@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/internal/email-native-state.mjs

@@ -0,0 +1,135 @@
+import { exactSqlText } from "./sql-change.mjs";
+import { Effect, Option, Schema } from "effect";
+import { EmailCredentialSnapshot, EmailUnavailable } from "@yielded/auth/Email";
+import { AuthenticationRevision } from "@yielded/auth/Sessions";
+import { SqlClient } from "effect/sql/SqlClient";
+import { LoginIdentifier } from "@yielded/auth/Identity";
+//#region src/internal/email-native-state.ts
+const emailUnavailable = () => EmailUnavailable.make({});
+const ensureEmail = (condition) => {
+	if (!condition) throw emailUnavailable();
+};
+/** Every role binds the decoded native subject through its own physical column codec. */
+const makeNativeEmailReader = Effect.fnUntraced(function* (tables, mapping, engineNow) {
+	const sql = (yield* SqlClient).withoutTransforms();
+	const s = mapping.subject, i = mapping.identifier, c = mapping.credential, a = mapping.authorityCredential;
+	const subject = tables(s.table).as("email_subject"), targetIdentifier = tables(i.table).as("email_target_identifier"), sourceIdentifier = tables(i.table).as("email_source_identifier"), targetCredential = tables(c.table).as("email_target_credential"), sourceCredential = tables(c.table).as("email_source_credential"), authority = tables(a.table).as("email_authority"), sourceAuthority = tables(a.table).as("email_source_authority"), cardinality = tables(c.table).as("email_cardinality");
+	const exact = (t, key, value) => exactSqlText(sql, t.column(key), t.value(key, value));
+	const id = (t, key, value) => sql`${t.column(key)} = ${t.value(key, value)}`;
+	const identifierKey = (t, value) => sql.and([exact(t, i.namespace, value.namespace), exact(t, i.value, value.value)]);
+	const credentialKey = (t, moduleId, value) => sql.and([
+		exact(t, c.moduleId, moduleId),
+		exact(t, c.identifierNamespace, value.namespace),
+		exact(t, c.identifierValue, value.value)
+	]);
+	const selected = (t, row, prefix, key) => {
+		const decoded = t.decode(row, prefix);
+		return decoded[key] === null || decoded[key] === void 0 ? void 0 : decoded;
+	};
+	const owned = Effect.fnUntraced(function* (row, key, subjectId) {
+		return row !== void 0 && (yield* mapping.subjectId.toSubject(row[key])) === subjectId;
+	});
+	const read = Effect.fnUntraced(function* (input) {
+		const native = yield* mapping.subjectId.toNative(input.subjectId);
+		let source = input.sourceIdentifier;
+		if (input.sourceCredentialId !== void 0 && source === void 0) {
+			const table = tables(c.table);
+			const rows = yield* sql`select ${table.fields("email_source_lookup_")} from ${table.name} where ${exact(table, c.moduleId, input.moduleId)} and ${exact(table, c.credentialId, input.sourceCredentialId)} and ${id(table, c.subjectId, native)} limit 2`;
+			if (rows.length !== 1) return void 0;
+			const row = table.decode(rows[0], "email_source_lookup_");
+			ensureEmail(row[c.credentialId] === input.sourceCredentialId);
+			source = yield* Schema.decodeUnknownEffect(LoginIdentifier)({
+				namespace: row[c.identifierNamespace],
+				value: row[c.identifierValue]
+			});
+		}
+		const rows = yield* sql`select ${subject.fields("email_subject_")}, ${targetIdentifier.fields("email_target_identifier_")}, ${sourceIdentifier.fields("email_source_identifier_")}, ${targetCredential.fields("email_target_credential_")}, ${sourceCredential.fields("email_source_credential_")}, ${authority.fields("email_authority_")}, ${sourceAuthority.fields("email_source_authority_")}, ${engineNow ?? sql`0`} as engine_now, case when ${input.single === true && input.sourceCredentialId === void 0 ? sql`exists(select 1 from ${cardinality.name} where ${id(cardinality, c.subjectId, native)} and ${exact(cardinality, c.moduleId, input.moduleId)} and ${id(cardinality, c.status, c.activeStatusValue)})` : sql`1 = 0`} then 1 else 0 end as cardinality_conflict
+      from ${subject.name}
+      left join ${targetIdentifier.name} on ${identifierKey(targetIdentifier, input.identifier)}
+      left join ${sourceIdentifier.name} on ${source === void 0 ? sql`1 = 0` : identifierKey(sourceIdentifier, source)}
+      left join ${targetCredential.name} on ${credentialKey(targetCredential, input.moduleId, input.identifier)}
+      left join ${sourceCredential.name} on ${input.sourceCredentialId === void 0 ? sql`1 = 0` : sql.and([exact(sourceCredential, c.moduleId, input.moduleId), exact(sourceCredential, c.credentialId, input.sourceCredentialId)])}
+      left join ${sourceAuthority.name} on ${input.sourceCredentialId === void 0 ? sql`1 = 0` : sql.and([id(sourceAuthority, a.subjectId, native), exact(sourceAuthority, a.credentialId, input.sourceCredentialId)])}
+      left join ${authority.name} on ${id(authority, a.subjectId, native)} and ${id(authority, a.status, a.activeStatusValue)}
+      where ${id(subject, s.id, native)} and ${input.validity ?? sql`1 = 1`} limit 65`;
+		ensureEmail(rows.length <= 64);
+		const first = rows[0];
+		if (first === void 0) return void 0;
+		const subjectRow = subject.decode(first, "email_subject_");
+		ensureEmail((yield* mapping.subjectId.toSubject(subjectRow[s.id])) === input.subjectId);
+		if (!s.isActiveStatus(subjectRow[s.status])) return void 0;
+		const factors = [];
+		for (const row of rows) {
+			const factor = selected(authority, row, "email_authority_", a.credentialId);
+			if (factor === void 0) continue;
+			ensureEmail((yield* owned(factor, a.subjectId, input.subjectId)) && a.isActiveStatus(factor[a.status]));
+			ensureEmail(!factors.some((f) => f.credentialId === factor[a.credentialId]));
+			factors.push({
+				credentialId: factor[a.credentialId],
+				revision: factor[a.revision]
+			});
+		}
+		const revision = yield* Schema.decodeUnknownEffect(AuthenticationRevision)({
+			subjectId: input.subjectId,
+			securityRevision: subjectRow[s.securityRevision],
+			credentials: factors.sort((a, b) => String(a.credentialId).localeCompare(String(b.credentialId)))
+		});
+		const targetRow = selected(targetIdentifier, first, "email_target_identifier_", i.namespace), sourceRow = selected(sourceIdentifier, first, "email_source_identifier_", i.namespace), targetFactor = selected(targetCredential, first, "email_target_credential_", c.credentialId), sourceFactor = selected(sourceCredential, first, "email_source_credential_", c.credentialId);
+		const snapshot = Effect.fnUntraced(function* (identifierRow, credentialRow, value) {
+			if (identifierRow === void 0 || credentialRow === void 0 || value === void 0 || !i.isCurrent(identifierRow) || identifierRow[i.verifiedAt] === null || identifierRow[i.verifiedAt] === void 0 || !c.isActiveStatus(credentialRow[c.status]) || !(yield* owned(identifierRow, i.subjectId, input.subjectId)) || !(yield* owned(credentialRow, c.subjectId, input.subjectId))) return void 0;
+			ensureEmail(identifierRow[i.namespace] === value.namespace && identifierRow[i.value] === value.value && credentialRow[c.moduleId] === input.moduleId && credentialRow[c.identifierNamespace] === value.namespace && credentialRow[c.identifierValue] === value.value);
+			if (!revision.credentials.some((f) => f.credentialId === credentialRow[c.credentialId] && f.revision === credentialRow[c.credentialRevision])) return void 0;
+			const decoded = yield* c.decode({
+				moduleId: input.moduleId,
+				subject: subjectRow,
+				identifier: identifierRow,
+				credential: credentialRow
+			});
+			return yield* Schema.decodeEffect(EmailCredentialSnapshot)({
+				...decoded,
+				revision,
+				requirement: yield* s.decodeRequirement(subjectRow)
+			});
+		});
+		ensureEmail(targetRow === void 0 || targetRow[i.namespace] === input.identifier.namespace && targetRow[i.value] === input.identifier.value);
+		ensureEmail(targetFactor === void 0 || targetFactor[c.moduleId] === input.moduleId && targetFactor[c.identifierNamespace] === input.identifier.namespace && targetFactor[c.identifierValue] === input.identifier.value);
+		const now = Number(first.engine_now);
+		ensureEmail(Number.isSafeInteger(now));
+		return {
+			native,
+			subject: subjectRow,
+			revision,
+			targetIdentifier: targetRow,
+			sourceIdentifier: sourceRow,
+			targetCredential: targetFactor,
+			sourceCredential: sourceFactor,
+			sourceAuthority: selected(sourceAuthority, first, "email_source_authority_", a.credentialId),
+			targetSnapshot: yield* snapshot(targetRow, targetFactor, input.identifier),
+			sourceSnapshot: yield* snapshot(sourceRow, sourceFactor, source),
+			cardinalityConflict: Number(first.cardinality_conflict) === 1,
+			now
+		};
+	});
+	return {
+		read,
+		lookup: Effect.fnUntraced(function* (input) {
+			const table = tables(i.table);
+			const rows = yield* sql`select ${table.fields("email_lookup_")} from ${table.name} where ${identifierKey(table, input.identifier)} limit 2`;
+			if (rows.length === 0) return Option.none();
+			ensureEmail(rows.length === 1);
+			const row = table.decode(rows[0], "email_lookup_");
+			ensureEmail(row[i.namespace] === input.identifier.namespace && row[i.value] === input.identifier.value);
+			if (!i.isCurrent(row) || row[i.verifiedAt] === null || row[i.verifiedAt] === void 0) return Option.none();
+			const subjectId = yield* mapping.subjectId.toSubject(row[i.subjectId]);
+			const result = yield* read({
+				...input,
+				subjectId
+			});
+			return Option.fromUndefinedOr(result?.targetSnapshot);
+		})
+	};
+});
+//#endregion
+export { emailUnavailable, ensureEmail, makeNativeEmailReader };
+
+//# sourceMappingURL=email-native-state.mjs.map

package/dist/internal/email-native-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-native-state.mjs","names":[],"sources":["../../src/internal/email-native-state.ts"],"sourcesContent":["import { EmailCredentialSnapshot, EmailUnavailable } from \"@yielded/auth/Email\";\nimport { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport { AuthenticationRevision } from \"@yielded/auth/Sessions\";\nimport { Effect, Option, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport type { AnyEmailSignInMapping } from \"./models/email-model\";\nimport type { NativeSqlTables, SqlTable } from \"./native-sql-table\";\nimport { exactSqlText } from \"./sql-change\";\n\nexport const emailUnavailable = () => EmailUnavailable.make({});\n\nexport const ensureEmail: (condition: unknown) => asserts condition = (condition) => {\n  if (!condition) throw emailUnavailable();\n};\n\n/** Every role binds the decoded native subject through its own physical column codec. */\nexport const makeNativeEmailReader = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: AnyEmailSignInMapping,\n  engineNow?: Fragment,\n) {\n  const sql = (yield* SqlClient).withoutTransforms();\n\n  const s = mapping.subject,\n    i = mapping.identifier,\n    c = mapping.credential,\n    a = mapping.authorityCredential;\n\n  const subject = tables(s.table).as(\"email_subject\"),\n    targetIdentifier = tables(i.table).as(\"email_target_identifier\"),\n    sourceIdentifier = tables(i.table).as(\"email_source_identifier\"),\n    targetCredential = tables(c.table).as(\"email_target_credential\"),\n    sourceCredential = tables(c.table).as(\"email_source_credential\"),\n    authority = tables(a.table).as(\"email_authority\"),\n    sourceAuthority = tables(a.table).as(\"email_source_authority\"),\n    cardinality = tables(c.table).as(\"email_cardinality\");\n\n  const exact = (t: SqlTable, key: string, value: unknown) =>\n    exactSqlText(sql, t.column(key), t.value(key, value));\n\n  const id = (t: SqlTable, key: string, value: unknown) =>\n    sql`${t.column(key)} = ${t.value(key, value)}`;\n\n  const identifierKey = (t: SqlTable, value: LoginIdentifier) =>\n    sql.and([exact(t, i.namespace, value.namespace), exact(t, i.value, value.value)]);\n\n  const credentialKey = (t: SqlTable, moduleId: string, value: LoginIdentifier) =>\n    sql.and([\n      exact(t, c.moduleId, moduleId),\n      exact(t, c.identifierNamespace, value.namespace),\n      exact(t, c.identifierValue, value.value),\n    ]);\n\n  const selected = (t: SqlTable, row: Record<string, unknown>, prefix: string, key: string) => {\n    const decoded = t.decode(row, prefix);\n\n    return decoded[key] === null || decoded[key] === undefined ? undefined : decoded;\n  };\n\n  const owned = Effect.fnUntraced(function* (\n    row: Record<string, unknown> | undefined,\n    key: string,\n    subjectId: SubjectId,\n  ) {\n    return row !== undefined && (yield* mapping.subjectId.toSubject(row[key])) === subjectId;\n  });\n\n  const read = Effect.fnUntraced(function* (input: {\n    readonly moduleId: string;\n    readonly subjectId: SubjectId;\n    readonly identifier: LoginIdentifier;\n    readonly sourceCredentialId?: string;\n    readonly sourceIdentifier?: LoginIdentifier;\n    readonly single?: boolean;\n    readonly validity?: Fragment;\n  }) {\n    const native = yield* mapping.subjectId.toNative(input.subjectId);\n    let source = input.sourceIdentifier;\n\n    if (input.sourceCredentialId !== undefined && source === undefined) {\n      const table = tables(c.table);\n\n      const rows =\n        yield* sql`select ${table.fields(\"email_source_lookup_\")} from ${table.name} where ${exact(table, c.moduleId, input.moduleId)} and ${exact(table, c.credentialId, input.sourceCredentialId)} and ${id(table, c.subjectId, native)} limit 2`;\n\n      if (rows.length !== 1) return undefined;\n      const row = table.decode(rows[0]!, \"email_source_lookup_\");\n\n      ensureEmail(row[c.credentialId] === input.sourceCredentialId);\n      source = yield* Schema.decodeUnknownEffect(LoginIdentifier)({\n        namespace: row[c.identifierNamespace],\n        value: row[c.identifierValue],\n      });\n    }\n\n    const rows =\n      yield* sql`select ${subject.fields(\"email_subject_\")}, ${targetIdentifier.fields(\"email_target_identifier_\")}, ${sourceIdentifier.fields(\"email_source_identifier_\")}, ${targetCredential.fields(\"email_target_credential_\")}, ${sourceCredential.fields(\"email_source_credential_\")}, ${authority.fields(\"email_authority_\")}, ${sourceAuthority.fields(\"email_source_authority_\")}, ${engineNow ?? sql`0`} as engine_now, case when ${input.single === true && input.sourceCredentialId === undefined ? sql`exists(select 1 from ${cardinality.name} where ${id(cardinality, c.subjectId, native)} and ${exact(cardinality, c.moduleId, input.moduleId)} and ${id(cardinality, c.status, c.activeStatusValue)})` : sql`1 = 0`} then 1 else 0 end as cardinality_conflict\n      from ${subject.name}\n      left join ${targetIdentifier.name} on ${identifierKey(targetIdentifier, input.identifier)}\n      left join ${sourceIdentifier.name} on ${source === undefined ? sql`1 = 0` : identifierKey(sourceIdentifier, source)}\n      left join ${targetCredential.name} on ${credentialKey(targetCredential, input.moduleId, input.identifier)}\n      left join ${sourceCredential.name} on ${input.sourceCredentialId === undefined ? sql`1 = 0` : sql.and([exact(sourceCredential, c.moduleId, input.moduleId), exact(sourceCredential, c.credentialId, input.sourceCredentialId)])}\n      left join ${sourceAuthority.name} on ${input.sourceCredentialId === undefined ? sql`1 = 0` : sql.and([id(sourceAuthority, a.subjectId, native), exact(sourceAuthority, a.credentialId, input.sourceCredentialId)])}\n      left join ${authority.name} on ${id(authority, a.subjectId, native)} and ${id(authority, a.status, a.activeStatusValue)}\n      where ${id(subject, s.id, native)} and ${input.validity ?? sql`1 = 1`} limit 65`;\n\n    ensureEmail(rows.length <= 64);\n    const first = rows[0];\n\n    if (first === undefined) return undefined;\n    const subjectRow = subject.decode(first, \"email_subject_\");\n\n    ensureEmail((yield* mapping.subjectId.toSubject(subjectRow[s.id])) === input.subjectId);\n    if (!s.isActiveStatus(subjectRow[s.status])) return undefined;\n    const factors: { readonly credentialId: unknown; readonly revision: unknown }[] = [];\n\n    for (const row of rows) {\n      const factor = selected(authority, row, \"email_authority_\", a.credentialId);\n\n      if (factor === undefined) continue;\n      ensureEmail(\n        (yield* owned(factor, a.subjectId, input.subjectId)) && a.isActiveStatus(factor[a.status]),\n      );\n      ensureEmail(!factors.some((f) => f.credentialId === factor[a.credentialId]));\n      factors.push({ credentialId: factor[a.credentialId], revision: factor[a.revision] });\n    }\n\n    const revision = yield* Schema.decodeUnknownEffect(AuthenticationRevision)({\n      subjectId: input.subjectId,\n      securityRevision: subjectRow[s.securityRevision],\n      credentials: factors.sort((a, b) =>\n        String(a.credentialId).localeCompare(String(b.credentialId)),\n      ),\n    });\n\n    const targetRow = selected(targetIdentifier, first, \"email_target_identifier_\", i.namespace),\n      sourceRow = selected(sourceIdentifier, first, \"email_source_identifier_\", i.namespace),\n      targetFactor = selected(targetCredential, first, \"email_target_credential_\", c.credentialId),\n      sourceFactor = selected(sourceCredential, first, \"email_source_credential_\", c.credentialId);\n\n    const snapshot = Effect.fnUntraced(function* (\n      identifierRow: Record<string, unknown> | undefined,\n      credentialRow: Record<string, unknown> | undefined,\n      value: LoginIdentifier | undefined,\n    ) {\n      if (\n        identifierRow === undefined ||\n        credentialRow === undefined ||\n        value === undefined ||\n        !i.isCurrent(identifierRow) ||\n        identifierRow[i.verifiedAt] === null ||\n        identifierRow[i.verifiedAt] === undefined ||\n        !c.isActiveStatus(credentialRow[c.status]) ||\n        !(yield* owned(identifierRow, i.subjectId, input.subjectId)) ||\n        !(yield* owned(credentialRow, c.subjectId, input.subjectId))\n      )\n        return undefined;\n      ensureEmail(\n        identifierRow[i.namespace] === value.namespace &&\n          identifierRow[i.value] === value.value &&\n          credentialRow[c.moduleId] === input.moduleId &&\n          credentialRow[c.identifierNamespace] === value.namespace &&\n          credentialRow[c.identifierValue] === value.value,\n      );\n      if (\n        !revision.credentials.some(\n          (f) =>\n            f.credentialId === credentialRow[c.credentialId] &&\n            f.revision === credentialRow[c.credentialRevision],\n        )\n      )\n        return undefined;\n\n      const decoded = yield* c.decode({\n        moduleId: input.moduleId,\n        subject: subjectRow,\n        identifier: identifierRow,\n        credential: credentialRow,\n      });\n\n      return yield* Schema.decodeEffect(EmailCredentialSnapshot)({\n        ...decoded,\n        revision,\n        requirement: yield* s.decodeRequirement(subjectRow),\n      });\n    });\n\n    ensureEmail(\n      targetRow === undefined ||\n        (targetRow[i.namespace] === input.identifier.namespace &&\n          targetRow[i.value] === input.identifier.value),\n    );\n    ensureEmail(\n      targetFactor === undefined ||\n        (targetFactor[c.moduleId] === input.moduleId &&\n          targetFactor[c.identifierNamespace] === input.identifier.namespace &&\n          targetFactor[c.identifierValue] === input.identifier.value),\n    );\n    const now = Number(first.engine_now);\n\n    ensureEmail(Number.isSafeInteger(now));\n\n    return {\n      native,\n      subject: subjectRow,\n      revision,\n      targetIdentifier: targetRow,\n      sourceIdentifier: sourceRow,\n      targetCredential: targetFactor,\n      sourceCredential: sourceFactor,\n      sourceAuthority: selected(sourceAuthority, first, \"email_source_authority_\", a.credentialId),\n      targetSnapshot: yield* snapshot(targetRow, targetFactor, input.identifier),\n      sourceSnapshot: yield* snapshot(sourceRow, sourceFactor, source),\n      cardinalityConflict: Number(first.cardinality_conflict) === 1,\n      now,\n    };\n  });\n\n  const lookup = Effect.fnUntraced(function* (input: {\n    readonly moduleId: string;\n    readonly identifier: LoginIdentifier;\n  }) {\n    const table = tables(i.table);\n\n    const rows =\n      yield* sql`select ${table.fields(\"email_lookup_\")} from ${table.name} where ${identifierKey(table, input.identifier)} limit 2`;\n\n    if (rows.length === 0) return Option.none();\n    ensureEmail(rows.length === 1);\n    const row = table.decode(rows[0]!, \"email_lookup_\");\n\n    ensureEmail(\n      row[i.namespace] === input.identifier.namespace && row[i.value] === input.identifier.value,\n    );\n    if (!i.isCurrent(row) || row[i.verifiedAt] === null || row[i.verifiedAt] === undefined)\n      return Option.none();\n    const subjectId = yield* mapping.subjectId.toSubject(row[i.subjectId]);\n    const result = yield* read({ ...input, subjectId });\n\n    return Option.fromUndefinedOr(result?.targetSnapshot);\n  });\n\n  return { read, lookup };\n});\n"],"mappings":";;;;;;;AAYA,MAAa,yBAAyB,iBAAiB,KAAK,CAAC,CAAC;AAE9D,MAAa,eAA0D,cAAc;CACnF,IAAI,CAAC,WAAW,MAAM,iBAAiB;AACzC;;AAGA,MAAa,wBAAwB,OAAO,WAAW,WACrD,QACA,SACA,WACA;CACA,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB;CAEjD,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ,YACZ,IAAI,QAAQ,YACZ,IAAI,QAAQ;CAEd,MAAM,UAAU,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,eAAe,GAChD,mBAAmB,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,yBAAyB,GAC/D,mBAAmB,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,yBAAyB,GAC/D,mBAAmB,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,yBAAyB,GAC/D,mBAAmB,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,yBAAyB,GAC/D,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,iBAAiB,GAChD,kBAAkB,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,wBAAwB,GAC7D,cAAc,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,mBAAmB;CAEtD,MAAM,SAAS,GAAa,KAAa,UACvC,aAAa,KAAK,EAAE,OAAO,GAAG,GAAG,EAAE,MAAM,KAAK,KAAK,CAAC;CAEtD,MAAM,MAAM,GAAa,KAAa,UACpC,GAAG,GAAG,EAAE,OAAO,GAAG,EAAE,KAAK,EAAE,MAAM,KAAK,KAAK;CAE7C,MAAM,iBAAiB,GAAa,UAClC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,WAAW,MAAM,SAAS,GAAG,MAAM,GAAG,EAAE,OAAO,MAAM,KAAK,CAAC,CAAC;CAElF,MAAM,iBAAiB,GAAa,UAAkB,UACpD,IAAI,IAAI;EACN,MAAM,GAAG,EAAE,UAAU,QAAQ;EAC7B,MAAM,GAAG,EAAE,qBAAqB,MAAM,SAAS;EAC/C,MAAM,GAAG,EAAE,iBAAiB,MAAM,KAAK;CACzC,CAAC;CAEH,MAAM,YAAY,GAAa,KAA8B,QAAgB,QAAgB;EAC3F,MAAM,UAAU,EAAE,OAAO,KAAK,MAAM;EAEpC,OAAO,QAAQ,SAAS,QAAQ,QAAQ,SAAS,KAAA,IAAY,KAAA,IAAY;CAC3E;CAEA,MAAM,QAAQ,OAAO,WAAW,WAC9B,KACA,KACA,WACA;EACA,OAAO,QAAQ,KAAA,MAAc,OAAO,QAAQ,UAAU,UAAU,IAAI,IAAI,OAAO;CACjF,CAAC;CAED,MAAM,OAAO,OAAO,WAAW,WAAW,OAQvC;EACD,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;EAChE,IAAI,SAAS,MAAM;EAEnB,IAAI,MAAM,uBAAuB,KAAA,KAAa,WAAW,KAAA,GAAW;GAClE,MAAM,QAAQ,OAAO,EAAE,KAAK;GAE5B,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,sBAAsB,EAAE,QAAQ,MAAM,KAAK,SAAS,MAAM,OAAO,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,MAAM,OAAO,EAAE,cAAc,MAAM,kBAAkB,EAAE,OAAO,GAAG,OAAO,EAAE,WAAW,MAAM,EAAE;GAEpO,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;GAC9B,MAAM,MAAM,MAAM,OAAO,KAAK,IAAK,sBAAsB;GAEzD,YAAY,IAAI,EAAE,kBAAkB,MAAM,kBAAkB;GAC5D,SAAS,OAAO,OAAO,oBAAoB,eAAe,CAAC,CAAC;IAC1D,WAAW,IAAI,EAAE;IACjB,OAAO,IAAI,EAAE;GACf,CAAC;EACH;EAEA,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,gBAAgB,EAAE,IAAI,iBAAiB,OAAO,0BAA0B,EAAE,IAAI,iBAAiB,OAAO,0BAA0B,EAAE,IAAI,iBAAiB,OAAO,0BAA0B,EAAE,IAAI,iBAAiB,OAAO,0BAA0B,EAAE,IAAI,UAAU,OAAO,kBAAkB,EAAE,IAAI,gBAAgB,OAAO,yBAAyB,EAAE,IAAI,aAAa,GAAG,IAAI,4BAA4B,MAAM,WAAW,QAAQ,MAAM,uBAAuB,KAAA,IAAY,GAAG,wBAAwB,YAAY,KAAK,SAAS,GAAG,aAAa,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,aAAa,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,GAAG,aAAa,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,GAAG,QAAQ;aACzrB,QAAQ,KAAK;kBACR,iBAAiB,KAAK,MAAM,cAAc,kBAAkB,MAAM,UAAU,EAAE;kBAC9E,iBAAiB,KAAK,MAAM,WAAW,KAAA,IAAY,GAAG,UAAU,cAAc,kBAAkB,MAAM,EAAE;kBACxG,iBAAiB,KAAK,MAAM,cAAc,kBAAkB,MAAM,UAAU,MAAM,UAAU,EAAE;kBAC9F,iBAAiB,KAAK,MAAM,MAAM,uBAAuB,KAAA,IAAY,GAAG,UAAU,IAAI,IAAI,CAAC,MAAM,kBAAkB,EAAE,UAAU,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,cAAc,MAAM,kBAAkB,CAAC,CAAC,EAAE;kBACpN,gBAAgB,KAAK,MAAM,MAAM,uBAAuB,KAAA,IAAY,GAAG,UAAU,IAAI,IAAI,CAAC,GAAG,iBAAiB,EAAE,WAAW,MAAM,GAAG,MAAM,iBAAiB,EAAE,cAAc,MAAM,kBAAkB,CAAC,CAAC,EAAE;kBACvM,UAAU,KAAK,MAAM,GAAG,WAAW,EAAE,WAAW,MAAM,EAAE,OAAO,GAAG,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE;cAChH,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE,OAAO,MAAM,YAAY,GAAG,QAAQ;EAExE,YAAY,KAAK,UAAU,EAAE;EAC7B,MAAM,QAAQ,KAAK;EAEnB,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,MAAM,aAAa,QAAQ,OAAO,OAAO,gBAAgB;EAEzD,aAAa,OAAO,QAAQ,UAAU,UAAU,WAAW,EAAE,GAAG,OAAO,MAAM,SAAS;EACtF,IAAI,CAAC,EAAE,eAAe,WAAW,EAAE,OAAO,GAAG,OAAO,KAAA;EACpD,MAAM,UAA4E,CAAC;EAEnF,KAAK,MAAM,OAAO,MAAM;GACtB,MAAM,SAAS,SAAS,WAAW,KAAK,oBAAoB,EAAE,YAAY;GAE1E,IAAI,WAAW,KAAA,GAAW;GAC1B,aACG,OAAO,MAAM,QAAQ,EAAE,WAAW,MAAM,SAAS,MAAM,EAAE,eAAe,OAAO,EAAE,OAAO,CAC3F;GACA,YAAY,CAAC,QAAQ,MAAM,MAAM,EAAE,iBAAiB,OAAO,EAAE,aAAa,CAAC;GAC3E,QAAQ,KAAK;IAAE,cAAc,OAAO,EAAE;IAAe,UAAU,OAAO,EAAE;GAAU,CAAC;EACrF;EAEA,MAAM,WAAW,OAAO,OAAO,oBAAoB,sBAAsB,CAAC,CAAC;GACzE,WAAW,MAAM;GACjB,kBAAkB,WAAW,EAAE;GAC/B,aAAa,QAAQ,MAAM,GAAG,MAC5B,OAAO,EAAE,YAAY,CAAC,CAAC,cAAc,OAAO,EAAE,YAAY,CAAC,CAC7D;EACF,CAAC;EAED,MAAM,YAAY,SAAS,kBAAkB,OAAO,4BAA4B,EAAE,SAAS,GACzF,YAAY,SAAS,kBAAkB,OAAO,4BAA4B,EAAE,SAAS,GACrF,eAAe,SAAS,kBAAkB,OAAO,4BAA4B,EAAE,YAAY,GAC3F,eAAe,SAAS,kBAAkB,OAAO,4BAA4B,EAAE,YAAY;EAE7F,MAAM,WAAW,OAAO,WAAW,WACjC,eACA,eACA,OACA;GACA,IACE,kBAAkB,KAAA,KAClB,kBAAkB,KAAA,KAClB,UAAU,KAAA,KACV,CAAC,EAAE,UAAU,aAAa,KAC1B,cAAc,EAAE,gBAAgB,QAChC,cAAc,EAAE,gBAAgB,KAAA,KAChC,CAAC,EAAE,eAAe,cAAc,EAAE,OAAO,KACzC,EAAE,OAAO,MAAM,eAAe,EAAE,WAAW,MAAM,SAAS,MAC1D,EAAE,OAAO,MAAM,eAAe,EAAE,WAAW,MAAM,SAAS,IAE1D,OAAO,KAAA;GACT,YACE,cAAc,EAAE,eAAe,MAAM,aACnC,cAAc,EAAE,WAAW,MAAM,SACjC,cAAc,EAAE,cAAc,MAAM,YACpC,cAAc,EAAE,yBAAyB,MAAM,aAC/C,cAAc,EAAE,qBAAqB,MAAM,KAC/C;GACA,IACE,CAAC,SAAS,YAAY,MACnB,MACC,EAAE,iBAAiB,cAAc,EAAE,iBACnC,EAAE,aAAa,cAAc,EAAE,mBACnC,GAEA,OAAO,KAAA;GAET,MAAM,UAAU,OAAO,EAAE,OAAO;IAC9B,UAAU,MAAM;IAChB,SAAS;IACT,YAAY;IACZ,YAAY;GACd,CAAC;GAED,OAAO,OAAO,OAAO,aAAa,uBAAuB,CAAC,CAAC;IACzD,GAAG;IACH;IACA,aAAa,OAAO,EAAE,kBAAkB,UAAU;GACpD,CAAC;EACH,CAAC;EAED,YACE,cAAc,KAAA,KACX,UAAU,EAAE,eAAe,MAAM,WAAW,aAC3C,UAAU,EAAE,WAAW,MAAM,WAAW,KAC9C;EACA,YACE,iBAAiB,KAAA,KACd,aAAa,EAAE,cAAc,MAAM,YAClC,aAAa,EAAE,yBAAyB,MAAM,WAAW,aACzD,aAAa,EAAE,qBAAqB,MAAM,WAAW,KAC3D;EACA,MAAM,MAAM,OAAO,MAAM,UAAU;EAEnC,YAAY,OAAO,cAAc,GAAG,CAAC;EAErC,OAAO;GACL;GACA,SAAS;GACT;GACA,kBAAkB;GAClB,kBAAkB;GAClB,kBAAkB;GAClB,kBAAkB;GAClB,iBAAiB,SAAS,iBAAiB,OAAO,2BAA2B,EAAE,YAAY;GAC3F,gBAAgB,OAAO,SAAS,WAAW,cAAc,MAAM,UAAU;GACzE,gBAAgB,OAAO,SAAS,WAAW,cAAc,MAAM;GAC/D,qBAAqB,OAAO,MAAM,oBAAoB,MAAM;GAC5D;EACF;CACF,CAAC;CA0BD,OAAO;EAAE;EAAM,QAxBA,OAAO,WAAW,WAAW,OAGzC;GACD,MAAM,QAAQ,OAAO,EAAE,KAAK;GAE5B,MAAM,OACJ,OAAO,GAAG,UAAU,MAAM,OAAO,eAAe,EAAE,QAAQ,MAAM,KAAK,SAAS,cAAc,OAAO,MAAM,UAAU,EAAE;GAEvH,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,KAAK;GAC1C,YAAY,KAAK,WAAW,CAAC;GAC7B,MAAM,MAAM,MAAM,OAAO,KAAK,IAAK,eAAe;GAElD,YACE,IAAI,EAAE,eAAe,MAAM,WAAW,aAAa,IAAI,EAAE,WAAW,MAAM,WAAW,KACvF;GACA,IAAI,CAAC,EAAE,UAAU,GAAG,KAAK,IAAI,EAAE,gBAAgB,QAAQ,IAAI,EAAE,gBAAgB,KAAA,GAC3E,OAAO,OAAO,KAAK;GACrB,MAAM,YAAY,OAAO,QAAQ,UAAU,UAAU,IAAI,EAAE,UAAU;GACrE,MAAM,SAAS,OAAO,KAAK;IAAE,GAAG;IAAO;GAAU,CAAC;GAElD,OAAO,OAAO,gBAAgB,QAAQ,cAAc;EACtD,CAEoB;CAAE;AACxB,CAAC"}

package/dist/internal/email-native.d.mts

@@ -0,0 +1,17 @@
+import { AnyProofPersistenceMapping } from "./models/proof-model.mjs";
+import { AnyEmailAddressMapping, AnyEmailSignInMapping } from "./models/email-model.mjs";
+import { NativeSqlTables } from "./native-sql-table.mjs";
+import { SqlBatchCommit } from "./sql-commit.mjs";
+import { Crypto, Effect } from "effect";
+import * as E from "@yielded/auth/Email";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/email-native.d.ts
+export declare const makeNativeEmailSignInServices: (tables: NativeSqlTables, mapping: AnyEmailSignInMapping) => Effect.Effect<{
+  readonly emailSignInTargets: E.EmailSignInTargets["Service"];
+}, never, LifecycleHooks | SqlClient>;
+export declare const makeNativeEmailAddressServices: (tables: NativeSqlTables, mapping: AnyEmailAddressMapping, proofs?: AnyProofPersistenceMapping | undefined) => Effect.Effect<{
+  readonly emailAddressPersistence: E.EmailAddressPersistence["Service"];
+}, never, Crypto.Crypto | LifecycleHooks | SqlBatchCommit | SqlClient>;
+//#endregion
+//# sourceMappingURL=email-native.d.mts.map

package/dist/internal/email-native.mjs

@@ -0,0 +1,245 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { sqlBatchAssertion } from "./d1-planning.mjs";
+import { exactSqlText, executeSqlChange } from "./sql-change.mjs";
+import { emailUnavailable, ensureEmail, makeNativeEmailReader } from "./email-native-state.mjs";
+import { passwordEvidenceSatisfiedAt } from "./password-policy.mjs";
+import { allocateEmailSecurityRevision, allocateEmailValue, sameEmailRevision, snapshotEmailMutation, validateEmailMutation } from "./email-policy.mjs";
+import { SqlBatchCommit, appendSqlBatchStatement, makeSqlCommitExecutor, registerSqlBatchPostcondition, registerSqlCommitReceipt, registerSqlPostcondition } from "./sql-commit.mjs";
+import { makeNativeProofStore } from "./proof-native.mjs";
+import { Crypto, DateTime, Effect, Schema } from "effect";
+import * as E from "@yielded/auth/Email";
+import { CurrentCommitJournal } from "@yielded/auth/Hooks";
+import { ProofRedemptionInput } from "@yielded/auth/Proofs";
+import { SecurityRevision } from "@yielded/auth/Sessions";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/email-native.ts
+const makeNativeEmailSignInServices = Effect.fnUntraced(function* (tables, mapping) {
+	const executor = yield* makeSqlCommitExecutor(emailUnavailable);
+	const reader = yield* makeNativeEmailReader(tables, mapping);
+	return { emailSignInTargets: E.EmailSignInTargets.of({ lookup: (input) => executor.read(reader.lookup(input)) }) };
+});
+const makeNativeEmailAddressServices = Effect.fnUntraced(function* (tables, mapping, proofs) {
+	const batch = yield* SqlBatchCommit;
+	const sql = (yield* SqlClient).withoutTransforms(), executor = yield* makeSqlCommitExecutor(emailUnavailable), crypto = yield* Crypto.Crypto;
+	const now = tables.expression(mapping.clock.engineNowMillis);
+	const reader = yield* makeNativeEmailReader(tables, mapping, now);
+	const s = mapping.subject, i = mapping.identifier, c = mapping.credential, a = mapping.authorityCredential;
+	const subject = tables(s.table), identifier = tables(i.table), credential = tables(c.table), authority = tables(a.table);
+	const exact = (t, key, value) => exactSqlText(sql, t.column(key), t.value(key, value));
+	const id = (t, key, value) => sql`${t.column(key)} = ${t.value(key, value)}`;
+	const identifierKey = (value) => sql.and([exact(identifier, i.namespace, value.namespace), exact(identifier, i.value, value.value)]);
+	const activeSubject = id(subject, s.status, s.activeStatusValue), activeCredential = id(credential, c.status, c.activeStatusValue), activeAuthority = id(authority, a.status, a.activeStatusValue);
+	const lock = sql.onDialectOrElse({
+		sqlite: () => sql``,
+		orElse: () => sql`for update`
+	});
+	const mode = "interactive";
+	const run = (work) => batch === void 0 ? executor.run(work.pipe(Effect.provideService(Crypto.Crypto, crypto))) : executor.batch(work.pipe(Effect.provideService(Crypto.Crypto, crypto))).pipe(Effect.provideService(SqlBatchCommit, batch));
+	const stage = Effect.fnUntraced(function* (statement) {
+		if (batch === void 0) ensureEmail((yield* executeSqlChange(sql, statement)) === 1);
+		else {
+			yield* appendSqlBatchStatement(sql`${statement}`);
+			yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));
+		}
+	});
+	const prepare = (decision, project) => Effect.gen(function* () {
+		const receipt = project(decision, yield* CurrentCommitJournal);
+		yield* registerSqlCommitReceipt(receipt);
+		return receipt;
+	});
+	const target = Effect.fnUntraced(function* (input, sourceIdentifier) {
+		const state = yield* reader.read({
+			moduleId: input.moduleId,
+			subjectId: input.subjectId,
+			identifier: input.target,
+			...input.sourceCredentialId === void 0 ? {} : { sourceCredentialId: input.sourceCredentialId },
+			...sourceIdentifier === void 0 ? {} : { sourceIdentifier },
+			single: mapping.addressCardinality === "single"
+		});
+		if (state === void 0) return void 0;
+		const mutable = state.targetIdentifier !== void 0 && (yield* mapping.subjectId.toSubject(state.targetIdentifier[i.subjectId])) === input.subjectId && mapping.identifier.isMutableTarget(state.targetIdentifier) && (state.targetCredential === void 0 || !c.isActiveStatus(state.targetCredential[c.status]) && (yield* mapping.subjectId.toSubject(state.targetCredential[c.subjectId])) === input.subjectId);
+		const source = state.sourceSnapshot;
+		const eligible = (state.targetIdentifier === void 0 ? state.targetCredential === void 0 : mutable) && (input.sourceCredentialId === void 0 || source !== void 0) && (source === void 0 || source.identifier.namespace !== input.target.namespace || source.identifier.value !== input.target.value) && !state.cardinalityConflict;
+		const captured = {
+			revision: state.revision,
+			eligible,
+			...source === void 0 ? {} : { source },
+			...mutable ? { targetIdentifierRevision: yield* Schema.decodeUnknownEffect(SecurityRevision)(state.targetIdentifier[i.bindingRevision]) } : {}
+		};
+		return {
+			...state,
+			target: captured
+		};
+	});
+	const mutate = (original, action, project) => run(Effect.gen(function* () {
+		const input = yield* snapshotEmailMutation(original);
+		const redemption = yield* Schema.decodeEffect(Schema.toCodecIso(ProofRedemptionInput))(yield* Schema.encodeEffect(Schema.toCodecIso(ProofRedemptionInput))(original.redemption.input));
+		const native = yield* mapping.subjectId.toNative(input.captured.revision.subjectId);
+		const locked = yield* sql`select ${subject.fields("email_locked_")} from ${subject.name} where ${id(subject, s.id, native)} limit 2 ${batch === void 0 ? lock : sql``}`;
+		if (locked.length !== 1) return yield* prepare("rejected", project);
+		ensureEmail((yield* mapping.subjectId.toSubject(subject.decode(locked[0], "email_locked_")[s.id])) === input.captured.revision.subjectId);
+		const current = yield* target({
+			moduleId: input.moduleId,
+			subjectId: input.captured.revision.subjectId,
+			target: input.target,
+			...input.captured.source === void 0 ? {} : { sourceCredentialId: input.captured.source.credentialId }
+		}, input.captured.source?.identifier);
+		if (current === void 0 || proofs === void 0) return yield* prepare("rejected", project);
+		const requirement = yield* s.decodeActionRequirement(current.subject, action);
+		if (!(yield* validateEmailMutation(mapping, {
+			...input,
+			redemption: {
+				input: redemption,
+				prepare: original.redemption.prepare
+			}
+		}, action, {
+			target: current.target,
+			requirement: Effect.succeed(requirement)
+		}, current.now))) return yield* prepare("rejected", project);
+		const requirements = [input.authorization.requirement, requirement];
+		const deadline = [...new Set(input.authorization.evidence.proofs.flatMap((proof) => requirements.map((r) => DateTime.toEpochMillis(proof.verifiedAt) + r.maximumAgeMillis)))].filter((time) => time > current.now).sort((a, b) => a - b).find((time) => requirements.some((r) => !passwordEvidenceSatisfiedAt(input.authorization.evidence, r, time)));
+		ensureEmail(deadline !== void 0);
+		const freshness = sql`${now} >= ${current.now} and ${now} < ${deadline}`;
+		const factorCondition = (revision) => sql.and([sql`(select count(*) from ${authority.name} where ${id(authority, a.subjectId, native)} and ${activeAuthority}) = ${revision.credentials.length}`, ...revision.credentials.map((f) => sql`exists(select 1 from ${authority.name} where ${id(authority, a.subjectId, native)} and ${exact(authority, a.credentialId, f.credentialId)} and ${exact(authority, a.revision, f.revision)} and ${activeAuthority})`)]);
+		if (batch !== void 0) {
+			yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql.and([
+				sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, native)} and ${exact(subject, s.securityRevision, current.revision.securityRevision)} and ${activeSubject})`,
+				factorCondition(current.revision),
+				freshness
+			])));
+			if (current.targetIdentifier !== void 0) {
+				ensureEmail(i.d1MutableTargetCondition !== void 0);
+				yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`exists(select 1 from ${identifier.name} where ${identifierKey(input.target)} and ${id(identifier, i.subjectId, native)} and ${tables.expression(i.d1MutableTargetCondition({
+					identifier: input.target,
+					nativeSubjectId: native
+				}))})`));
+			}
+			if (current.target.source !== void 0) {
+				ensureEmail(i.d1CurrentCondition !== void 0);
+				yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`exists(select 1 from ${identifier.name} where ${identifierKey(current.target.source.identifier)} and ${id(identifier, i.subjectId, native)} and ${tables.expression(i.d1CurrentCondition({
+					identifier: current.target.source.identifier,
+					nativeSubjectId: native,
+					bindingRevision: current.target.source.identifierRevision
+				}))})`));
+			}
+		}
+		const redeemed = yield* (yield* makeNativeProofStore(tables, proofs, batch !== void 0)).redeemLocked(redemption);
+		yield* registerSqlCommitReceipt(original.redemption.prepare(redeemed.decision, yield* CurrentCommitJournal, (value) => value));
+		if (redeemed.decision !== "redeemed") return yield* prepare("rejected", project);
+		const allocate = () => allocateEmailValue(mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+		const targetIdentifierRevision = yield* allocate(), targetCredentialRevision = yield* allocate(), sourceIdentifierRevision = yield* allocate(), sourceCredentialRevision = yield* allocate();
+		const confirms = action === "verify-address" && current.target.targetIdentifierRevision !== void 0;
+		const nextSecurityRevision = confirms ? current.revision.securityRevision : yield* allocateEmailSecurityRevision(mapping, mode, current.revision.securityRevision);
+		ensureEmail(confirms || nextSecurityRevision !== current.revision.securityRevision);
+		const targetCredentialId = current.targetCredential === void 0 ? yield* allocateEmailValue(mode, mapping.allocateCredentialId, mapping.allocateCredentialIdSync) : yield* Schema.decodeUnknownEffect(Schema.String)(current.targetCredential[c.credentialId]);
+		const source = current.target.source;
+		if (action === "change-address") {
+			ensureEmail(source !== void 0);
+			yield* stage(sql`${identifier.update(i.encodeRetirement({
+				source: source.identifier,
+				bindingRevision: sourceIdentifierRevision
+			}))} where ${identifierKey(source.identifier)} and ${id(identifier, i.subjectId, native)} and ${exact(identifier, i.bindingRevision, source.identifierRevision)}`);
+			yield* stage(sql`${credential.update(c.encodeRetirement({
+				source: source.identifier,
+				credentialRevision: sourceCredentialRevision
+			}))} where ${exact(credential, c.moduleId, input.moduleId)} and ${exact(credential, c.credentialId, source.credentialId)} and ${id(credential, c.subjectId, native)} and ${exact(credential, c.credentialRevision, source.credentialRevision)} and ${activeCredential}`);
+			yield* stage(sql`${authority.update(a.encodeRetirement(sourceCredentialRevision))} where ${id(authority, a.subjectId, native)} and ${exact(authority, a.credentialId, source.credentialId)} and ${exact(authority, a.revision, source.credentialRevision)} and ${activeAuthority}`);
+		}
+		if (current.targetIdentifier === void 0) yield* stage(identifier.insert(i.encodeVerifiedInsert({
+			identifier: input.target,
+			subjectId: native,
+			verifiedAtMillis: current.now,
+			bindingRevision: targetIdentifierRevision
+		})));
+		else yield* stage(sql`${identifier.update(i.encodeVerification({
+			verifiedAtMillis: current.now,
+			bindingRevision: targetIdentifierRevision
+		}))} where ${identifierKey(input.target)} and ${id(identifier, i.subjectId, native)} and ${exact(identifier, i.bindingRevision, current.targetIdentifier[i.bindingRevision])} and ${identifier.column(i.verifiedAt)} is null`);
+		if (current.targetCredential === void 0) {
+			yield* stage(credential.insert(c.encodeVerifiedInsert({
+				moduleId: input.moduleId,
+				subjectId: native,
+				credentialId: targetCredentialId,
+				identifier: input.target,
+				credentialRevision: targetCredentialRevision
+			})));
+			yield* stage(authority.insert(a.encodeInsert({
+				subjectId: native,
+				credentialId: targetCredentialId,
+				revision: targetCredentialRevision
+			})));
+		} else {
+			const old = current.targetCredential[c.credentialRevision];
+			yield* stage(sql`${credential.update(c.encodeActivation({
+				identifier: input.target,
+				credentialRevision: targetCredentialRevision
+			}))} where ${exact(credential, c.moduleId, input.moduleId)} and ${exact(credential, c.credentialId, targetCredentialId)} and ${id(credential, c.subjectId, native)} and ${exact(credential, c.credentialRevision, old)}`);
+			yield* stage(sql`${authority.update(a.encodeActivation(targetCredentialRevision))} where ${id(authority, a.subjectId, native)} and ${exact(authority, a.credentialId, targetCredentialId)} and ${exact(authority, a.revision, old)}`);
+		}
+		if (!confirms) yield* stage(sql`${subject.update({ [s.securityRevision]: nextSecurityRevision })} where ${id(subject, s.id, native)} and ${exact(subject, s.securityRevision, current.revision.securityRevision)} and ${activeSubject} and ${freshness}`);
+		const revision = {
+			subjectId: current.revision.subjectId,
+			securityRevision: nextSecurityRevision,
+			credentials: [...current.revision.credentials.filter((f) => f.credentialId !== targetCredentialId && f.credentialId !== source?.credentialId), {
+				credentialId: targetCredentialId,
+				revision: targetCredentialRevision
+			}].sort((a, b) => a.credentialId.localeCompare(b.credentialId))
+		};
+		if (batch !== void 0) {
+			ensureEmail(i.d1CurrentCondition !== void 0);
+			const conditions = [
+				redeemed.validUntil,
+				freshness,
+				factorCondition(revision),
+				sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, native)} and ${exact(subject, s.securityRevision, nextSecurityRevision)} and ${activeSubject})`,
+				sql`exists(select 1 from ${identifier.name} where ${identifierKey(input.target)} and ${id(identifier, i.subjectId, native)} and ${tables.expression(i.d1CurrentCondition({
+					identifier: input.target,
+					nativeSubjectId: native,
+					bindingRevision: targetIdentifierRevision
+				}))})`,
+				sql`exists(select 1 from ${identifier.name} where ${identifierKey(input.target)} and ${id(identifier, i.subjectId, native)} and ${exact(identifier, i.bindingRevision, targetIdentifierRevision)} and ${id(identifier, i.verifiedAt, mapping.clock.encodeInstant(current.now))})`,
+				sql`exists(select 1 from ${credential.name} where ${exact(credential, c.moduleId, input.moduleId)} and ${exact(credential, c.credentialId, targetCredentialId)} and ${id(credential, c.subjectId, native)} and ${exact(credential, c.credentialRevision, targetCredentialRevision)} and ${exact(credential, c.identifierNamespace, input.target.namespace)} and ${exact(credential, c.identifierValue, input.target.value)} and ${activeCredential})`
+			];
+			if (source !== void 0) conditions.push(sql`exists(select 1 from ${identifier.name} where ${identifierKey(source.identifier)} and ${id(identifier, i.subjectId, native)} and ${exact(identifier, i.bindingRevision, sourceIdentifierRevision)} and not (${tables.expression(i.d1CurrentCondition({
+				identifier: source.identifier,
+				nativeSubjectId: native,
+				bindingRevision: sourceIdentifierRevision
+			}))}))`, sql`exists(select 1 from ${credential.name} where ${exact(credential, c.moduleId, input.moduleId)} and ${exact(credential, c.credentialId, source.credentialId)} and ${id(credential, c.subjectId, native)} and ${exact(credential, c.credentialRevision, sourceCredentialRevision)} and not (${activeCredential}))`, sql`exists(select 1 from ${authority.name} where ${id(authority, a.subjectId, native)} and ${exact(authority, a.credentialId, source.credentialId)} and ${exact(authority, a.revision, sourceCredentialRevision)} and not (${activeAuthority}))`);
+			yield* registerSqlBatchPostcondition({
+				name: "email-address-authority",
+				statement: sqlBatchAssertion(sql, sql.and(conditions))
+			});
+		} else yield* registerSqlPostcondition({
+			name: "email-address-authority",
+			check: Effect.gen(function* () {
+				const final = yield* reader.read({
+					validity: redeemed.validUntil,
+					moduleId: input.moduleId,
+					subjectId: revision.subjectId,
+					identifier: input.target,
+					...source === void 0 ? {} : {
+						sourceCredentialId: source.credentialId,
+						sourceIdentifier: source.identifier
+					}
+				});
+				ensureEmail(final !== void 0 && sameEmailRevision(final.revision, revision) && final.now >= current.now && final.now < deadline && final.targetSnapshot !== void 0 && final.targetSnapshot.credentialId === targetCredentialId && final.targetSnapshot.credentialRevision === targetCredentialRevision && final.targetSnapshot.identifierRevision === targetIdentifierRevision && (yield* mapping.decodeInstant(final.targetIdentifier[i.verifiedAt])) === current.now);
+				const policy = yield* s.decodeActionRequirement(final.subject, action);
+				ensureEmail(passwordEvidenceSatisfiedAt(input.authorization.evidence, policy, final.now));
+				if (source !== void 0) ensureEmail(final.sourceIdentifier !== void 0 && final.sourceCredential !== void 0 && final.sourceAuthority !== void 0 && (yield* mapping.subjectId.toSubject(final.sourceAuthority[a.subjectId])) === revision.subjectId && final.sourceAuthority[a.credentialId] === source.credentialId && final.sourceAuthority[a.revision] === sourceCredentialRevision && !a.isActiveStatus(final.sourceAuthority[a.status]) && (yield* mapping.subjectId.toSubject(final.sourceIdentifier[i.subjectId])) === revision.subjectId && final.sourceIdentifier[i.bindingRevision] === sourceIdentifierRevision && !i.isCurrent(final.sourceIdentifier) && final.sourceCredential[c.credentialRevision] === sourceCredentialRevision && !c.isActiveStatus(final.sourceCredential[c.status]));
+			}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
+				operation: "decode",
+				cause
+			})))
+		});
+		return yield* prepare("changed", project);
+	}));
+	return { emailAddressPersistence: E.EmailAddressPersistence.of({
+		target: (input) => executor.read(Effect.flatMap(target(input), (value) => value === void 0 ? Effect.fail(emailUnavailable()) : Effect.succeed(value.target))),
+		verifyWithProof: (input, project) => mutate(input, "verify-address", project),
+		changeWithProof: (input, project) => mutate(input, "change-address", project)
+	}) };
+});
+//#endregion
+export { makeNativeEmailAddressServices, makeNativeEmailSignInServices };
+
+//# sourceMappingURL=email-native.mjs.map

package/dist/internal/email-native.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-native.mjs","names":["unavailable"],"sources":["../../src/internal/email-native.ts"],"sourcesContent":["import * as E from \"@yielded/auth/Email\";\nimport { CurrentCommitJournal, type LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport { ProofRedemptionInput } from \"@yielded/auth/Proofs\";\nimport type { AuthenticationRevision } from \"@yielded/auth/Sessions\";\nimport { SecurityRevision } from \"@yielded/auth/Sessions\";\nimport { Crypto, DateTime, Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport {\n  makeNativeEmailReader,\n  emailUnavailable as unavailable,\n  ensureEmail as ensure,\n} from \"./email-native-state\";\nimport {\n  allocateEmailValue,\n  allocateEmailSecurityRevision,\n  snapshotEmailMutation,\n  validateEmailMutation,\n  sameEmailRevision,\n} from \"./email-policy\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type { AnyEmailAddressMapping, AnyEmailSignInMapping } from \"./models/email-model\";\nimport type { AnyProofPersistenceMapping } from \"./models/proof-model\";\nimport type { NativeSqlTables, SqlTable } from \"./native-sql-table\";\nimport { passwordEvidenceSatisfiedAt } from \"./password-policy\";\nimport { makeNativeProofStore } from \"./proof-native\";\nimport { exactSqlText, executeSqlChange } from \"./sql-change\";\nimport {\n  appendSqlBatchStatement,\n  makeSqlCommitExecutor,\n  registerSqlBatchPostcondition,\n  registerSqlCommitReceipt,\n  registerSqlPostcondition,\n  SqlBatchCommit,\n} from \"./sql-commit\";\n\nexport const makeNativeEmailSignInServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: AnyEmailSignInMapping,\n): Effect.fn.Return<\n  { readonly emailSignInTargets: E.EmailSignInTargets[\"Service\"] },\n  never,\n  SqlClient | LifecycleHooks\n> {\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const reader = yield* makeNativeEmailReader(tables, mapping);\n\n  return {\n    emailSignInTargets: E.EmailSignInTargets.of({\n      lookup: (input) => executor.read(reader.lookup(input)),\n    }),\n  };\n});\n\nexport const makeNativeEmailAddressServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: AnyEmailAddressMapping,\n  proofs?: AnyProofPersistenceMapping,\n): Effect.fn.Return<\n  { readonly emailAddressPersistence: E.EmailAddressPersistence[\"Service\"] },\n  never,\n  SqlClient | LifecycleHooks | Crypto.Crypto | SqlBatchCommit\n> {\n  const batch = yield* SqlBatchCommit;\n\n  const sql = (yield* SqlClient).withoutTransforms(),\n    executor = yield* makeSqlCommitExecutor(unavailable),\n    crypto = yield* Crypto.Crypto;\n\n  const now = tables.expression(mapping.clock.engineNowMillis);\n  const reader = yield* makeNativeEmailReader(tables, mapping, now);\n\n  const s = mapping.subject,\n    i = mapping.identifier,\n    c = mapping.credential,\n    a = mapping.authorityCredential;\n\n  const subject = tables(s.table),\n    identifier = tables(i.table),\n    credential = tables(c.table),\n    authority = tables(a.table);\n\n  const exact = (t: SqlTable, key: string, value: unknown) =>\n    exactSqlText(sql, t.column(key), t.value(key, value));\n\n  const id = (t: SqlTable, key: string, value: unknown) =>\n    sql`${t.column(key)} = ${t.value(key, value)}`;\n\n  const identifierKey = (value: { readonly namespace: string; readonly value: string }) =>\n    sql.and([\n      exact(identifier, i.namespace, value.namespace),\n      exact(identifier, i.value, value.value),\n    ]);\n\n  const activeSubject = id(subject, s.status, s.activeStatusValue),\n    activeCredential = id(credential, c.status, c.activeStatusValue),\n    activeAuthority = id(authority, a.status, a.activeStatusValue);\n\n  const lock = sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` });\n  const mode = \"interactive\";\n\n  const run = <A, X, R>(work: Effect.Effect<A, X, R>) =>\n    batch === undefined\n      ? executor.run(work.pipe(Effect.provideService(Crypto.Crypto, crypto)))\n      : executor\n          .batch(work.pipe(Effect.provideService(Crypto.Crypto, crypto)))\n          .pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const stage = Effect.fnUntraced(function* (statement: Fragment) {\n    if (batch === undefined) ensure((yield* executeSqlChange(sql, statement)) === 1);\n    else {\n      yield* appendSqlBatchStatement(sql`${statement}`);\n      yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = 1`));\n    }\n  });\n\n  const prepare = <A>(\n    decision: E.EmailAddressDecision,\n    project: E.PrepareEmailCommit<E.EmailAddressDecision, A>,\n  ) =>\n    Effect.gen(function* () {\n      const receipt = project(decision, yield* CurrentCommitJournal);\n\n      yield* registerSqlCommitReceipt(receipt);\n\n      return receipt;\n    });\n\n  const target = Effect.fnUntraced(function* (\n    input: Parameters<E.EmailAddressPersistence[\"Service\"][\"target\"]>[0],\n    sourceIdentifier?: { readonly namespace: string; readonly value: string },\n  ) {\n    const state = yield* reader.read({\n      moduleId: input.moduleId,\n      subjectId: input.subjectId,\n      identifier: input.target,\n      ...(input.sourceCredentialId === undefined\n        ? {}\n        : { sourceCredentialId: input.sourceCredentialId }),\n      ...(sourceIdentifier === undefined ? {} : { sourceIdentifier }),\n      single: mapping.addressCardinality === \"single\",\n    });\n\n    if (state === undefined) return undefined;\n\n    const owned =\n      state.targetIdentifier !== undefined &&\n      (yield* mapping.subjectId.toSubject(state.targetIdentifier[i.subjectId])) === input.subjectId;\n\n    const mutable =\n      owned &&\n      mapping.identifier.isMutableTarget(state.targetIdentifier!) &&\n      (state.targetCredential === undefined ||\n        (!c.isActiveStatus(state.targetCredential[c.status]) &&\n          (yield* mapping.subjectId.toSubject(state.targetCredential[c.subjectId])) ===\n            input.subjectId));\n\n    const source = state.sourceSnapshot;\n\n    const eligible =\n      (state.targetIdentifier === undefined ? state.targetCredential === undefined : mutable) &&\n      (input.sourceCredentialId === undefined || source !== undefined) &&\n      (source === undefined ||\n        source.identifier.namespace !== input.target.namespace ||\n        source.identifier.value !== input.target.value) &&\n      !state.cardinalityConflict;\n\n    const captured: E.EmailAddressTarget = {\n      revision: state.revision,\n      eligible,\n      ...(source === undefined ? {} : { source }),\n      ...(mutable\n        ? {\n            targetIdentifierRevision: yield* Schema.decodeUnknownEffect(SecurityRevision)(\n              state.targetIdentifier![i.bindingRevision],\n            ),\n          }\n        : {}),\n    };\n\n    return { ...state, target: captured };\n  });\n\n  const mutate = <A>(\n    original: E.EmailAddressMutation,\n    action: E.EmailAction,\n    project: E.PrepareEmailCommit<E.EmailAddressDecision, A>,\n  ) =>\n    run(\n      Effect.gen(function* () {\n        const input = yield* snapshotEmailMutation(original);\n\n        const redemption = yield* Schema.decodeEffect(Schema.toCodecIso(ProofRedemptionInput))(\n          yield* Schema.encodeEffect(Schema.toCodecIso(ProofRedemptionInput))(\n            original.redemption.input,\n          ),\n        );\n\n        const native = yield* mapping.subjectId.toNative(input.captured.revision.subjectId);\n\n        const locked =\n          yield* sql`select ${subject.fields(\"email_locked_\")} from ${subject.name} where ${id(subject, s.id, native)} limit 2 ${batch === undefined ? lock : sql``}`;\n\n        if (locked.length !== 1) return yield* prepare(\"rejected\", project);\n        ensure(\n          (yield* mapping.subjectId.toSubject(\n            subject.decode(locked[0]!, \"email_locked_\")[s.id],\n          )) === input.captured.revision.subjectId,\n        );\n\n        const current = yield* target(\n          {\n            moduleId: input.moduleId,\n            subjectId: input.captured.revision.subjectId,\n            target: input.target,\n            ...(input.captured.source === undefined\n              ? {}\n              : { sourceCredentialId: input.captured.source.credentialId }),\n          },\n          input.captured.source?.identifier,\n        );\n\n        if (current === undefined || proofs === undefined)\n          return yield* prepare(\"rejected\", project);\n        const requirement = yield* s.decodeActionRequirement(current.subject, action);\n\n        if (\n          !(yield* validateEmailMutation(\n            mapping,\n            { ...input, redemption: { input: redemption, prepare: original.redemption.prepare } },\n            action,\n            { target: current.target, requirement: Effect.succeed(requirement) },\n            current.now,\n          ))\n        )\n          return yield* prepare(\"rejected\", project);\n        const requirements = [input.authorization.requirement, requirement];\n\n        const boundaries = [\n          ...new Set(\n            input.authorization.evidence.proofs.flatMap((proof) =>\n              requirements.map(\n                (r) => DateTime.toEpochMillis(proof.verifiedAt) + r.maximumAgeMillis,\n              ),\n            ),\n          ),\n        ]\n          .filter((time) => time > current.now)\n          .sort((a, b) => a - b);\n\n        const deadline = boundaries.find((time) =>\n          requirements.some(\n            (r) => !passwordEvidenceSatisfiedAt(input.authorization.evidence, r, time),\n          ),\n        );\n\n        ensure(deadline !== undefined);\n        const freshness = sql`${now} >= ${current.now} and ${now} < ${deadline}`;\n\n        const factorCondition = (revision: AuthenticationRevision) =>\n          sql.and([\n            sql`(select count(*) from ${authority.name} where ${id(authority, a.subjectId, native)} and ${activeAuthority}) = ${revision.credentials.length}`,\n            ...revision.credentials.map(\n              (f) =>\n                sql`exists(select 1 from ${authority.name} where ${id(authority, a.subjectId, native)} and ${exact(authority, a.credentialId, f.credentialId)} and ${exact(authority, a.revision, f.revision)} and ${activeAuthority})`,\n            ),\n          ]);\n\n        if (batch !== undefined) {\n          yield* appendSqlBatchStatement(\n            sqlBatchAssertion(\n              sql,\n              sql.and([\n                sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, native)} and ${exact(subject, s.securityRevision, current.revision.securityRevision)} and ${activeSubject})`,\n                factorCondition(current.revision),\n                freshness,\n              ]),\n            ),\n          );\n          if (current.targetIdentifier !== undefined) {\n            ensure(i.d1MutableTargetCondition !== undefined);\n            yield* appendSqlBatchStatement(\n              sqlBatchAssertion(\n                sql,\n                sql`exists(select 1 from ${identifier.name} where ${identifierKey(input.target)} and ${id(identifier, i.subjectId, native)} and ${tables.expression(i.d1MutableTargetCondition({ identifier: input.target, nativeSubjectId: native }))})`,\n              ),\n            );\n          }\n          if (current.target.source !== undefined) {\n            ensure(i.d1CurrentCondition !== undefined);\n            yield* appendSqlBatchStatement(\n              sqlBatchAssertion(\n                sql,\n                sql`exists(select 1 from ${identifier.name} where ${identifierKey(current.target.source.identifier)} and ${id(identifier, i.subjectId, native)} and ${tables.expression(i.d1CurrentCondition({ identifier: current.target.source.identifier, nativeSubjectId: native, bindingRevision: current.target.source.identifierRevision }))})`,\n              ),\n            );\n          }\n        }\n\n        const proof = yield* makeNativeProofStore(tables, proofs, batch !== undefined),\n          redeemed = yield* proof.redeemLocked(redemption);\n\n        yield* registerSqlCommitReceipt(\n          original.redemption.prepare(\n            redeemed.decision,\n            yield* CurrentCommitJournal,\n            (value) => value,\n          ),\n        );\n        if (redeemed.decision !== \"redeemed\") return yield* prepare(\"rejected\", project);\n\n        const allocate = () =>\n          allocateEmailValue(mode, mapping.allocateRevision, mapping.allocateRevisionSync);\n\n        const targetIdentifierRevision = yield* allocate(),\n          targetCredentialRevision = yield* allocate(),\n          sourceIdentifierRevision = yield* allocate(),\n          sourceCredentialRevision = yield* allocate();\n\n        const confirms =\n          action === \"verify-address\" && current.target.targetIdentifierRevision !== undefined;\n\n        const nextSecurityRevision = confirms\n          ? current.revision.securityRevision\n          : yield* allocateEmailSecurityRevision(mapping, mode, current.revision.securityRevision);\n\n        ensure(confirms || nextSecurityRevision !== current.revision.securityRevision);\n\n        const targetCredentialId =\n          current.targetCredential === undefined\n            ? yield* allocateEmailValue(\n                mode,\n                mapping.allocateCredentialId,\n                mapping.allocateCredentialIdSync,\n              )\n            : yield* Schema.decodeUnknownEffect(Schema.String)(\n                current.targetCredential[c.credentialId],\n              );\n\n        const source = current.target.source;\n\n        if (action === \"change-address\") {\n          ensure(source !== undefined);\n          yield* stage(\n            sql`${identifier.update(i.encodeRetirement({ source: source.identifier, bindingRevision: sourceIdentifierRevision }))} where ${identifierKey(source.identifier)} and ${id(identifier, i.subjectId, native)} and ${exact(identifier, i.bindingRevision, source.identifierRevision)}`,\n          );\n          yield* stage(\n            sql`${credential.update(c.encodeRetirement({ source: source.identifier, credentialRevision: sourceCredentialRevision }))} where ${exact(credential, c.moduleId, input.moduleId)} and ${exact(credential, c.credentialId, source.credentialId)} and ${id(credential, c.subjectId, native)} and ${exact(credential, c.credentialRevision, source.credentialRevision)} and ${activeCredential}`,\n          );\n          yield* stage(\n            sql`${authority.update(a.encodeRetirement(sourceCredentialRevision))} where ${id(authority, a.subjectId, native)} and ${exact(authority, a.credentialId, source.credentialId)} and ${exact(authority, a.revision, source.credentialRevision)} and ${activeAuthority}`,\n          );\n        }\n        if (current.targetIdentifier === undefined)\n          yield* stage(\n            identifier.insert(\n              i.encodeVerifiedInsert({\n                identifier: input.target,\n                subjectId: native,\n                verifiedAtMillis: current.now,\n                bindingRevision: targetIdentifierRevision,\n              }),\n            ),\n          );\n        else\n          yield* stage(\n            sql`${identifier.update(i.encodeVerification({ verifiedAtMillis: current.now, bindingRevision: targetIdentifierRevision }))} where ${identifierKey(input.target)} and ${id(identifier, i.subjectId, native)} and ${exact(identifier, i.bindingRevision, current.targetIdentifier[i.bindingRevision])} and ${identifier.column(i.verifiedAt)} is null`,\n          );\n        if (current.targetCredential === undefined) {\n          yield* stage(\n            credential.insert(\n              c.encodeVerifiedInsert({\n                moduleId: input.moduleId,\n                subjectId: native,\n                credentialId: targetCredentialId,\n                identifier: input.target,\n                credentialRevision: targetCredentialRevision,\n              }),\n            ),\n          );\n          yield* stage(\n            authority.insert(\n              a.encodeInsert({\n                subjectId: native,\n                credentialId: targetCredentialId,\n                revision: targetCredentialRevision,\n              }),\n            ),\n          );\n        } else {\n          const old = current.targetCredential[c.credentialRevision];\n\n          yield* stage(\n            sql`${credential.update(c.encodeActivation({ identifier: input.target, credentialRevision: targetCredentialRevision }))} where ${exact(credential, c.moduleId, input.moduleId)} and ${exact(credential, c.credentialId, targetCredentialId)} and ${id(credential, c.subjectId, native)} and ${exact(credential, c.credentialRevision, old)}`,\n          );\n          yield* stage(\n            sql`${authority.update(a.encodeActivation(targetCredentialRevision))} where ${id(authority, a.subjectId, native)} and ${exact(authority, a.credentialId, targetCredentialId)} and ${exact(authority, a.revision, old)}`,\n          );\n        }\n        if (!confirms)\n          yield* stage(\n            sql`${subject.update({ [s.securityRevision]: nextSecurityRevision })} where ${id(subject, s.id, native)} and ${exact(subject, s.securityRevision, current.revision.securityRevision)} and ${activeSubject} and ${freshness}`,\n          );\n\n        const revision: AuthenticationRevision = {\n          subjectId: current.revision.subjectId,\n          securityRevision: nextSecurityRevision,\n          credentials: [\n            ...current.revision.credentials.filter(\n              (f) =>\n                f.credentialId !== targetCredentialId && f.credentialId !== source?.credentialId,\n            ),\n            { credentialId: targetCredentialId, revision: targetCredentialRevision },\n          ].sort((a, b) => a.credentialId.localeCompare(b.credentialId)),\n        };\n\n        if (batch !== undefined) {\n          ensure(i.d1CurrentCondition !== undefined);\n\n          const conditions = [\n            redeemed.validUntil,\n            freshness,\n            factorCondition(revision),\n            sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, native)} and ${exact(subject, s.securityRevision, nextSecurityRevision)} and ${activeSubject})`,\n            sql`exists(select 1 from ${identifier.name} where ${identifierKey(input.target)} and ${id(identifier, i.subjectId, native)} and ${tables.expression(i.d1CurrentCondition({ identifier: input.target, nativeSubjectId: native, bindingRevision: targetIdentifierRevision }))})`,\n            sql`exists(select 1 from ${identifier.name} where ${identifierKey(input.target)} and ${id(identifier, i.subjectId, native)} and ${exact(identifier, i.bindingRevision, targetIdentifierRevision)} and ${id(identifier, i.verifiedAt, mapping.clock.encodeInstant(current.now))})`,\n            sql`exists(select 1 from ${credential.name} where ${exact(credential, c.moduleId, input.moduleId)} and ${exact(credential, c.credentialId, targetCredentialId)} and ${id(credential, c.subjectId, native)} and ${exact(credential, c.credentialRevision, targetCredentialRevision)} and ${exact(credential, c.identifierNamespace, input.target.namespace)} and ${exact(credential, c.identifierValue, input.target.value)} and ${activeCredential})`,\n          ];\n\n          if (source !== undefined)\n            conditions.push(\n              sql`exists(select 1 from ${identifier.name} where ${identifierKey(source.identifier)} and ${id(identifier, i.subjectId, native)} and ${exact(identifier, i.bindingRevision, sourceIdentifierRevision)} and not (${tables.expression(i.d1CurrentCondition({ identifier: source.identifier, nativeSubjectId: native, bindingRevision: sourceIdentifierRevision }))}))`,\n              sql`exists(select 1 from ${credential.name} where ${exact(credential, c.moduleId, input.moduleId)} and ${exact(credential, c.credentialId, source.credentialId)} and ${id(credential, c.subjectId, native)} and ${exact(credential, c.credentialRevision, sourceCredentialRevision)} and not (${activeCredential}))`,\n              sql`exists(select 1 from ${authority.name} where ${id(authority, a.subjectId, native)} and ${exact(authority, a.credentialId, source.credentialId)} and ${exact(authority, a.revision, sourceCredentialRevision)} and not (${activeAuthority}))`,\n            );\n          yield* registerSqlBatchPostcondition({\n            name: \"email-address-authority\",\n            statement: sqlBatchAssertion(sql, sql.and(conditions)),\n          });\n        } else\n          yield* registerSqlPostcondition({\n            name: \"email-address-authority\",\n            check: Effect.gen(function* () {\n              const final = yield* reader.read({\n                validity: redeemed.validUntil,\n                moduleId: input.moduleId,\n                subjectId: revision.subjectId,\n                identifier: input.target,\n                ...(source === undefined\n                  ? {}\n                  : {\n                      sourceCredentialId: source.credentialId,\n                      sourceIdentifier: source.identifier,\n                    }),\n              });\n\n              ensure(\n                final !== undefined &&\n                  sameEmailRevision(final.revision, revision) &&\n                  final.now >= current.now &&\n                  final.now < deadline &&\n                  final.targetSnapshot !== undefined &&\n                  final.targetSnapshot.credentialId === targetCredentialId &&\n                  final.targetSnapshot.credentialRevision === targetCredentialRevision &&\n                  final.targetSnapshot.identifierRevision === targetIdentifierRevision &&\n                  (yield* mapping.decodeInstant(final.targetIdentifier![i.verifiedAt])) ===\n                    current.now,\n              );\n              const policy = yield* s.decodeActionRequirement(final.subject, action);\n\n              ensure(passwordEvidenceSatisfiedAt(input.authorization.evidence, policy, final.now));\n              if (source !== undefined)\n                ensure(\n                  final.sourceIdentifier !== undefined &&\n                    final.sourceCredential !== undefined &&\n                    final.sourceAuthority !== undefined &&\n                    (yield* mapping.subjectId.toSubject(final.sourceAuthority[a.subjectId])) ===\n                      revision.subjectId &&\n                    final.sourceAuthority[a.credentialId] === source.credentialId &&\n                    final.sourceAuthority[a.revision] === sourceCredentialRevision &&\n                    !a.isActiveStatus(final.sourceAuthority[a.status]) &&\n                    (yield* mapping.subjectId.toSubject(final.sourceIdentifier[i.subjectId])) ===\n                      revision.subjectId &&\n                    final.sourceIdentifier[i.bindingRevision] === sourceIdentifierRevision &&\n                    !i.isCurrent(final.sourceIdentifier) &&\n                    final.sourceCredential[c.credentialRevision] === sourceCredentialRevision &&\n                    !c.isActiveStatus(final.sourceCredential[c.status]),\n                );\n            }).pipe(\n              Effect.mapError((cause) =>\n                PersistenceMappingError.make({ operation: \"decode\", cause }),\n              ),\n            ),\n          });\n\n        return yield* prepare(\"changed\", project);\n      }),\n    );\n\n  return {\n    emailAddressPersistence: E.EmailAddressPersistence.of({\n      target: (input) =>\n        executor.read(\n          Effect.flatMap(target(input), (value) =>\n            value === undefined ? Effect.fail(unavailable()) : Effect.succeed(value.target),\n          ),\n        ),\n      verifyWithProof: (input, project) => mutate(input, \"verify-address\", project),\n      changeWithProof: (input, project) => mutate(input, \"change-address\", project),\n    }),\n  };\n});\n"],"mappings":";;;;;;;;;;;;;;;AAsCA,MAAa,gCAAgC,OAAO,WAAW,WAC7D,QACA,SAKA;CACA,MAAM,WAAW,OAAO,sBAAsBA,gBAAW;CACzD,MAAM,SAAS,OAAO,sBAAsB,QAAQ,OAAO;CAE3D,OAAO,EACL,oBAAoB,EAAE,mBAAmB,GAAG,EAC1C,SAAS,UAAU,SAAS,KAAK,OAAO,OAAO,KAAK,CAAC,EACvD,CAAC,EACH;AACF,CAAC;AAED,MAAa,iCAAiC,OAAO,WAAW,WAC9D,QACA,SACA,QAKA;CACA,MAAM,QAAQ,OAAO;CAErB,MAAM,OAAO,OAAO,UAAA,CAAW,kBAAkB,GAC/C,WAAW,OAAO,sBAAsBA,gBAAW,GACnD,SAAS,OAAO,OAAO;CAEzB,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAC3D,MAAM,SAAS,OAAO,sBAAsB,QAAQ,SAAS,GAAG;CAEhE,MAAM,IAAI,QAAQ,SAChB,IAAI,QAAQ,YACZ,IAAI,QAAQ,YACZ,IAAI,QAAQ;CAEd,MAAM,UAAU,OAAO,EAAE,KAAK,GAC5B,aAAa,OAAO,EAAE,KAAK,GAC3B,aAAa,OAAO,EAAE,KAAK,GAC3B,YAAY,OAAO,EAAE,KAAK;CAE5B,MAAM,SAAS,GAAa,KAAa,UACvC,aAAa,KAAK,EAAE,OAAO,GAAG,GAAG,EAAE,MAAM,KAAK,KAAK,CAAC;CAEtD,MAAM,MAAM,GAAa,KAAa,UACpC,GAAG,GAAG,EAAE,OAAO,GAAG,EAAE,KAAK,EAAE,MAAM,KAAK,KAAK;CAE7C,MAAM,iBAAiB,UACrB,IAAI,IAAI,CACN,MAAM,YAAY,EAAE,WAAW,MAAM,SAAS,GAC9C,MAAM,YAAY,EAAE,OAAO,MAAM,KAAK,CACxC,CAAC;CAEH,MAAM,gBAAgB,GAAG,SAAS,EAAE,QAAQ,EAAE,iBAAiB,GAC7D,mBAAmB,GAAG,YAAY,EAAE,QAAQ,EAAE,iBAAiB,GAC/D,kBAAkB,GAAG,WAAW,EAAE,QAAQ,EAAE,iBAAiB;CAE/D,MAAM,OAAO,IAAI,gBAAgB;EAAE,cAAc,GAAG;EAAI,cAAc,GAAG;CAAa,CAAC;CACvF,MAAM,OAAO;CAEb,MAAM,OAAgB,SACpB,UAAU,KAAA,IACN,SAAS,IAAI,KAAK,KAAK,OAAO,eAAe,OAAO,QAAQ,MAAM,CAAC,CAAC,IACpE,SACG,MAAM,KAAK,KAAK,OAAO,eAAe,OAAO,QAAQ,MAAM,CAAC,CAAC,CAAC,CAC9D,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAE1D,MAAM,QAAQ,OAAO,WAAW,WAAW,WAAqB;EAC9D,IAAI,UAAU,KAAA,GAAW,aAAQ,OAAO,iBAAiB,KAAK,SAAS,OAAO,CAAC;OAC1E;GACH,OAAO,wBAAwB,GAAG,GAAG,WAAW;GAChD,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,CAAC;EAC3E;CACF,CAAC;CAED,MAAM,WACJ,UACA,YAEA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,QAAQ,UAAU,OAAO,oBAAoB;EAE7D,OAAO,yBAAyB,OAAO;EAEvC,OAAO;CACT,CAAC;CAEH,MAAM,SAAS,OAAO,WAAW,WAC/B,OACA,kBACA;EACA,MAAM,QAAQ,OAAO,OAAO,KAAK;GAC/B,UAAU,MAAM;GAChB,WAAW,MAAM;GACjB,YAAY,MAAM;GAClB,GAAI,MAAM,uBAAuB,KAAA,IAC7B,CAAC,IACD,EAAE,oBAAoB,MAAM,mBAAmB;GACnD,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC7D,QAAQ,QAAQ,uBAAuB;EACzC,CAAC;EAED,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAMhC,MAAM,UAHJ,MAAM,qBAAqB,KAAA,MAC1B,OAAO,QAAQ,UAAU,UAAU,MAAM,iBAAiB,EAAE,UAAU,OAAO,MAAM,aAIpF,QAAQ,WAAW,gBAAgB,MAAM,gBAAiB,MACzD,MAAM,qBAAqB,KAAA,KACzB,CAAC,EAAE,eAAe,MAAM,iBAAiB,EAAE,OAAO,MAChD,OAAO,QAAQ,UAAU,UAAU,MAAM,iBAAiB,EAAE,UAAU,OACrE,MAAM;EAEd,MAAM,SAAS,MAAM;EAErB,MAAM,YACH,MAAM,qBAAqB,KAAA,IAAY,MAAM,qBAAqB,KAAA,IAAY,aAC9E,MAAM,uBAAuB,KAAA,KAAa,WAAW,KAAA,OACrD,WAAW,KAAA,KACV,OAAO,WAAW,cAAc,MAAM,OAAO,aAC7C,OAAO,WAAW,UAAU,MAAM,OAAO,UAC3C,CAAC,MAAM;EAET,MAAM,WAAiC;GACrC,UAAU,MAAM;GAChB;GACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GACzC,GAAI,UACA,EACE,0BAA0B,OAAO,OAAO,oBAAoB,gBAAgB,CAAC,CAC3E,MAAM,iBAAkB,EAAE,gBAC5B,EACF,IACA,CAAC;EACP;EAEA,OAAO;GAAE,GAAG;GAAO,QAAQ;EAAS;CACtC,CAAC;CAED,MAAM,UACJ,UACA,QACA,YAEA,IACE,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,sBAAsB,QAAQ;EAEnD,MAAM,aAAa,OAAO,OAAO,aAAa,OAAO,WAAW,oBAAoB,CAAC,CAAC,CACpF,OAAO,OAAO,aAAa,OAAO,WAAW,oBAAoB,CAAC,CAAC,CACjE,SAAS,WAAW,KACtB,CACF;EAEA,MAAM,SAAS,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS,SAAS,SAAS;EAElF,MAAM,SACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,eAAe,EAAE,QAAQ,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE,WAAW,UAAU,KAAA,IAAY,OAAO,GAAG;EAEzJ,IAAI,OAAO,WAAW,GAAG,OAAO,OAAO,QAAQ,YAAY,OAAO;EAClE,aACG,OAAO,QAAQ,UAAU,UACxB,QAAQ,OAAO,OAAO,IAAK,eAAe,CAAC,CAAC,EAAE,GAChD,OAAO,MAAM,SAAS,SAAS,SACjC;EAEA,MAAM,UAAU,OAAO,OACrB;GACE,UAAU,MAAM;GAChB,WAAW,MAAM,SAAS,SAAS;GACnC,QAAQ,MAAM;GACd,GAAI,MAAM,SAAS,WAAW,KAAA,IAC1B,CAAC,IACD,EAAE,oBAAoB,MAAM,SAAS,OAAO,aAAa;EAC/D,GACA,MAAM,SAAS,QAAQ,UACzB;EAEA,IAAI,YAAY,KAAA,KAAa,WAAW,KAAA,GACtC,OAAO,OAAO,QAAQ,YAAY,OAAO;EAC3C,MAAM,cAAc,OAAO,EAAE,wBAAwB,QAAQ,SAAS,MAAM;EAE5E,IACE,EAAE,OAAO,sBACP,SACA;GAAE,GAAG;GAAO,YAAY;IAAE,OAAO;IAAY,SAAS,SAAS,WAAW;GAAQ;EAAE,GACpF,QACA;GAAE,QAAQ,QAAQ;GAAQ,aAAa,OAAO,QAAQ,WAAW;EAAE,GACnE,QAAQ,GACV,IAEA,OAAO,OAAO,QAAQ,YAAY,OAAO;EAC3C,MAAM,eAAe,CAAC,MAAM,cAAc,aAAa,WAAW;EAclE,MAAM,WAZa,CACjB,GAAG,IAAI,IACL,MAAM,cAAc,SAAS,OAAO,SAAS,UAC3C,aAAa,KACV,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,EAAE,gBACtD,CACF,CACF,CACF,CAAC,CACE,QAAQ,SAAS,OAAO,QAAQ,GAAG,CAAC,CACpC,MAAM,GAAG,MAAM,IAAI,CAEI,CAAC,CAAC,MAAM,SAChC,aAAa,MACV,MAAM,CAAC,4BAA4B,MAAM,cAAc,UAAU,GAAG,IAAI,CAC3E,CACF;EAEA,YAAO,aAAa,KAAA,CAAS;EAC7B,MAAM,YAAY,GAAG,GAAG,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,KAAK;EAE9D,MAAM,mBAAmB,aACvB,IAAI,IAAI,CACN,GAAG,yBAAyB,UAAU,KAAK,SAAS,GAAG,WAAW,EAAE,WAAW,MAAM,EAAE,OAAO,gBAAgB,MAAM,SAAS,YAAY,UACzI,GAAG,SAAS,YAAY,KACrB,MACC,GAAG,wBAAwB,UAAU,KAAK,SAAS,GAAG,WAAW,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,MAAM,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,gBAAgB,EACzN,CACF,CAAC;EAEH,IAAI,UAAU,KAAA,GAAW;GACvB,OAAO,wBACL,kBACE,KACA,IAAI,IAAI;IACN,GAAG,wBAAwB,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,QAAQ,SAAS,gBAAgB,EAAE,OAAO,cAAc;IAC7K,gBAAgB,QAAQ,QAAQ;IAChC;GACF,CAAC,CACH,CACF;GACA,IAAI,QAAQ,qBAAqB,KAAA,GAAW;IAC1C,YAAO,EAAE,6BAA6B,KAAA,CAAS;IAC/C,OAAO,wBACL,kBACE,KACA,GAAG,wBAAwB,WAAW,KAAK,SAAS,cAAc,MAAM,MAAM,EAAE,OAAO,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,OAAO,WAAW,EAAE,yBAAyB;KAAE,YAAY,MAAM;KAAQ,iBAAiB;IAAO,CAAC,CAAC,EAAE,EACzO,CACF;GACF;GACA,IAAI,QAAQ,OAAO,WAAW,KAAA,GAAW;IACvC,YAAO,EAAE,uBAAuB,KAAA,CAAS;IACzC,OAAO,wBACL,kBACE,KACA,GAAG,wBAAwB,WAAW,KAAK,SAAS,cAAc,QAAQ,OAAO,OAAO,UAAU,EAAE,OAAO,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,OAAO,WAAW,EAAE,mBAAmB;KAAE,YAAY,QAAQ,OAAO,OAAO;KAAY,iBAAiB;KAAQ,iBAAiB,QAAQ,OAAO,OAAO;IAAmB,CAAC,CAAC,EAAE,EACtU,CACF;GACF;EACF;EAEA,MACE,WAAW,QAAO,OADC,qBAAqB,QAAQ,QAAQ,UAAU,KAAA,CAAS,EAAA,CACnD,aAAa,UAAU;EAEjD,OAAO,yBACL,SAAS,WAAW,QAClB,SAAS,UACT,OAAO,uBACN,UAAU,KACb,CACF;EACA,IAAI,SAAS,aAAa,YAAY,OAAO,OAAO,QAAQ,YAAY,OAAO;EAE/E,MAAM,iBACJ,mBAAmB,MAAM,QAAQ,kBAAkB,QAAQ,oBAAoB;EAEjF,MAAM,2BAA2B,OAAO,SAAS,GAC/C,2BAA2B,OAAO,SAAS,GAC3C,2BAA2B,OAAO,SAAS,GAC3C,2BAA2B,OAAO,SAAS;EAE7C,MAAM,WACJ,WAAW,oBAAoB,QAAQ,OAAO,6BAA6B,KAAA;EAE7E,MAAM,uBAAuB,WACzB,QAAQ,SAAS,mBACjB,OAAO,8BAA8B,SAAS,MAAM,QAAQ,SAAS,gBAAgB;EAEzF,YAAO,YAAY,yBAAyB,QAAQ,SAAS,gBAAgB;EAE7E,MAAM,qBACJ,QAAQ,qBAAqB,KAAA,IACzB,OAAO,mBACL,MACA,QAAQ,sBACR,QAAQ,wBACV,IACA,OAAO,OAAO,oBAAoB,OAAO,MAAM,CAAC,CAC9C,QAAQ,iBAAiB,EAAE,aAC7B;EAEN,MAAM,SAAS,QAAQ,OAAO;EAE9B,IAAI,WAAW,kBAAkB;GAC/B,YAAO,WAAW,KAAA,CAAS;GAC3B,OAAO,MACL,GAAG,GAAG,WAAW,OAAO,EAAE,iBAAiB;IAAE,QAAQ,OAAO;IAAY,iBAAiB;GAAyB,CAAC,CAAC,EAAE,SAAS,cAAc,OAAO,UAAU,EAAE,OAAO,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,YAAY,EAAE,iBAAiB,OAAO,kBAAkB,GAClR;GACA,OAAO,MACL,GAAG,GAAG,WAAW,OAAO,EAAE,iBAAiB;IAAE,QAAQ,OAAO;IAAY,oBAAoB;GAAyB,CAAC,CAAC,EAAE,SAAS,MAAM,YAAY,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,MAAM,YAAY,EAAE,cAAc,OAAO,YAAY,EAAE,OAAO,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,YAAY,EAAE,oBAAoB,OAAO,kBAAkB,EAAE,OAAO,kBAC5W;GACA,OAAO,MACL,GAAG,GAAG,UAAU,OAAO,EAAE,iBAAiB,wBAAwB,CAAC,EAAE,SAAS,GAAG,WAAW,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,WAAW,EAAE,cAAc,OAAO,YAAY,EAAE,OAAO,MAAM,WAAW,EAAE,UAAU,OAAO,kBAAkB,EAAE,OAAO,iBACtP;EACF;EACA,IAAI,QAAQ,qBAAqB,KAAA,GAC/B,OAAO,MACL,WAAW,OACT,EAAE,qBAAqB;GACrB,YAAY,MAAM;GAClB,WAAW;GACX,kBAAkB,QAAQ;GAC1B,iBAAiB;EACnB,CAAC,CACH,CACF;OAEA,OAAO,MACL,GAAG,GAAG,WAAW,OAAO,EAAE,mBAAmB;GAAE,kBAAkB,QAAQ;GAAK,iBAAiB;EAAyB,CAAC,CAAC,EAAE,SAAS,cAAc,MAAM,MAAM,EAAE,OAAO,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,YAAY,EAAE,iBAAiB,QAAQ,iBAAiB,EAAE,gBAAgB,EAAE,OAAO,WAAW,OAAO,EAAE,UAAU,EAAE,SAC9U;EACF,IAAI,QAAQ,qBAAqB,KAAA,GAAW;GAC1C,OAAO,MACL,WAAW,OACT,EAAE,qBAAqB;IACrB,UAAU,MAAM;IAChB,WAAW;IACX,cAAc;IACd,YAAY,MAAM;IAClB,oBAAoB;GACtB,CAAC,CACH,CACF;GACA,OAAO,MACL,UAAU,OACR,EAAE,aAAa;IACb,WAAW;IACX,cAAc;IACd,UAAU;GACZ,CAAC,CACH,CACF;EACF,OAAO;GACL,MAAM,MAAM,QAAQ,iBAAiB,EAAE;GAEvC,OAAO,MACL,GAAG,GAAG,WAAW,OAAO,EAAE,iBAAiB;IAAE,YAAY,MAAM;IAAQ,oBAAoB;GAAyB,CAAC,CAAC,EAAE,SAAS,MAAM,YAAY,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,MAAM,YAAY,EAAE,cAAc,kBAAkB,EAAE,OAAO,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,YAAY,EAAE,oBAAoB,GAAG,GAC3U;GACA,OAAO,MACL,GAAG,GAAG,UAAU,OAAO,EAAE,iBAAiB,wBAAwB,CAAC,EAAE,SAAS,GAAG,WAAW,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,WAAW,EAAE,cAAc,kBAAkB,EAAE,OAAO,MAAM,WAAW,EAAE,UAAU,GAAG,GACtN;EACF;EACA,IAAI,CAAC,UACH,OAAO,MACL,GAAG,GAAG,QAAQ,OAAO,GAAG,EAAE,mBAAmB,qBAAqB,CAAC,EAAE,SAAS,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,QAAQ,SAAS,gBAAgB,EAAE,OAAO,cAAc,OAAO,WACnN;EAEF,MAAM,WAAmC;GACvC,WAAW,QAAQ,SAAS;GAC5B,kBAAkB;GAClB,aAAa,CACX,GAAG,QAAQ,SAAS,YAAY,QAC7B,MACC,EAAE,iBAAiB,sBAAsB,EAAE,iBAAiB,QAAQ,YACxE,GACA;IAAE,cAAc;IAAoB,UAAU;GAAyB,CACzE,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,aAAa,cAAc,EAAE,YAAY,CAAC;EAC/D;EAEA,IAAI,UAAU,KAAA,GAAW;GACvB,YAAO,EAAE,uBAAuB,KAAA,CAAS;GAEzC,MAAM,aAAa;IACjB,SAAS;IACT;IACA,gBAAgB,QAAQ;IACxB,GAAG,wBAAwB,QAAQ,KAAK,SAAS,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE,OAAO,MAAM,SAAS,EAAE,kBAAkB,oBAAoB,EAAE,OAAO,cAAc;IAChK,GAAG,wBAAwB,WAAW,KAAK,SAAS,cAAc,MAAM,MAAM,EAAE,OAAO,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,OAAO,WAAW,EAAE,mBAAmB;KAAE,YAAY,MAAM;KAAQ,iBAAiB;KAAQ,iBAAiB;IAAyB,CAAC,CAAC,EAAE;IAC5Q,GAAG,wBAAwB,WAAW,KAAK,SAAS,cAAc,MAAM,MAAM,EAAE,OAAO,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,YAAY,EAAE,iBAAiB,wBAAwB,EAAE,OAAO,GAAG,YAAY,EAAE,YAAY,QAAQ,MAAM,cAAc,QAAQ,GAAG,CAAC,EAAE;IAC/Q,GAAG,wBAAwB,WAAW,KAAK,SAAS,MAAM,YAAY,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,MAAM,YAAY,EAAE,cAAc,kBAAkB,EAAE,OAAO,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,YAAY,EAAE,oBAAoB,wBAAwB,EAAE,OAAO,MAAM,YAAY,EAAE,qBAAqB,MAAM,OAAO,SAAS,EAAE,OAAO,MAAM,YAAY,EAAE,iBAAiB,MAAM,OAAO,KAAK,EAAE,OAAO,iBAAiB;GACrb;GAEA,IAAI,WAAW,KAAA,GACb,WAAW,KACT,GAAG,wBAAwB,WAAW,KAAK,SAAS,cAAc,OAAO,UAAU,EAAE,OAAO,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,YAAY,EAAE,iBAAiB,wBAAwB,EAAE,YAAY,OAAO,WAAW,EAAE,mBAAmB;IAAE,YAAY,OAAO;IAAY,iBAAiB;IAAQ,iBAAiB;GAAyB,CAAC,CAAC,EAAE,KACjW,GAAG,wBAAwB,WAAW,KAAK,SAAS,MAAM,YAAY,EAAE,UAAU,MAAM,QAAQ,EAAE,OAAO,MAAM,YAAY,EAAE,cAAc,OAAO,YAAY,EAAE,OAAO,GAAG,YAAY,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,YAAY,EAAE,oBAAoB,wBAAwB,EAAE,YAAY,iBAAiB,KACjT,GAAG,wBAAwB,UAAU,KAAK,SAAS,GAAG,WAAW,EAAE,WAAW,MAAM,EAAE,OAAO,MAAM,WAAW,EAAE,cAAc,OAAO,YAAY,EAAE,OAAO,MAAM,WAAW,EAAE,UAAU,wBAAwB,EAAE,YAAY,gBAAgB,GAC/O;GACF,OAAO,8BAA8B;IACnC,MAAM;IACN,WAAW,kBAAkB,KAAK,IAAI,IAAI,UAAU,CAAC;GACvD,CAAC;EACH,OACE,OAAO,yBAAyB;GAC9B,MAAM;GACN,OAAO,OAAO,IAAI,aAAa;IAC7B,MAAM,QAAQ,OAAO,OAAO,KAAK;KAC/B,UAAU,SAAS;KACnB,UAAU,MAAM;KAChB,WAAW,SAAS;KACpB,YAAY,MAAM;KAClB,GAAI,WAAW,KAAA,IACX,CAAC,IACD;MACE,oBAAoB,OAAO;MAC3B,kBAAkB,OAAO;KAC3B;IACN,CAAC;IAED,YACE,UAAU,KAAA,KACR,kBAAkB,MAAM,UAAU,QAAQ,KAC1C,MAAM,OAAO,QAAQ,OACrB,MAAM,MAAM,YACZ,MAAM,mBAAmB,KAAA,KACzB,MAAM,eAAe,iBAAiB,sBACtC,MAAM,eAAe,uBAAuB,4BAC5C,MAAM,eAAe,uBAAuB,6BAC3C,OAAO,QAAQ,cAAc,MAAM,iBAAkB,EAAE,WAAW,OACjE,QAAQ,GACd;IACA,MAAM,SAAS,OAAO,EAAE,wBAAwB,MAAM,SAAS,MAAM;IAErE,YAAO,4BAA4B,MAAM,cAAc,UAAU,QAAQ,MAAM,GAAG,CAAC;IACnF,IAAI,WAAW,KAAA,GACb,YACE,MAAM,qBAAqB,KAAA,KACzB,MAAM,qBAAqB,KAAA,KAC3B,MAAM,oBAAoB,KAAA,MACzB,OAAO,QAAQ,UAAU,UAAU,MAAM,gBAAgB,EAAE,UAAU,OACpE,SAAS,aACX,MAAM,gBAAgB,EAAE,kBAAkB,OAAO,gBACjD,MAAM,gBAAgB,EAAE,cAAc,4BACtC,CAAC,EAAE,eAAe,MAAM,gBAAgB,EAAE,OAAO,MAChD,OAAO,QAAQ,UAAU,UAAU,MAAM,iBAAiB,EAAE,UAAU,OACrE,SAAS,aACX,MAAM,iBAAiB,EAAE,qBAAqB,4BAC9C,CAAC,EAAE,UAAU,MAAM,gBAAgB,KACnC,MAAM,iBAAiB,EAAE,wBAAwB,4BACjD,CAAC,EAAE,eAAe,MAAM,iBAAiB,EAAE,OAAO,CACtD;GACJ,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,wBAAwB,KAAK;IAAE,WAAW;IAAU;GAAM,CAAC,CAC7D,CACF;EACF,CAAC;EAEH,OAAO,OAAO,QAAQ,WAAW,OAAO;CAC1C,CAAC,CACH;CAEF,OAAO,EACL,yBAAyB,EAAE,wBAAwB,GAAG;EACpD,SAAS,UACP,SAAS,KACP,OAAO,QAAQ,OAAO,KAAK,IAAI,UAC7B,UAAU,KAAA,IAAY,OAAO,KAAKA,iBAAY,CAAC,IAAI,OAAO,QAAQ,MAAM,MAAM,CAChF,CACF;EACF,kBAAkB,OAAO,YAAY,OAAO,OAAO,kBAAkB,OAAO;EAC5E,kBAAkB,OAAO,YAAY,OAAO,OAAO,kBAAkB,OAAO;CAC9E,CAAC,EACH;AACF,CAAC"}

package/dist/internal/email-policy.mjs

@@ -0,0 +1,92 @@
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { passwordEvidenceSatisfiedAt } from "./password-policy.mjs";
+import { Effect } from "effect";
+import { EmailUnavailable, snapshotEmailCredential, snapshotEmailRequirement, snapshotEmailRevision } from "@yielded/auth/Email";
+import { snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
+//#region src/internal/email-policy.ts
+const unavailable = () => EmailUnavailable.make({});
+const sameIdentifier = (left, right) => left.namespace === right.namespace && left.value === right.value;
+const sameEmailRevision = (left, right) => {
+	if (left.subjectId !== right.subjectId || left.securityRevision !== right.securityRevision || left.credentials.length !== right.credentials.length) return false;
+	const expected = [...left.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId));
+	const actual = [...right.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId));
+	return expected.every((item, index) => item.credentialId === actual[index].credentialId && item.revision === actual[index].revision);
+};
+const emailActionModule = (moduleId, action) => `${moduleId}/${action === "verify-address" ? "verify-address" : "change-address"}`;
+const emailActionPurpose = (action) => action === "verify-address" ? "email-address-verification" : "email-address-change";
+const emailRedemptionMatches = (input, action) => {
+	const completion = input.redemption.input;
+	const binding = completion.binding;
+	return completion.moduleId === emailActionModule(input.moduleId, action) && completion.purpose === emailActionPurpose(action) && binding._tag === "IdentifierChange" && sameIdentifier(binding.identifier, input.target) && sameEmailRevision(binding.revision, input.captured.revision);
+};
+const snapshotEmailMutation = Effect.fn("EmailAddressPersistence.snapshotMutation")(function* (input) {
+	const evidence = yield* snapshotAuthenticationEvidence(input.authorization.evidence).pipe(Effect.mapError(unavailable));
+	const requirement = yield* snapshotEmailRequirement(input.authorization.requirement);
+	const source = input.captured.source === void 0 ? void 0 : yield* snapshotEmailCredential(input.captured.source);
+	return Object.freeze({
+		...input,
+		target: Object.freeze({ ...input.target }),
+		...input.invalidation === void 0 ? {} : { invalidation: Object.freeze({ ...input.invalidation }) },
+		captured: Object.freeze({
+			eligible: input.captured.eligible,
+			revision: snapshotEmailRevision(input.captured.revision),
+			...input.captured.targetIdentifierRevision === void 0 ? {} : { targetIdentifierRevision: input.captured.targetIdentifierRevision },
+			...source === void 0 ? {} : { source }
+		}),
+		authorization: Object.freeze({
+			challenge: Object.freeze({
+				...input.authorization.challenge,
+				target: Object.freeze({ ...input.authorization.challenge.target }),
+				revision: snapshotEmailRevision(input.authorization.challenge.revision)
+			}),
+			evidence,
+			requirement
+		})
+	});
+});
+const validateEmailMutation = Effect.fn("EmailAddressPersistence.validateAuthority")(function* (policy, input, action, current, now) {
+	const confirmsExisting = action === "verify-address" && input.captured.targetIdentifierRevision !== void 0;
+	if (!input.captured.eligible || !emailRedemptionMatches(input, action) || input.authorization.challenge.moduleId !== input.moduleId || input.authorization.challenge.action !== action || input.authorization.challenge.commandId !== input.commandId || !sameIdentifier(input.authorization.challenge.target, input.target) || input.authorization.challenge.sourceCredentialId !== input.captured.source?.credentialId || !sameEmailRevision(input.authorization.challenge.revision, input.captured.revision) || input.authorization.challenge.targetIdentifierRevision !== input.captured.targetIdentifierRevision || input.authorization.evidence.flowId !== input.commandId || input.authorization.evidence.bindingDigest !== input.authorization.challenge.bindingDigest || !sameEmailRevision(input.authorization.evidence.revision, input.captured.revision) || action === "verify-address" && input.captured.source !== void 0 || action === "change-address" && input.captured.source === void 0 || confirmsExisting !== (input.invalidation === void 0) || input.invalidation?.existingSessions === "immediate" && policy.sessionInvalidation !== "same-authority-immediate") return false;
+	if (current === void 0 || !current.target.eligible || !sameEmailRevision(current.target.revision, input.captured.revision) || current.target.targetIdentifierRevision !== input.captured.targetIdentifierRevision || input.captured.source !== void 0 && (current.target.source === void 0 || current.target.source.identifierRevision !== input.captured.source.identifierRevision || current.target.source.credentialRevision !== input.captured.source.credentialRevision || !sameIdentifier(current.target.source.identifier, input.captured.source.identifier))) return false;
+	const currentRequirement = yield* current.requirement;
+	return passwordEvidenceSatisfiedAt(input.authorization.evidence, input.authorization.requirement, now) && passwordEvidenceSatisfiedAt(input.authorization.evidence, currentRequirement, now);
+});
+const allocateEmailValue = (mode, asynchronous, synchronous) => {
+	if (mode === "synchronous") return synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
+		try: synchronous,
+		catch: (cause) => PersistenceMappingError.make({
+			operation: "mapping",
+			cause
+		})
+	});
+	if (asynchronous !== void 0) return asynchronous;
+	return synchronous === void 0 ? Effect.fail(unavailable()) : Effect.try({
+		try: synchronous,
+		catch: (cause) => PersistenceMappingError.make({
+			operation: "mapping",
+			cause
+		})
+	});
+};
+const allocateEmailSecurityRevision = (mapping, mode, current) => {
+	if (mode === "synchronous") return mapping.subject.nextSecurityRevisionSync === void 0 ? Effect.fail(unavailable()) : Effect.try({
+		try: () => mapping.subject.nextSecurityRevisionSync(current),
+		catch: (cause) => PersistenceMappingError.make({
+			operation: "mapping",
+			cause
+		})
+	});
+	if (mapping.subject.nextSecurityRevision !== void 0) return mapping.subject.nextSecurityRevision(current);
+	if (mapping.subject.nextSecurityRevisionSync !== void 0) return Effect.try({
+		try: () => mapping.subject.nextSecurityRevisionSync(current),
+		catch: (cause) => PersistenceMappingError.make({
+			operation: "mapping",
+			cause
+		})
+	});
+	return Effect.fail(unavailable());
+};
+//#endregion
+export { allocateEmailSecurityRevision, allocateEmailValue, emailActionModule, emailActionPurpose, emailRedemptionMatches, sameEmailRevision, snapshotEmailMutation, validateEmailMutation };
+
+//# sourceMappingURL=email-policy.mjs.map