@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/internal/password-registration-native.mjs

@@ -0,0 +1,142 @@
+import { PersistenceMappingError, isMappedConstraintConflict } from "./mapping-error.mjs";
+import { sqlBatchAssertion } from "./d1-planning.mjs";
+import { exactSqlText, executeSqlChange } from "./sql-change.mjs";
+import { allocatePasswordValue } from "./password-policy.mjs";
+import { CurrentSqlCommit, SqlBatchCommit, appendSqlBatchStatement, makeSqlCommitExecutor, registerSqlBatchPostcondition, registerSqlCommitReceipt, registerSqlPostcondition } from "./sql-commit.mjs";
+import { Cause, Data, Effect, Option, Redacted, Schema } from "effect";
+import { CurrentCommitJournal } from "@yielded/auth/Hooks";
+import { PasswordUnavailable } from "@yielded/auth/Password";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/password-registration-native.ts
+const unavailable = () => PasswordUnavailable.make({});
+const ensure = (condition) => {
+	if (!condition) throw unavailable();
+};
+var PasswordIdentifierTaken = class extends Data.TaggedError("PasswordIdentifierTaken") {};
+/** Shared binding writes for mapped SQL provisioning and application provisioning. */
+const makeNativePasswordRegistrationStore = Effect.fnUntraced(function* (tables, mapping, batch = false) {
+	const sql = (yield* SqlClient).withoutTransforms();
+	const s = mapping.subject, i = mapping.identifier, c = mapping.credential, a = mapping.authorityCredential;
+	const subject = tables(s.table), identifier = tables(i.table), password = tables(c.table), authority = tables(a.table);
+	const exact = (table, key, value) => exactSqlText(sql, table.column(key), table.value(key, value));
+	const owner = (table, key, value) => sql`${table.column(key)} = ${table.value(key, value)}`;
+	const stage = Effect.fnUntraced(function* (statement) {
+		if (batch) {
+			yield* appendSqlBatchStatement(sql`${statement}`);
+			yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));
+		} else ensure((yield* executeSqlChange(sql, statement)) === 1);
+	});
+	const available = (value) => sql`select 1 from ${identifier.name} where ${exact(identifier, i.namespace, value.namespace)} and ${exact(identifier, i.value, value.value)} limit 1`;
+	const bind = Effect.fnUntraced(function* (input) {
+		const nativeId = yield* mapping.subjectId.toNative(input.subjectId);
+		const initial = sql`${identifier.insert(i.encodeInitialInsert(input.identifier, nativeId, input.identifierRevision))}`;
+		if (batch) yield* stage(initial);
+		else yield* sql.onDialectOrElse({
+			mysql: () => stage(initial).pipe(Effect.catchIf((cause) => mapping.isIdentifierConflict !== void 0 && isMappedConstraintConflict(mapping.isIdentifierConflict, cause), () => Effect.fail(new PasswordIdentifierTaken()))),
+			orElse: () => sql`${initial} on conflict (${identifier.columnName(i.namespace)}, ${identifier.columnName(i.value)}) do nothing returning 1 as bound`.pipe(Effect.flatMap((rows) => rows.length === 1 ? Effect.void : Effect.fail(new PasswordIdentifierTaken())))
+		});
+		yield* stage(sql`${password.insert(c.encodeInsert({
+			...input,
+			subjectId: nativeId
+		}))}`);
+		yield* stage(sql`${authority.insert(a.encodeInsert({
+			subjectId: nativeId,
+			credentialId: input.credentialId,
+			revision: input.credentialRevision
+		}))}`);
+		const passwordCondition = sql`exists(select 1 from ${password.name} where ${owner(password, c.subjectId, nativeId)} and ${exact(password, c.moduleId, input.moduleId)} and ${exact(password, c.credentialId, input.credentialId)} and ${exact(password, c.credentialRevision, input.credentialRevision)} and ${exact(password, c.verifierVersion, input.verifierVersion)} and ${exact(password, c.verifier, Redacted.value(input.replacement.verifier))} and ${exact(password, c.normalization, input.replacement.normalization)})`;
+		const identifierCondition = sql`exists(select 1 from ${identifier.name} where ${exact(identifier, i.namespace, input.identifier.namespace)} and ${exact(identifier, i.value, input.identifier.value)} and ${owner(identifier, i.subjectId, nativeId)} and ${exact(identifier, i.bindingRevision, input.identifierRevision)} and ${identifier.column(i.verifiedAt)} is null)`;
+		const authorityCondition = sql`exists(select 1 from ${authority.name} where ${owner(authority, a.subjectId, nativeId)} and ${exact(authority, a.credentialId, input.credentialId)} and ${exact(authority, a.revision, input.credentialRevision)} ${a.status === void 0 ? sql`` : sql`and ${authority.column(a.status)} = ${authority.value(a.status, a.d1ActiveStatusValue)}`})`;
+		if (batch) {
+			ensure(i.d1CurrentCondition !== void 0 && s.d1ActiveStatusValue !== void 0 && (a.status === void 0 || a.d1ActiveStatusValue !== void 0));
+			yield* registerSqlBatchPostcondition({
+				name: "password-registration-authority",
+				statement: sqlBatchAssertion(sql, sql.and([
+					passwordCondition,
+					identifierCondition,
+					sql`exists(select 1 from ${identifier.name} where ${exact(identifier, i.namespace, input.identifier.namespace)} and ${exact(identifier, i.value, input.identifier.value)} and ${owner(identifier, i.subjectId, nativeId)} and ${tables.expression(i.d1CurrentCondition({
+						identifier: input.identifier,
+						nativeSubjectId: nativeId
+					}))})`,
+					authorityCondition,
+					sql`exists(select 1 from ${subject.name} where ${owner(subject, s.id, nativeId)} and ${exact(subject, s.securityRevision, input.securityRevision)} and ${subject.column(s.status)} = ${subject.value(s.status, s.d1ActiveStatusValue)})`
+				]))
+			});
+		} else yield* registerSqlPostcondition({
+			name: "password-registration-authority",
+			check: Effect.gen(function* () {
+				const rows = yield* sql`select ${subject.fields("registration_subject_")}, ${authority.fields("registration_factor_")}, ${identifier.fields("registration_identifier_")} from ${subject.name} inner join ${identifier.name} on ${exact(identifier, i.namespace, input.identifier.namespace)} and ${exact(identifier, i.value, input.identifier.value)} and ${owner(identifier, i.subjectId, nativeId)} inner join ${authority.name} on ${owner(authority, a.subjectId, nativeId)} and ${exact(authority, a.credentialId, input.credentialId)} and ${exact(authority, a.revision, input.credentialRevision)} where ${owner(subject, s.id, nativeId)} and ${exact(subject, s.securityRevision, input.securityRevision)} and ${passwordCondition} and ${identifierCondition} limit 2`;
+				ensure(rows.length === 1);
+				const subjectRow = subject.decode(rows[0], "registration_subject_");
+				const factorRow = authority.decode(rows[0], "registration_factor_");
+				ensure(i.isCurrent(identifier.decode(rows[0], "registration_identifier_")) && s.isActiveStatus(subjectRow[s.status]) && (a.status === void 0 || a.isActiveStatus?.(factorRow[a.status]) === true));
+			}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
+				operation: "decode",
+				cause
+			})))
+		});
+	});
+	const prepare = (value, project) => Effect.gen(function* () {
+		const receipt = project(value, yield* CurrentCommitJournal);
+		const current = yield* CurrentSqlCommit;
+		if (current.mode === "batch" && current.statements.length === 0) yield* appendSqlBatchStatement(sql`select 1`);
+		ensure(receipt?._tag === "PreparedCommit" && Effect.isEffect(receipt.read));
+		yield* registerSqlCommitReceipt(receipt);
+		return receipt;
+	});
+	return {
+		available,
+		bind,
+		prepare,
+		stage
+	};
+});
+const makeNativePasswordRegistrationServices = Effect.fnUntraced(function* (tables, mapping, batch) {
+	const sql = (yield* SqlClient).withoutTransforms();
+	const executor = yield* makeSqlCommitExecutor(unavailable);
+	const store = yield* makeNativePasswordRegistrationStore(tables, mapping, batch !== void 0);
+	const mode = "interactive";
+	const parent = yield* Effect.serviceOption(CurrentSqlCommit);
+	const run = (work, suppressed) => batch !== void 0 ? executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch)) : Option.isSome(parent) ? executor.run(work) : executor.operation(work.pipe(Effect.mapError((error) => error instanceof PasswordIdentifierTaken ? error : unavailable()))).pipe(Effect.catchCause((cause) => cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && reason.error instanceof PasswordIdentifierTaken) ? executor.run(suppressed, "statement") : Effect.failCause(cause)), Effect.mapError(unavailable));
+	return { registrationAuthority: { register: (input, project) => executor.read(store.available(input.identifier)).pipe(Effect.flatMap((existing) => existing.length !== 0 ? executor.run(store.prepare({ _tag: "Suppressed" }, project), "statement") : run(Effect.gen(function* () {
+		const provisioning = mapping.provisioning;
+		if (batch !== void 0 && provisioning.idMode === "generated") return yield* unavailable();
+		let nativeId = provisioning.idMode === "generated" ? void 0 : yield* allocatePasswordValue(mode, provisioning.allocateSubjectId, provisioning.allocateSubjectIdSync);
+		const securityRevision = yield* allocatePasswordValue(mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+		const identifierRevision = yield* allocatePasswordValue(mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+		const credentialRevision = yield* allocatePasswordValue(mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+		const verifierVersion = yield* allocatePasswordValue(mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+		const credentialId = yield* allocatePasswordValue(mode, mapping.allocateCredentialId, mapping.allocateCredentialIdSync);
+		const subject = tables(mapping.subject.table);
+		const insertion = sql`${subject.insert(provisioning.encodeSubjectInsert(input, {
+			nativeSubjectId: nativeId,
+			securityRevision
+		}))}`;
+		if (provisioning.idMode === "generated") {
+			const generated = yield* sql.onDialectOrElse({
+				mysql: () => insertion.raw.pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.Struct({ insertId: Schema.Union([Schema.Int, Schema.String]) }))), Effect.map((header) => [{ [mapping.subject.id]: header.insertId }])),
+				orElse: () => sql`${insertion} returning ${subject.fields("registration_generated_")}`.pipe(Effect.map((rows) => rows.map((row) => subject.decode(row, "registration_generated_"))))
+			});
+			nativeId = yield* provisioning.decodeGeneratedId(generated);
+		} else yield* store.stage(insertion);
+		ensure(nativeId !== void 0);
+		const subjectId = yield* mapping.subjectId.toSubject(nativeId);
+		yield* store.bind({
+			...input,
+			subjectId,
+			securityRevision,
+			identifierRevision,
+			credentialId,
+			credentialRevision,
+			verifierVersion
+		});
+		return yield* store.prepare({
+			_tag: "Created",
+			subjectId
+		}, project);
+	}), store.prepare({ _tag: "Suppressed" }, project)))) } };
+});
+//#endregion
+export { PasswordIdentifierTaken, makeNativePasswordRegistrationServices, makeNativePasswordRegistrationStore };
+
+//# sourceMappingURL=password-registration-native.mjs.map

package/dist/internal/password-registration-native.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-registration-native.mjs","names":[],"sources":["../../src/internal/password-registration-native.ts"],"sourcesContent":["import { CurrentCommitJournal, type LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  PasswordUnavailable,\n  type PasswordReplacement,\n  type PreparePasswordCommit,\n  type PasswordRegistrationDecision,\n} from \"@yielded/auth/Password\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type { SecurityRevision } from \"@yielded/auth/Sessions\";\nimport { Effect, Redacted, Schema, Option, Data, Cause, type Crypto } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError, isMappedConstraintConflict } from \"./mapping-error\";\nimport type { AnyPasswordRegistrationMapping } from \"./models/password-model\";\nimport type { NativeSqlTables, SqlTable } from \"./native-sql-table\";\nimport { allocatePasswordValue } from \"./password-policy\";\nimport type { PasswordRegistrationAuthority } from \"./registration-contract\";\nimport { exactSqlText, executeSqlChange } from \"./sql-change\";\nimport {\n  appendSqlBatchStatement,\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  registerSqlBatchPostcondition,\n  registerSqlCommitReceipt,\n  registerSqlPostcondition,\n  SqlBatchCommit,\n} from \"./sql-commit\";\n\nconst unavailable = () => PasswordUnavailable.make({});\n\nconst ensure: (condition: unknown) => asserts condition = (condition) => {\n  if (!condition) throw unavailable();\n};\n\nexport class PasswordIdentifierTaken extends Data.TaggedError(\"PasswordIdentifierTaken\") {}\n\ntype BindingMapping = Pick<\n  AnyPasswordRegistrationMapping,\n  \"subject\" | \"identifier\" | \"credential\" | \"authorityCredential\" | \"subjectId\"\n> & { readonly isIdentifierConflict?: (cause: unknown) => boolean };\n\n/** Shared binding writes for mapped SQL provisioning and application provisioning. */\nexport const makeNativePasswordRegistrationStore = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: BindingMapping,\n  batch = false,\n) {\n  const sql = (yield* SqlClient).withoutTransforms();\n\n  const s = mapping.subject,\n    i = mapping.identifier,\n    c = mapping.credential,\n    a = mapping.authorityCredential;\n\n  const subject = tables(s.table),\n    identifier = tables(i.table),\n    password = tables(c.table),\n    authority = tables(a.table);\n\n  const exact = (table: SqlTable, key: string, value: unknown) =>\n    exactSqlText(sql, table.column(key), table.value(key, value));\n\n  const owner = (table: SqlTable, key: string, value: unknown) =>\n    sql`${table.column(key)} = ${table.value(key, value)}`;\n\n  const stage = Effect.fnUntraced(function* (statement: Fragment) {\n    if (batch) {\n      yield* appendSqlBatchStatement(sql`${statement}`);\n      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));\n    } else ensure((yield* executeSqlChange(sql, statement)) === 1);\n  });\n\n  const available = (value: LoginIdentifier) =>\n    sql`select 1 from ${identifier.name} where ${exact(identifier, i.namespace, value.namespace)} and ${exact(identifier, i.value, value.value)} limit 1`;\n\n  const bind = Effect.fnUntraced(function* (input: {\n    readonly moduleId: string;\n    readonly identifier: LoginIdentifier;\n    readonly subjectId: SubjectId;\n    readonly securityRevision: SecurityRevision;\n    readonly identifierRevision: SecurityRevision;\n    readonly credentialId: string;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly replacement: PasswordReplacement;\n  }) {\n    const nativeId = yield* mapping.subjectId.toNative(input.subjectId);\n\n    const initial = sql`${identifier.insert(i.encodeInitialInsert(input.identifier, nativeId, input.identifierRevision))}`;\n\n    if (batch) yield* stage(initial);\n    else\n      yield* sql.onDialectOrElse({\n        mysql: () =>\n          stage(initial).pipe(\n            Effect.catchIf(\n              (cause) =>\n                mapping.isIdentifierConflict !== undefined &&\n                isMappedConstraintConflict(mapping.isIdentifierConflict, cause),\n              () => Effect.fail(new PasswordIdentifierTaken()),\n            ),\n          ),\n        orElse: () =>\n          sql`${initial} on conflict (${identifier.columnName(i.namespace)}, ${identifier.columnName(i.value)}) do nothing returning 1 as bound`.pipe(\n            Effect.flatMap((rows) =>\n              rows.length === 1 ? Effect.void : Effect.fail(new PasswordIdentifierTaken()),\n            ),\n          ),\n      });\n    yield* stage(sql`${password.insert(c.encodeInsert({ ...input, subjectId: nativeId }))}`);\n    yield* stage(\n      sql`${authority.insert(a.encodeInsert({ subjectId: nativeId, credentialId: input.credentialId, revision: input.credentialRevision }))}`,\n    );\n    const passwordCondition = sql`exists(select 1 from ${password.name} where ${owner(password, c.subjectId, nativeId)} and ${exact(password, c.moduleId, input.moduleId)} and ${exact(password, c.credentialId, input.credentialId)} and ${exact(password, c.credentialRevision, input.credentialRevision)} and ${exact(password, c.verifierVersion, input.verifierVersion)} and ${exact(password, c.verifier, Redacted.value(input.replacement.verifier))} and ${exact(password, c.normalization, input.replacement.normalization)})`;\n    const identifierCondition = sql`exists(select 1 from ${identifier.name} where ${exact(identifier, i.namespace, input.identifier.namespace)} and ${exact(identifier, i.value, input.identifier.value)} and ${owner(identifier, i.subjectId, nativeId)} and ${exact(identifier, i.bindingRevision, input.identifierRevision)} and ${identifier.column(i.verifiedAt)} is null)`;\n    const authorityCondition = sql`exists(select 1 from ${authority.name} where ${owner(authority, a.subjectId, nativeId)} and ${exact(authority, a.credentialId, input.credentialId)} and ${exact(authority, a.revision, input.credentialRevision)} ${a.status === undefined ? sql`` : sql`and ${authority.column(a.status)} = ${authority.value(a.status, a.d1ActiveStatusValue)}`})`;\n\n    if (batch) {\n      ensure(\n        i.d1CurrentCondition !== undefined &&\n          s.d1ActiveStatusValue !== undefined &&\n          (a.status === undefined || a.d1ActiveStatusValue !== undefined),\n      );\n      yield* registerSqlBatchPostcondition({\n        name: \"password-registration-authority\",\n        statement: sqlBatchAssertion(\n          sql,\n          sql.and([\n            passwordCondition,\n            identifierCondition,\n            sql`exists(select 1 from ${identifier.name} where ${exact(identifier, i.namespace, input.identifier.namespace)} and ${exact(identifier, i.value, input.identifier.value)} and ${owner(identifier, i.subjectId, nativeId)} and ${tables.expression(i.d1CurrentCondition!({ identifier: input.identifier, nativeSubjectId: nativeId }))})`,\n            authorityCondition,\n            sql`exists(select 1 from ${subject.name} where ${owner(subject, s.id, nativeId)} and ${exact(subject, s.securityRevision, input.securityRevision)} and ${subject.column(s.status)} = ${subject.value(s.status, s.d1ActiveStatusValue)})`,\n          ]),\n        ),\n      });\n    } else\n      yield* registerSqlPostcondition({\n        name: \"password-registration-authority\",\n        check: Effect.gen(function* () {\n          const rows =\n            yield* sql`select ${subject.fields(\"registration_subject_\")}, ${authority.fields(\"registration_factor_\")}, ${identifier.fields(\"registration_identifier_\")} from ${subject.name} inner join ${identifier.name} on ${exact(identifier, i.namespace, input.identifier.namespace)} and ${exact(identifier, i.value, input.identifier.value)} and ${owner(identifier, i.subjectId, nativeId)} inner join ${authority.name} on ${owner(authority, a.subjectId, nativeId)} and ${exact(authority, a.credentialId, input.credentialId)} and ${exact(authority, a.revision, input.credentialRevision)} where ${owner(subject, s.id, nativeId)} and ${exact(subject, s.securityRevision, input.securityRevision)} and ${passwordCondition} and ${identifierCondition} limit 2`;\n\n          ensure(rows.length === 1);\n          const subjectRow = subject.decode(rows[0]!, \"registration_subject_\");\n          const factorRow = authority.decode(rows[0]!, \"registration_factor_\");\n\n          ensure(\n            i.isCurrent(identifier.decode(rows[0]!, \"registration_identifier_\")) &&\n              s.isActiveStatus(subjectRow[s.status]) &&\n              (a.status === undefined || a.isActiveStatus?.(factorRow[a.status]) === true),\n          );\n        }).pipe(\n          Effect.mapError((cause) => PersistenceMappingError.make({ operation: \"decode\", cause })),\n        ),\n      });\n  });\n\n  const prepare = <A>(\n    value: PasswordRegistrationDecision,\n    project: PreparePasswordCommit<PasswordRegistrationDecision, A>,\n  ) =>\n    Effect.gen(function* () {\n      const receipt = project(value, yield* CurrentCommitJournal);\n      const current = yield* CurrentSqlCommit;\n\n      if (current.mode === \"batch\" && current.statements.length === 0)\n        yield* appendSqlBatchStatement(sql`select 1`);\n      ensure(receipt?._tag === \"PreparedCommit\" && Effect.isEffect(receipt.read));\n      yield* registerSqlCommitReceipt(receipt);\n\n      return receipt;\n    });\n\n  return { available, bind, prepare, stage };\n});\n\nexport const makeNativePasswordRegistrationServices = Effect.fnUntraced(function* <Registration>(\n  tables: NativeSqlTables,\n  mapping: AnyPasswordRegistrationMapping<Registration>,\n  batch?: SqlBatchCommit[\"Service\"],\n): Effect.fn.Return<\n  { readonly registrationAuthority: PasswordRegistrationAuthority<Registration> },\n  PasswordUnavailable,\n  SqlClient | LifecycleHooks | Crypto.Crypto\n> {\n  const sql = (yield* SqlClient).withoutTransforms();\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const store = yield* makeNativePasswordRegistrationStore(tables, mapping, batch !== undefined);\n  const mode = \"interactive\";\n  const parent = yield* Effect.serviceOption(CurrentSqlCommit);\n\n  const run = <A, E, R>(work: Effect.Effect<A, E, R>, suppressed: Effect.Effect<A, E, R>) =>\n    batch !== undefined\n      ? executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch))\n      : Option.isSome(parent)\n        ? executor.run(work)\n        : executor\n            .operation(\n              work.pipe(\n                Effect.mapError((error) =>\n                  error instanceof PasswordIdentifierTaken ? error : unavailable(),\n                ),\n              ),\n            )\n            .pipe(\n              Effect.catchCause((cause) =>\n                cause.reasons.length > 0 &&\n                cause.reasons.every(\n                  (reason) =>\n                    Cause.isFailReason(reason) && reason.error instanceof PasswordIdentifierTaken,\n                )\n                  ? executor.run(suppressed, \"statement\")\n                  : Effect.failCause(cause),\n              ),\n              Effect.mapError(unavailable),\n            );\n\n  const registrationAuthority: PasswordRegistrationAuthority<Registration> = {\n    register: (input, project) =>\n      executor.read(store.available(input.identifier)).pipe(\n        Effect.flatMap((existing) =>\n          existing.length !== 0\n            ? executor.run(store.prepare({ _tag: \"Suppressed\" }, project), \"statement\")\n            : run(\n                Effect.gen(function* () {\n                  const provisioning = mapping.provisioning;\n\n                  if (batch !== undefined && provisioning.idMode === \"generated\")\n                    return yield* unavailable();\n\n                  let nativeId =\n                    provisioning.idMode === \"generated\"\n                      ? undefined\n                      : yield* allocatePasswordValue(\n                          mode,\n                          provisioning.allocateSubjectId,\n                          provisioning.allocateSubjectIdSync,\n                        );\n\n                  const securityRevision = yield* allocatePasswordValue(\n                    mode,\n                    mapping.allocateRevision,\n                    mapping.allocateRevisionSync,\n                  );\n\n                  const identifierRevision = yield* allocatePasswordValue(\n                    mode,\n                    mapping.allocateRevision,\n                    mapping.allocateRevisionSync,\n                  );\n\n                  const credentialRevision = yield* allocatePasswordValue(\n                    mode,\n                    mapping.allocateRevision,\n                    mapping.allocateRevisionSync,\n                  );\n\n                  const verifierVersion = yield* allocatePasswordValue(\n                    mode,\n                    mapping.allocateRevision,\n                    mapping.allocateRevisionSync,\n                  );\n\n                  const credentialId = yield* allocatePasswordValue(\n                    mode,\n                    mapping.allocateCredentialId,\n                    mapping.allocateCredentialIdSync,\n                  );\n\n                  const subject = tables(mapping.subject.table);\n                  const insertion = sql`${subject.insert(provisioning.encodeSubjectInsert(input, { nativeSubjectId: nativeId, securityRevision }))}`;\n\n                  if (provisioning.idMode === \"generated\") {\n                    const generated = yield* sql.onDialectOrElse({\n                      mysql: () =>\n                        insertion.raw.pipe(\n                          Effect.flatMap(\n                            Schema.decodeUnknownEffect(\n                              Schema.Struct({\n                                insertId: Schema.Union([Schema.Int, Schema.String]),\n                              }),\n                            ),\n                          ),\n                          Effect.map((header) => [{ [mapping.subject.id]: header.insertId }]),\n                        ),\n                      orElse: () =>\n                        sql`${insertion} returning ${subject.fields(\"registration_generated_\")}`.pipe(\n                          Effect.map((rows) =>\n                            rows.map((row) => subject.decode(row, \"registration_generated_\")),\n                          ),\n                        ),\n                    });\n\n                    nativeId = yield* provisioning.decodeGeneratedId(generated);\n                  } else yield* store.stage(insertion);\n                  ensure(nativeId !== undefined);\n                  const subjectId = yield* mapping.subjectId.toSubject(nativeId);\n\n                  yield* store.bind({\n                    ...input,\n                    subjectId,\n                    securityRevision,\n                    identifierRevision,\n                    credentialId,\n                    credentialRevision,\n                    verifierVersion,\n                  });\n\n                  return yield* store.prepare({ _tag: \"Created\", subjectId }, project);\n                }),\n                store.prepare({ _tag: \"Suppressed\" }, project),\n              ),\n        ),\n      ),\n  };\n\n  return { registrationAuthority };\n});\n"],"mappings":";;;;;;;;;;AA+BA,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;AAErD,MAAM,UAAqD,cAAc;CACvE,IAAI,CAAC,WAAW,MAAM,YAAY;AACpC;AAEA,IAAa,0BAAb,cAA6C,KAAK,YAAY,yBAAyB,CAAC,CAAC,CAAC;;AAQ1F,MAAa,sCAAsC,OAAO,WAAW,WACnE,QACA,SACA,QAAQ,OACR;CACA,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CAEjD,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ,YACZ,IAAI,QAAQ,YACZ,IAAI,QAAQ;CAEd,MAAM,UAAU,OAAO,EAAE,KAAK,GAC5B,aAAa,OAAO,EAAE,KAAK,GAC3B,WAAW,OAAO,EAAE,KAAK,GACzB,YAAY,OAAO,EAAE,KAAK;CAE5B,MAAM,SAAS,OAAiB,KAAa,UAC3C,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,KAAK,KAAK,CAAC;CAE9D,MAAM,SAAS,OAAiB,KAAa,UAC3C,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,KAAK;CAErD,MAAM,QAAQ,OAAO,WAAW,WAAW,WAAqB;EAC9D,IAAI,OAAO;GACT,OAAO,wBAAwB,GAAG,GAAG,WAAW;GAChD,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,CAAC;EAC3E,OAAO,QAAQ,OAAO,iBAAiB,KAAK,SAAS,OAAO,CAAC;CAC/D,CAAC;CAED,MAAM,aAAa,UACjB,GAAG,iBAAiB,WAAW,KAAK,SAAS,MAAM,YAAY,EAAE,WAAW,MAAM,SAAS,EAAE,OAAO,MAAM,YAAY,EAAE,OAAO,MAAM,KAAK,EAAE;CAE9I,MAAM,OAAO,OAAO,WAAW,WAAW,OAUvC;EACD,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;EAElE,MAAM,UAAU,GAAG,GAAG,WAAW,OAAO,EAAE,oBAAoB,MAAM,YAAY,UAAU,MAAM,kBAAkB,CAAC;EAEnH,IAAI,OAAO,OAAO,MAAM,OAAO;OAE7B,OAAO,IAAI,gBAAgB;GACzB,aACE,MAAM,OAAO,CAAC,CAAC,KACb,OAAO,SACJ,UACC,QAAQ,yBAAyB,KAAA,KACjC,2BAA2B,QAAQ,sBAAsB,KAAK,SAC1D,OAAO,KAAK,IAAI,wBAAwB,CAAC,CACjD,CACF;GACF,cACE,GAAG,GAAG,QAAQ,gBAAgB,WAAW,WAAW,EAAE,SAAS,EAAE,IAAI,WAAW,WAAW,EAAE,KAAK,EAAE,mCAAmC,KACrI,OAAO,SAAS,SACd,KAAK,WAAW,IAAI,OAAO,OAAO,OAAO,KAAK,IAAI,wBAAwB,CAAC,CAC7E,CACF;EACJ,CAAC;EACH,OAAO,MAAM,GAAG,GAAG,SAAS,OAAO,EAAE,aAAa;GAAE,GAAG;GAAO,WAAW;EAAS,CAAC,CAAC,GAAG;EACvF,OAAO,MACL,GAAG,GAAG,UAAU,OAAO,EAAE,aAAa;GAAE,WAAW;GAAU,cAAc,MAAM;GAAc,UAAU,MAAM;EAAmB,CAAC,CAAC,GACtI;EACA,MAAM,oBAAoB,GAAG,wBAAwB,SAAS,KAAK,SAAS,MAAM,UAAU,EAAE,WAAW,QAAQ,EAAE,OAAO,MAAM,UAAU,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,MAAM,UAAU,EAAE,cAAc,MAAM,YAAY,EAAE,OAAO,MAAM,UAAU,EAAE,oBAAoB,MAAM,kBAAkB,EAAE,OAAO,MAAM,UAAU,EAAE,iBAAiB,MAAM,eAAe,EAAE,OAAO,MAAM,UAAU,EAAE,UAAU,SAAS,MAAM,MAAM,YAAY,QAAQ,CAAC,EAAE,OAAO,MAAM,UAAU,EAAE,eAAe,MAAM,YAAY,aAAa,EAAE;EACjgB,MAAM,sBAAsB,GAAG,wBAAwB,WAAW,KAAK,SAAS,MAAM,YAAY,EAAE,WAAW,MAAM,WAAW,SAAS,EAAE,OAAO,MAAM,YAAY,EAAE,OAAO,MAAM,WAAW,KAAK,EAAE,OAAO,MAAM,YAAY,EAAE,WAAW,QAAQ,EAAE,OAAO,MAAM,YAAY,EAAE,iBAAiB,MAAM,kBAAkB,EAAE,OAAO,WAAW,OAAO,EAAE,UAAU,EAAE;EAClW,MAAM,qBAAqB,GAAG,wBAAwB,UAAU,KAAK,SAAS,MAAM,WAAW,EAAE,WAAW,QAAQ,EAAE,OAAO,MAAM,WAAW,EAAE,cAAc,MAAM,YAAY,EAAE,OAAO,MAAM,WAAW,EAAE,UAAU,MAAM,kBAAkB,EAAE,GAAG,EAAE,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,OAAO,UAAU,OAAO,EAAE,MAAM,EAAE,KAAK,UAAU,MAAM,EAAE,QAAQ,EAAE,mBAAmB,IAAI;EAEjX,IAAI,OAAO;GACT,OACE,EAAE,uBAAuB,KAAA,KACvB,EAAE,wBAAwB,KAAA,MACzB,EAAE,WAAW,KAAA,KAAa,EAAE,wBAAwB,KAAA,EACzD;GACA,OAAO,8BAA8B;IACnC,MAAM;IACN,WAAW,kBACT,KACA,IAAI,IAAI;KACN;KACA;KACA,GAAG,wBAAwB,WAAW,KAAK,SAAS,MAAM,YAAY,EAAE,WAAW,MAAM,WAAW,SAAS,EAAE,OAAO,MAAM,YAAY,EAAE,OAAO,MAAM,WAAW,KAAK,EAAE,OAAO,MAAM,YAAY,EAAE,WAAW,QAAQ,EAAE,OAAO,OAAO,WAAW,EAAE,mBAAoB;MAAE,YAAY,MAAM;MAAY,iBAAiB;KAAS,CAAC,CAAC,EAAE;KACtU;KACA,GAAG,wBAAwB,QAAQ,KAAK,SAAS,MAAM,SAAS,EAAE,IAAI,QAAQ,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,MAAM,gBAAgB,EAAE,OAAO,QAAQ,OAAO,EAAE,MAAM,EAAE,KAAK,QAAQ,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE;IACxO,CAAC,CACH;GACF,CAAC;EACH,OACE,OAAO,yBAAyB;GAC9B,MAAM;GACN,OAAO,OAAO,IAAI,aAAa;IAC7B,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,uBAAuB,EAAE,IAAI,UAAU,OAAO,sBAAsB,EAAE,IAAI,WAAW,OAAO,0BAA0B,EAAE,QAAQ,QAAQ,KAAK,cAAc,WAAW,KAAK,MAAM,MAAM,YAAY,EAAE,WAAW,MAAM,WAAW,SAAS,EAAE,OAAO,MAAM,YAAY,EAAE,OAAO,MAAM,WAAW,KAAK,EAAE,OAAO,MAAM,YAAY,EAAE,WAAW,QAAQ,EAAE,cAAc,UAAU,KAAK,MAAM,MAAM,WAAW,EAAE,WAAW,QAAQ,EAAE,OAAO,MAAM,WAAW,EAAE,cAAc,MAAM,YAAY,EAAE,OAAO,MAAM,WAAW,EAAE,UAAU,MAAM,kBAAkB,EAAE,SAAS,MAAM,SAAS,EAAE,IAAI,QAAQ,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,MAAM,gBAAgB,EAAE,OAAO,kBAAkB,OAAO,oBAAoB;IAE9tB,OAAO,KAAK,WAAW,CAAC;IACxB,MAAM,aAAa,QAAQ,OAAO,KAAK,IAAK,uBAAuB;IACnE,MAAM,YAAY,UAAU,OAAO,KAAK,IAAK,sBAAsB;IAEnE,OACE,EAAE,UAAU,WAAW,OAAO,KAAK,IAAK,0BAA0B,CAAC,KACjE,EAAE,eAAe,WAAW,EAAE,OAAO,MACpC,EAAE,WAAW,KAAA,KAAa,EAAE,iBAAiB,UAAU,EAAE,OAAO,MAAM,KAC3E;GACF,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UAAU,wBAAwB,KAAK;IAAE,WAAW;IAAU;GAAM,CAAC,CAAC,CACzF;EACF,CAAC;CACL,CAAC;CAED,MAAM,WACJ,OACA,YAEA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,QAAQ,OAAO,OAAO,oBAAoB;EAC1D,MAAM,UAAU,OAAO;EAEvB,IAAI,QAAQ,SAAS,WAAW,QAAQ,WAAW,WAAW,GAC5D,OAAO,wBAAwB,GAAG,UAAU;EAC9C,OAAO,SAAS,SAAS,oBAAoB,OAAO,SAAS,QAAQ,IAAI,CAAC;EAC1E,OAAO,yBAAyB,OAAO;EAEvC,OAAO;CACT,CAAC;CAEH,OAAO;EAAE;EAAW;EAAM;EAAS;CAAM;AAC3C,CAAC;AAED,MAAa,yCAAyC,OAAO,WAAW,WACtE,QACA,SACA,OAKA;CACA,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CACjD,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,QAAQ,OAAO,oCAAoC,QAAQ,SAAS,UAAU,KAAA,CAAS;CAC7F,MAAM,OAAO;CACb,MAAM,SAAS,OAAO,OAAO,cAAc,gBAAgB;CAE3D,MAAM,OAAgB,MAA8B,eAClD,UAAU,KAAA,IACN,SAAS,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,IACtE,OAAO,OAAO,MAAM,IAClB,SAAS,IAAI,IAAI,IACjB,SACG,UACC,KAAK,KACH,OAAO,UAAU,UACf,iBAAiB,0BAA0B,QAAQ,YAAY,CACjE,CACF,CACF,CAAC,CACA,KACC,OAAO,YAAY,UACjB,MAAM,QAAQ,SAAS,KACvB,MAAM,QAAQ,OACX,WACC,MAAM,aAAa,MAAM,KAAK,OAAO,iBAAiB,uBAC1D,IACI,SAAS,IAAI,YAAY,WAAW,IACpC,OAAO,UAAU,KAAK,CAC5B,GACA,OAAO,SAAS,WAAW,CAC7B;CAqGV,OAAO,EAAE,uBAAA,EAlGP,WAAW,OAAO,YAChB,SAAS,KAAK,MAAM,UAAU,MAAM,UAAU,CAAC,CAAC,CAAC,KAC/C,OAAO,SAAS,aACd,SAAS,WAAW,IAChB,SAAS,IAAI,MAAM,QAAQ,EAAE,MAAM,aAAa,GAAG,OAAO,GAAG,WAAW,IACxE,IACE,OAAO,IAAI,aAAa;EACtB,MAAM,eAAe,QAAQ;EAE7B,IAAI,UAAU,KAAA,KAAa,aAAa,WAAW,aACjD,OAAO,OAAO,YAAY;EAE5B,IAAI,WACF,aAAa,WAAW,cACpB,KAAA,IACA,OAAO,sBACL,MACA,aAAa,mBACb,aAAa,qBACf;EAEN,MAAM,mBAAmB,OAAO,sBAC9B,MACA,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,qBAAqB,OAAO,sBAChC,MACA,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,qBAAqB,OAAO,sBAChC,MACA,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,kBAAkB,OAAO,sBAC7B,MACA,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,eAAe,OAAO,sBAC1B,MACA,QAAQ,sBACR,QAAQ,wBACV;EAEA,MAAM,UAAU,OAAO,QAAQ,QAAQ,KAAK;EAC5C,MAAM,YAAY,GAAG,GAAG,QAAQ,OAAO,aAAa,oBAAoB,OAAO;GAAE,iBAAiB;GAAU;EAAiB,CAAC,CAAC;EAE/H,IAAI,aAAa,WAAW,aAAa;GACvC,MAAM,YAAY,OAAO,IAAI,gBAAgB;IAC3C,aACE,UAAU,IAAI,KACZ,OAAO,QACL,OAAO,oBACL,OAAO,OAAO,EACZ,UAAU,OAAO,MAAM,CAAC,OAAO,KAAK,OAAO,MAAM,CAAC,EACpD,CAAC,CACH,CACF,GACA,OAAO,KAAK,WAAW,CAAC,GAAG,QAAQ,QAAQ,KAAK,OAAO,SAAS,CAAC,CAAC,CACpE;IACF,cACE,GAAG,GAAG,UAAU,aAAa,QAAQ,OAAO,yBAAyB,IAAI,KACvE,OAAO,KAAK,SACV,KAAK,KAAK,QAAQ,QAAQ,OAAO,KAAK,yBAAyB,CAAC,CAClE,CACF;GACJ,CAAC;GAED,WAAW,OAAO,aAAa,kBAAkB,SAAS;EAC5D,OAAO,OAAO,MAAM,MAAM,SAAS;EACnC,OAAO,aAAa,KAAA,CAAS;EAC7B,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,QAAQ;EAE7D,OAAO,MAAM,KAAK;GAChB,GAAG;GACH;GACA;GACA;GACA;GACA;GACA;EACF,CAAC;EAED,OAAO,OAAO,MAAM,QAAQ;GAAE,MAAM;GAAW;EAAU,GAAG,OAAO;CACrE,CAAC,GACD,MAAM,QAAQ,EAAE,MAAM,aAAa,GAAG,OAAO,CAC/C,CACN,CACF,EAGyB,EAAE;AACjC,CAAC"}

package/dist/internal/persistence.d.mts

@@ -1,28 +1,15 @@
-import { NativeDatabase } from "./transaction-kernel.mjs";
-import { QueryOperations } from "./query-operations.mjs";
-import { CurrentProofSql } from "./proof-kernel.mjs";
 import { StorageTable } from "./storage-tables.mjs";
-import { MappingInput, PasskeyFeature, PersistenceApi, PersistenceConfigurationError } from "./configuration.mjs";
+import { PersistenceApi, PersistenceConfigurationError } from "./configuration.mjs";
 import { NativeSqlTables } from "./native-sql-table.mjs";
-import { Context, Crypto, Effect } from "effect";
+import { Effect } from "effect";
 import { SqlClient } from "effect/sql";
-import { PasskeyConfig } from "@yielded/auth/Passkey";
-import { LifecycleHooks } from "@yielded/auth/Hooks";
 //#region src/internal/persistence.d.ts
-export interface Backend<T extends object, R> {
+export interface Backend<T extends object, R, Database extends object = object> {
   readonly makeTable: (definition: StorageTable) => T;
   readonly describe: (table: T) => StorageTable;
-  readonly acquire: Effect.Effect<object, PersistenceConfigurationError, R | SqlClient.SqlClient>;
-  readonly operations: QueryOperations;
-  readonly nativeTables: (client: SqlClient.SqlClient, database: object) => NativeSqlTables;
-  readonly passkeys: (input: {
-    readonly storage: MappingInput;
-    readonly namespace: string;
-    readonly dialect: "pg" | "sqlite";
-    readonly features: ReadonlyArray<PasskeyFeature>;
-    readonly passwordModules: ReadonlyArray<string>;
-  }) => Effect.Effect<Context.Context<never>, PersistenceConfigurationError, PasskeyConfig | LifecycleHooks | SqlClient.SqlClient | NativeDatabase | CurrentProofSql | Crypto.Crypto>;
+  readonly acquire: Effect.Effect<Database, PersistenceConfigurationError, R | SqlClient.SqlClient>;
+  readonly nativeTables: (database: Database) => NativeSqlTables;
 }
-export declare const createPersistence: <T extends object, R>(backend: Backend<T, R>) => PersistenceApi<T, R>;
+export declare const createPersistence: <T extends object, R, Database extends object = object>(backend: Backend<T, R, Database>) => PersistenceApi<T, R>;
 //#endregion
 //# sourceMappingURL=persistence.d.mts.map