 +69,6 @@ export interface PasskeyManagementMapping<S extends TableModel, C extends TableM
     readonly postcondition: (input: PasskeyInvalidationInput<N>) => Expression;
   };
 }
-export declare const requiredPasskeyManagementConstraints: {
-  readonly command: readonly ["moduleId", "commandId"];
-};
 export interface PasskeyManagementServices extends PasskeyPersistenceServices {
   readonly passkeyManagementPersistence: PasskeyManagementPersistence["Service"];
 }
@@ -118,13 +81,12 @@ export interface PasskeyRegistrationWriter<R> {
   }, PasskeyUnavailable>;
   readonly issueRegistration: <A>(input: {
     readonly ceremony: PasskeyCeremony;
-    readonly policy: PasskeyMethodPolicy;
     readonly registration: R;
   }, prepare: PreparePasskeyCommit<PasskeyIssueDecision, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
   readonly completeRegistration: <A>(input: {
-    readonly claim: PasskeyClaim;
+    readonly access: PasskeyAccess;
+    readonly ceremony: PasskeyCeremony;
     readonly verified: PasskeyRegistrationVerified;
-    readonly nowMillis: number;
   }, prepare: PreparePasskeyCommit<PasskeyRegistrationResult | {
     readonly _tag: "Rejected";
   }, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
@@ -132,26 +94,11 @@ export interface PasskeyRegistrationWriter<R> {
 export interface PasskeyRegistrationServices<R> extends PasskeyPersistenceServices {
   readonly passkeyRegistrationAuthority: PasskeyRegistrationWriter<R>;
 }
-export interface PasskeyRegistrationMapping<S extends TableModel, C extends TableModel, F extends TableModel, O extends TableModel, H extends TableModel, M extends TableModel, Flow extends TableModel, A extends TableModel, Charge extends TableModel, Intent extends TableModel, N, R, Expression extends SqlExpression = SqlExpression> extends PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, O, H, N, Expression>, M, Flow, A, Charge, N, Expression, C> {
-  readonly write: PasskeyWriteTables<S, C, F, O, H, N, Expression>;
+export interface PasskeyRegistrationMapping<S extends TableModel, C extends TableModel, F extends TableModel, Flow extends TableModel, N, R, Expression extends SqlExpression = SqlExpression> extends PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, N, Expression>, Flow, N, Expression, C> {
+  readonly write: PasskeyWriteTables<S, C, F, N, Expression>;
   readonly flow: PasskeyFlowTable<Flow>;
-  readonly handle: PasskeyHandleReservationTable<H, Expression> & {
-    readonly reservedState: unknown;
-    readonly encodeInsert: (input: {
-      readonly ceremony: PasskeyCeremony;
-      readonly reservationId: string;
-    }) => H["insert"];
-  };
-  readonly intent: PasskeyRegistrationIntentReadTable<Intent, Expression> & {
-    readonly pendingState: unknown;
-    readonly acceptedState: unknown;
-    readonly rejectedState: unknown;
-    readonly encodeInsert: (input: {
-      readonly ceremony: PasskeyCeremony;
-      readonly registration: R;
-      readonly reservationId: string;
-    }) => Intent["insert"];
-  };
+  /** Schema-encoded original registration payload on the same immutable flow row. */
+  readonly applicationSnapshot: PasskeyColumn<Flow>;
   /** Consumer-owned data and identity, synchronously encoded inside the owner. A SQL-local registration creates no session and needs no email address. */
   readonly registration: {
     readonly schema: Schema.Codec<R, unknown, never, never>;
@@ -162,12 +109,13 @@ export interface PasskeyRegistrationMapping<S extends TableModel, C extends Tabl
     readonly eligible: (registration: R) => Expression;
     /** Commit-time application policy after provisioning. Unlike `eligible`, this
      * must permit the newly created subject and retain every mutable prerequisite.
-     * Declare mutable external policy rows in module.guards so native locking
-     * owners serialize revocation through commit; this predicate alone is not a lock. */
+     * Subject-local prerequisites are checked under its lock. */
     readonly finalEligibility: (input: {
       readonly registration: R;
       readonly subjectId: N;
     }) => Expression;
+    /** D1 plans require explicit subject identity, status, and security revision
+     * values; they cannot read database defaults before the atomic batch runs. */
     readonly subject: (input: {
       readonly registration: R;
       readonly ceremony: PasskeyCeremony;
@@ -178,12 +126,6 @@ export interface PasskeyRegistrationMapping<S extends TableModel, C extends Tabl
     };
     readonly activeStatus: unknown;
   };
-  readonly registrationConstraints: typeof requiredPasskeyRegistrationWriteConstraints;
 }
-export declare const requiredPasskeyRegistrationWriteConstraints: {
-  readonly intentFlow: readonly ["moduleId", "flowId"];
-  readonly intentCommand: readonly ["moduleId", "commandId"];
-  readonly handle: readonly ["handleKey"];
-};
 //#endregion
 //# sourceMappingURL=passkey-write-model.d.mts.map

package/dist/internal/models/passkey-write-model.mjs

@@ -1,13 +1,7 @@
 //#region src/internal/models/passkey-write-model.ts
 /** Same-owner updates for consumer session/pending tables. No external effects or callbacks after commit. */
 const passkeyInvalidationMutation = (input) => input;
-const requiredPasskeyManagementConstraints = { command: ["moduleId", "commandId"] };
-const requiredPasskeyRegistrationWriteConstraints = {
-	intentFlow: ["moduleId", "flowId"],
-	intentCommand: ["moduleId", "commandId"],
-	handle: ["handleKey"]
-};
 //#endregion
-export { passkeyInvalidationMutation, requiredPasskeyManagementConstraints, requiredPasskeyRegistrationWriteConstraints };
+export { passkeyInvalidationMutation };
 
 //# sourceMappingURL=passkey-write-model.mjs.map

package/dist/internal/models/passkey-write-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-write-model.mjs","names":[],"sources":["../../../src/internal/models/passkey-write-model.ts"],"sourcesContent":["import type { PreparedCommit } from \"@yielded/auth/Hooks\";\nimport type {\n  PasskeyUnavailable,\n  PasskeyActionAuthorization,\n  PasskeyCeremony,\n  PasskeyClaim,\n  PasskeyCredential,\n  PasskeyCredentialSummary,\n  PasskeyIssueDecision,\n  PasskeyRegistrationResult,\n  PasskeyRegistrationVerified,\n  PasskeyRequirement,\n  PasskeyRevision,\n  PasskeyManagementPersistence,\n  PreparePasskeyCommit,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n} from \"@yielded/auth/Passkey\";\nimport type { TokenDigest } from \"@yielded/auth/Schema\";\nimport type { SessionInvalidationWindow } from \"@yielded/auth/Sessions\";\nimport type { Effect, Schema } from \"effect\";\n\nimport type { TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError } from \"./common\";\nimport type {\n  PasskeyColumn,\n  PasskeyCredentialMapping,\n  PasskeyFlowTable,\n  PasskeyHandleReservationTable,\n  PasskeyPersistenceMapping,\n  PasskeyPersistenceServices,\n} from \"./passkey-model\";\nimport type { PasskeyRegistrationIntentReadTable } from \"./passkey-registration-ceremony-model\";\n\nexport interface PasskeyCredentialInsert<N> {\n  readonly subjectId: N;\n  readonly credential: PasskeyCredential;\n  readonly summary: PasskeyCredentialSummary;\n  readonly marker: string;\n}\n\nexport interface PasskeyWriteTables<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly credential: {\n    readonly name: PasskeyColumn<C>;\n    readonly createdAt: PasskeyColumn<C>;\n    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => C[\"insert\"];\n    readonly encodePrimarySignIn: (value: boolean) => unknown;\n    readonly encodeEnrollmentUserVerified: (value: boolean) => unknown;\n    readonly encodeBackupEligible: (value: boolean) => unknown;\n    readonly activeStatus: unknown;\n    readonly removedStatus: unknown;\n  };\n  readonly authority: {\n    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => F[\"insert\"];\n    readonly activeStatus: unknown;\n    readonly removedStatus: unknown;\n  };\n  readonly credentialOwnership: {\n    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => O[\"insert\"];\n    readonly ownedState: unknown;\n    readonly removedState: unknown;\n  };\n  readonly handleOwnership: {\n    readonly encodeInsert: (input: {\n      readonly subjectId: N;\n      readonly rpId: string;\n      readonly userHandle: string;\n      readonly marker: string;\n    }) => H[\"insert\"];\n    readonly ownedState: unknown;\n  };\n  /** All mutable policy dependencies must be subject columns or declared module guards. */\n  readonly policy: {\n    readonly subjectColumns: ReadonlyArray<PasskeyColumn<S>>;\n    readonly management: (row: Readonly<Partial<S[\"select\"]>>) => PasskeyManagementPolicy;\n    readonly requirement: (\n      row: Readonly<Partial<S[\"select\"]>>,\n      action: PasskeyActionAuthorization[\"challenge\"][\"action\"],\n    ) => Effect.Effect<typeof PasskeyRequirement.Type, PersistenceMappingError>;\n    readonly metadata: (subjectId: N) => Expression;\n    readonly action: (subjectId: N, authorization: PasskeyActionAuthorization) => Expression;\n    /** Usable primary/recovery path AND required remaining factors. Evaluated with the target excluded, before and after removal. Connected grants/factor-only credentials are not primary paths. */\n    readonly remainingSignIn: (\n      subjectId: N,\n      removedCredentialId: string,\n      row: Readonly<Partial<S[\"select\"]>>,\n    ) => Effect.Effect<Expression, PersistenceMappingError>;\n  };\n}\n\nexport interface PasskeyInvalidationInput<N> {\n  readonly subjectId: N;\n  readonly previousRevision: typeof PasskeyRevision.Type.securityRevision;\n  readonly securityRevision: typeof PasskeyRevision.Type.securityRevision;\n  readonly invalidation: SessionInvalidationWindow;\n}\n\nexport interface PasskeyInvalidationMutation<N, Expression extends SqlExpression = SqlExpression> {\n  readonly table: object;\n  readonly where: (input: PasskeyInvalidationInput<N>) => Expression;\n  readonly values: (input: PasskeyInvalidationInput<N>) => Readonly<Record<string, unknown>>;\n  readonly postcondition: (input: PasskeyInvalidationInput<N>) => Expression;\n}\n\n/** Same-owner updates for consumer session/pending tables. No external effects or callbacks after commit. */\nexport const passkeyInvalidationMutation = <\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n>(input: {\n  readonly table: T[\"table\"];\n  readonly where: (input: PasskeyInvalidationInput<N>) => Expression;\n  readonly values: (input: PasskeyInvalidationInput<N>) => Partial<T[\"insert\"]>;\n  readonly postcondition: (input: PasskeyInvalidationInput<N>) => Expression;\n}): PasskeyInvalidationMutation<N, Expression> => input;\n\nexport interface PasskeyCommandTable<T extends Table, N> {\n  readonly table: T[\"table\"];\n  readonly moduleId: PasskeyColumn<T>;\n  readonly commandId: PasskeyColumn<T>;\n  readonly subjectId: PasskeyColumn<T>;\n  readonly credentialId: PasskeyColumn<T>;\n  readonly intent: PasskeyColumn<T>;\n  readonly decision: PasskeyColumn<T>;\n  readonly retentionUntil: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly subjectId: N;\n    readonly credentialId: string;\n  }) => T[\"insert\"];\n}\n\nexport interface PasskeyManagementMapping<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  M extends Table,\n  Flow extends Table,\n  A extends Table,\n  Charge extends Table,\n  Command extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> extends PasskeyPersistenceMapping<\n  PasskeyCredentialMapping<S, C, F, O, H, N, Expression>,\n  M,\n  Flow,\n  A,\n  Charge,\n  N,\n  Expression,\n  C\n> {\n  readonly write: PasskeyWriteTables<S, C, F, O, H, N, Expression>;\n  readonly command: PasskeyCommandTable<Command, N>;\n  readonly managementConstraints: typeof requiredPasskeyManagementConstraints;\n  /** Removal must match the installed session strategy and change the subject revision; immediate sessions must consult that authority or be updated here. Enrollment preserves existing authentication. */\n  readonly invalidation: {\n    readonly window: SessionInvalidationWindow;\n    readonly mutations: ReadonlyArray<PasskeyInvalidationMutation<N, Expression>>;\n    readonly postcondition: (input: PasskeyInvalidationInput<N>) => Expression;\n  };\n}\n\nexport const requiredPasskeyManagementConstraints = { command: [\"moduleId\", \"commandId\"] } as const;\n\nexport interface PasskeyManagementServices extends PasskeyPersistenceServices {\n  readonly passkeyManagementPersistence: PasskeyManagementPersistence[\"Service\"];\n}\n\nexport interface PasskeyRegistrationWriter<R> {\n  readonly inspect: (registration: R) => Effect.Effect<\n    {\n      readonly fingerprint: TokenDigest;\n      readonly eligible: boolean;\n      readonly name: string;\n      readonly displayName: string;\n    },\n    PasskeyUnavailable\n  >;\n  readonly issueRegistration: <A>(\n    input: {\n      readonly ceremony: PasskeyCeremony;\n      readonly policy: PasskeyMethodPolicy;\n      readonly registration: R;\n    },\n    prepare: PreparePasskeyCommit<PasskeyIssueDecision, A>,\n  ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n  readonly completeRegistration: <A>(\n    input: {\n      readonly claim: PasskeyClaim;\n      readonly verified: PasskeyRegistrationVerified;\n      readonly nowMillis: number;\n    },\n    prepare: PreparePasskeyCommit<\n      | PasskeyRegistrationResult\n      | {\n          readonly _tag: \"Rejected\";\n        },\n      A\n    >,\n  ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n}\n\nexport interface PasskeyRegistrationServices<R> extends PasskeyPersistenceServices {\n  readonly passkeyRegistrationAuthority: PasskeyRegistrationWriter<R>;\n}\n\nexport interface PasskeyRegistrationMapping<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  M extends Table,\n  Flow extends Table,\n  A extends Table,\n  Charge extends Table,\n  Intent extends Table,\n  N,\n  R,\n  Expression extends SqlExpression = SqlExpression,\n> extends PasskeyPersistenceMapping<\n  PasskeyCredentialMapping<S, C, F, O, H, N, Expression>,\n  M,\n  Flow,\n  A,\n  Charge,\n  N,\n  Expression,\n  C\n> {\n  readonly write: PasskeyWriteTables<S, C, F, O, H, N, Expression>;\n  readonly flow: PasskeyFlowTable<Flow>;\n  readonly handle: PasskeyHandleReservationTable<H, Expression> & {\n    readonly reservedState: unknown;\n    readonly encodeInsert: (input: {\n      readonly ceremony: PasskeyCeremony;\n      readonly reservationId: string;\n    }) => H[\"insert\"];\n  };\n  readonly intent: PasskeyRegistrationIntentReadTable<Intent, Expression> & {\n    readonly pendingState: unknown;\n    readonly acceptedState: unknown;\n    readonly rejectedState: unknown;\n    readonly encodeInsert: (input: {\n      readonly ceremony: PasskeyCeremony;\n      readonly registration: R;\n      readonly reservationId: string;\n    }) => Intent[\"insert\"];\n  };\n  /** Consumer-owned data and identity, synchronously encoded inside the owner. A SQL-local registration creates no session and needs no email address. */\n  readonly registration: {\n    readonly schema: Schema.Codec<R, unknown, never, never>;\n    readonly describe: (registration: R) => {\n      readonly name: string;\n      readonly displayName: string;\n    };\n    readonly eligible: (registration: R) => Expression;\n    /** Commit-time application policy after provisioning. Unlike `eligible`, this\n     * must permit the newly created subject and retain every mutable prerequisite.\n     * Declare mutable external policy rows in module.guards so native locking\n     * owners serialize revocation through commit; this predicate alone is not a lock. */\n    readonly finalEligibility: (input: {\n      readonly registration: R;\n      readonly subjectId: N;\n    }) => Expression;\n    readonly subject: (input: {\n      readonly registration: R;\n      readonly ceremony: PasskeyCeremony;\n      readonly marker: string;\n    }) => {\n      readonly subjectId: N;\n      readonly values: S[\"insert\"];\n    };\n    readonly activeStatus: unknown;\n  };\n  readonly registrationConstraints: typeof requiredPasskeyRegistrationWriteConstraints;\n}\n\nexport const requiredPasskeyRegistrationWriteConstraints = {\n  intentFlow: [\"moduleId\", \"flowId\"],\n  intentCommand: [\"moduleId\", \"commandId\"],\n  handle: [\"handleKey\"],\n} as const;\n"],"mappings":";;AAiHA,MAAa,+BAIX,UAKgD;AAsDlD,MAAa,uCAAuC,EAAE,SAAS,CAAC,YAAY,WAAW,EAAE;AAoHzF,MAAa,8CAA8C;CACzD,YAAY,CAAC,YAAY,QAAQ;CACjC,eAAe,CAAC,YAAY,WAAW;CACvC,QAAQ,CAAC,WAAW;AACtB"}
+{"version":3,"file":"passkey-write-model.mjs","names":[],"sources":["../../../src/internal/models/passkey-write-model.ts"],"sourcesContent":["import type { PreparedCommit } from \"@yielded/auth/Hooks\";\nimport type {\n  PasskeyUnavailable,\n  PasskeyActionAuthorization,\n  PasskeyCeremony,\n  PasskeyAccess,\n  PasskeyCredential,\n  PasskeyCredentialSummary,\n  PasskeyIssueDecision,\n  PasskeyRegistrationResult,\n  PasskeyRegistrationVerified,\n  PasskeyRequirement,\n  PasskeyRevision,\n  PasskeyManagementPersistence,\n  PreparePasskeyCommit,\n  PasskeyManagementPolicy,\n} from \"@yielded/auth/Passkey\";\nimport type { TokenDigest } from \"@yielded/auth/Schema\";\nimport type { SessionInvalidationWindow } from \"@yielded/auth/Sessions\";\nimport type { Effect, Schema } from \"effect\";\n\nimport type { TableModel as Table, SqlExpression } from \"../table-model\";\nimport type { PersistenceMappingError } from \"./common\";\nimport type {\n  PasskeyColumn,\n  PasskeyCredentialMapping,\n  PasskeyFlowTable,\n  PasskeyPersistenceMapping,\n  PasskeyPersistenceServices,\n} from \"./passkey-model\";\n\nexport interface PasskeyCredentialInsert<N> {\n  readonly subjectId: N;\n  readonly credential: PasskeyCredential;\n  readonly summary: PasskeyCredentialSummary;\n  readonly marker: string;\n}\n\nexport interface PasskeyWriteTables<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly credential: {\n    readonly name: PasskeyColumn<C>;\n    readonly createdAt: PasskeyColumn<C>;\n    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => C[\"insert\"];\n    readonly encodePrimarySignIn: (value: boolean) => unknown;\n    readonly encodeEnrollmentUserVerified: (value: boolean) => unknown;\n    readonly encodeBackupEligible: (value: boolean) => unknown;\n    readonly activeStatus: unknown;\n    readonly removedStatus: unknown;\n  };\n  readonly authority: {\n    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => F[\"insert\"];\n    readonly activeStatus: unknown;\n    readonly removedStatus: unknown;\n  };\n  /** Mutable management policy dependencies belong to the locked subject row. */\n  readonly policy: {\n    readonly subjectColumns: ReadonlyArray<PasskeyColumn<S>>;\n    readonly management: (row: Readonly<Partial<S[\"select\"]>>) => PasskeyManagementPolicy;\n    readonly requirement: (\n      row: Readonly<Partial<S[\"select\"]>>,\n      action: PasskeyActionAuthorization[\"challenge\"][\"action\"],\n    ) => Effect.Effect<typeof PasskeyRequirement.Type, PersistenceMappingError>;\n    readonly metadata: (subjectId: N) => Expression;\n    readonly action: (subjectId: N, authorization: PasskeyActionAuthorization) => Expression;\n    /** Usable primary/recovery path AND required remaining factors. Evaluated with the target excluded, before and after removal. Connected grants/factor-only credentials are not primary paths. */\n    readonly remainingSignIn: (\n      subjectId: N,\n      removedCredentialId: string,\n      row: Readonly<Partial<S[\"select\"]>>,\n    ) => Effect.Effect<Expression, PersistenceMappingError>;\n  };\n}\n\nexport interface PasskeyInvalidationInput<N> {\n  readonly subjectId: N;\n  readonly previousRevision: typeof PasskeyRevision.Type.securityRevision;\n  readonly securityRevision: typeof PasskeyRevision.Type.securityRevision;\n  readonly invalidation: SessionInvalidationWindow;\n}\n\nexport interface PasskeyInvalidationMutation<N, Expression extends SqlExpression = SqlExpression> {\n  readonly table: object;\n  readonly where: (input: PasskeyInvalidationInput<N>) => Expression;\n  readonly values: (input: PasskeyInvalidationInput<N>) => Readonly<Record<string, unknown>>;\n  readonly postcondition: (input: PasskeyInvalidationInput<N>) => Expression;\n}\n\n/** Same-owner updates for consumer session/pending tables. No external effects or callbacks after commit. */\nexport const passkeyInvalidationMutation = <\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n>(input: {\n  readonly table: T[\"table\"];\n  readonly where: (input: PasskeyInvalidationInput<N>) => Expression;\n  readonly values: (input: PasskeyInvalidationInput<N>) => Partial<T[\"insert\"]>;\n  readonly postcondition: (input: PasskeyInvalidationInput<N>) => Expression;\n}): PasskeyInvalidationMutation<N, Expression> => input;\n\nexport interface PasskeyManagementMapping<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  Flow extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> extends PasskeyPersistenceMapping<\n  PasskeyCredentialMapping<S, C, F, N, Expression>,\n  Flow,\n  N,\n  Expression,\n  C\n> {\n  readonly write: PasskeyWriteTables<S, C, F, N, Expression>;\n  /** Removal must match the installed session strategy and change the subject revision; immediate sessions must consult that authority or be updated here. Enrollment preserves existing authentication. */\n  readonly invalidation: {\n    readonly window: SessionInvalidationWindow;\n    readonly mutations: ReadonlyArray<PasskeyInvalidationMutation<N, Expression>>;\n    readonly postcondition: (input: PasskeyInvalidationInput<N>) => Expression;\n  };\n}\n\nexport interface PasskeyManagementServices extends PasskeyPersistenceServices {\n  readonly passkeyManagementPersistence: PasskeyManagementPersistence[\"Service\"];\n}\n\nexport interface PasskeyRegistrationWriter<R> {\n  readonly inspect: (registration: R) => Effect.Effect<\n    {\n      readonly fingerprint: TokenDigest;\n      readonly eligible: boolean;\n      readonly name: string;\n      readonly displayName: string;\n    },\n    PasskeyUnavailable\n  >;\n  readonly issueRegistration: <A>(\n    input: {\n      readonly ceremony: PasskeyCeremony;\n      readonly registration: R;\n    },\n    prepare: PreparePasskeyCommit<PasskeyIssueDecision, A>,\n  ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n  readonly completeRegistration: <A>(\n    input: {\n      readonly access: PasskeyAccess;\n      readonly ceremony: PasskeyCeremony;\n      readonly verified: PasskeyRegistrationVerified;\n    },\n    prepare: PreparePasskeyCommit<\n      | PasskeyRegistrationResult\n      | {\n          readonly _tag: \"Rejected\";\n        },\n      A\n    >,\n  ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n}\n\nexport interface PasskeyRegistrationServices<R> extends PasskeyPersistenceServices {\n  readonly passkeyRegistrationAuthority: PasskeyRegistrationWriter<R>;\n}\n\nexport interface PasskeyRegistrationMapping<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  Flow extends Table,\n  N,\n  R,\n  Expression extends SqlExpression = SqlExpression,\n> extends PasskeyPersistenceMapping<\n  PasskeyCredentialMapping<S, C, F, N, Expression>,\n  Flow,\n  N,\n  Expression,\n  C\n> {\n  readonly write: PasskeyWriteTables<S, C, F, N, Expression>;\n  readonly flow: PasskeyFlowTable<Flow>;\n  /** Schema-encoded original registration payload on the same immutable flow row. */\n  readonly applicationSnapshot: PasskeyColumn<Flow>;\n  /** Consumer-owned data and identity, synchronously encoded inside the owner. A SQL-local registration creates no session and needs no email address. */\n  readonly registration: {\n    readonly schema: Schema.Codec<R, unknown, never, never>;\n    readonly describe: (registration: R) => {\n      readonly name: string;\n      readonly displayName: string;\n    };\n    readonly eligible: (registration: R) => Expression;\n    /** Commit-time application policy after provisioning. Unlike `eligible`, this\n     * must permit the newly created subject and retain every mutable prerequisite.\n     * Subject-local prerequisites are checked under its lock. */\n    readonly finalEligibility: (input: {\n      readonly registration: R;\n      readonly subjectId: N;\n    }) => Expression;\n    /** D1 plans require explicit subject identity, status, and security revision\n     * values; they cannot read database defaults before the atomic batch runs. */\n    readonly subject: (input: {\n      readonly registration: R;\n      readonly ceremony: PasskeyCeremony;\n      readonly marker: string;\n    }) => {\n      readonly subjectId: N;\n      readonly values: S[\"insert\"];\n    };\n    readonly activeStatus: unknown;\n  };\n}\n"],"mappings":";;AA8FA,MAAa,+BAIX,UAKgD"}

package/dist/internal/models/password-model.d.mts

@@ -1,10 +1,11 @@
+import { AnyTableModel, SqlExpression, TableModel } from "../table-model.mjs";
 import { PersistenceMappingError } from "../mapping-error.mjs";
-import { AnyTableModel, SqlExpression, TableModel } from "../query-operations.mjs";
 import { SubjectIdCodec } from "./common.mjs";
+import { ProofClock } from "./proof-model.mjs";
 import { Effect, Redacted } from "effect";
+import { EncodedPasswordHash, PasswordAction, PasswordCredentialSnapshot, PasswordReplacement } from "@yielded/auth/Password";
 import { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
-import { EncodedPasswordHash, PasswordAction, PasswordCredentialSnapshot, PasswordRegistrationDecision, PasswordReplacement } from "@yielded/auth/Password";
-import { LoginIdentifier, RecoveryReference } from "@yielded/auth/Identity";
+import { LoginIdentifier } from "@yielded/auth/Identity";
 //#region src/internal/models/password-model.d.ts
 type ColumnKey<T extends TableModel> = T["column"];
 export interface PasswordSubjectTable<Subject extends TableModel, _NativeSubjectId> {
@@ -82,48 +83,19 @@ export interface PasswordCredentialTable<Subject extends TableModel, Identifier
     readonly credential: Credential["select"];
   }) => Effect.Effect<PasswordCredentialSnapshot, PersistenceMappingError>;
 }
-export interface PasswordCommandTable<Command extends TableModel> {
-  readonly table: Command["table"];
-  readonly moduleId: ColumnKey<Command>;
-  readonly commandId: ColumnKey<Command>;
-  readonly action: ColumnKey<Command>;
-  readonly bindingDigest: ColumnKey<Command>;
-  readonly decision: ColumnKey<Command>;
-  readonly retentionUntil: ColumnKey<Command>;
-  readonly encodeInsert: (input: {
-    readonly moduleId: string;
-    readonly commandId: string;
-    readonly action: string;
-    readonly bindingDigest: string;
-    readonly decision: "changed";
-    readonly retentionUntilMillis: number;
-  }) => Command["insert"];
-}
 export interface RequiredPasswordConstraints {
   readonly identifier: "unique(identifier.namespace,identifier.value)";
   readonly authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)";
   readonly credentialSubject: "unique(credential.moduleId,credential.subjectId)";
   readonly credentialId: "unique(credential.moduleId,credential.credentialId)";
-  readonly command: "unique(command.moduleId,command.commandId)";
 }
 export declare const requiredPasswordConstraints: RequiredPasswordConstraints;
-export interface PasswordConstraintClassifier {
-  /** Match only the mapped command uniqueness constraint. */
-  readonly isCommandConflict: (cause: unknown) => boolean;
-}
-export interface PasswordD1Clock<Expression extends SqlExpression = SqlExpression> {
-  readonly engineNow: Expression;
-  readonly engineNowMillis: Expression;
-  readonly engineInstantMinus: (millis: number) => Expression;
-  readonly engineInstantPlus: (millis: number) => Expression;
-}
-export interface PasswordPersistenceMapping<Subject extends TableModel, Identifier extends TableModel, Credential extends TableModel, AuthorityCredential extends TableModel, Command extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> extends PasswordConstraintClassifier {
+export interface PasswordPersistenceMapping<Subject extends TableModel, Identifier extends TableModel, Credential extends TableModel, AuthorityCredential extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> {
   readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;
   readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;
   readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;
   /** Every factor revision named by action evidence, including non-password factors. */
   readonly authorityCredential: PasswordAuthorityCredentialTable<AuthorityCredential, NativeSubjectId>;
-  readonly command: PasswordCommandTable<Command>;
   readonly subjectId: SubjectIdCodec<NativeSubjectId>;
   readonly constraints: RequiredPasswordConstraints;
   readonly encodeInstant: (epochMillis: number) => unknown;
@@ -132,27 +104,14 @@ export interface PasswordPersistenceMapping<Subject extends TableModel, Identifi
   readonly allocateCredentialIdSync?: () => string;
   readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
   readonly allocateRevisionSync?: () => SecurityRevision;
-  readonly commandRetentionMillis: number;
-  /** All semantic replacements still bump subject revision. This flag only declares bearer invalidation latency. */
+  /** All semantic replacements still bump subject revision. This flag declares
+   * authoritative verification's invalidation latency; cookie exposure is separate. */
   readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
-  readonly d1?: PasswordD1Clock<Expression>;
-}
-export type D1PasswordPersistenceMapping<Subject extends TableModel, Identifier extends TableModel, Credential extends TableModel, AuthorityCredential extends TableModel, Command extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> = PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Command, NativeSubjectId, Expression> & {
-  readonly d1: PasswordD1Clock<Expression>;
-  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId> & {
-    readonly d1ActiveStatusValue: unknown;
+  readonly clock: ProofClock<Expression>;
+  readonly d1?: {
+    readonly primary: true;
   };
-  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression> & {
-    readonly d1CurrentCondition: (input: {
-      readonly identifier: LoginIdentifier;
-      readonly nativeSubjectId: NativeSubjectId;
-    }) => Expression;
-  };
-  readonly authorityCredential: PasswordAuthorityCredentialTable<AuthorityCredential, NativeSubjectId> & {
-    readonly d1ActiveStatusValue: unknown;
-  };
-};
-export type PasswordRegistrationState = "pending" | "created";
+}
 export interface PasswordRegistrationIntent<Registration> {
   readonly moduleId: string;
   readonly requestId: string;
@@ -160,23 +119,6 @@ export interface PasswordRegistrationIntent<Registration> {
   readonly registration: Registration;
   readonly replacement: PasswordReplacement;
 }
-export interface PasswordRegistrationTable<Registration, Request extends TableModel, NativeSubjectId> {
-  readonly table: Request["table"];
-  readonly moduleId: ColumnKey<Request>;
-  readonly requestId: ColumnKey<Request>;
-  readonly state: ColumnKey<Request>;
-  readonly subjectId: ColumnKey<Request>;
-  readonly recoveryReference: ColumnKey<Request>;
-  readonly encodeInsert: (input: PasswordRegistrationIntent<Registration>, state: {
-    readonly state: PasswordRegistrationState;
-    readonly nativeSubjectId?: NativeSubjectId;
-    readonly recoveryReference?: typeof RecoveryReference.Type;
-  }) => Request["insert"];
-  /** Replay projection must never expose a stored subject or decode protected intent. */
-  readonly decodeReplay: (row: Request["select"]) => Effect.Effect<Exclude<PasswordRegistrationDecision, {
-    readonly _tag: "Created";
-  }>, PersistenceMappingError>;
-}
 export interface PasswordRegistrationProvisioning<Registration, Subject extends TableModel, NativeSubjectId> {
   readonly encodeSubjectInsert: (input: PasswordRegistrationIntent<Registration>, values: {
     readonly nativeSubjectId: NativeSubjectId | undefined;
@@ -188,31 +130,27 @@ export interface PasswordRegistrationProvisioning<Registration, Subject extends
   readonly decodeGeneratedId?: (rows: ReadonlyArray<unknown>) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;
 }
 export interface RequiredPasswordRegistrationConstraints {
-  readonly request: "unique(registration.moduleId,registration.requestId)";
-  readonly recoveryReference: "unique(registration.recoveryReference)";
   readonly identifier: "unique(identifier.namespace,identifier.value)";
   readonly credentialSubject: "unique(credential.moduleId,credential.subjectId)";
   readonly authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)";
 }
 export declare const requiredPasswordRegistrationConstraints: RequiredPasswordRegistrationConstraints;
 export interface PasswordRegistrationConstraintClassifier {
-  readonly isRequestConflict: (cause: unknown) => boolean;
   readonly isIdentifierConflict: (cause: unknown) => boolean;
   readonly isCredentialConflict: (cause: unknown) => boolean;
 }
-export type PasswordRegistrationMapping<Registration, Subject extends TableModel, Identifier extends TableModel, Credential extends TableModel, AuthorityCredential extends TableModel, Request extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> = PasswordRegistrationConstraintClassifier & {
+export type PasswordRegistrationMapping<Registration, Subject extends TableModel, Identifier extends TableModel, Credential extends TableModel, AuthorityCredential extends TableModel, NativeSubjectId, Expression extends SqlExpression = SqlExpression> = PasswordRegistrationConstraintClassifier & {
   readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;
   readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;
   readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;
   readonly authorityCredential: PasswordAuthorityCredentialTable<AuthorityCredential, NativeSubjectId>;
-  readonly registration: PasswordRegistrationTable<Registration, Request, NativeSubjectId>;
   readonly subjectId: SubjectIdCodec<NativeSubjectId>;
   readonly constraints: RequiredPasswordRegistrationConstraints;
   readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;
   readonly allocateCredentialIdSync?: () => string;
   readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
   readonly allocateRevisionSync?: () => SecurityRevision;
-} & ({
+} & {
   readonly mode: "atomic";
   readonly provisioning: PasswordRegistrationProvisioning<Registration, Subject, NativeSubjectId> & ({
     readonly idMode: "allocated";
@@ -224,12 +162,8 @@ export type PasswordRegistrationMapping<Registration, Subject extends TableModel
     readonly idMode: "generated";
     readonly decodeGeneratedId: (rows: ReadonlyArray<unknown>) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;
   });
-} | {
-  readonly mode: "pending";
-  readonly allocateRecoveryReference?: Effect.Effect<typeof RecoveryReference.Type, PersistenceMappingError>;
-  readonly allocateRecoveryReferenceSync?: () => typeof RecoveryReference.Type;
-});
-export type AnyPasswordPersistenceMapping<Expression extends SqlExpression = SqlExpression> = PasswordPersistenceMapping<AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, unknown, Expression>;
-export type AnyPasswordRegistrationMapping<Registration = unknown, Expression extends SqlExpression = SqlExpression> = PasswordRegistrationMapping<Registration, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, unknown, Expression>;
+};
+export type AnyPasswordPersistenceMapping<Expression extends SqlExpression = SqlExpression> = PasswordPersistenceMapping<AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, unknown, Expression>;
+export type AnyPasswordRegistrationMapping<Registration = unknown, Expression extends SqlExpression = SqlExpression> = PasswordRegistrationMapping<Registration, AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, unknown, Expression>;
 //#endregion
 //# sourceMappingURL=password-model.d.mts.map

package/dist/internal/models/password-model.mjs

@@ -4,12 +4,9 @@ const requiredPasswordConstraints = {
 	identifier: "unique(identifier.namespace,identifier.value)",
 	authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)",
 	credentialSubject: "unique(credential.moduleId,credential.subjectId)",
-	credentialId: "unique(credential.moduleId,credential.credentialId)",
-	command: "unique(command.moduleId,command.commandId)"
+	credentialId: "unique(credential.moduleId,credential.credentialId)"
 };
 const requiredPasswordRegistrationConstraints = {
-	request: "unique(registration.moduleId,registration.requestId)",
-	recoveryReference: "unique(registration.recoveryReference)",
 	identifier: "unique(identifier.namespace,identifier.value)",
 	credentialSubject: "unique(credential.moduleId,credential.subjectId)",
 	authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)"

package/dist/internal/models/password-model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password-model.mjs","names":[],"sources":["../../../src/internal/models/password-model.ts"],"sourcesContent":["import { type RecoveryReference, type LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasswordAction,\n  PasswordCredentialSnapshot,\n  PasswordReplacement,\n  PasswordRegistrationDecision,\n  EncodedPasswordHash,\n} from \"@yielded/auth/Password\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport type { Effect, Redacted } from \"effect\";\n\nimport type { AnyTableModel, TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./common\";\n\ntype ColumnKey<T extends Table> = T[\"column\"];\n\nexport interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {\n  readonly table: Subject[\"table\"];\n  readonly id: ColumnKey<Subject>;\n  readonly status: ColumnKey<Subject>;\n  readonly securityRevision: ColumnKey<Subject>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly decodeRequirement: (\n    row: Subject[\"select\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Current policy for this exact credential mutation, decoded under the subject lock. */\n  readonly decodeActionRequirement: (\n    row: Subject[\"select\"],\n    action: PasswordAction,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  readonly nextSecurityRevision?: (\n    current: SecurityRevision,\n  ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  /** Required only by D1 conditional statements. */\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface PasswordIdentifierTable<\n  Identifier extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: Identifier[\"table\"];\n  readonly namespace: ColumnKey<Identifier>;\n  readonly value: ColumnKey<Identifier>;\n  readonly subjectId: ColumnKey<Identifier>;\n  readonly verifiedAt: ColumnKey<Identifier>;\n  readonly bindingRevision: ColumnKey<Identifier>;\n  /** Consumer-owned current login/recovery eligibility, including row status. */\n  readonly isCurrent: (row: Identifier[\"select\"]) => boolean;\n  /** Required by D1 so current ownership/eligibility is rechecked in the batch. */\n  readonly d1CurrentCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n  }) => Expression;\n  readonly encodeInitialInsert: (\n    identifier: LoginIdentifier,\n    subjectId: NativeSubjectId,\n    bindingRevision: SecurityRevision,\n  ) => Identifier[\"insert\"];\n}\n\nexport interface PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {\n  readonly table: Credential[\"table\"];\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly revision: ColumnKey<Credential>;\n  readonly status?: ColumnKey<Credential>;\n  readonly isActiveStatus?: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n  readonly encodeInsert: (input: {\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => Credential[\"insert\"];\n  readonly encodeRevision: (revision: SecurityRevision) => Partial<Credential[\"insert\"]>;\n}\n\nexport interface PasswordCredentialTable<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> {\n  readonly table: Credential[\"table\"];\n  readonly moduleId: ColumnKey<Credential>;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly credentialRevision: ColumnKey<Credential>;\n  readonly verifierVersion: ColumnKey<Credential>;\n  readonly verifier: ColumnKey<Credential>;\n  readonly normalization: ColumnKey<Credential>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly replacement: PasswordReplacement;\n  }) => Credential[\"insert\"];\n  readonly encodeVerifier: (\n    verifier: Redacted.Redacted<EncodedPasswordHash>,\n    verifierVersion: SecurityRevision,\n  ) => Partial<Credential[\"insert\"]>;\n  readonly encodeReplacement: (input: {\n    readonly replacement: PasswordReplacement;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n  }) => Partial<Credential[\"insert\"]>;\n  readonly decode: (input: {\n    readonly moduleId: string;\n    readonly subject: Subject[\"select\"];\n    readonly identifier: Identifier[\"select\"];\n    readonly credential: Credential[\"select\"];\n  }) => Effect.Effect<PasswordCredentialSnapshot, PersistenceMappingError>;\n}\n\nexport interface PasswordCommandTable<Command extends Table> {\n  readonly table: Command[\"table\"];\n  readonly moduleId: ColumnKey<Command>;\n  readonly commandId: ColumnKey<Command>;\n  readonly action: ColumnKey<Command>;\n  readonly bindingDigest: ColumnKey<Command>;\n  readonly decision: ColumnKey<Command>;\n  readonly retentionUntil: ColumnKey<Command>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly action: string;\n    readonly bindingDigest: string;\n    readonly decision: \"changed\";\n    readonly retentionUntilMillis: number;\n  }) => Command[\"insert\"];\n}\n\nexport interface RequiredPasswordConstraints {\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n  readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n  readonly credentialId: \"unique(credential.moduleId,credential.credentialId)\";\n  readonly command: \"unique(command.moduleId,command.commandId)\";\n}\n\nexport const requiredPasswordConstraints: RequiredPasswordConstraints = {\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n  credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n  credentialId: \"unique(credential.moduleId,credential.credentialId)\",\n  command: \"unique(command.moduleId,command.commandId)\",\n};\n\nexport interface PasswordConstraintClassifier {\n  /** Match only the mapped command uniqueness constraint. */\n  readonly isCommandConflict: (cause: unknown) => boolean;\n}\n\nexport interface PasswordD1Clock<Expression extends SqlExpression = SqlExpression> {\n  readonly engineNow: Expression;\n  readonly engineNowMillis: Expression;\n  readonly engineInstantMinus: (millis: number) => Expression;\n  readonly engineInstantPlus: (millis: number) => Expression;\n}\n\nexport interface PasswordPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Command extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> extends PasswordConstraintClassifier {\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;\n  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  /** Every factor revision named by action evidence, including non-password factors. */\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly command: PasswordCommandTable<Command>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredPasswordConstraints;\n  readonly encodeInstant: (epochMillis: number) => unknown;\n  readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n  readonly commandRetentionMillis: number;\n  /** All semantic replacements still bump subject revision. This flag only declares bearer invalidation latency. */\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n  readonly d1?: PasswordD1Clock<Expression>;\n}\n\nexport type D1PasswordPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Command extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordPersistenceMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Command,\n  NativeSubjectId,\n  Expression\n> & {\n  readonly d1: PasswordD1Clock<Expression>;\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId> & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression> & {\n    readonly d1CurrentCondition: (input: {\n      readonly identifier: LoginIdentifier;\n      readonly nativeSubjectId: NativeSubjectId;\n    }) => Expression;\n  };\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  > & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n};\n\nexport type PasswordRegistrationState = \"pending\" | \"created\";\n\nexport interface PasswordRegistrationIntent<Registration> {\n  readonly moduleId: string;\n  readonly requestId: string;\n  readonly identifier: LoginIdentifier;\n  readonly registration: Registration;\n  readonly replacement: PasswordReplacement;\n}\n\nexport interface PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> {\n  readonly table: Request[\"table\"];\n  readonly moduleId: ColumnKey<Request>;\n  readonly requestId: ColumnKey<Request>;\n  readonly state: ColumnKey<Request>;\n  readonly subjectId: ColumnKey<Request>;\n  readonly recoveryReference: ColumnKey<Request>;\n  readonly encodeInsert: (\n    input: PasswordRegistrationIntent<Registration>,\n    state: {\n      readonly state: PasswordRegistrationState;\n      readonly nativeSubjectId?: NativeSubjectId;\n      readonly recoveryReference?: typeof RecoveryReference.Type;\n    },\n  ) => Request[\"insert\"];\n  /** Replay projection must never expose a stored subject or decode protected intent. */\n  readonly decodeReplay: (row: Request[\"select\"]) => Effect.Effect<\n    Exclude<\n      PasswordRegistrationDecision,\n      {\n        readonly _tag: \"Created\";\n      }\n    >,\n    PersistenceMappingError\n  >;\n}\n\nexport interface PasswordRegistrationProvisioning<\n  Registration,\n  Subject extends Table,\n  NativeSubjectId,\n> {\n  readonly encodeSubjectInsert: (\n    input: PasswordRegistrationIntent<Registration>,\n    values: {\n      readonly nativeSubjectId: NativeSubjectId | undefined;\n      readonly securityRevision: SecurityRevision;\n    },\n  ) => Subject[\"insert\"];\n  readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n  readonly allocateSubjectIdSync?: () => NativeSubjectId;\n  /** Interactive targets use this for database-generated/autoincrement keys. */\n  readonly decodeGeneratedId?: (\n    rows: ReadonlyArray<unknown>,\n  ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n}\n\nexport interface RequiredPasswordRegistrationConstraints {\n  readonly request: \"unique(registration.moduleId,registration.requestId)\";\n  readonly recoveryReference: \"unique(registration.recoveryReference)\";\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n}\n\nexport const requiredPasswordRegistrationConstraints: RequiredPasswordRegistrationConstraints = {\n  request: \"unique(registration.moduleId,registration.requestId)\",\n  recoveryReference: \"unique(registration.recoveryReference)\",\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n};\n\nexport interface PasswordRegistrationConstraintClassifier {\n  readonly isRequestConflict: (cause: unknown) => boolean;\n  readonly isIdentifierConflict: (cause: unknown) => boolean;\n  readonly isCredentialConflict: (cause: unknown) => boolean;\n}\n\nexport type PasswordRegistrationMapping<\n  Registration,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Request extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordRegistrationConstraintClassifier & {\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;\n  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly registration: PasswordRegistrationTable<Registration, Request, NativeSubjectId>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredPasswordRegistrationConstraints;\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n} & (\n    | {\n        readonly mode: \"atomic\";\n        readonly provisioning: PasswordRegistrationProvisioning<\n          Registration,\n          Subject,\n          NativeSubjectId\n        > &\n          (\n            | {\n                readonly idMode: \"allocated\";\n                readonly allocateSubjectId: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n              }\n            | {\n                readonly idMode: \"synchronous\";\n                readonly allocateSubjectIdSync: () => NativeSubjectId;\n              }\n            | {\n                readonly idMode: \"generated\";\n                readonly decodeGeneratedId: (\n                  rows: ReadonlyArray<unknown>,\n                ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n              }\n          );\n      }\n    | {\n        readonly mode: \"pending\";\n        readonly allocateRecoveryReference?: Effect.Effect<\n          typeof RecoveryReference.Type,\n          PersistenceMappingError\n        >;\n        readonly allocateRecoveryReferenceSync?: () => typeof RecoveryReference.Type;\n      }\n  );\n\nexport type AnyPasswordPersistenceMapping<Expression extends SqlExpression = SqlExpression> =\n  PasswordPersistenceMapping<\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    unknown,\n    Expression\n  >;\n\nexport type AnyPasswordRegistrationMapping<\n  Registration = unknown,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordRegistrationMapping<\n  Registration,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  Expression\n>;\n"],"mappings":";;AAgJA,MAAa,8BAA2D;CACtE,YAAY;CACZ,qBAAqB;CACrB,mBAAmB;CACnB,cAAc;CACd,SAAS;AACX;AAkJA,MAAa,0CAAmF;CAC9F,SAAS;CACT,mBAAmB;CACnB,YAAY;CACZ,mBAAmB;CACnB,qBAAqB;AACvB"}
+{"version":3,"file":"password-model.mjs","names":[],"sources":["../../../src/internal/models/password-model.ts"],"sourcesContent":["import { type LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasswordAction,\n  PasswordCredentialSnapshot,\n  PasswordReplacement,\n  EncodedPasswordHash,\n} from \"@yielded/auth/Password\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport type { Effect, Redacted } from \"effect\";\n\nimport type { AnyTableModel, TableModel as Table, SqlExpression } from \"../table-model\";\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./common\";\nimport type { ProofClock } from \"./proof-model\";\n\ntype ColumnKey<T extends Table> = T[\"column\"];\n\nexport interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {\n  readonly table: Subject[\"table\"];\n  readonly id: ColumnKey<Subject>;\n  readonly status: ColumnKey<Subject>;\n  readonly securityRevision: ColumnKey<Subject>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly decodeRequirement: (\n    row: Subject[\"select\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Current policy for this exact credential mutation, decoded under the subject lock. */\n  readonly decodeActionRequirement: (\n    row: Subject[\"select\"],\n    action: PasswordAction,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  readonly nextSecurityRevision?: (\n    current: SecurityRevision,\n  ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  /** Required only by D1 conditional statements. */\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface PasswordIdentifierTable<\n  Identifier extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: Identifier[\"table\"];\n  readonly namespace: ColumnKey<Identifier>;\n  readonly value: ColumnKey<Identifier>;\n  readonly subjectId: ColumnKey<Identifier>;\n  readonly verifiedAt: ColumnKey<Identifier>;\n  readonly bindingRevision: ColumnKey<Identifier>;\n  /** Consumer-owned current login/recovery eligibility, including row status. */\n  readonly isCurrent: (row: Identifier[\"select\"]) => boolean;\n  /** Required by D1 so current ownership/eligibility is rechecked in the batch. */\n  readonly d1CurrentCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n  }) => Expression;\n  readonly encodeInitialInsert: (\n    identifier: LoginIdentifier,\n    subjectId: NativeSubjectId,\n    bindingRevision: SecurityRevision,\n  ) => Identifier[\"insert\"];\n}\n\nexport interface PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {\n  readonly table: Credential[\"table\"];\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly revision: ColumnKey<Credential>;\n  readonly status?: ColumnKey<Credential>;\n  readonly isActiveStatus?: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n  readonly encodeInsert: (input: {\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => Credential[\"insert\"];\n  readonly encodeRevision: (revision: SecurityRevision) => Partial<Credential[\"insert\"]>;\n}\n\nexport interface PasswordCredentialTable<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> {\n  readonly table: Credential[\"table\"];\n  readonly moduleId: ColumnKey<Credential>;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly credentialRevision: ColumnKey<Credential>;\n  readonly verifierVersion: ColumnKey<Credential>;\n  readonly verifier: ColumnKey<Credential>;\n  readonly normalization: ColumnKey<Credential>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly replacement: PasswordReplacement;\n  }) => Credential[\"insert\"];\n  readonly encodeVerifier: (\n    verifier: Redacted.Redacted<EncodedPasswordHash>,\n    verifierVersion: SecurityRevision,\n  ) => Partial<Credential[\"insert\"]>;\n  readonly encodeReplacement: (input: {\n    readonly replacement: PasswordReplacement;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n  }) => Partial<Credential[\"insert\"]>;\n  readonly decode: (input: {\n    readonly moduleId: string;\n    readonly subject: Subject[\"select\"];\n    readonly identifier: Identifier[\"select\"];\n    readonly credential: Credential[\"select\"];\n  }) => Effect.Effect<PasswordCredentialSnapshot, PersistenceMappingError>;\n}\n\nexport interface RequiredPasswordConstraints {\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n  readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n  readonly credentialId: \"unique(credential.moduleId,credential.credentialId)\";\n}\n\nexport const requiredPasswordConstraints: RequiredPasswordConstraints = {\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n  credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n  credentialId: \"unique(credential.moduleId,credential.credentialId)\",\n};\n\nexport interface PasswordPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;\n  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  /** Every factor revision named by action evidence, including non-password factors. */\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredPasswordConstraints;\n  readonly encodeInstant: (epochMillis: number) => unknown;\n  readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n  /** All semantic replacements still bump subject revision. This flag declares\n   * authoritative verification's invalidation latency; cookie exposure is separate. */\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n  readonly clock: ProofClock<Expression>;\n  readonly d1?: { readonly primary: true };\n}\n\nexport interface PasswordRegistrationIntent<Registration> {\n  readonly moduleId: string;\n  readonly requestId: string;\n  readonly identifier: LoginIdentifier;\n  readonly registration: Registration;\n  readonly replacement: PasswordReplacement;\n}\n\nexport interface PasswordRegistrationProvisioning<\n  Registration,\n  Subject extends Table,\n  NativeSubjectId,\n> {\n  readonly encodeSubjectInsert: (\n    input: PasswordRegistrationIntent<Registration>,\n    values: {\n      readonly nativeSubjectId: NativeSubjectId | undefined;\n      readonly securityRevision: SecurityRevision;\n    },\n  ) => Subject[\"insert\"];\n  readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n  readonly allocateSubjectIdSync?: () => NativeSubjectId;\n  /** Interactive targets use this for database-generated/autoincrement keys. */\n  readonly decodeGeneratedId?: (\n    rows: ReadonlyArray<unknown>,\n  ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n}\n\nexport interface RequiredPasswordRegistrationConstraints {\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n}\n\nexport const requiredPasswordRegistrationConstraints: RequiredPasswordRegistrationConstraints = {\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n};\n\nexport interface PasswordRegistrationConstraintClassifier {\n  readonly isIdentifierConflict: (cause: unknown) => boolean;\n  readonly isCredentialConflict: (cause: unknown) => boolean;\n}\n\nexport type PasswordRegistrationMapping<\n  Registration,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordRegistrationConstraintClassifier & {\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;\n  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredPasswordRegistrationConstraints;\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n} & {\n  readonly mode: \"atomic\";\n  readonly provisioning: PasswordRegistrationProvisioning<Registration, Subject, NativeSubjectId> &\n    (\n      | {\n          readonly idMode: \"allocated\";\n          readonly allocateSubjectId: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n        }\n      | {\n          readonly idMode: \"synchronous\";\n          readonly allocateSubjectIdSync: () => NativeSubjectId;\n        }\n      | {\n          readonly idMode: \"generated\";\n          readonly decodeGeneratedId: (\n            rows: ReadonlyArray<unknown>,\n          ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n        }\n    );\n};\n\nexport type AnyPasswordPersistenceMapping<Expression extends SqlExpression = SqlExpression> =\n  PasswordPersistenceMapping<\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    unknown,\n    Expression\n  >;\n\nexport type AnyPasswordRegistrationMapping<\n  Registration = unknown,\n  Expression extends SqlExpression = SqlExpression,\n> = PasswordRegistrationMapping<\n  Registration,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  Expression\n>;\n"],"mappings":";;AA6HA,MAAa,8BAA2D;CACtE,YAAY;CACZ,qBAAqB;CACrB,mBAAmB;CACnB,cAAc;AAChB;AAmEA,MAAa,0CAAmF;CAC9F,YAAY;CACZ,mBAAmB;CACnB,qBAAqB;AACvB"}

package/dist/internal/models/phone-model.d.mts

@@ -0,0 +1,86 @@
+import { AnyTableModel, SqlExpression, TableModel } from "../table-model.mjs";
+import { PersistenceMappingError } from "../mapping-error.mjs";
+import "./common.mjs";
+import { ProofPersistenceMapping } from "./proof-model.mjs";
+import { Effect } from "effect";
+import { PhoneLifecyclePolicy, PhoneNumber } from "@yielded/auth/PhoneOtp";
+import { AuthenticationRequirement } from "@yielded/auth/Sessions";
+import { SubjectId } from "@yielded/auth/Schema";
+//#region src/internal/models/phone-model.d.ts
+type PhoneColumn<T extends TableModel> = T["column"];
+export declare const requiredPhoneConstraints: {
+  readonly subject: "unique(id)";
+  readonly identifier: "unique(namespace,value)";
+  readonly credential: "unique(credentialId)";
+};
+/** Consumer-owned schema; encoders and allocators are synchronous and side-effect free.
+ * Identifiers store permanent number custody. Never delete retired rows to make a recycled number eligible. A consumer's
+ * explicit recovery workflow may resolve custody only after independent authentication.
+ * Subject defaults own account provisioning; no email/profile schema is prescribed. */
+export interface PhoneMapping<S extends TableModel, I extends TableModel, C extends TableModel, P extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+  readonly moduleId: string;
+  readonly policy: PhoneLifecyclePolicy;
+  readonly constraints: typeof requiredPhoneConstraints;
+  readonly proofs: ProofPersistenceMapping<P, S, N, Expression>;
+  readonly subjectIds: {
+    readonly toNative: (id: SubjectId) => N | Effect.Effect<N, PersistenceMappingError>;
+    readonly toSubject: (id: N) => SubjectId | Effect.Effect<SubjectId, PersistenceMappingError>;
+    readonly allocate?: () => N | Effect.Effect<N, PersistenceMappingError>;
+  };
+  readonly subject: {
+    readonly table: S["table"];
+    readonly id: PhoneColumn<S>;
+    readonly securityRevision: PhoneColumn<S>;
+    readonly activeCondition: Expression;
+    readonly decodeRequirement: (row: S["select"]) => AuthenticationRequirement | Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
+    /** Current action policy, independently from primary sign-in assurance. */
+    readonly decodeActionRequirement?: (row: S["select"], action: "verify" | "change") => AuthenticationRequirement | Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
+    readonly encodeInsert?: (input: {
+      readonly id: N;
+      readonly securityRevision: string;
+      readonly phoneNumber: PhoneNumber;
+    }) => S["insert"];
+  };
+  readonly identifier: {
+    readonly table: I["table"];
+    readonly moduleId: PhoneColumn<I>;
+    readonly credentialId: PhoneColumn<I>;
+    readonly namespace: PhoneColumn<I>;
+    readonly value: PhoneColumn<I>;
+    readonly subjectId: PhoneColumn<I>;
+    readonly revision: PhoneColumn<I>;
+    readonly verifiedAt: PhoneColumn<I>;
+    readonly status: PhoneColumn<I>;
+    readonly activeCondition: Expression;
+    readonly encodeStatus: (active: boolean) => unknown;
+    readonly encodeInsert: (input: {
+      readonly moduleId: string;
+      readonly credentialId: string;
+      readonly phoneNumber: PhoneNumber;
+      readonly subjectId: N;
+      readonly revision: string;
+      readonly verifiedAtMillis: number;
+      readonly active: boolean;
+    }) => I["insert"];
+  };
+  readonly credential: {
+    readonly table: C["table"];
+    readonly id: PhoneColumn<C>;
+    readonly subjectId: PhoneColumn<C>;
+    readonly revision: PhoneColumn<C>;
+    readonly status: PhoneColumn<C>;
+    readonly activeCondition: Expression;
+    readonly encodeStatus: (active: boolean) => unknown;
+    readonly encodeInsert: (input: {
+      readonly credentialId: string;
+      readonly subjectId: N;
+      readonly revision: string;
+      readonly active: boolean;
+    }) => C["insert"];
+  };
+  readonly encodeInstant: (millis: number) => unknown;
+  readonly engineNowMillis: Expression;
+}
+export type AnyPhoneMapping<Expression extends SqlExpression = SqlExpression> = PhoneMapping<AnyTableModel, AnyTableModel, AnyTableModel, AnyTableModel, unknown, Expression>;
+//#endregion
+//# sourceMappingURL=phone-model.d.mts.map

package/dist/internal/models/phone-model.mjs

@@ -0,0 +1,10 @@
+//#region src/internal/models/phone-model.ts
+const requiredPhoneConstraints = {
+	subject: "unique(id)",
+	identifier: "unique(namespace,value)",
+	credential: "unique(credentialId)"
+};
+//#endregion
+export { requiredPhoneConstraints };
+
+//# sourceMappingURL=phone-model.mjs.map

package/dist/internal/models/phone-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone-model.mjs","names":[],"sources":["../../../src/internal/models/phone-model.ts"],"sourcesContent":["import type { PhoneLifecyclePolicy, PhoneNumber } from \"@yielded/auth/PhoneOtp\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport type { Effect } from \"effect\";\n\nimport type { AnyTableModel, TableModel as Table, SqlExpression } from \"../table-model\";\nimport type { PersistenceMappingError } from \"./common\";\nimport type { ProofPersistenceMapping } from \"./proof-model\";\n\ntype PhoneColumn<T extends Table> = T[\"column\"];\n\nexport const requiredPhoneConstraints = {\n  subject: \"unique(id)\",\n  identifier: \"unique(namespace,value)\",\n  credential: \"unique(credentialId)\",\n} as const;\n\n/** Consumer-owned schema; encoders and allocators are synchronous and side-effect free.\n * Identifiers store permanent number custody. Never delete retired rows to make a recycled number eligible. A consumer's\n * explicit recovery workflow may resolve custody only after independent authentication.\n * Subject defaults own account provisioning; no email/profile schema is prescribed. */\nexport interface PhoneMapping<\n  S extends Table,\n  I extends Table,\n  C extends Table,\n  P extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly moduleId: string;\n  readonly policy: PhoneLifecyclePolicy;\n  readonly constraints: typeof requiredPhoneConstraints;\n  readonly proofs: ProofPersistenceMapping<P, S, N, Expression>;\n  readonly subjectIds: {\n    readonly toNative: (id: SubjectId) => N | Effect.Effect<N, PersistenceMappingError>;\n    readonly toSubject: (id: N) => SubjectId | Effect.Effect<SubjectId, PersistenceMappingError>;\n    readonly allocate?: () => N | Effect.Effect<N, PersistenceMappingError>;\n  };\n  readonly subject: {\n    readonly table: S[\"table\"];\n    readonly id: PhoneColumn<S>;\n    readonly securityRevision: PhoneColumn<S>;\n    readonly activeCondition: Expression;\n    readonly decodeRequirement: (\n      row: S[\"select\"],\n    ) =>\n      | AuthenticationRequirement\n      | Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n    /** Current action policy, independently from primary sign-in assurance. */\n    readonly decodeActionRequirement?: (\n      row: S[\"select\"],\n      action: \"verify\" | \"change\",\n    ) =>\n      | AuthenticationRequirement\n      | Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n    readonly encodeInsert?: (input: {\n      readonly id: N;\n      readonly securityRevision: string;\n      readonly phoneNumber: PhoneNumber;\n    }) => S[\"insert\"];\n  };\n  readonly identifier: {\n    readonly table: I[\"table\"];\n    readonly moduleId: PhoneColumn<I>;\n    readonly credentialId: PhoneColumn<I>;\n    readonly namespace: PhoneColumn<I>;\n    readonly value: PhoneColumn<I>;\n    readonly subjectId: PhoneColumn<I>;\n    readonly revision: PhoneColumn<I>;\n    readonly verifiedAt: PhoneColumn<I>;\n    readonly status: PhoneColumn<I>;\n    readonly activeCondition: Expression;\n    readonly encodeStatus: (active: boolean) => unknown;\n    readonly encodeInsert: (input: {\n      readonly moduleId: string;\n      readonly credentialId: string;\n      readonly phoneNumber: PhoneNumber;\n      readonly subjectId: N;\n      readonly revision: string;\n      readonly verifiedAtMillis: number;\n      readonly active: boolean;\n    }) => I[\"insert\"];\n  };\n  readonly credential: {\n    readonly table: C[\"table\"];\n    readonly id: PhoneColumn<C>;\n    readonly subjectId: PhoneColumn<C>;\n    readonly revision: PhoneColumn<C>;\n    readonly status: PhoneColumn<C>;\n    readonly activeCondition: Expression;\n    readonly encodeStatus: (active: boolean) => unknown;\n    readonly encodeInsert: (input: {\n      readonly credentialId: string;\n      readonly subjectId: N;\n      readonly revision: string;\n      readonly active: boolean;\n    }) => C[\"insert\"];\n  };\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly engineNowMillis: Expression;\n}\n\nexport type AnyPhoneMapping<Expression extends SqlExpression = SqlExpression> = PhoneMapping<\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  Expression\n>;\n"],"mappings":";AAWA,MAAa,2BAA2B;CACtC,SAAS;CACT,YAAY;CACZ,YAAY;AACd"}