@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/proof-native.mjs

@@ -0,0 +1,289 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { sqlBatchAssertion } from "./d1-planning.mjs";
+import { exactSqlText, executeSqlChange } from "./sql-change.mjs";
+import { CurrentSqlCommit, SqlBatchCommit, appendSqlBatchStatement, makeSqlCommitExecutor, registerSqlBatchPostcondition, registerSqlCommitReceipt, registerSqlPostcondition } from "./sql-commit.mjs";
+import { cleanupSqlRows } from "./sql-cleanup.mjs";
+import { Crypto, Effect, Option, Schema } from "effect";
+import { CurrentCommitJournal } from "@yielded/auth/Hooks";
+import * as P from "@yielded/auth/Proofs";
+import { SqlClient } from "effect/sql/SqlClient";
+import { Base64Url } from "effect/encoding";
+//#region src/internal/proof-native.ts
+const bindingJson = Schema.encodeSync(Schema.fromJsonString(P.ProofBinding));
+const decodeBinding = Schema.decodeUnknownSync(Schema.fromJsonString(P.ProofBinding));
+const unavailable = () => P.ProofUnavailable.make({});
+const invariant = (condition) => {
+	if (!condition) throw PersistenceMappingError.make({
+		operation: "decode",
+		cause: "Invalid proof state"
+	});
+};
+/** Flow/context changes do not allocate new durable series. The hash bounds the
+* indexed key; the complete canonical binding is still checked independently. */
+const seriesKey = Effect.fnUntraced(function* (binding) {
+	const crypto = yield* Crypto.Crypto;
+	const tuple = Schema.encodeSync(Schema.fromJsonString(Schema.Array(Schema.NullOr(Schema.String))))([
+		"effect-auth/proof-series/v1",
+		binding.identifier.namespace,
+		binding.identifier.value,
+		binding._tag === "Identifier" ? null : binding.revision.subjectId
+	]);
+	return Base64Url.encode(yield* crypto.digest("SHA-256", new TextEncoder().encode(tuple)));
+});
+/** Shared native statements. A protected mutation calls redeemLocked only after
+* taking its subject lock; bare redemption calls lockSubject first. */
+const makeNativeProofStore = Effect.fnUntraced(function* (tables, mapping, batch = false) {
+	const externalOwner = yield* Effect.serviceOption(CurrentSqlCommit);
+	const sql = (yield* SqlClient).withoutTransforms();
+	const crypto = yield* Crypto.Crypto;
+	const p = mapping.proof;
+	const proof = tables(p.table);
+	const subject = tables(mapping.subject.table);
+	const mysql = sql.onDialectOrElse({
+		mysql: () => true,
+		orElse: () => false
+	});
+	const locking = sql.onDialectOrElse({
+		sqlite: () => sql``,
+		orElse: () => sql`for update`
+	});
+	const rowLocks = !batch && sql.onDialectOrElse({
+		sqlite: () => false,
+		orElse: () => true
+	});
+	const now = tables.expression(mapping.clock.engineNowMillis);
+	const millis = (key) => tables.expression(mapping.clock.toMillis(proof.column(key)));
+	const instant = (value) => tables.expression(mapping.clock.fromMillis(sql`(${value})`));
+	const exact = (key, value) => exactSqlText(sql, proof.column(key), proof.value(key, value));
+	const series = Effect.fnUntraced(function* (input) {
+		const key = yield* seriesKey(input.binding).pipe(Effect.provideService(Crypto.Crypto, crypto));
+		return {
+			key,
+			predicate: sql.and([
+				exact(p.moduleId, input.moduleId),
+				exact(p.purpose, input.purpose),
+				exact(p.seriesKey, key)
+			])
+		};
+	});
+	const decode = (row) => {
+		const value = proof.decode(row, "proof_");
+		return Schema.decodeUnknownSync(P.ProofRecord)({
+			moduleId: value[p.moduleId],
+			purpose: value[p.purpose],
+			proofId: value[p.proofId],
+			binding: decodeBinding(value[p.binding]),
+			verifier: {
+				keyId: value[p.verifierKeyId],
+				digest: value[p.verifierDigest]
+			},
+			issuedAtMillis: mapping.clock.decodeInstant(value[p.issuedAt]),
+			expiresAtMillis: mapping.clock.decodeInstant(value[p.expiresAt])
+		});
+	};
+	const clock = Effect.gen(function* () {
+		const rows = yield* sql`select ${now} as engine_now`;
+		return yield* Schema.decodeEffect(P.ProofInstant)(Number(rows[0]?.engine_now));
+	});
+	const lockSubject = Effect.fnUntraced(function* (binding) {
+		if (binding._tag === "Identifier") return true;
+		const nativeId = yield* mapping.subjectId.toNative(binding.revision.subjectId);
+		const condition = sql`${subject.column(mapping.subject.id)} = ${subject.value(mapping.subject.id, nativeId)}`;
+		const rows = yield* sql`select ${subject.fields("proof_subject_")} from ${subject.name} where ${condition} ${batch ? sql`` : locking}`;
+		if (rows.length === 0) return false;
+		invariant(rows.length === 1);
+		const value = subject.decode(rows[0], "proof_subject_");
+		const decoded = yield* mapping.subjectId.toSubject(value[mapping.subject.id]);
+		invariant(decoded === binding.revision.subjectId);
+		if (batch) yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`exists(select 1 from ${subject.name} where ${condition})`));
+		return true;
+	});
+	const issue = Effect.fnUntraced(function* (input) {
+		if (!input.eligible) return { _tag: "Suppressed" };
+		const record = yield* Schema.decodeEffect(P.ProofIssueRecord)(input.record);
+		invariant(Number.isSafeInteger(input.lifetimeMillis) && input.lifetimeMillis > 0 && Number.isSafeInteger(input.resendCooldownMillis) && input.resendCooldownMillis >= 0);
+		const key = yield* series(record);
+		const binding = bindingJson(record.binding);
+		const decisionNow = batch || mysql ? now : sql`(select instant from effect_auth_proof_clock)`;
+		const allowed = sql.and([sql`${millis(p.issuedAt)} + ${input.resendCooldownMillis} <= ${decisionNow}`, sql`(${millis(p.expiresAt)} <= ${decisionNow} or ${exact(p.binding, binding)})`]);
+		let sampled;
+		if (batch || mysql) {
+			const rows = yield* sql`select ${proof.fields("proof_")} from ${proof.name} where ${key.predicate} ${mysql ? locking : sql``}`;
+			sampled = yield* clock;
+			invariant(rows.length <= 1);
+			if (rows[0] !== void 0) {
+				const old = decode(rows[0]);
+				if (old.issuedAtMillis + input.resendCooldownMillis > sampled || old.expiresAtMillis > sampled && bindingJson(old.binding) !== binding) return { _tag: "Suppressed" };
+			}
+		}
+		const issuedAt = sampled === void 0 ? instant(decisionNow) : mapping.clock.encodeInstant(sampled);
+		const expiresAt = sampled === void 0 ? instant(sql`${decisionNow} + ${input.lifetimeMillis}`) : mapping.clock.encodeInstant(sampled + input.lifetimeMillis);
+		const values = {
+			...p.encodeInsert({
+				record,
+				seriesKey: key.key
+			}),
+			[p.moduleId]: record.moduleId,
+			[p.purpose]: record.purpose,
+			[p.seriesKey]: key.key,
+			[p.proofId]: record.proofId,
+			[p.binding]: binding,
+			[p.verifierKeyId]: record.verifier.keyId,
+			[p.verifierDigest]: record.verifier.digest,
+			[p.issuedAt]: issuedAt,
+			[p.expiresAt]: expiresAt,
+			[p.failedAttempts]: 0
+		};
+		if (mysql) {
+			if ((yield* executeSqlChange(sql, sql`${proof.update(values)} where ${key.predicate} and ${allowed}`)) === 0) yield* sql`${proof.insert(values)}`;
+			invariant(sampled !== void 0);
+			return {
+				_tag: "Issued",
+				record: yield* Schema.decodeEffect(P.ProofRecord)({
+					...record,
+					issuedAtMillis: sampled,
+					expiresAtMillis: sampled + input.lifetimeMillis
+				})
+			};
+		}
+		const replaced = [
+			p.proofId,
+			p.binding,
+			p.verifierKeyId,
+			p.verifierDigest,
+			p.issuedAt,
+			p.expiresAt,
+			p.failedAttempts
+		];
+		const excluded = proof.as("excluded");
+		const upsert = sql`${proof.insert(values)} on conflict (${sql.join(", ", false)([
+			p.moduleId,
+			p.purpose,
+			p.seriesKey
+		].map(proof.columnName))}) do update set ${sql.join(", ", false)(replaced.map((key) => sql`${proof.columnName(key)} = ${excluded.column(key)}`))} where ${allowed}`;
+		if (batch) {
+			invariant(sampled !== void 0);
+			yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`${now} >= ${sampled} and ${now} < ${sampled + input.lifetimeMillis}`));
+			yield* appendSqlBatchStatement(upsert);
+			yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));
+			return {
+				_tag: "Issued",
+				record: yield* Schema.decodeEffect(P.ProofRecord)({
+					...record,
+					issuedAtMillis: sampled,
+					expiresAtMillis: sampled + input.lifetimeMillis
+				})
+			};
+		}
+		const rows = yield* sql`with effect_auth_proof_clock as materialized (select ${now} as instant) ${upsert} returning ${proof.fields("proof_")}`;
+		invariant(rows.length <= 1);
+		return rows[0] === void 0 ? { _tag: "Suppressed" } : {
+			_tag: "Issued",
+			record: decode(rows[0])
+		};
+	});
+	const redeemLocked = Effect.fnUntraced(function* (original) {
+		const input = yield* Schema.decodeEffect(P.ProofRedemptionInput)(original);
+		const key = yield* series(input);
+		const current = sql.and([
+			key.predicate,
+			exact(p.proofId, input.proofId),
+			exact(p.binding, bindingJson(input.binding)),
+			sql`${millis(p.issuedAt)} <= ${now}`,
+			sql`${millis(p.expiresAt)} > ${now}`,
+			sql`${proof.column(p.failedAttempts)} >= 0`,
+			sql`${proof.column(p.failedAttempts)} < ${input.maximumFailedAttempts}`
+		]);
+		const valid = sql.and([current, input.candidate === void 0 ? sql`1 = 0` : sql.and([exact(p.verifierKeyId, input.candidate.keyId), exact(p.verifierDigest, input.candidate.digest)])]);
+		if (input.binding._tag === "Identifier" && rowLocks) yield* sql`select 1 from ${proof.name} where ${current} ${locking}`;
+		const deletion = sql`delete from ${proof.name} where ${valid}`;
+		const rows = batch || mysql ? yield* sql`select ${proof.fields("proof_")} from ${proof.name} where ${valid} ${mysql ? locking : sql``}` : yield* sql`${deletion} returning ${proof.fields("proof_")}`;
+		invariant(rows.length <= 1);
+		if (rows[0] === void 0) {
+			const failure = sql`${proof.update({ [p.failedAttempts]: sql`${proof.column(p.failedAttempts)} + 1` })} where ${current}`;
+			if (batch) {
+				yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`not exists(select 1 from ${proof.name} where ${valid})`));
+				yield* appendSqlBatchStatement(failure);
+			} else yield* sql`${failure}`;
+			return { decision: "rejected" };
+		}
+		const consumed = decode(rows[0]);
+		if (mysql) invariant((yield* executeSqlChange(sql, deletion)) === 1);
+		if (batch) {
+			yield* appendSqlBatchStatement(deletion);
+			yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));
+		}
+		const validUntil = sql`${now} >= ${consumed.issuedAtMillis} and ${now} < ${consumed.expiresAtMillis}`;
+		if (Option.isSome(externalOwner) && externalOwner.value.origin === "application") {
+			const absent = sql`not exists(select 1 from ${proof.name} where ${exact(p.moduleId, input.moduleId)} and ${exact(p.proofId, input.proofId)})`;
+			const condition = sql`${absent} and ${validUntil}`;
+			if (batch) yield* registerSqlBatchPostcondition({
+				name: "proof-redemption",
+				statement: sqlBatchAssertion(sql, condition)
+			});
+			else yield* registerSqlPostcondition({
+				name: "proof-redemption",
+				check: Effect.gen(function* () {
+					const rows = yield* sql`select 1 as valid where ${condition}`;
+					invariant(rows.length === 1);
+				})
+			});
+		}
+		return {
+			decision: "redeemed",
+			validUntil
+		};
+	});
+	const cancel = Effect.fnUntraced(function* (input) {
+		const key = yield* series(input);
+		const deletion = sql`delete from ${proof.name} where ${key.predicate} and ${exact(p.binding, bindingJson(input.binding))}`;
+		if (batch) yield* appendSqlBatchStatement(deletion);
+		else yield* sql`${deletion}`;
+	});
+	const cleanup = (input) => cleanupSqlRows([{
+		table: proof,
+		keys: [p.moduleId, p.proofId],
+		due: sql`${exact(p.moduleId, input.moduleId)} and ${millis(p.expiresAt)} <= ${now}`,
+		order: [proof.column(p.expiresAt), proof.column(p.proofId)]
+	}], input.limit, batch);
+	return {
+		issue,
+		lockSubject,
+		redeemLocked,
+		cancel,
+		cleanup,
+		mysql
+	};
+});
+const makeNativeProofServices = Effect.fnUntraced(function* (tables, mapping) {
+	const batch = yield* SqlBatchCommit;
+	const executor = yield* makeSqlCommitExecutor(unavailable);
+	const store = yield* makeNativeProofStore(tables, mapping, batch !== void 0);
+	const run = (effect, mode = "transaction") => batch === void 0 ? executor.run(effect, mode) : executor.batch(effect).pipe(Effect.provideService(SqlBatchCommit, batch));
+	const prepare = (value, project) => Effect.gen(function* () {
+		const receipt = project(value, yield* CurrentCommitJournal);
+		invariant(receipt?._tag === "PreparedCommit" && Effect.isEffect(receipt.read));
+		yield* registerSqlCommitReceipt(receipt);
+		return receipt;
+	});
+	return { proofPersistence: {
+		issue: (input, project) => run(Effect.gen(function* () {
+			return yield* prepare(yield* store.issue(input), project);
+		}), store.mysql ? "transaction" : "statement"),
+		redeem: (input, project) => run(Effect.gen(function* () {
+			const locked = yield* store.lockSubject(input.binding);
+			return yield* prepare(locked ? (yield* store.redeemLocked(input)).decision : "rejected", project);
+		})),
+		cancel: (input, project) => run(Effect.gen(function* () {
+			yield* store.cancel(input);
+			return yield* prepare(void 0, project);
+		}), "statement"),
+		cleanup: (input, project) => run(Effect.gen(function* () {
+			return yield* prepare(yield* store.cleanup(input), project);
+		}), "statement")
+	} };
+});
+//#endregion
+export { makeNativeProofServices, makeNativeProofStore };
+
+//# sourceMappingURL=proof-native.mjs.map

package/dist/internal/proof-native.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-native.mjs","names":[],"sources":["../../src/internal/proof-native.ts"],"sourcesContent":["import { CurrentCommitJournal, type LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport * as P from \"@yielded/auth/Proofs\";\nimport { Crypto, Effect, Option, Schema, type PlatformError } from \"effect\";\nimport { Base64Url } from \"effect/encoding\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\nimport type { SqlError } from \"effect/sql/SqlError\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type { AnyProofPersistenceMapping } from \"./models/proof-model\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { exactSqlText, executeSqlChange } from \"./sql-change\";\nimport { cleanupSqlRows } from \"./sql-cleanup\";\nimport {\n  appendSqlBatchStatement,\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  registerSqlBatchPostcondition,\n  registerSqlCommitReceipt,\n  registerSqlPostcondition,\n  SqlBatchCommit,\n  type SqlCommitOwnerError,\n} from \"./sql-commit\";\n\nconst bindingJson = Schema.encodeSync(Schema.fromJsonString(P.ProofBinding));\nconst decodeBinding = Schema.decodeUnknownSync(Schema.fromJsonString(P.ProofBinding));\nconst unavailable = () => P.ProofUnavailable.make({});\n\nconst invariant: (condition: unknown) => asserts condition = (condition) => {\n  if (!condition)\n    throw PersistenceMappingError.make({ operation: \"decode\", cause: \"Invalid proof state\" });\n};\n\n/** Flow/context changes do not allocate new durable series. The hash bounds the\n * indexed key; the complete canonical binding is still checked independently. */\nconst seriesKey = Effect.fnUntraced(function* (binding: P.ProofBinding) {\n  const crypto = yield* Crypto.Crypto;\n\n  const tuple = Schema.encodeSync(\n    Schema.fromJsonString(Schema.Array(Schema.NullOr(Schema.String))),\n  )([\n    \"effect-auth/proof-series/v1\",\n    binding.identifier.namespace,\n    binding.identifier.value,\n    binding._tag === \"Identifier\" ? null : binding.revision.subjectId,\n  ]);\n\n  return Base64Url.encode(yield* crypto.digest(\"SHA-256\", new TextEncoder().encode(tuple)));\n});\n\n/** Shared native statements. A protected mutation calls redeemLocked only after\n * taking its subject lock; bare redemption calls lockSubject first. */\nexport const makeNativeProofStore = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: AnyProofPersistenceMapping,\n  batch = false,\n) {\n  const externalOwner = yield* Effect.serviceOption(CurrentSqlCommit);\n  const sql = (yield* SqlClient).withoutTransforms();\n  const crypto = yield* Crypto.Crypto;\n  const p = mapping.proof;\n  const proof = tables(p.table);\n  const subject = tables(mapping.subject.table);\n  const mysql = sql.onDialectOrElse({ mysql: () => true, orElse: () => false });\n  const locking = sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` });\n  const rowLocks = !batch && sql.onDialectOrElse({ sqlite: () => false, orElse: () => true });\n  const now = tables.expression(mapping.clock.engineNowMillis);\n  const millis = (key: string) => tables.expression(mapping.clock.toMillis(proof.column(key)));\n  const instant = (value: Fragment) => tables.expression(mapping.clock.fromMillis(sql`(${value})`));\n\n  const exact = (key: string, value: unknown) =>\n    exactSqlText(sql, proof.column(key), proof.value(key, value));\n\n  const series = Effect.fnUntraced(function* (input: {\n    readonly moduleId: string;\n    readonly purpose: P.ProofPurpose;\n    readonly binding: P.ProofBinding;\n  }) {\n    const key = yield* seriesKey(input.binding).pipe(Effect.provideService(Crypto.Crypto, crypto));\n\n    return {\n      key,\n      predicate: sql.and([\n        exact(p.moduleId, input.moduleId),\n        exact(p.purpose, input.purpose),\n        exact(p.seriesKey, key),\n      ]),\n    };\n  });\n\n  const decode = (row: Readonly<Record<string, unknown>>) => {\n    const value = proof.decode(row, \"proof_\");\n\n    return Schema.decodeUnknownSync(P.ProofRecord)({\n      moduleId: value[p.moduleId],\n      purpose: value[p.purpose],\n      proofId: value[p.proofId],\n      binding: decodeBinding(value[p.binding]),\n      verifier: { keyId: value[p.verifierKeyId], digest: value[p.verifierDigest] },\n      issuedAtMillis: mapping.clock.decodeInstant(value[p.issuedAt]),\n      expiresAtMillis: mapping.clock.decodeInstant(value[p.expiresAt]),\n    });\n  };\n\n  const clock = Effect.gen(function* () {\n    const rows = yield* sql`select ${now} as engine_now`;\n\n    return yield* Schema.decodeEffect(P.ProofInstant)(Number(rows[0]?.engine_now));\n  });\n\n  const lockSubject = Effect.fnUntraced(function* (binding: P.ProofBinding) {\n    if (binding._tag === \"Identifier\") return true;\n    const nativeId = yield* mapping.subjectId.toNative(binding.revision.subjectId);\n    const condition = sql`${subject.column(mapping.subject.id)} = ${subject.value(mapping.subject.id, nativeId)}`;\n\n    const rows =\n      yield* sql`select ${subject.fields(\"proof_subject_\")} from ${subject.name} where ${condition} ${batch ? sql`` : locking}`;\n\n    if (rows.length === 0) return false;\n    invariant(rows.length === 1);\n    const value = subject.decode(rows[0]!, \"proof_subject_\");\n    const decoded = yield* mapping.subjectId.toSubject(value[mapping.subject.id]);\n\n    invariant(decoded === binding.revision.subjectId);\n    if (batch)\n      yield* appendSqlBatchStatement(\n        sqlBatchAssertion(sql, sql`exists(select 1 from ${subject.name} where ${condition})`),\n      );\n\n    return true;\n  });\n\n  const issue = Effect.fnUntraced(function* (\n    input: Parameters<P.ProofPersistence[\"Service\"][\"issue\"]>[0],\n  ): Effect.fn.Return<\n    P.ProofIssueDecision,\n    | SqlError\n    | Schema.SchemaError\n    | PlatformError.PlatformError\n    | PersistenceMappingError\n    | SqlCommitOwnerError,\n    CurrentSqlCommit\n  > {\n    if (!input.eligible) return { _tag: \"Suppressed\" };\n    const record = yield* Schema.decodeEffect(P.ProofIssueRecord)(input.record);\n\n    invariant(\n      Number.isSafeInteger(input.lifetimeMillis) &&\n        input.lifetimeMillis > 0 &&\n        Number.isSafeInteger(input.resendCooldownMillis) &&\n        input.resendCooldownMillis >= 0,\n    );\n    const key = yield* series(record);\n    const binding = bindingJson(record.binding);\n    // PostgreSQL's clock_timestamp is volatile. One materialized sample owns\n    // both timestamps and this upsert's cooldown/expiry decision.\n    const decisionNow = batch || mysql ? now : sql`(select instant from effect_auth_proof_clock)`;\n\n    const allowed = sql.and([\n      sql`${millis(p.issuedAt)} + ${input.resendCooldownMillis} <= ${decisionNow}`,\n      sql`(${millis(p.expiresAt)} <= ${decisionNow} or ${exact(p.binding, binding)})`,\n    ]);\n\n    let sampled: number | undefined;\n\n    if (batch || mysql) {\n      const rows =\n        yield* sql`select ${proof.fields(\"proof_\")} from ${proof.name} where ${key.predicate} ${mysql ? locking : sql``}`;\n\n      sampled = yield* clock;\n      invariant(rows.length <= 1);\n      if (rows[0] !== undefined) {\n        const old = decode(rows[0]);\n\n        if (\n          old.issuedAtMillis + input.resendCooldownMillis > sampled ||\n          (old.expiresAtMillis > sampled && bindingJson(old.binding) !== binding)\n        )\n          return { _tag: \"Suppressed\" };\n      }\n    }\n\n    const issuedAt =\n      sampled === undefined ? instant(decisionNow) : mapping.clock.encodeInstant(sampled);\n\n    const expiresAt =\n      sampled === undefined\n        ? instant(sql`${decisionNow} + ${input.lifetimeMillis}`)\n        : mapping.clock.encodeInstant(sampled + input.lifetimeMillis);\n\n    const values = {\n      ...p.encodeInsert({ record, seriesKey: key.key }),\n      [p.moduleId]: record.moduleId,\n      [p.purpose]: record.purpose,\n      [p.seriesKey]: key.key,\n      [p.proofId]: record.proofId,\n      [p.binding]: binding,\n      [p.verifierKeyId]: record.verifier.keyId,\n      [p.verifierDigest]: record.verifier.digest,\n      [p.issuedAt]: issuedAt,\n      [p.expiresAt]: expiresAt,\n      [p.failedAttempts]: 0,\n    };\n\n    if (mysql) {\n      const changed = yield* executeSqlChange(\n        sql,\n        sql`${proof.update(values)} where ${key.predicate} and ${allowed}`,\n      );\n\n      if (changed === 0) yield* sql`${proof.insert(values)}`;\n      invariant(sampled !== undefined);\n\n      return {\n        _tag: \"Issued\",\n        record: yield* Schema.decodeEffect(P.ProofRecord)({\n          ...record,\n          issuedAtMillis: sampled,\n          expiresAtMillis: sampled! + input.lifetimeMillis,\n        }),\n      };\n    }\n\n    const replaced = [\n      p.proofId,\n      p.binding,\n      p.verifierKeyId,\n      p.verifierDigest,\n      p.issuedAt,\n      p.expiresAt,\n      p.failedAttempts,\n    ];\n\n    const excluded = proof.as(\"excluded\");\n    const upsert = sql`${proof.insert(values)} on conflict (${sql.join(\", \", false)([p.moduleId, p.purpose, p.seriesKey].map(proof.columnName))}) do update set ${sql.join(\", \", false)(replaced.map((key) => sql`${proof.columnName(key)} = ${excluded.column(key)}`))} where ${allowed}`;\n\n    if (batch) {\n      invariant(sampled !== undefined);\n      yield* appendSqlBatchStatement(\n        sqlBatchAssertion(\n          sql,\n          sql`${now} >= ${sampled} and ${now} < ${sampled! + input.lifetimeMillis}`,\n        ),\n      );\n      yield* appendSqlBatchStatement(upsert);\n      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));\n\n      return {\n        _tag: \"Issued\",\n        record: yield* Schema.decodeEffect(P.ProofRecord)({\n          ...record,\n          issuedAtMillis: sampled,\n          expiresAtMillis: sampled! + input.lifetimeMillis,\n        }),\n      };\n    }\n\n    const rows =\n      yield* sql`with effect_auth_proof_clock as materialized (select ${now} as instant) ${upsert} returning ${proof.fields(\"proof_\")}`;\n\n    invariant(rows.length <= 1);\n\n    return rows[0] === undefined\n      ? { _tag: \"Suppressed\" }\n      : { _tag: \"Issued\", record: decode(rows[0]) };\n  });\n\n  const redeemLocked = Effect.fnUntraced(function* (original: P.ProofRedemptionInput) {\n    const input = yield* Schema.decodeEffect(P.ProofRedemptionInput)(original);\n    const key = yield* series(input);\n\n    const current = sql.and([\n      key.predicate,\n      exact(p.proofId, input.proofId),\n      exact(p.binding, bindingJson(input.binding)),\n      sql`${millis(p.issuedAt)} <= ${now}`,\n      sql`${millis(p.expiresAt)} > ${now}`,\n      sql`${proof.column(p.failedAttempts)} >= 0`,\n      sql`${proof.column(p.failedAttempts)} < ${input.maximumFailedAttempts}`,\n    ]);\n\n    const valid = sql.and([\n      current,\n      input.candidate === undefined\n        ? sql`1 = 0`\n        : sql.and([\n            exact(p.verifierKeyId, input.candidate.keyId),\n            exact(p.verifierDigest, input.candidate.digest),\n          ]),\n    ]);\n\n    // No subject lock serializes an identifier-bound proof. Lock its row first so\n    // concurrent wrong guesses cannot all compare before any of them is charged.\n    if (input.binding._tag === \"Identifier\" && rowLocks)\n      yield* sql`select 1 from ${proof.name} where ${current} ${locking}`;\n\n    const deletion = sql`delete from ${proof.name} where ${valid}`;\n\n    const rows =\n      batch || mysql\n        ? yield* sql`select ${proof.fields(\"proof_\")} from ${proof.name} where ${valid} ${mysql ? locking : sql``}`\n        : yield* sql`${deletion} returning ${proof.fields(\"proof_\")}`;\n\n    invariant(rows.length <= 1);\n    if (rows[0] === undefined) {\n      const failure = sql`${proof.update({ [p.failedAttempts]: sql`${proof.column(p.failedAttempts)} + 1` })} where ${current}`;\n\n      if (batch) {\n        // The planning miss never authorizes charging or accepting a replacement.\n        yield* appendSqlBatchStatement(\n          sqlBatchAssertion(sql, sql`not exists(select 1 from ${proof.name} where ${valid})`),\n        );\n        yield* appendSqlBatchStatement(failure);\n      } else yield* sql`${failure}`;\n\n      return { decision: \"rejected\" as const };\n    }\n    const consumed = decode(rows[0]);\n\n    if (mysql) invariant((yield* executeSqlChange(sql, deletion)) === 1);\n    if (batch) {\n      yield* appendSqlBatchStatement(deletion);\n      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));\n    }\n    const validUntil = sql`${now} >= ${consumed.issuedAtMillis} and ${now} < ${consumed.expiresAtMillis}`;\n\n    if (Option.isSome(externalOwner) && externalOwner.value.origin === \"application\") {\n      const absent = sql`not exists(select 1 from ${proof.name} where ${exact(p.moduleId, input.moduleId)} and ${exact(p.proofId, input.proofId)})`;\n      const condition = sql`${absent} and ${validUntil}`;\n\n      if (batch)\n        yield* registerSqlBatchPostcondition({\n          name: \"proof-redemption\",\n          statement: sqlBatchAssertion(sql, condition),\n        });\n      else\n        yield* registerSqlPostcondition({\n          name: \"proof-redemption\",\n          check: Effect.gen(function* () {\n            const rows = yield* sql`select 1 as valid where ${condition}`;\n\n            invariant(rows.length === 1);\n          }),\n        });\n    }\n\n    return { decision: \"redeemed\" as const, validUntil };\n  });\n\n  const cancel = Effect.fnUntraced(function* (\n    input: Parameters<P.ProofPersistence[\"Service\"][\"cancel\"]>[0],\n  ) {\n    const key = yield* series(input);\n    const deletion = sql`delete from ${proof.name} where ${key.predicate} and ${exact(p.binding, bindingJson(input.binding))}`;\n\n    if (batch) yield* appendSqlBatchStatement(deletion);\n    else yield* sql`${deletion}`;\n  });\n\n  const cleanup = (input: Parameters<P.ProofPersistence[\"Service\"][\"cleanup\"]>[0]) =>\n    cleanupSqlRows(\n      [\n        {\n          table: proof,\n          keys: [p.moduleId, p.proofId],\n          due: sql`${exact(p.moduleId, input.moduleId)} and ${millis(p.expiresAt)} <= ${now}`,\n          order: [proof.column(p.expiresAt), proof.column(p.proofId)],\n        },\n      ],\n      input.limit,\n      batch,\n    );\n\n  return { issue, lockSubject, redeemLocked, cancel, cleanup, mysql };\n});\n\nexport const makeNativeProofServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: AnyProofPersistenceMapping,\n): Effect.fn.Return<\n  { readonly proofPersistence: P.ProofPersistence[\"Service\"] },\n  P.ProofUnavailable,\n  SqlClient | LifecycleHooks | Crypto.Crypto | SqlBatchCommit\n> {\n  const batch = yield* SqlBatchCommit;\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const store = yield* makeNativeProofStore(tables, mapping, batch !== undefined);\n\n  const run = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) =>\n    batch === undefined\n      ? executor.run(effect, mode)\n      : executor.batch(effect).pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const prepare = <Value, A>(value: Value, project: P.PrepareProofCommit<Value, A>) =>\n    Effect.gen(function* () {\n      const journal = yield* CurrentCommitJournal;\n\n      const receipt = project(value, journal);\n\n      invariant(receipt?._tag === \"PreparedCommit\" && Effect.isEffect(receipt.read));\n      yield* registerSqlCommitReceipt(receipt);\n\n      return receipt;\n    });\n\n  const proofPersistence: P.ProofPersistence[\"Service\"] = {\n    issue: (input, project) =>\n      run(\n        Effect.gen(function* () {\n          return yield* prepare(yield* store.issue(input), project);\n        }),\n        store.mysql ? \"transaction\" : \"statement\",\n      ),\n    redeem: (input, project) =>\n      run(\n        Effect.gen(function* () {\n          const locked = yield* store.lockSubject(input.binding);\n\n          return yield* prepare(\n            locked ? (yield* store.redeemLocked(input)).decision : \"rejected\",\n            project,\n          );\n        }),\n      ),\n    cancel: (input, project) =>\n      run(\n        Effect.gen(function* () {\n          yield* store.cancel(input);\n\n          return yield* prepare(undefined, project);\n        }),\n        \"statement\",\n      ),\n    cleanup: (input, project) =>\n      run(\n        Effect.gen(function* () {\n          return yield* prepare(yield* store.cleanup(input), project);\n        }),\n        \"statement\",\n      ),\n  };\n\n  return { proofPersistence };\n});\n"],"mappings":";;;;;;;;;;;AAyBA,MAAM,cAAc,OAAO,WAAW,OAAO,eAAe,EAAE,YAAY,CAAC;AAC3E,MAAM,gBAAgB,OAAO,kBAAkB,OAAO,eAAe,EAAE,YAAY,CAAC;AACpF,MAAM,oBAAoB,EAAE,iBAAiB,KAAK,CAAC,CAAC;AAEpD,MAAM,aAAwD,cAAc;CAC1E,IAAI,CAAC,WACH,MAAM,wBAAwB,KAAK;EAAE,WAAW;EAAU,OAAO;CAAsB,CAAC;AAC5F;;;AAIA,MAAM,YAAY,OAAO,WAAW,WAAW,SAAyB;CACtE,MAAM,SAAS,OAAO,OAAO;CAE7B,MAAM,QAAQ,OAAO,WACnB,OAAO,eAAe,OAAO,MAAM,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,CAClE,CAAC,CAAC;EACA;EACA,QAAQ,WAAW;EACnB,QAAQ,WAAW;EACnB,QAAQ,SAAS,eAAe,OAAO,QAAQ,SAAS;CAC1D,CAAC;CAED,OAAO,UAAU,OAAO,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC;AAC1F,CAAC;;;AAID,MAAa,uBAAuB,OAAO,WAAW,WACpD,QACA,SACA,QAAQ,OACR;CACA,MAAM,gBAAgB,OAAO,OAAO,cAAc,gBAAgB;CAClE,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CACjD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,IAAI,QAAQ;CAClB,MAAM,QAAQ,OAAO,EAAE,KAAK;CAC5B,MAAM,UAAU,OAAO,QAAQ,QAAQ,KAAK;CAC5C,MAAM,QAAQ,IAAI,gBAAgB;EAAE,aAAa;EAAM,cAAc;CAAM,CAAC;CAC5E,MAAM,UAAU,IAAI,gBAAgB;EAAE,cAAc,GAAG;EAAI,cAAc,GAAG;CAAa,CAAC;CAC1F,MAAM,WAAW,CAAC,SAAS,IAAI,gBAAgB;EAAE,cAAc;EAAO,cAAc;CAAK,CAAC;CAC1F,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAC3D,MAAM,UAAU,QAAgB,OAAO,WAAW,QAAQ,MAAM,SAAS,MAAM,OAAO,GAAG,CAAC,CAAC;CAC3F,MAAM,WAAW,UAAoB,OAAO,WAAW,QAAQ,MAAM,WAAW,GAAG,IAAI,MAAM,EAAE,CAAC;CAEhG,MAAM,SAAS,KAAa,UAC1B,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,KAAK,KAAK,CAAC;CAE9D,MAAM,SAAS,OAAO,WAAW,WAAW,OAIzC;EACD,MAAM,MAAM,OAAO,UAAU,MAAM,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,OAAO,QAAQ,MAAM,CAAC;EAE7F,OAAO;GACL;GACA,WAAW,IAAI,IAAI;IACjB,MAAM,EAAE,UAAU,MAAM,QAAQ;IAChC,MAAM,EAAE,SAAS,MAAM,OAAO;IAC9B,MAAM,EAAE,WAAW,GAAG;GACxB,CAAC;EACH;CACF,CAAC;CAED,MAAM,UAAU,QAA2C;EACzD,MAAM,QAAQ,MAAM,OAAO,KAAK,QAAQ;EAExC,OAAO,OAAO,kBAAkB,EAAE,WAAW,CAAC,CAAC;GAC7C,UAAU,MAAM,EAAE;GAClB,SAAS,MAAM,EAAE;GACjB,SAAS,MAAM,EAAE;GACjB,SAAS,cAAc,MAAM,EAAE,QAAQ;GACvC,UAAU;IAAE,OAAO,MAAM,EAAE;IAAgB,QAAQ,MAAM,EAAE;GAAgB;GAC3E,gBAAgB,QAAQ,MAAM,cAAc,MAAM,EAAE,SAAS;GAC7D,iBAAiB,QAAQ,MAAM,cAAc,MAAM,EAAE,UAAU;EACjE,CAAC;CACH;CAEA,MAAM,QAAQ,OAAO,IAAI,aAAa;EACpC,MAAM,OAAO,OAAO,GAAG,UAAU,IAAI;EAErC,OAAO,OAAO,OAAO,aAAa,EAAE,YAAY,CAAC,CAAC,OAAO,KAAK,EAAE,EAAE,UAAU,CAAC;CAC/E,CAAC;CAED,MAAM,cAAc,OAAO,WAAW,WAAW,SAAyB;EACxE,IAAI,QAAQ,SAAS,cAAc,OAAO;EAC1C,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,QAAQ,SAAS,SAAS;EAC7E,MAAM,YAAY,GAAG,GAAG,QAAQ,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,IAAI,QAAQ;EAE1G,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,gBAAgB,EAAE,QAAQ,QAAQ,KAAK,SAAS,UAAU,GAAG,QAAQ,GAAG,KAAK;EAElH,IAAI,KAAK,WAAW,GAAG,OAAO;EAC9B,UAAU,KAAK,WAAW,CAAC;EAC3B,MAAM,QAAQ,QAAQ,OAAO,KAAK,IAAK,gBAAgB;EACvD,MAAM,UAAU,OAAO,QAAQ,UAAU,UAAU,MAAM,QAAQ,QAAQ,GAAG;EAE5E,UAAU,YAAY,QAAQ,SAAS,SAAS;EAChD,IAAI,OACF,OAAO,wBACL,kBAAkB,KAAK,GAAG,wBAAwB,QAAQ,KAAK,SAAS,UAAU,EAAE,CACtF;EAEF,OAAO;CACT,CAAC;CAED,MAAM,QAAQ,OAAO,WAAW,WAC9B,OASA;EACA,IAAI,CAAC,MAAM,UAAU,OAAO,EAAE,MAAM,aAAa;EACjD,MAAM,SAAS,OAAO,OAAO,aAAa,EAAE,gBAAgB,CAAC,CAAC,MAAM,MAAM;EAE1E,UACE,OAAO,cAAc,MAAM,cAAc,KACvC,MAAM,iBAAiB,KACvB,OAAO,cAAc,MAAM,oBAAoB,KAC/C,MAAM,wBAAwB,CAClC;EACA,MAAM,MAAM,OAAO,OAAO,MAAM;EAChC,MAAM,UAAU,YAAY,OAAO,OAAO;EAG1C,MAAM,cAAc,SAAS,QAAQ,MAAM,GAAG;EAE9C,MAAM,UAAU,IAAI,IAAI,CACtB,GAAG,GAAG,OAAO,EAAE,QAAQ,EAAE,KAAK,MAAM,qBAAqB,MAAM,eAC/D,GAAG,IAAI,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,MAAM,MAAM,EAAE,SAAS,OAAO,EAAE,EAC/E,CAAC;EAED,IAAI;EAEJ,IAAI,SAAS,OAAO;GAClB,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,QAAQ,EAAE,QAAQ,MAAM,KAAK,SAAS,IAAI,UAAU,GAAG,QAAQ,UAAU,GAAG;GAE/G,UAAU,OAAO;GACjB,UAAU,KAAK,UAAU,CAAC;GAC1B,IAAI,KAAK,OAAO,KAAA,GAAW;IACzB,MAAM,MAAM,OAAO,KAAK,EAAE;IAE1B,IACE,IAAI,iBAAiB,MAAM,uBAAuB,WACjD,IAAI,kBAAkB,WAAW,YAAY,IAAI,OAAO,MAAM,SAE/D,OAAO,EAAE,MAAM,aAAa;GAChC;EACF;EAEA,MAAM,WACJ,YAAY,KAAA,IAAY,QAAQ,WAAW,IAAI,QAAQ,MAAM,cAAc,OAAO;EAEpF,MAAM,YACJ,YAAY,KAAA,IACR,QAAQ,GAAG,GAAG,YAAY,KAAK,MAAM,gBAAgB,IACrD,QAAQ,MAAM,cAAc,UAAU,MAAM,cAAc;EAEhE,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAAE;IAAQ,WAAW,IAAI;GAAI,CAAC;IAC/C,EAAE,WAAW,OAAO;IACpB,EAAE,UAAU,OAAO;IACnB,EAAE,YAAY,IAAI;IAClB,EAAE,UAAU,OAAO;IACnB,EAAE,UAAU;IACZ,EAAE,gBAAgB,OAAO,SAAS;IAClC,EAAE,iBAAiB,OAAO,SAAS;IACnC,EAAE,WAAW;IACb,EAAE,YAAY;IACd,EAAE,iBAAiB;EACtB;EAEA,IAAI,OAAO;GAMT,KAAI,OALmB,iBACrB,KACA,GAAG,GAAG,MAAM,OAAO,MAAM,EAAE,SAAS,IAAI,UAAU,OAAO,SAC3D,OAEgB,GAAG,OAAO,GAAG,GAAG,MAAM,OAAO,MAAM;GACnD,UAAU,YAAY,KAAA,CAAS;GAE/B,OAAO;IACL,MAAM;IACN,QAAQ,OAAO,OAAO,aAAa,EAAE,WAAW,CAAC,CAAC;KAChD,GAAG;KACH,gBAAgB;KAChB,iBAAiB,UAAW,MAAM;IACpC,CAAC;GACH;EACF;EAEA,MAAM,WAAW;GACf,EAAE;GACF,EAAE;GACF,EAAE;GACF,EAAE;GACF,EAAE;GACF,EAAE;GACF,EAAE;EACJ;EAEA,MAAM,WAAW,MAAM,GAAG,UAAU;EACpC,MAAM,SAAS,GAAG,GAAG,MAAM,OAAO,MAAM,EAAE,gBAAgB,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC;GAAC,EAAE;GAAU,EAAE;GAAS,EAAE;EAAS,CAAC,CAAC,IAAI,MAAM,UAAU,CAAC,EAAE,kBAAkB,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC,SAAS,KAAK,QAAQ,GAAG,GAAG,MAAM,WAAW,GAAG,EAAE,KAAK,SAAS,OAAO,GAAG,GAAG,CAAC,EAAE,SAAS;EAE7Q,IAAI,OAAO;GACT,UAAU,YAAY,KAAA,CAAS;GAC/B,OAAO,wBACL,kBACE,KACA,GAAG,GAAG,IAAI,MAAM,QAAQ,OAAO,IAAI,KAAK,UAAW,MAAM,gBAC3D,CACF;GACA,OAAO,wBAAwB,MAAM;GACrC,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,CAAC;GAEzE,OAAO;IACL,MAAM;IACN,QAAQ,OAAO,OAAO,aAAa,EAAE,WAAW,CAAC,CAAC;KAChD,GAAG;KACH,gBAAgB;KAChB,iBAAiB,UAAW,MAAM;IACpC,CAAC;GACH;EACF;EAEA,MAAM,OACJ,OAAO,GAAG,wDAAwD,IAAI,eAAe,OAAO,aAAa,MAAM,OAAO,QAAQ;EAEhI,UAAU,KAAK,UAAU,CAAC;EAE1B,OAAO,KAAK,OAAO,KAAA,IACf,EAAE,MAAM,aAAa,IACrB;GAAE,MAAM;GAAU,QAAQ,OAAO,KAAK,EAAE;EAAE;CAChD,CAAC;CAED,MAAM,eAAe,OAAO,WAAW,WAAW,UAAkC;EAClF,MAAM,QAAQ,OAAO,OAAO,aAAa,EAAE,oBAAoB,CAAC,CAAC,QAAQ;EACzE,MAAM,MAAM,OAAO,OAAO,KAAK;EAE/B,MAAM,UAAU,IAAI,IAAI;GACtB,IAAI;GACJ,MAAM,EAAE,SAAS,MAAM,OAAO;GAC9B,MAAM,EAAE,SAAS,YAAY,MAAM,OAAO,CAAC;GAC3C,GAAG,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM;GAC/B,GAAG,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK;GAC/B,GAAG,GAAG,MAAM,OAAO,EAAE,cAAc,EAAE;GACrC,GAAG,GAAG,MAAM,OAAO,EAAE,cAAc,EAAE,KAAK,MAAM;EAClD,CAAC;EAED,MAAM,QAAQ,IAAI,IAAI,CACpB,SACA,MAAM,cAAc,KAAA,IAChB,GAAG,UACH,IAAI,IAAI,CACN,MAAM,EAAE,eAAe,MAAM,UAAU,KAAK,GAC5C,MAAM,EAAE,gBAAgB,MAAM,UAAU,MAAM,CAChD,CAAC,CACP,CAAC;EAID,IAAI,MAAM,QAAQ,SAAS,gBAAgB,UACzC,OAAO,GAAG,iBAAiB,MAAM,KAAK,SAAS,QAAQ,GAAG;EAE5D,MAAM,WAAW,GAAG,eAAe,MAAM,KAAK,SAAS;EAEvD,MAAM,OACJ,SAAS,QACL,OAAO,GAAG,UAAU,MAAM,OAAO,QAAQ,EAAE,QAAQ,MAAM,KAAK,SAAS,MAAM,GAAG,QAAQ,UAAU,GAAG,OACrG,OAAO,GAAG,GAAG,SAAS,aAAa,MAAM,OAAO,QAAQ;EAE9D,UAAU,KAAK,UAAU,CAAC;EAC1B,IAAI,KAAK,OAAO,KAAA,GAAW;GACzB,MAAM,UAAU,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,iBAAiB,GAAG,GAAG,MAAM,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,SAAS;GAEhH,IAAI,OAAO;IAET,OAAO,wBACL,kBAAkB,KAAK,GAAG,4BAA4B,MAAM,KAAK,SAAS,MAAM,EAAE,CACpF;IACA,OAAO,wBAAwB,OAAO;GACxC,OAAO,OAAO,GAAG,GAAG;GAEpB,OAAO,EAAE,UAAU,WAAoB;EACzC;EACA,MAAM,WAAW,OAAO,KAAK,EAAE;EAE/B,IAAI,OAAO,WAAW,OAAO,iBAAiB,KAAK,QAAQ,OAAO,CAAC;EACnE,IAAI,OAAO;GACT,OAAO,wBAAwB,QAAQ;GACvC,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,CAAC;EAC3E;EACA,MAAM,aAAa,GAAG,GAAG,IAAI,MAAM,SAAS,eAAe,OAAO,IAAI,KAAK,SAAS;EAEpF,IAAI,OAAO,OAAO,aAAa,KAAK,cAAc,MAAM,WAAW,eAAe;GAChF,MAAM,SAAS,GAAG,4BAA4B,MAAM,KAAK,SAAS,MAAM,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,MAAM,EAAE,SAAS,MAAM,OAAO,EAAE;GAC3I,MAAM,YAAY,GAAG,GAAG,OAAO,OAAO;GAEtC,IAAI,OACF,OAAO,8BAA8B;IACnC,MAAM;IACN,WAAW,kBAAkB,KAAK,SAAS;GAC7C,CAAC;QAED,OAAO,yBAAyB;IAC9B,MAAM;IACN,OAAO,OAAO,IAAI,aAAa;KAC7B,MAAM,OAAO,OAAO,GAAG,2BAA2B;KAElD,UAAU,KAAK,WAAW,CAAC;IAC7B,CAAC;GACH,CAAC;EACL;EAEA,OAAO;GAAE,UAAU;GAAqB;EAAW;CACrD,CAAC;CAED,MAAM,SAAS,OAAO,WAAW,WAC/B,OACA;EACA,MAAM,MAAM,OAAO,OAAO,KAAK;EAC/B,MAAM,WAAW,GAAG,eAAe,MAAM,KAAK,SAAS,IAAI,UAAU,OAAO,MAAM,EAAE,SAAS,YAAY,MAAM,OAAO,CAAC;EAEvH,IAAI,OAAO,OAAO,wBAAwB,QAAQ;OAC7C,OAAO,GAAG,GAAG;CACpB,CAAC;CAED,MAAM,WAAW,UACf,eACE,CACE;EACE,OAAO;EACP,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO;EAC5B,KAAK,GAAG,GAAG,MAAM,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,OAAO,EAAE,SAAS,EAAE,MAAM;EAC9E,OAAO,CAAC,MAAM,OAAO,EAAE,SAAS,GAAG,MAAM,OAAO,EAAE,OAAO,CAAC;CAC5D,CACF,GACA,MAAM,OACN,KACF;CAEF,OAAO;EAAE;EAAO;EAAa;EAAc;EAAQ;EAAS;CAAM;AACpE,CAAC;AAED,MAAa,0BAA0B,OAAO,WAAW,WACvD,QACA,SAKA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,QAAQ,OAAO,qBAAqB,QAAQ,SAAS,UAAU,KAAA,CAAS;CAE9E,MAAM,OACJ,QACA,OAAoC,kBAEpC,UAAU,KAAA,IACN,SAAS,IAAI,QAAQ,IAAI,IACzB,SAAS,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAE9E,MAAM,WAAqB,OAAc,YACvC,OAAO,IAAI,aAAa;EAGtB,MAAM,UAAU,QAAQ,OAAO,OAFR,oBAEe;EAEtC,UAAU,SAAS,SAAS,oBAAoB,OAAO,SAAS,QAAQ,IAAI,CAAC;EAC7E,OAAO,yBAAyB,OAAO;EAEvC,OAAO;CACT,CAAC;CAuCH,OAAO,EAAE,kBAAA;EApCP,QAAQ,OAAO,YACb,IACE,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,QAAQ,OAAO,MAAM,MAAM,KAAK,GAAG,OAAO;EAC1D,CAAC,GACD,MAAM,QAAQ,gBAAgB,WAChC;EACF,SAAS,OAAO,YACd,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,MAAM,YAAY,MAAM,OAAO;GAErD,OAAO,OAAO,QACZ,UAAU,OAAO,MAAM,aAAa,KAAK,EAAA,CAAG,WAAW,YACvD,OACF;EACF,CAAC,CACH;EACF,SAAS,OAAO,YACd,IACE,OAAO,IAAI,aAAa;GACtB,OAAO,MAAM,OAAO,KAAK;GAEzB,OAAO,OAAO,QAAQ,KAAA,GAAW,OAAO;EAC1C,CAAC,GACD,WACF;EACF,UAAU,OAAO,YACf,IACE,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,QAAQ,OAAO,MAAM,QAAQ,KAAK,GAAG,OAAO;EAC5D,CAAC,GACD,WACF;CAGoB,EAAE;AAC5B,CAAC"}

package/dist/internal/registration.mjs

@@ -1,70 +1,60 @@
 import { PersistenceConfigurationError } from "./configuration.mjs";
+import { CurrentSqlCommit, makeSqlCommitExecutor } from "./sql-commit.mjs";
 import { randomId } from "./crypto.mjs";
-import { CurrentPasswordSql } from "./password-kernel.mjs";
-import { Crypto, Effect, Schema } from "effect";
-import { LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
-import { SecurityRevision } from "@yielded/auth/Sessions";
-import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { PasswordIdentifierTaken, makeNativePasswordRegistrationStore } from "./password-registration-native.mjs";
+import { Cause, Crypto, Effect, Option, Schema } from "effect";
 import { PasswordUnavailable } from "@yielded/auth/Password";
+import { SecurityRevision } from "@yielded/auth/Sessions";
+import { SqlClient } from "effect/sql/SqlClient";
 //#region src/internal/registration.ts
-var IdentifierTaken = class extends Schema.TaggedError()("IdentifierTaken", {}) {};
-/** Registration reserves the command, provisions the application's subject, and
-* creates the unverified identifier and password in one SQL transaction. Replays
-* always suppress; a public request ID never recovers a private password intent.
-*/
-const makeRegistrationAuthority = Effect.fn("makeRegistrationAuthority")(function* (mappings, operations, standalone, provisioning, strategy) {
-	const database = yield* CurrentPasswordSql;
-	const hooks = yield* LifecycleHooks;
+/** Application provisioning and the unverified identifier/password binding share
+* one physical owner. Identifier uniqueness arbitrates registration; correlation
+* request IDs never become a retained credential-issuance receipt. */
+const makeRegistrationAuthority = Effect.fnUntraced(function* (tables, mapping, provisioning, strategy) {
+	const sql = (yield* SqlClient).withoutTransforms();
 	const crypto = yield* Crypto.Crypto;
+	const executor = yield* makeSqlCommitExecutor(() => PasswordUnavailable.make({}));
+	const parent = yield* Effect.serviceOption(CurrentSqlCommit);
+	const store = yield* makeNativePasswordRegistrationStore(tables, mapping);
 	const createSubject = (yield* provisioning)[strategy];
 	if (createSubject === void 0) return yield* PersistenceConfigurationError.make({ reason: `Missing subject provisioning for ${strategy}` });
-	const { and, eq, column } = operations;
-	const mapping = mappings.passwords();
-	const receipts = mappings.table("passwordRegistrations");
-	return { register: (input, prepare) => Effect.gen(function* () {
-		if (yield* hasCommitScope) return yield* PasswordUnavailable.make({});
-		yield* standalone;
-		const receipt = {
-			moduleId: input.moduleId,
-			requestId: input.requestId
-		};
-		const suppress = coordinateCommit((journal) => database.transaction((tx) => Effect.gen(function* () {
-			yield* tx.insert(receipts).values(receipt).onConflictDoNothing();
-			return prepare({ _tag: "Suppressed" }, journal);
-		})), { mode: "interactive" });
-		return (yield* coordinateCommit((journal) => database.transaction((tx) => Effect.gen(function* () {
-			if ((yield* tx.insert(receipts).values(receipt).onConflictDoNothing().returning()).length === 0) return prepare({ _tag: "Suppressed" }, journal);
-			if ((yield* tx.select().from(mapping.identifier.table).where(and(eq(column(mapping.identifier.table, mapping.identifier.namespace), input.identifier.namespace), eq(column(mapping.identifier.table, mapping.identifier.value), input.identifier.value))).limit(1)).length !== 0) return prepare({ _tag: "Suppressed" }, journal);
-			const subjectId = yield* createSubject({
-				identifier: input.identifier,
-				registration: input.registration
-			});
-			const nativeId = yield* mapping.subjectId.toNative(subjectId);
-			const subjects = yield* tx.select().from(mapping.subject.table).where(eq(column(mapping.subject.table, mapping.subject.id), nativeId)).limit(1);
-			if (subjects.length !== 1 || !mapping.subject.isActiveStatus(subjects[0][mapping.subject.status])) return yield* PasswordUnavailable.make({});
-			yield* Schema.decodeUnknownEffect(SecurityRevision)(subjects[0][mapping.subject.securityRevision]);
-			if ((yield* tx.insert(mapping.identifier.table).values(mapping.identifier.encodeInitialInsert(input.identifier, nativeId, SecurityRevision.make(yield* randomId))).onConflictDoNothing().returning()).length !== 1) return yield* new IdentifierTaken({});
-			const credentialId = yield* randomId;
-			const credentialRevision = SecurityRevision.make(yield* randomId);
-			yield* tx.insert(mapping.credential.table).values(mapping.credential.encodeInsert({
-				moduleId: input.moduleId,
-				subjectId: nativeId,
-				credentialId,
-				credentialRevision,
-				verifierVersion: SecurityRevision.make(yield* randomId),
-				replacement: input.replacement
-			}));
-			yield* tx.insert(mapping.authorityCredential.table).values(mapping.authorityCredential.encodeInsert({
-				subjectId: nativeId,
-				credentialId,
-				revision: credentialRevision
-			}));
-			return prepare({
-				_tag: "Created",
-				subjectId
-			}, journal);
-		})), { mode: "interactive" }).pipe(Effect.catchTag("IdentifierTaken", () => suppress))).value;
-	}).pipe(Effect.provideService(LifecycleHooks, hooks), Effect.provideService(Crypto.Crypto, crypto), (work) => reportPersistenceFailure(work, Schema.is(PasswordUnavailable)), Effect.mapError(() => PasswordUnavailable.make({}))) };
+	const s = mapping.subject;
+	const subject = tables(s.table);
+	const lock = sql.onDialectOrElse({
+		sqlite: () => sql``,
+		orElse: () => sql`for update`
+	});
+	const run = (work, suppressed) => Option.isSome(parent) ? executor.run(work) : executor.operation(work.pipe(Effect.mapError((error) => error instanceof PasswordIdentifierTaken ? error : PasswordUnavailable.make({})))).pipe(Effect.catchCause((cause) => cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && reason.error instanceof PasswordIdentifierTaken) ? executor.run(suppressed, "statement") : Effect.failCause(cause)), Effect.mapError(() => PasswordUnavailable.make({})));
+	return { register: (input, project) => executor.read(store.available(input.identifier)).pipe(Effect.flatMap((existing) => existing.length !== 0 ? executor.run(store.prepare({ _tag: "Suppressed" }, project), "statement") : run(Effect.gen(function* () {
+		const subjectId = yield* createSubject({
+			requestId: input.requestId,
+			identifier: input.identifier,
+			registration: input.registration
+		});
+		const nativeId = yield* mapping.subjectId.toNative(subjectId);
+		const rows = yield* sql`select ${subject.fields("registration_subject_")} from ${subject.name} where ${subject.column(s.id)} = ${subject.value(s.id, nativeId)} limit 2 ${lock}`;
+		if (rows.length !== 1) return yield* PasswordUnavailable.make({});
+		const row = subject.decode(rows[0], "registration_subject_");
+		if (!s.isActiveStatus(row[s.status])) return yield* PasswordUnavailable.make({});
+		const securityRevision = yield* Schema.decodeUnknownEffect(SecurityRevision)(row[s.securityRevision]);
+		const identifierRevision = SecurityRevision.make(yield* randomId);
+		const credentialId = yield* randomId;
+		const credentialRevision = SecurityRevision.make(yield* randomId);
+		const verifierVersion = SecurityRevision.make(yield* randomId);
+		yield* store.bind({
+			...input,
+			subjectId,
+			securityRevision,
+			identifierRevision,
+			credentialId,
+			credentialRevision,
+			verifierVersion
+		});
+		return yield* store.prepare({
+			_tag: "Created",
+			subjectId
+		}, project);
+	}).pipe(Effect.provideService(Crypto.Crypto, crypto)), store.prepare({ _tag: "Suppressed" }, project)))) };
 });
 //#endregion
 export { makeRegistrationAuthority };

package/dist/internal/registration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"registration.mjs","names":[],"sources":["../../src/internal/registration.ts"],"sourcesContent":["import { coordinateCommit, hasCommitScope, LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport { PasswordUnavailable } from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport { SecurityRevision } from \"@yielded/auth/Sessions\";\nimport { type Context, Crypto, Effect, Schema } from \"effect\";\n\nimport { PersistenceConfigurationError } from \"./configuration\";\nimport { randomId } from \"./crypto\";\nimport { CurrentPasswordSql } from \"./password-kernel\";\nimport type { QueryOperations } from \"./query-operations\";\nimport type { PasswordRegistrationAuthority } from \"./registration-contract\";\nimport type { makeMappings } from \"./storage-mapping\";\n\nclass IdentifierTaken extends Schema.TaggedError<IdentifierTaken>()(\"IdentifierTaken\", {}) {}\n\ntype CreateSubject = (input: {\n  readonly identifier: LoginIdentifier;\n  readonly registration: unknown;\n}) => Effect.Effect<SubjectId, PasswordUnavailable>;\n\n/** Registration reserves the command, provisions the application's subject, and\n * creates the unverified identifier and password in one SQL transaction. Replays\n * always suppress; a public request ID never recovers a private password intent.\n */\nexport const makeRegistrationAuthority = Effect.fn(\"makeRegistrationAuthority\")(function* <R>(\n  mappings: Effect.Success<ReturnType<typeof makeMappings>>,\n  operations: QueryOperations,\n  standalone: Effect.Effect<void, PasswordUnavailable>,\n  provisioning: Context.Key<R, object>,\n  strategy: string,\n): Effect.fn.Return<\n  PasswordRegistrationAuthority<unknown>,\n  PersistenceConfigurationError,\n  LifecycleHooks | CurrentPasswordSql | Crypto.Crypto | R\n> {\n  const database = yield* CurrentPasswordSql;\n  const hooks = yield* LifecycleHooks;\n  const crypto = yield* Crypto.Crypto;\n  // Core has already decoded registration with the selected strategy's Schema;\n  // the dynamic strategy table erases only that heterogeneous callback signature.\n  const creators = (yield* provisioning) as Readonly<Record<string, CreateSubject>>;\n  const createSubject = creators[strategy];\n\n  if (createSubject === undefined)\n    return yield* PersistenceConfigurationError.make({\n      reason: `Missing subject provisioning for ${strategy}`,\n    });\n  const { and, eq, column } = operations;\n  const mapping = mappings.passwords();\n  const receipts = mappings.table(\"passwordRegistrations\");\n\n  return {\n    register: (input, prepare) =>\n      Effect.gen(function* () {\n        if (yield* hasCommitScope) return yield* PasswordUnavailable.make({});\n        yield* standalone;\n\n        const receipt = { moduleId: input.moduleId, requestId: input.requestId };\n\n        const suppress = coordinateCommit(\n          (journal) =>\n            database.transaction((tx) =>\n              Effect.gen(function* () {\n                yield* tx.insert(receipts).values(receipt).onConflictDoNothing();\n\n                return prepare({ _tag: \"Suppressed\" }, journal);\n              }),\n            ),\n          { mode: \"interactive\" },\n        );\n\n        const committed = yield* coordinateCommit(\n          (journal) =>\n            database.transaction((tx) =>\n              Effect.gen(function* () {\n                const reserved = yield* tx\n                  .insert(receipts)\n                  .values(receipt)\n                  .onConflictDoNothing()\n                  .returning();\n\n                if (reserved.length === 0) return prepare({ _tag: \"Suppressed\" }, journal);\n\n                const identifiers = yield* tx\n                  .select()\n                  .from(mapping.identifier.table)\n                  .where(\n                    and(\n                      eq(\n                        column(mapping.identifier.table, mapping.identifier.namespace),\n                        input.identifier.namespace,\n                      ),\n                      eq(\n                        column(mapping.identifier.table, mapping.identifier.value),\n                        input.identifier.value,\n                      ),\n                    ),\n                  )\n                  .limit(1);\n\n                if (identifiers.length !== 0) return prepare({ _tag: \"Suppressed\" }, journal);\n\n                const subjectId = yield* createSubject({\n                  identifier: input.identifier,\n                  registration: input.registration,\n                });\n\n                const nativeId = yield* mapping.subjectId.toNative(subjectId);\n\n                const subjects = yield* tx\n                  .select()\n                  .from(mapping.subject.table)\n                  .where(eq(column(mapping.subject.table, mapping.subject.id), nativeId))\n                  .limit(1);\n\n                if (\n                  subjects.length !== 1 ||\n                  !mapping.subject.isActiveStatus(subjects[0][mapping.subject.status])\n                )\n                  return yield* PasswordUnavailable.make({});\n                yield* Schema.decodeUnknownEffect(SecurityRevision)(\n                  subjects[0][mapping.subject.securityRevision],\n                );\n\n                const bound = yield* tx\n                  .insert(mapping.identifier.table)\n                  .values(\n                    mapping.identifier.encodeInitialInsert(\n                      input.identifier,\n                      nativeId,\n                      SecurityRevision.make(yield* randomId),\n                    ),\n                  )\n                  .onConflictDoNothing()\n                  .returning();\n\n                // A concurrent registration won the identifier. Roll back the application\n                // subject too, then persist a non-authorizing receipt in a new transaction.\n                if (bound.length !== 1) return yield* new IdentifierTaken({});\n\n                const credentialId = yield* randomId;\n                const credentialRevision = SecurityRevision.make(yield* randomId);\n\n                yield* tx.insert(mapping.credential.table).values(\n                  mapping.credential.encodeInsert({\n                    moduleId: input.moduleId,\n                    subjectId: nativeId,\n                    credentialId,\n                    credentialRevision,\n                    verifierVersion: SecurityRevision.make(yield* randomId),\n                    replacement: input.replacement,\n                  }),\n                );\n                yield* tx.insert(mapping.authorityCredential.table).values(\n                  mapping.authorityCredential.encodeInsert({\n                    subjectId: nativeId,\n                    credentialId,\n                    revision: credentialRevision,\n                  }),\n                );\n\n                return prepare({ _tag: \"Created\", subjectId }, journal);\n              }),\n            ),\n          { mode: \"interactive\" },\n        ).pipe(Effect.catchTag(\"IdentifierTaken\", () => suppress));\n\n        return committed.value;\n      }).pipe(\n        Effect.provideService(LifecycleHooks, hooks),\n        Effect.provideService(Crypto.Crypto, crypto),\n        (work) => reportPersistenceFailure(work, Schema.is(PasswordUnavailable)),\n        Effect.mapError(() => PasswordUnavailable.make({})),\n      ),\n  };\n});\n"],"mappings":";;;;;;;;;AAeA,IAAM,kBAAN,cAA8B,OAAO,YAA6B,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;;;;;AAW5F,MAAa,4BAA4B,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC9E,UACA,YACA,YACA,cACA,UAKA;CACA,MAAM,WAAW,OAAO;CACxB,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,OAAO,OAAO;CAI7B,MAAM,iBAAgB,OADG,aAAA,CACM;CAE/B,IAAI,kBAAkB,KAAA,GACpB,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,oCAAoC,WAC9C,CAAC;CACH,MAAM,EAAE,KAAK,IAAI,WAAW;CAC5B,MAAM,UAAU,SAAS,UAAU;CACnC,MAAM,WAAW,SAAS,MAAM,uBAAuB;CAEvD,OAAO,EACL,WAAW,OAAO,YAChB,OAAO,IAAI,aAAa;EACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;EACpE,OAAO;EAEP,MAAM,UAAU;GAAE,UAAU,MAAM;GAAU,WAAW,MAAM;EAAU;EAEvE,MAAM,WAAW,kBACd,YACC,SAAS,aAAa,OACpB,OAAO,IAAI,aAAa;GACtB,OAAO,GAAG,OAAO,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,oBAAoB;GAE/D,OAAO,QAAQ,EAAE,MAAM,aAAa,GAAG,OAAO;EAChD,CAAC,CACH,GACF,EAAE,MAAM,cAAc,CACxB;EAkGA,QAAO,OAhGkB,kBACtB,YACC,SAAS,aAAa,OACpB,OAAO,IAAI,aAAa;GAOtB,KAAI,OANoB,GACrB,OAAO,QAAQ,CAAC,CAChB,OAAO,OAAO,CAAC,CACf,oBAAoB,CAAC,CACrB,UAAU,EAAA,CAEA,WAAW,GAAG,OAAO,QAAQ,EAAE,MAAM,aAAa,GAAG,OAAO;GAmBzE,KAAI,OAjBuB,GACxB,OAAO,CAAC,CACR,KAAK,QAAQ,WAAW,KAAK,CAAC,CAC9B,MACC,IACE,GACE,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS,GAC7D,MAAM,WAAW,SACnB,GACA,GACE,OAAO,QAAQ,WAAW,OAAO,QAAQ,WAAW,KAAK,GACzD,MAAM,WAAW,KACnB,CACF,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CAEM,WAAW,GAAG,OAAO,QAAQ,EAAE,MAAM,aAAa,GAAG,OAAO;GAE5E,MAAM,YAAY,OAAO,cAAc;IACrC,YAAY,MAAM;IAClB,cAAc,MAAM;GACtB,CAAC;GAED,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,SAAS;GAE5D,MAAM,WAAW,OAAO,GACrB,OAAO,CAAC,CACR,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAC3B,MAAM,GAAG,OAAO,QAAQ,QAAQ,OAAO,QAAQ,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CACtE,MAAM,CAAC;GAEV,IACE,SAAS,WAAW,KACpB,CAAC,QAAQ,QAAQ,eAAe,SAAS,EAAE,CAAC,QAAQ,QAAQ,OAAO,GAEnE,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;GAC3C,OAAO,OAAO,oBAAoB,gBAAgB,CAAC,CACjD,SAAS,EAAE,CAAC,QAAQ,QAAQ,iBAC9B;GAgBA,KAAI,OAdiB,GAClB,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,OACC,QAAQ,WAAW,oBACjB,MAAM,YACN,UACA,iBAAiB,KAAK,OAAO,QAAQ,CACvC,CACF,CAAC,CACA,oBAAoB,CAAC,CACrB,UAAU,EAAA,CAIH,WAAW,GAAG,OAAO,OAAO,IAAI,gBAAgB,CAAC,CAAC;GAE5D,MAAM,eAAe,OAAO;GAC5B,MAAM,qBAAqB,iBAAiB,KAAK,OAAO,QAAQ;GAEhE,OAAO,GAAG,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OACzC,QAAQ,WAAW,aAAa;IAC9B,UAAU,MAAM;IAChB,WAAW;IACX;IACA;IACA,iBAAiB,iBAAiB,KAAK,OAAO,QAAQ;IACtD,aAAa,MAAM;GACrB,CAAC,CACH;GACA,OAAO,GAAG,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OAClD,QAAQ,oBAAoB,aAAa;IACvC,WAAW;IACX;IACA,UAAU;GACZ,CAAC,CACH;GAEA,OAAO,QAAQ;IAAE,MAAM;IAAW;GAAU,GAAG,OAAO;EACxD,CAAC,CACH,GACF,EAAE,MAAM,cAAc,CACxB,CAAC,CAAC,KAAK,OAAO,SAAS,yBAAyB,QAAQ,CAAC,EAAA,CAExC;CACnB,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,OAAO,eAAe,OAAO,QAAQ,MAAM,IAC1C,SAAS,yBAAyB,MAAM,OAAO,GAAG,mBAAmB,CAAC,GACvE,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD,EACJ;AACF,CAAC"}
+{"version":3,"file":"registration.mjs","names":[],"sources":["../../src/internal/registration.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport { PasswordUnavailable } from \"@yielded/auth/Password\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport { SecurityRevision } from \"@yielded/auth/Sessions\";\nimport { type Context, Crypto, Effect, Schema, Option, Cause } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\n\nimport { PersistenceConfigurationError } from \"./configuration\";\nimport { randomId } from \"./crypto\";\nimport type { AnyPasswordPersistenceMapping } from \"./models/password-model\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport {\n  makeNativePasswordRegistrationStore,\n  PasswordIdentifierTaken,\n} from \"./password-registration-native\";\nimport type { PasswordRegistrationAuthority } from \"./registration-contract\";\nimport { makeSqlCommitExecutor, CurrentSqlCommit } from \"./sql-commit\";\n\ntype CreateSubject = (input: {\n  readonly requestId: string;\n  readonly identifier: LoginIdentifier;\n  readonly registration: unknown;\n}) => Effect.Effect<SubjectId, PasswordUnavailable>;\n\n/** Application provisioning and the unverified identifier/password binding share\n * one physical owner. Identifier uniqueness arbitrates registration; correlation\n * request IDs never become a retained credential-issuance receipt. */\nexport const makeRegistrationAuthority = Effect.fnUntraced(function* <R>(\n  tables: NativeSqlTables,\n  mapping: AnyPasswordPersistenceMapping,\n  provisioning: Context.Key<R, object>,\n  strategy: string,\n): Effect.fn.Return<\n  PasswordRegistrationAuthority<unknown>,\n  PersistenceConfigurationError,\n  LifecycleHooks | SqlClient | Crypto.Crypto | R\n> {\n  const sql = (yield* SqlClient).withoutTransforms();\n  const crypto = yield* Crypto.Crypto;\n  const executor = yield* makeSqlCommitExecutor(() => PasswordUnavailable.make({}));\n  const parent = yield* Effect.serviceOption(CurrentSqlCommit);\n  const store = yield* makeNativePasswordRegistrationStore(tables, mapping);\n  // The strategy has already decoded its registration Schema. Only its callback\n  // signature is erased by the heterogeneous strategy service map.\n  const creators = (yield* provisioning) as Readonly<Record<string, CreateSubject>>;\n  const createSubject = creators[strategy];\n\n  if (createSubject === undefined)\n    return yield* PersistenceConfigurationError.make({\n      reason: `Missing subject provisioning for ${strategy}`,\n    });\n  const s = mapping.subject;\n  const subject = tables(s.table);\n  const lock = sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` });\n\n  const run = <A, E, R2>(work: Effect.Effect<A, E, R2>, suppressed: Effect.Effect<A, E, R2>) =>\n    Option.isSome(parent)\n      ? executor.run(work)\n      : executor\n          .operation(\n            work.pipe(\n              Effect.mapError((error) =>\n                error instanceof PasswordIdentifierTaken ? error : PasswordUnavailable.make({}),\n              ),\n            ),\n          )\n          .pipe(\n            Effect.catchCause((cause) =>\n              cause.reasons.length > 0 &&\n              cause.reasons.every(\n                (reason) =>\n                  Cause.isFailReason(reason) && reason.error instanceof PasswordIdentifierTaken,\n              )\n                ? executor.run(suppressed, \"statement\")\n                : Effect.failCause(cause),\n            ),\n            Effect.mapError(() => PasswordUnavailable.make({})),\n          );\n\n  return {\n    register: (input, project) =>\n      executor.read(store.available(input.identifier)).pipe(\n        Effect.flatMap((existing) =>\n          existing.length !== 0\n            ? executor.run(store.prepare({ _tag: \"Suppressed\" }, project), \"statement\")\n            : run(\n                Effect.gen(function* () {\n                  const subjectId = yield* createSubject({\n                    requestId: input.requestId,\n                    identifier: input.identifier,\n                    registration: input.registration,\n                  });\n\n                  const nativeId = yield* mapping.subjectId.toNative(subjectId);\n\n                  const rows =\n                    yield* sql`select ${subject.fields(\"registration_subject_\")} from ${subject.name} where ${subject.column(s.id)} = ${subject.value(s.id, nativeId)} limit 2 ${lock}`;\n\n                  if (rows.length !== 1) return yield* PasswordUnavailable.make({});\n                  const row = subject.decode(rows[0]!, \"registration_subject_\");\n\n                  if (!s.isActiveStatus(row[s.status])) return yield* PasswordUnavailable.make({});\n\n                  const securityRevision = yield* Schema.decodeUnknownEffect(SecurityRevision)(\n                    row[s.securityRevision],\n                  );\n\n                  const identifierRevision = SecurityRevision.make(yield* randomId);\n                  const credentialId = yield* randomId;\n                  const credentialRevision = SecurityRevision.make(yield* randomId);\n                  const verifierVersion = SecurityRevision.make(yield* randomId);\n\n                  yield* store.bind({\n                    ...input,\n                    subjectId,\n                    securityRevision,\n                    identifierRevision,\n                    credentialId,\n                    credentialRevision,\n                    verifierVersion,\n                  });\n\n                  return yield* store.prepare({ _tag: \"Created\", subjectId }, project);\n                }).pipe(Effect.provideService(Crypto.Crypto, crypto)),\n                store.prepare({ _tag: \"Suppressed\" }, project),\n              ),\n        ),\n      ),\n  };\n});\n"],"mappings":";;;;;;;;;;;;AA4BA,MAAa,4BAA4B,OAAO,WAAW,WACzD,QACA,SACA,cACA,UAKA;CACA,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CACjD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,WAAW,OAAO,4BAA4B,oBAAoB,KAAK,CAAC,CAAC,CAAC;CAChF,MAAM,SAAS,OAAO,OAAO,cAAc,gBAAgB;CAC3D,MAAM,QAAQ,OAAO,oCAAoC,QAAQ,OAAO;CAIxE,MAAM,iBAAgB,OADG,aAAA,CACM;CAE/B,IAAI,kBAAkB,KAAA,GACpB,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,oCAAoC,WAC9C,CAAC;CACH,MAAM,IAAI,QAAQ;CAClB,MAAM,UAAU,OAAO,EAAE,KAAK;CAC9B,MAAM,OAAO,IAAI,gBAAgB;EAAE,cAAc,GAAG;EAAI,cAAc,GAAG;CAAa,CAAC;CAEvF,MAAM,OAAiB,MAA+B,eACpD,OAAO,OAAO,MAAM,IAChB,SAAS,IAAI,IAAI,IACjB,SACG,UACC,KAAK,KACH,OAAO,UAAU,UACf,iBAAiB,0BAA0B,QAAQ,oBAAoB,KAAK,CAAC,CAAC,CAChF,CACF,CACF,CAAC,CACA,KACC,OAAO,YAAY,UACjB,MAAM,QAAQ,SAAS,KACvB,MAAM,QAAQ,OACX,WACC,MAAM,aAAa,MAAM,KAAK,OAAO,iBAAiB,uBAC1D,IACI,SAAS,IAAI,YAAY,WAAW,IACpC,OAAO,UAAU,KAAK,CAC5B,GACA,OAAO,eAAe,oBAAoB,KAAK,CAAC,CAAC,CAAC,CACpD;CAER,OAAO,EACL,WAAW,OAAO,YAChB,SAAS,KAAK,MAAM,UAAU,MAAM,UAAU,CAAC,CAAC,CAAC,KAC/C,OAAO,SAAS,aACd,SAAS,WAAW,IAChB,SAAS,IAAI,MAAM,QAAQ,EAAE,MAAM,aAAa,GAAG,OAAO,GAAG,WAAW,IACxE,IACE,OAAO,IAAI,aAAa;EACtB,MAAM,YAAY,OAAO,cAAc;GACrC,WAAW,MAAM;GACjB,YAAY,MAAM;GAClB,cAAc,MAAM;EACtB,CAAC;EAED,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,SAAS;EAE5D,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,uBAAuB,EAAE,QAAQ,QAAQ,KAAK,SAAS,QAAQ,OAAO,EAAE,EAAE,EAAE,KAAK,QAAQ,MAAM,EAAE,IAAI,QAAQ,EAAE,WAAW;EAE/J,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;EAChE,MAAM,MAAM,QAAQ,OAAO,KAAK,IAAK,uBAAuB;EAE5D,IAAI,CAAC,EAAE,eAAe,IAAI,EAAE,OAAO,GAAG,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;EAE/E,MAAM,mBAAmB,OAAO,OAAO,oBAAoB,gBAAgB,CAAC,CAC1E,IAAI,EAAE,iBACR;EAEA,MAAM,qBAAqB,iBAAiB,KAAK,OAAO,QAAQ;EAChE,MAAM,eAAe,OAAO;EAC5B,MAAM,qBAAqB,iBAAiB,KAAK,OAAO,QAAQ;EAChE,MAAM,kBAAkB,iBAAiB,KAAK,OAAO,QAAQ;EAE7D,OAAO,MAAM,KAAK;GAChB,GAAG;GACH;GACA;GACA;GACA;GACA;GACA;EACF,CAAC;EAED,OAAO,OAAO,MAAM,QAAQ;GAAE,MAAM;GAAW;EAAU,GAAG,OAAO;CACrE,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,OAAO,QAAQ,MAAM,CAAC,GACpD,MAAM,QAAQ,EAAE,MAAM,aAAa,GAAG,OAAO,CAC/C,CACN,CACF,EACJ;AACF,CAAC"}

package/dist/internal/session-native-authority.d.mts

@@ -0,0 +1,15 @@
+import { AnyTableModel } from "./table-model.mjs";
+import { AuthenticationAuthorityMapping } from "./models/session-model.mjs";
+import { NativeSqlTables } from "./native-sql-table.mjs";
+import { SqlBatchCommit } from "./sql-commit.mjs";
+import { DateTime, Effect } from "effect";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { AuthenticationAuthority, StaleAuthentication } from "@yielded/auth/Sessions";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/session-native-authority.d.ts
+export type NativeAuthenticationAuthorityMapping<Claims> = AuthenticationAuthorityMapping<Claims, AnyTableModel, AnyTableModel, AnyTableModel, unknown>;
+export declare const makeNativeAuthenticationAuthorityServices: <Claims>(tables: NativeSqlTables, mapping: NativeAuthenticationAuthorityMapping<Claims>) => Effect.Effect<{
+  readonly authenticationAuthority: AuthenticationAuthority["Service"];
+}, never, LifecycleHooks | SqlBatchCommit | SqlClient>;
+//#endregion
+//# sourceMappingURL=session-native-authority.d.mts.map

package/dist/internal/session-native-authority.mjs

@@ -0,0 +1,91 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { sqlBatchAssertion } from "./d1-planning.mjs";
+import { CurrentSqlCommit, SqlBatchCommit, appendSqlBatchStatement, makeSqlCommitExecutor, registerSqlBatchPostcondition, registerSqlPostcondition } from "./sql-commit.mjs";
+import { assessSessionAt, makeNativeSessionAuthorityState, normalizeSessionOperation, sameSessionRevision, sessionUnavailable } from "./session-native-state.mjs";
+import { makeNativeSessionPending, prepareNativeSession } from "./session-native-pending.mjs";
+import { preservesRevision } from "./session-policy.mjs";
+import { DateTime, Effect, Option } from "effect";
+import "@yielded/auth/Hooks";
+import { PendingAuthenticationInvalid, StaleAuthentication } from "@yielded/auth/Sessions";
+//#region src/internal/session-native-authority.ts
+const sessionEvidenceDeadline = Effect.fnUntraced(function* (evidence, requirement, now) {
+	const assessed = yield* assessSessionAt(evidence, requirement, now);
+	if (!assessed.satisfied) return yield* StaleAuthentication.make({});
+	const boundaries = [...new Set(evidence.proofs.map((proof) => DateTime.toEpochMillis(proof.verifiedAt) + requirement.maximumAgeMillis))].filter((n) => n > now).sort((a, b) => a - b);
+	for (const boundary of boundaries) {
+		const after = yield* assessSessionAt(evidence, requirement, boundary).pipe(Effect.result);
+		if (after._tag === "Failure" || !after.success.satisfied) return {
+			assessed,
+			validUntil: boundary
+		};
+	}
+	return yield* StaleAuthentication.make({});
+});
+const makeNativeAuthenticationAuthorityServices = Effect.fnUntraced(function* (tables, mapping) {
+	const batch = yield* SqlBatchCommit;
+	const state = yield* makeNativeSessionAuthorityState(tables, mapping, batch !== void 0);
+	const executor = yield* makeSqlCommitExecutor(sessionUnavailable);
+	const external = yield* Effect.serviceOption(CurrentSqlCommit);
+	const pending = mapping.pending === void 0 ? void 0 : yield* makeNativeSessionPending(tables, {
+		...mapping,
+		...mapping.pending
+	}, batch !== void 0);
+	const { sql, now } = state;
+	const readEvidence = Effect.fnUntraced(function* (evidence, locking) {
+		const current = yield* state.read(evidence.revision.subjectId, locking);
+		return current !== void 0 && sameSessionRevision(current.revision, evidence.revision) ? current : void 0;
+	});
+	const consume = Effect.fnUntraced(function* (input, evidence, native) {
+		if (pending === void 0 || mapping.pending === void 0) return yield* PendingAuthenticationInvalid.make({});
+		const found = yield* pending.read("Login", input.digest);
+		if (found === void 0 || found.record.version !== input.version || found.record.flowId !== input.flowId || found.record.bindingDigest !== input.bindingDigest || found.record.subjectId !== evidence.revision.subjectId) return yield* PendingAuthenticationInvalid.make({});
+		const original = yield* mapping.pending.login.decode(found.record.snapshot);
+		if (original.digest !== input.digest || original.version !== input.version || !preservesRevision(evidence, original.evidence) || DateTime.toEpochMillis(original.expiresAt) !== found.record.expiresAtMillis || original.attemptLimit !== found.record.attemptLimit) return yield* PendingAuthenticationInvalid.make({});
+		yield* pending.consume("Login", input, native);
+		return found.record.expiresAtMillis;
+	});
+	const native = (work) => batch === void 0 ? executor.operation(normalizeSessionOperation(work)) : executor.operationBatch(normalizeSessionOperation(work)).pipe(Effect.provideService(SqlBatchCommit, batch));
+	return { authenticationAuthority: {
+		capture: (subjectId, credentialIds) => executor.read(state.read(subjectId)).pipe(Effect.flatMap((current) => current === void 0 || new Set(credentialIds).size !== credentialIds.length || credentialIds.some((id) => !current.revision.credentials.some((f) => f.credentialId === id)) ? Effect.fail(StaleAuthentication.make({})) : Effect.succeed({
+			revision: current.revision,
+			requirement: current.requirement
+		}))),
+		requirements: (evidence) => executor.read(readEvidence(evidence, false)).pipe(Effect.flatMap((current) => current === void 0 ? Effect.fail(StaleAuthentication.make({})) : Effect.succeed(current.requirement))),
+		approve: (input, project) => native(Effect.gen(function* () {
+			const current = yield* readEvidence(input.evidence, true);
+			if (current === void 0) return yield* StaleAuthentication.make({});
+			const assessment = yield* sessionEvidenceDeadline(input.evidence, current.requirement, current.now);
+			const expires = DateTime.toEpochMillis(input.expiresAt), absolute = DateTime.toEpochMillis(input.absoluteExpiresAt);
+			if (current.now >= expires || expires > absolute) return yield* StaleAuthentication.make({});
+			const pendingExpiry = input.pending === void 0 ? void 0 : yield* consume(input.pending, input.evidence, current.native);
+			const deadline = Math.min(assessment.validUntil, expires, pendingExpiry ?? Infinity);
+			const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
+			if (batch !== void 0) {
+				yield* appendSqlBatchStatement(sqlBatchAssertion(sql, condition));
+				yield* registerSqlBatchPostcondition({
+					name: "signed-session-issuance-authority",
+					statement: sqlBatchAssertion(sql, input.pending === void 0 || pending === void 0 ? condition : sql`${condition} and ${pending.consumedCondition("Login", input.pending, current.native)}`)
+				});
+			} else if (Option.isSome(external)) yield* registerSqlPostcondition({
+				name: "signed-session-issuance-authority",
+				check: Effect.gen(function* () {
+					const final = yield* readEvidence(input.evidence, false);
+					if (final === void 0 || final.now < current.now || final.now >= deadline) return yield* StaleAuthentication.make({});
+					yield* sessionEvidenceDeadline(input.evidence, final.requirement, final.now);
+					if (input.pending !== void 0 && pending !== void 0) {
+						if ((yield* sql`select 1 where ${pending.consumedCondition("Login", input.pending, current.native)}`).length !== 1) return yield* PendingAuthenticationInvalid.make({});
+					}
+				}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
+					operation: "decode",
+					cause
+				})))
+			});
+			else if ((yield* sql`select 1 where ${now} >= ${current.now} and ${now} < ${deadline}`).length !== 1) return yield* StaleAuthentication.make({});
+			return yield* prepareNativeSession(void 0, project);
+		}))
+	} };
+});
+//#endregion
+export { makeNativeAuthenticationAuthorityServices, sessionEvidenceDeadline };
+
+//# sourceMappingURL=session-native-authority.mjs.map