@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/internal/storage-tables.mjs

@@ -1,18 +1,17 @@
 import { Schema } from "effect";
 //#region src/internal/storage-tables.ts
-const StorageColumn = Schema.Struct({
-	name: Schema.NonEmptyString,
-	type: Schema.Literals([
-		"text",
-		"integer",
-		"boolean"
-	]),
-	nullable: Schema.optionalKey(Schema.Boolean)
-});
 const StorageTable = Schema.Struct({
 	name: Schema.NonEmptyString,
 	schema: Schema.optionalKey(Schema.NonEmptyString),
-	columns: Schema.Record(Schema.String, StorageColumn),
+	columns: Schema.Record(Schema.String, Schema.Struct({
+		name: Schema.NonEmptyString,
+		type: Schema.Literals([
+			"text",
+			"integer",
+			"boolean"
+		]),
+		nullable: Schema.optionalKey(Schema.Boolean)
+	})),
 	unique: Schema.Array(Schema.Array(Schema.String))
 });
 const text = { type: "text" };
@@ -40,6 +39,8 @@ const storageTables = {
 	identifiers: spec({
 		namespace: text,
 		value: text,
+		moduleId: optionalText,
+		credentialId: optionalText,
 		subjectId: text,
 		revision: text,
 		verifiedAt: optionalInteger,
@@ -60,18 +61,6 @@ const storageTables = {
 		verifier: text,
 		normalization: text
 	}, [["moduleId", "subjectId"], ["moduleId", "credentialId"]]),
-	passwordCommands: spec({
-		moduleId: text,
-		commandId: text,
-		action: text,
-		bindingDigest: text,
-		decision: text,
-		retentionUntil: integer
-	}, [["moduleId", "commandId"]]),
-	passwordRegistrations: spec({
-		moduleId: text,
-		requestId: text
-	}, [["moduleId", "requestId"]]),
 	emailCredentials: spec({
 		moduleId: text,
 		subjectId: text,
@@ -85,25 +74,12 @@ const storageTables = {
 		"identifierNamespace",
 		"identifierValue"
 	]]),
-	emailCommands: spec({
-		moduleId: text,
-		commandId: text,
-		action: text,
-		bindingDigest: text,
-		retentionUntil: integer
-	}, [["moduleId", "commandId"]]),
-	phoneState: spec({
-		scope: text,
-		state: text,
-		version: text
-	}, [["scope"]]),
 	passkeyCredentials: spec({
 		credentialId: text,
 		subjectId: text,
 		rpId: text,
 		protocolCredentialId: text,
 		credentialKey: text,
-		handleKey: text,
 		userHandle: text,
 		publicKey: text,
 		algorithm: integer,
@@ -115,216 +91,60 @@ const storageTables = {
 		backupEligible: boolean,
 		backupState: boolean,
 		counter: integer,
-		maximumCounter: integer,
 		name: text,
 		createdAt: integer,
 		lastUsedAt: optionalInteger
 	}, [["credentialId"], ["credentialKey"]]),
-	passkeyOwnership: spec({
-		credentialKey: text,
-		rpId: text,
-		protocolCredentialId: text,
-		subjectId: optionalText,
-		credentialId: optionalText,
-		state: text,
-		version: text,
-		reservationId: optionalText
-	}, [["credentialKey"]]),
-	passkeyHandles: spec({
-		handleKey: text,
-		rpId: text,
-		userHandle: text,
-		subjectId: optionalText,
-		state: text,
-		version: text,
-		reservationId: optionalText
-	}, [["handleKey"], ["rpId", "subjectId"]]),
-	passkeyModules: spec({
-		moduleId: text,
-		active: boolean,
-		policyRevision: text,
-		policy: text
-	}, [["moduleId"]]),
 	passkeyFlows: spec({
 		moduleId: text,
 		flowId: text,
-		commandId: text,
 		purpose: text,
-		state: text,
-		version: text,
-		generation: integer,
 		snapshot: text,
-		policySnapshot: text,
 		requestBindingVerifier: text,
 		requestBindingExpiresAt: integer,
 		issuedAt: integer,
-		expiresAt: integer,
-		retentionUntil: integer,
-		claimId: optionalText,
-		claimedAt: optionalInteger,
-		claimExpiresAt: optionalInteger,
-		credentialSnapshot: optionalText,
-		subjectScope: optionalText,
-		targetScope: optionalText
-	}, [["moduleId", "flowId"], ["moduleId", "commandId"]]),
-	passkeyAdmissions: spec({
-		authorityScope: text,
-		moduleId: text,
-		version: text,
-		ownerMarker: text,
-		admittedAt: optionalInteger
-	}, [["authorityScope", "moduleId"]]),
-	passkeyCharges: spec({
-		moduleId: text,
-		flowId: text,
-		purpose: text,
-		kind: text,
-		scope: text,
-		originalWindowMillis: integer,
-		admittedAt: optionalInteger,
-		retainUntil: optionalInteger,
-		version: text,
-		ownerMarker: text
-	}, [[
-		"moduleId",
-		"flowId",
-		"kind"
-	]]),
-	passkeyCommands: spec({
-		moduleId: text,
-		commandId: text,
-		subjectId: text,
-		credentialId: text,
-		intent: text,
-		decision: text,
-		retentionUntil: integer,
-		version: text
-	}, [["moduleId", "commandId"]]),
-	proofRequests: spec({
-		moduleId: text,
-		requestId: text,
-		fingerprint: text,
-		proofId: text,
-		purpose: text,
-		keyId: text,
-		createdAt: integer,
-		retentionUntil: integer,
-		receipt: text
-	}, [["moduleId", "requestId"]]),
-	proofSeries: spec({
-		moduleId: text,
-		purpose: text,
-		scopeKey: text,
-		activeProofId: optionalText,
-		lastIssueAt: optionalInteger,
-		version: text
-	}, [[
-		"moduleId",
-		"purpose",
-		"scopeKey"
-	]]),
-	proofGenerations: spec({
+		expiresAt: integer
+	}, [["moduleId", "flowId"]]),
+	proofs: spec({
 		moduleId: text,
 		purpose: text,
-		proofId: text,
-		requestId: text,
 		seriesKey: text,
-		deliveryId: text,
+		proofId: text,
 		binding: text,
 		verifierKeyId: text,
 		verifierDigest: text,
 		issuedAt: integer,
 		expiresAt: integer,
-		version: text,
-		state: text,
-		sendCount: integer,
-		deliveryState: text,
-		claimVersion: optionalText,
-		claimDeadline: optionalInteger,
-		retryAt: optionalInteger,
-		deliveryRetryMillis: integer,
-		retentionUntil: integer,
-		fingerprint: text
-	}, [["moduleId", "proofId"], ["moduleId", "deliveryId"]]),
-	proofContinuations: spec({
-		moduleId: text,
-		purpose: text,
-		continuationId: text,
-		digest: text,
-		proofId: text,
-		seriesKey: text,
-		binding: text,
-		expiresAt: integer,
-		consumed: boolean,
-		version: text,
-		retentionUntil: integer
-	}, [["moduleId", "continuationId"], ["moduleId", "digest"]]),
-	proofScopes: spec({
-		moduleId: text,
-		purpose: text,
-		action: text,
-		scopeKind: text,
-		scopeKey: text
+		failedAttempts: integer
 	}, [[
 		"moduleId",
 		"purpose",
-		"action",
-		"scopeKind",
-		"scopeKey"
-	]]),
-	proofAbuse: spec({
-		moduleId: text,
-		purpose: text,
-		action: text,
-		scopeKind: text,
-		scopeKey: text,
-		commandId: text,
-		occurredAt: integer,
-		retentionUntil: integer
-	}, [[
-		"moduleId",
-		"action",
-		"scopeKind",
-		"scopeKey",
-		"commandId"
-	]]),
-	proofFailures: spec({
-		moduleId: text,
-		purpose: text,
-		seriesKey: text,
-		commandId: text,
-		occurredAt: integer,
-		retentionUntil: integer
-	}, [[
-		"moduleId",
-		"seriesKey",
-		"commandId"
-	]]),
-	proofCommands: spec({
-		moduleId: text,
-		commandId: text,
-		kind: text,
-		decision: text,
-		retentionUntil: integer
-	}, [["moduleId", "commandId"]]),
+		"seriesKey"
+	], ["moduleId", "proofId"]]),
 	sessions: spec({
 		sessionId: text,
 		subjectId: text,
 		digest: text,
-		version: text,
 		securityRevision: text,
 		issuedAt: integer,
 		expiresAt: integer,
 		absoluteExpiresAt: integer,
 		record: text
 	}, [["sessionId"], ["digest"]]),
-	sessionFlows: spec({
+	pending: spec({
+		moduleId: text,
+		kind: text,
+		digest: text,
+		version: text,
 		flowId: text,
 		subjectId: text,
-		state: text,
-		pendingDigest: optionalText,
-		dedupUntil: integer
-	}, [["flowId"]])
+		bindingDigest: text,
+		snapshot: text,
+		expiresAt: integer,
+		attemptLimit: integer,
+		failedAttempts: integer,
+		consumed: boolean
+	}, [["digest"]])
 };
 const tableDefinition = (role, name, subjectType = "text") => {
 	const table = storageTables[role];
@@ -339,6 +159,6 @@ const tableDefinition = (role, name, subjectType = "text") => {
 	};
 };
 //#endregion
-export { StorageColumn, StorageTable, storageTables, tableDefinition };
+export { StorageTable, storageTables, tableDefinition };
 
 //# sourceMappingURL=storage-tables.mjs.map

package/dist/internal/storage-tables.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"storage-tables.mjs","names":[],"sources":["../../src/internal/storage-tables.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nexport const StorageColumn = Schema.Struct({\n  name: Schema.NonEmptyString,\n  type: Schema.Literals([\"text\", \"integer\", \"boolean\"]),\n  nullable: Schema.optionalKey(Schema.Boolean),\n});\n\nexport const StorageTable = Schema.Struct({\n  name: Schema.NonEmptyString,\n  schema: Schema.optionalKey(Schema.NonEmptyString),\n  columns: Schema.Record(Schema.String, StorageColumn),\n  unique: Schema.Array(Schema.Array(Schema.String)),\n});\n\nexport type StorageTable = typeof StorageTable.Type;\n\nconst text = { type: \"text\" as const };\nconst integer = { type: \"integer\" as const };\nconst boolean = { type: \"boolean\" as const };\nconst optionalText = { ...text, nullable: true };\nconst optionalInteger = { ...integer, nullable: true };\n\nconst spec = <C extends Readonly<Record<string, Omit<typeof StorageColumn.Type, \"name\">>>>(\n  columns: C,\n  unique: ReadonlyArray<ReadonlyArray<Extract<keyof C, string>>>,\n) => ({ columns, unique });\n\n/** Logical roles are independent of table names and migration ownership. */\nexport const storageTables = {\n  subjects: spec({ id: text, active: boolean, securityRevision: text }, [[\"id\"]]),\n  identifiers: spec(\n    {\n      namespace: text,\n      value: text,\n      subjectId: text,\n      revision: text,\n      verifiedAt: optionalInteger,\n      active: boolean,\n    },\n    [[\"namespace\", \"value\"]],\n  ),\n  credentials: spec({ credentialId: text, subjectId: text, revision: text, active: boolean }, [\n    [\"credentialId\"],\n  ]),\n  passwords: spec(\n    {\n      moduleId: text,\n      subjectId: text,\n      credentialId: text,\n      credentialRevision: text,\n      verifierVersion: text,\n      verifier: text,\n      normalization: text,\n    },\n    [\n      [\"moduleId\", \"subjectId\"],\n      [\"moduleId\", \"credentialId\"],\n    ],\n  ),\n  passwordCommands: spec(\n    {\n      moduleId: text,\n      commandId: text,\n      action: text,\n      bindingDigest: text,\n      decision: text,\n      retentionUntil: integer,\n    },\n    [[\"moduleId\", \"commandId\"]],\n  ),\n  passwordRegistrations: spec({ moduleId: text, requestId: text }, [[\"moduleId\", \"requestId\"]]),\n  emailCredentials: spec(\n    {\n      moduleId: text,\n      subjectId: text,\n      credentialId: text,\n      identifierNamespace: text,\n      identifierValue: text,\n      credentialRevision: text,\n      active: boolean,\n    },\n    [\n      [\"moduleId\", \"credentialId\"],\n      [\"moduleId\", \"identifierNamespace\", \"identifierValue\"],\n    ],\n  ),\n  emailCommands: spec(\n    { moduleId: text, commandId: text, action: text, bindingDigest: text, retentionUntil: integer },\n    [[\"moduleId\", \"commandId\"]],\n  ),\n  phoneState: spec({ scope: text, state: text, version: text }, [[\"scope\"]]),\n  passkeyCredentials: spec(\n    {\n      credentialId: text,\n      subjectId: text,\n      rpId: text,\n      protocolCredentialId: text,\n      credentialKey: text,\n      handleKey: text,\n      userHandle: text,\n      publicKey: text,\n      algorithm: integer,\n      profile: text,\n      credentialRevision: text,\n      active: boolean,\n      primarySignIn: boolean,\n      enrollmentUserVerified: boolean,\n      backupEligible: boolean,\n      backupState: boolean,\n      counter: integer,\n      maximumCounter: integer,\n      name: text,\n      createdAt: integer,\n      lastUsedAt: optionalInteger,\n    },\n    [[\"credentialId\"], [\"credentialKey\"]],\n  ),\n  passkeyOwnership: spec(\n    {\n      credentialKey: text,\n      rpId: text,\n      protocolCredentialId: text,\n      subjectId: optionalText,\n      credentialId: optionalText,\n      state: text,\n      version: text,\n      reservationId: optionalText,\n    },\n    [[\"credentialKey\"]],\n  ),\n  passkeyHandles: spec(\n    {\n      handleKey: text,\n      rpId: text,\n      userHandle: text,\n      subjectId: optionalText,\n      state: text,\n      version: text,\n      reservationId: optionalText,\n    },\n    [[\"handleKey\"], [\"rpId\", \"subjectId\"]],\n  ),\n  passkeyModules: spec(\n    {\n      moduleId: text,\n      active: boolean,\n      policyRevision: text,\n      policy: text,\n    },\n    [[\"moduleId\"]],\n  ),\n  passkeyFlows: spec(\n    {\n      moduleId: text,\n      flowId: text,\n      commandId: text,\n      purpose: text,\n      state: text,\n      version: text,\n      generation: integer,\n      snapshot: text,\n      policySnapshot: text,\n      requestBindingVerifier: text,\n      requestBindingExpiresAt: integer,\n      issuedAt: integer,\n      expiresAt: integer,\n      retentionUntil: integer,\n      claimId: optionalText,\n      claimedAt: optionalInteger,\n      claimExpiresAt: optionalInteger,\n      credentialSnapshot: optionalText,\n      subjectScope: optionalText,\n      targetScope: optionalText,\n    },\n    [\n      [\"moduleId\", \"flowId\"],\n      [\"moduleId\", \"commandId\"],\n    ],\n  ),\n  passkeyAdmissions: spec(\n    {\n      authorityScope: text,\n      moduleId: text,\n      version: text,\n      ownerMarker: text,\n      admittedAt: optionalInteger,\n    },\n    [[\"authorityScope\", \"moduleId\"]],\n  ),\n  passkeyCharges: spec(\n    {\n      moduleId: text,\n      flowId: text,\n      purpose: text,\n      kind: text,\n      scope: text,\n      originalWindowMillis: integer,\n      admittedAt: optionalInteger,\n      retainUntil: optionalInteger,\n      version: text,\n      ownerMarker: text,\n    },\n    [[\"moduleId\", \"flowId\", \"kind\"]],\n  ),\n  passkeyCommands: spec(\n    {\n      moduleId: text,\n      commandId: text,\n      subjectId: text,\n      credentialId: text,\n      intent: text,\n      decision: text,\n      retentionUntil: integer,\n      version: text,\n    },\n    [[\"moduleId\", \"commandId\"]],\n  ),\n  proofRequests: spec(\n    {\n      moduleId: text,\n      requestId: text,\n      fingerprint: text,\n      proofId: text,\n      purpose: text,\n      keyId: text,\n      createdAt: integer,\n      retentionUntil: integer,\n      receipt: text,\n    },\n    [[\"moduleId\", \"requestId\"]],\n  ),\n  proofSeries: spec(\n    {\n      moduleId: text,\n      purpose: text,\n      scopeKey: text,\n      activeProofId: optionalText,\n      lastIssueAt: optionalInteger,\n      version: text,\n    },\n    [[\"moduleId\", \"purpose\", \"scopeKey\"]],\n  ),\n  proofGenerations: spec(\n    {\n      moduleId: text,\n      purpose: text,\n      proofId: text,\n      requestId: text,\n      seriesKey: text,\n      deliveryId: text,\n      binding: text,\n      verifierKeyId: text,\n      verifierDigest: text,\n      issuedAt: integer,\n      expiresAt: integer,\n      version: text,\n      state: text,\n      sendCount: integer,\n      deliveryState: text,\n      claimVersion: optionalText,\n      claimDeadline: optionalInteger,\n      retryAt: optionalInteger,\n      deliveryRetryMillis: integer,\n      retentionUntil: integer,\n      fingerprint: text,\n    },\n    [\n      [\"moduleId\", \"proofId\"],\n      [\"moduleId\", \"deliveryId\"],\n    ],\n  ),\n  proofContinuations: spec(\n    {\n      moduleId: text,\n      purpose: text,\n      continuationId: text,\n      digest: text,\n      proofId: text,\n      seriesKey: text,\n      binding: text,\n      expiresAt: integer,\n      consumed: boolean,\n      version: text,\n      retentionUntil: integer,\n    },\n    [\n      [\"moduleId\", \"continuationId\"],\n      [\"moduleId\", \"digest\"],\n    ],\n  ),\n  proofScopes: spec(\n    { moduleId: text, purpose: text, action: text, scopeKind: text, scopeKey: text },\n    [[\"moduleId\", \"purpose\", \"action\", \"scopeKind\", \"scopeKey\"]],\n  ),\n  proofAbuse: spec(\n    {\n      moduleId: text,\n      purpose: text,\n      action: text,\n      scopeKind: text,\n      scopeKey: text,\n      commandId: text,\n      occurredAt: integer,\n      retentionUntil: integer,\n    },\n    [[\"moduleId\", \"action\", \"scopeKind\", \"scopeKey\", \"commandId\"]],\n  ),\n  proofFailures: spec(\n    {\n      moduleId: text,\n      purpose: text,\n      seriesKey: text,\n      commandId: text,\n      occurredAt: integer,\n      retentionUntil: integer,\n    },\n    [[\"moduleId\", \"seriesKey\", \"commandId\"]],\n  ),\n  proofCommands: spec(\n    { moduleId: text, commandId: text, kind: text, decision: text, retentionUntil: integer },\n    [[\"moduleId\", \"commandId\"]],\n  ),\n  sessions: spec(\n    {\n      sessionId: text,\n      subjectId: text,\n      digest: text,\n      version: text,\n      securityRevision: text,\n      issuedAt: integer,\n      expiresAt: integer,\n      absoluteExpiresAt: integer,\n      record: text,\n    },\n    [[\"sessionId\"], [\"digest\"]],\n  ),\n  sessionFlows: spec(\n    {\n      flowId: text,\n      subjectId: text,\n      state: text,\n      pendingDigest: optionalText,\n      dedupUntil: integer,\n    },\n    [[\"flowId\"]],\n  ),\n} as const;\n\nexport type StorageRole = keyof typeof storageTables;\n\nexport const tableDefinition = (\n  role: StorageRole,\n  name: string,\n  subjectType: \"text\" | \"integer\" = \"text\",\n): StorageTable => {\n  const table = storageTables[role];\n\n  return {\n    name,\n    columns: Object.fromEntries(\n      Object.entries(table.columns).map(([key, column]) => [\n        key,\n        {\n          ...column,\n          name: key.replace(/[A-Z]/g, (letter) => \"_\" + letter.toLowerCase()),\n          ...(key === \"subjectId\" ? { type: subjectType } : {}),\n        },\n      ]),\n    ),\n    unique: table.unique,\n  };\n};\n"],"mappings":";;AAEA,MAAa,gBAAgB,OAAO,OAAO;CACzC,MAAM,OAAO;CACb,MAAM,OAAO,SAAS;EAAC;EAAQ;EAAW;CAAS,CAAC;CACpD,UAAU,OAAO,YAAY,OAAO,OAAO;AAC7C,CAAC;AAED,MAAa,eAAe,OAAO,OAAO;CACxC,MAAM,OAAO;CACb,QAAQ,OAAO,YAAY,OAAO,cAAc;CAChD,SAAS,OAAO,OAAO,OAAO,QAAQ,aAAa;CACnD,QAAQ,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,CAAC;AAClD,CAAC;AAID,MAAM,OAAO,EAAE,MAAM,OAAgB;AACrC,MAAM,UAAU,EAAE,MAAM,UAAmB;AAC3C,MAAM,UAAU,EAAE,MAAM,UAAmB;AAC3C,MAAM,eAAe;CAAE,GAAG;CAAM,UAAU;AAAK;AAC/C,MAAM,kBAAkB;CAAE,GAAG;CAAS,UAAU;AAAK;AAErD,MAAM,QACJ,SACA,YACI;CAAE;CAAS;AAAO;;AAGxB,MAAa,gBAAgB;CAC3B,UAAU,KAAK;EAAE,IAAI;EAAM,QAAQ;EAAS,kBAAkB;CAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;CAC9E,aAAa,KACX;EACE,WAAW;EACX,OAAO;EACP,WAAW;EACX,UAAU;EACV,YAAY;EACZ,QAAQ;CACV,GACA,CAAC,CAAC,aAAa,OAAO,CAAC,CACzB;CACA,aAAa,KAAK;EAAE,cAAc;EAAM,WAAW;EAAM,UAAU;EAAM,QAAQ;CAAQ,GAAG,CAC1F,CAAC,cAAc,CACjB,CAAC;CACD,WAAW,KACT;EACE,UAAU;EACV,WAAW;EACX,cAAc;EACd,oBAAoB;EACpB,iBAAiB;EACjB,UAAU;EACV,eAAe;CACjB,GACA,CACE,CAAC,YAAY,WAAW,GACxB,CAAC,YAAY,cAAc,CAC7B,CACF;CACA,kBAAkB,KAChB;EACE,UAAU;EACV,WAAW;EACX,QAAQ;EACR,eAAe;EACf,UAAU;EACV,gBAAgB;CAClB,GACA,CAAC,CAAC,YAAY,WAAW,CAAC,CAC5B;CACA,uBAAuB,KAAK;EAAE,UAAU;EAAM,WAAW;CAAK,GAAG,CAAC,CAAC,YAAY,WAAW,CAAC,CAAC;CAC5F,kBAAkB,KAChB;EACE,UAAU;EACV,WAAW;EACX,cAAc;EACd,qBAAqB;EACrB,iBAAiB;EACjB,oBAAoB;EACpB,QAAQ;CACV,GACA,CACE,CAAC,YAAY,cAAc,GAC3B;EAAC;EAAY;EAAuB;CAAiB,CACvD,CACF;CACA,eAAe,KACb;EAAE,UAAU;EAAM,WAAW;EAAM,QAAQ;EAAM,eAAe;EAAM,gBAAgB;CAAQ,GAC9F,CAAC,CAAC,YAAY,WAAW,CAAC,CAC5B;CACA,YAAY,KAAK;EAAE,OAAO;EAAM,OAAO;EAAM,SAAS;CAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;CACzE,oBAAoB,KAClB;EACE,cAAc;EACd,WAAW;EACX,MAAM;EACN,sBAAsB;EACtB,eAAe;EACf,WAAW;EACX,YAAY;EACZ,WAAW;EACX,WAAW;EACX,SAAS;EACT,oBAAoB;EACpB,QAAQ;EACR,eAAe;EACf,wBAAwB;EACxB,gBAAgB;EAChB,aAAa;EACb,SAAS;EACT,gBAAgB;EAChB,MAAM;EACN,WAAW;EACX,YAAY;CACd,GACA,CAAC,CAAC,cAAc,GAAG,CAAC,eAAe,CAAC,CACtC;CACA,kBAAkB,KAChB;EACE,eAAe;EACf,MAAM;EACN,sBAAsB;EACtB,WAAW;EACX,cAAc;EACd,OAAO;EACP,SAAS;EACT,eAAe;CACjB,GACA,CAAC,CAAC,eAAe,CAAC,CACpB;CACA,gBAAgB,KACd;EACE,WAAW;EACX,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,SAAS;EACT,eAAe;CACjB,GACA,CAAC,CAAC,WAAW,GAAG,CAAC,QAAQ,WAAW,CAAC,CACvC;CACA,gBAAgB,KACd;EACE,UAAU;EACV,QAAQ;EACR,gBAAgB;EAChB,QAAQ;CACV,GACA,CAAC,CAAC,UAAU,CAAC,CACf;CACA,cAAc,KACZ;EACE,UAAU;EACV,QAAQ;EACR,WAAW;EACX,SAAS;EACT,OAAO;EACP,SAAS;EACT,YAAY;EACZ,UAAU;EACV,gBAAgB;EAChB,wBAAwB;EACxB,yBAAyB;EACzB,UAAU;EACV,WAAW;EACX,gBAAgB;EAChB,SAAS;EACT,WAAW;EACX,gBAAgB;EAChB,oBAAoB;EACpB,cAAc;EACd,aAAa;CACf,GACA,CACE,CAAC,YAAY,QAAQ,GACrB,CAAC,YAAY,WAAW,CAC1B,CACF;CACA,mBAAmB,KACjB;EACE,gBAAgB;EAChB,UAAU;EACV,SAAS;EACT,aAAa;EACb,YAAY;CACd,GACA,CAAC,CAAC,kBAAkB,UAAU,CAAC,CACjC;CACA,gBAAgB,KACd;EACE,UAAU;EACV,QAAQ;EACR,SAAS;EACT,MAAM;EACN,OAAO;EACP,sBAAsB;EACtB,YAAY;EACZ,aAAa;EACb,SAAS;EACT,aAAa;CACf,GACA,CAAC;EAAC;EAAY;EAAU;CAAM,CAAC,CACjC;CACA,iBAAiB,KACf;EACE,UAAU;EACV,WAAW;EACX,WAAW;EACX,cAAc;EACd,QAAQ;EACR,UAAU;EACV,gBAAgB;EAChB,SAAS;CACX,GACA,CAAC,CAAC,YAAY,WAAW,CAAC,CAC5B;CACA,eAAe,KACb;EACE,UAAU;EACV,WAAW;EACX,aAAa;EACb,SAAS;EACT,SAAS;EACT,OAAO;EACP,WAAW;EACX,gBAAgB;EAChB,SAAS;CACX,GACA,CAAC,CAAC,YAAY,WAAW,CAAC,CAC5B;CACA,aAAa,KACX;EACE,UAAU;EACV,SAAS;EACT,UAAU;EACV,eAAe;EACf,aAAa;EACb,SAAS;CACX,GACA,CAAC;EAAC;EAAY;EAAW;CAAU,CAAC,CACtC;CACA,kBAAkB,KAChB;EACE,UAAU;EACV,SAAS;EACT,SAAS;EACT,WAAW;EACX,WAAW;EACX,YAAY;EACZ,SAAS;EACT,eAAe;EACf,gBAAgB;EAChB,UAAU;EACV,WAAW;EACX,SAAS;EACT,OAAO;EACP,WAAW;EACX,eAAe;EACf,cAAc;EACd,eAAe;EACf,SAAS;EACT,qBAAqB;EACrB,gBAAgB;EAChB,aAAa;CACf,GACA,CACE,CAAC,YAAY,SAAS,GACtB,CAAC,YAAY,YAAY,CAC3B,CACF;CACA,oBAAoB,KAClB;EACE,UAAU;EACV,SAAS;EACT,gBAAgB;EAChB,QAAQ;EACR,SAAS;EACT,WAAW;EACX,SAAS;EACT,WAAW;EACX,UAAU;EACV,SAAS;EACT,gBAAgB;CAClB,GACA,CACE,CAAC,YAAY,gBAAgB,GAC7B,CAAC,YAAY,QAAQ,CACvB,CACF;CACA,aAAa,KACX;EAAE,UAAU;EAAM,SAAS;EAAM,QAAQ;EAAM,WAAW;EAAM,UAAU;CAAK,GAC/E,CAAC;EAAC;EAAY;EAAW;EAAU;EAAa;CAAU,CAAC,CAC7D;CACA,YAAY,KACV;EACE,UAAU;EACV,SAAS;EACT,QAAQ;EACR,WAAW;EACX,UAAU;EACV,WAAW;EACX,YAAY;EACZ,gBAAgB;CAClB,GACA,CAAC;EAAC;EAAY;EAAU;EAAa;EAAY;CAAW,CAAC,CAC/D;CACA,eAAe,KACb;EACE,UAAU;EACV,SAAS;EACT,WAAW;EACX,WAAW;EACX,YAAY;EACZ,gBAAgB;CAClB,GACA,CAAC;EAAC;EAAY;EAAa;CAAW,CAAC,CACzC;CACA,eAAe,KACb;EAAE,UAAU;EAAM,WAAW;EAAM,MAAM;EAAM,UAAU;EAAM,gBAAgB;CAAQ,GACvF,CAAC,CAAC,YAAY,WAAW,CAAC,CAC5B;CACA,UAAU,KACR;EACE,WAAW;EACX,WAAW;EACX,QAAQ;EACR,SAAS;EACT,kBAAkB;EAClB,UAAU;EACV,WAAW;EACX,mBAAmB;EACnB,QAAQ;CACV,GACA,CAAC,CAAC,WAAW,GAAG,CAAC,QAAQ,CAAC,CAC5B;CACA,cAAc,KACZ;EACE,QAAQ;EACR,WAAW;EACX,OAAO;EACP,eAAe;EACf,YAAY;CACd,GACA,CAAC,CAAC,QAAQ,CAAC,CACb;AACF;AAIA,MAAa,mBACX,MACA,MACA,cAAkC,WACjB;CACjB,MAAM,QAAQ,cAAc;CAE5B,OAAO;EACL;EACA,SAAS,OAAO,YACd,OAAO,QAAQ,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CACnD,KACA;GACE,GAAG;GACH,MAAM,IAAI,QAAQ,WAAW,WAAW,MAAM,OAAO,YAAY,CAAC;GAClE,GAAI,QAAQ,cAAc,EAAE,MAAM,YAAY,IAAI,CAAC;EACrD,CACF,CAAC,CACH;EACA,QAAQ,MAAM;CAChB;AACF"}
+{"version":3,"file":"storage-tables.mjs","names":[],"sources":["../../src/internal/storage-tables.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\nexport const StorageTable = Schema.Struct({\n  name: Schema.NonEmptyString,\n  schema: Schema.optionalKey(Schema.NonEmptyString),\n  columns: Schema.Record(\n    Schema.String,\n    Schema.Struct({\n      name: Schema.NonEmptyString,\n      type: Schema.Literals([\"text\", \"integer\", \"boolean\"]),\n      nullable: Schema.optionalKey(Schema.Boolean),\n    }),\n  ),\n  unique: Schema.Array(Schema.Array(Schema.String)),\n});\n\nexport type StorageTable = typeof StorageTable.Type;\n\nconst text = { type: \"text\" as const };\nconst integer = { type: \"integer\" as const };\nconst boolean = { type: \"boolean\" as const };\nconst optionalText = { ...text, nullable: true };\nconst optionalInteger = { ...integer, nullable: true };\n\nconst spec = <C extends Readonly<Record<string, Omit<StorageTable[\"columns\"][string], \"name\">>>>(\n  columns: C,\n  unique: ReadonlyArray<ReadonlyArray<Extract<keyof C, string>>>,\n) => ({ columns, unique });\n\n/** Logical roles are independent of table names and migration ownership. */\nexport const storageTables = {\n  subjects: spec({ id: text, active: boolean, securityRevision: text }, [[\"id\"]]),\n  identifiers: spec(\n    {\n      namespace: text,\n      value: text,\n      moduleId: optionalText,\n      credentialId: optionalText,\n      subjectId: text,\n      revision: text,\n      verifiedAt: optionalInteger,\n      active: boolean,\n    },\n    [[\"namespace\", \"value\"]],\n  ),\n  credentials: spec({ credentialId: text, subjectId: text, revision: text, active: boolean }, [\n    [\"credentialId\"],\n  ]),\n  passwords: spec(\n    {\n      moduleId: text,\n      subjectId: text,\n      credentialId: text,\n      credentialRevision: text,\n      verifierVersion: text,\n      verifier: text,\n      normalization: text,\n    },\n    [\n      [\"moduleId\", \"subjectId\"],\n      [\"moduleId\", \"credentialId\"],\n    ],\n  ),\n  emailCredentials: spec(\n    {\n      moduleId: text,\n      subjectId: text,\n      credentialId: text,\n      identifierNamespace: text,\n      identifierValue: text,\n      credentialRevision: text,\n      active: boolean,\n    },\n    [\n      [\"moduleId\", \"credentialId\"],\n      [\"moduleId\", \"identifierNamespace\", \"identifierValue\"],\n    ],\n  ),\n  passkeyCredentials: spec(\n    {\n      credentialId: text,\n      subjectId: text,\n      rpId: text,\n      protocolCredentialId: text,\n      credentialKey: text,\n      userHandle: text,\n      publicKey: text,\n      algorithm: integer,\n      profile: text,\n      credentialRevision: text,\n      active: boolean,\n      primarySignIn: boolean,\n      enrollmentUserVerified: boolean,\n      backupEligible: boolean,\n      backupState: boolean,\n      counter: integer,\n      name: text,\n      createdAt: integer,\n      lastUsedAt: optionalInteger,\n    },\n    [[\"credentialId\"], [\"credentialKey\"]],\n  ),\n  passkeyFlows: spec(\n    {\n      moduleId: text,\n      flowId: text,\n      purpose: text,\n      snapshot: text,\n      requestBindingVerifier: text,\n      requestBindingExpiresAt: integer,\n      issuedAt: integer,\n      expiresAt: integer,\n    },\n    [[\"moduleId\", \"flowId\"]],\n  ),\n  proofs: spec(\n    {\n      moduleId: text,\n      purpose: text,\n      seriesKey: text,\n      proofId: text,\n      binding: text,\n      verifierKeyId: text,\n      verifierDigest: text,\n      issuedAt: integer,\n      expiresAt: integer,\n      failedAttempts: integer,\n    },\n    [\n      [\"moduleId\", \"purpose\", \"seriesKey\"],\n      [\"moduleId\", \"proofId\"],\n    ],\n  ),\n  sessions: spec(\n    {\n      sessionId: text,\n      subjectId: text,\n      digest: text,\n      securityRevision: text,\n      issuedAt: integer,\n      expiresAt: integer,\n      absoluteExpiresAt: integer,\n      record: text,\n    },\n    [[\"sessionId\"], [\"digest\"]],\n  ),\n  pending: spec(\n    {\n      moduleId: text,\n      kind: text,\n      digest: text,\n      version: text,\n      flowId: text,\n      subjectId: text,\n      bindingDigest: text,\n      snapshot: text,\n      expiresAt: integer,\n      attemptLimit: integer,\n      failedAttempts: integer,\n      consumed: boolean,\n    },\n    [[\"digest\"]],\n  ),\n} as const;\n\nexport type StorageRole = keyof typeof storageTables;\n\nexport const tableDefinition = (\n  role: StorageRole,\n  name: string,\n  subjectType: \"text\" | \"integer\" = \"text\",\n): StorageTable => {\n  const table = storageTables[role];\n\n  return {\n    name,\n    columns: Object.fromEntries(\n      Object.entries(table.columns).map(([key, column]) => [\n        key,\n        {\n          ...column,\n          name: key.replace(/[A-Z]/g, (letter) => \"_\" + letter.toLowerCase()),\n          ...(key === \"subjectId\" ? { type: subjectType } : {}),\n        },\n      ]),\n    ),\n    unique: table.unique,\n  };\n};\n"],"mappings":";;AAEA,MAAa,eAAe,OAAO,OAAO;CACxC,MAAM,OAAO;CACb,QAAQ,OAAO,YAAY,OAAO,cAAc;CAChD,SAAS,OAAO,OACd,OAAO,QACP,OAAO,OAAO;EACZ,MAAM,OAAO;EACb,MAAM,OAAO,SAAS;GAAC;GAAQ;GAAW;EAAS,CAAC;EACpD,UAAU,OAAO,YAAY,OAAO,OAAO;CAC7C,CAAC,CACH;CACA,QAAQ,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,CAAC;AAClD,CAAC;AAID,MAAM,OAAO,EAAE,MAAM,OAAgB;AACrC,MAAM,UAAU,EAAE,MAAM,UAAmB;AAC3C,MAAM,UAAU,EAAE,MAAM,UAAmB;AAC3C,MAAM,eAAe;CAAE,GAAG;CAAM,UAAU;AAAK;AAC/C,MAAM,kBAAkB;CAAE,GAAG;CAAS,UAAU;AAAK;AAErD,MAAM,QACJ,SACA,YACI;CAAE;CAAS;AAAO;;AAGxB,MAAa,gBAAgB;CAC3B,UAAU,KAAK;EAAE,IAAI;EAAM,QAAQ;EAAS,kBAAkB;CAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;CAC9E,aAAa,KACX;EACE,WAAW;EACX,OAAO;EACP,UAAU;EACV,cAAc;EACd,WAAW;EACX,UAAU;EACV,YAAY;EACZ,QAAQ;CACV,GACA,CAAC,CAAC,aAAa,OAAO,CAAC,CACzB;CACA,aAAa,KAAK;EAAE,cAAc;EAAM,WAAW;EAAM,UAAU;EAAM,QAAQ;CAAQ,GAAG,CAC1F,CAAC,cAAc,CACjB,CAAC;CACD,WAAW,KACT;EACE,UAAU;EACV,WAAW;EACX,cAAc;EACd,oBAAoB;EACpB,iBAAiB;EACjB,UAAU;EACV,eAAe;CACjB,GACA,CACE,CAAC,YAAY,WAAW,GACxB,CAAC,YAAY,cAAc,CAC7B,CACF;CACA,kBAAkB,KAChB;EACE,UAAU;EACV,WAAW;EACX,cAAc;EACd,qBAAqB;EACrB,iBAAiB;EACjB,oBAAoB;EACpB,QAAQ;CACV,GACA,CACE,CAAC,YAAY,cAAc,GAC3B;EAAC;EAAY;EAAuB;CAAiB,CACvD,CACF;CACA,oBAAoB,KAClB;EACE,cAAc;EACd,WAAW;EACX,MAAM;EACN,sBAAsB;EACtB,eAAe;EACf,YAAY;EACZ,WAAW;EACX,WAAW;EACX,SAAS;EACT,oBAAoB;EACpB,QAAQ;EACR,eAAe;EACf,wBAAwB;EACxB,gBAAgB;EAChB,aAAa;EACb,SAAS;EACT,MAAM;EACN,WAAW;EACX,YAAY;CACd,GACA,CAAC,CAAC,cAAc,GAAG,CAAC,eAAe,CAAC,CACtC;CACA,cAAc,KACZ;EACE,UAAU;EACV,QAAQ;EACR,SAAS;EACT,UAAU;EACV,wBAAwB;EACxB,yBAAyB;EACzB,UAAU;EACV,WAAW;CACb,GACA,CAAC,CAAC,YAAY,QAAQ,CAAC,CACzB;CACA,QAAQ,KACN;EACE,UAAU;EACV,SAAS;EACT,WAAW;EACX,SAAS;EACT,SAAS;EACT,eAAe;EACf,gBAAgB;EAChB,UAAU;EACV,WAAW;EACX,gBAAgB;CAClB,GACA,CACE;EAAC;EAAY;EAAW;CAAW,GACnC,CAAC,YAAY,SAAS,CACxB,CACF;CACA,UAAU,KACR;EACE,WAAW;EACX,WAAW;EACX,QAAQ;EACR,kBAAkB;EAClB,UAAU;EACV,WAAW;EACX,mBAAmB;EACnB,QAAQ;CACV,GACA,CAAC,CAAC,WAAW,GAAG,CAAC,QAAQ,CAAC,CAC5B;CACA,SAAS,KACP;EACE,UAAU;EACV,MAAM;EACN,QAAQ;EACR,SAAS;EACT,QAAQ;EACR,WAAW;EACX,eAAe;EACf,UAAU;EACV,WAAW;EACX,cAAc;EACd,gBAAgB;EAChB,UAAU;CACZ,GACA,CAAC,CAAC,QAAQ,CAAC,CACb;AACF;AAIA,MAAa,mBACX,MACA,MACA,cAAkC,WACjB;CACjB,MAAM,QAAQ,cAAc;CAE5B,OAAO;EACL;EACA,SAAS,OAAO,YACd,OAAO,QAAQ,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,CACnD,KACA;GACE,GAAG;GACH,MAAM,IAAI,QAAQ,WAAW,WAAW,MAAM,OAAO,YAAY,CAAC;GAClE,GAAI,QAAQ,cAAc,EAAE,MAAM,YAAY,IAAI,CAAC;EACrD,CACF,CAAC,CACH;EACA,QAAQ,MAAM;CAChB;AACF"}

package/dist/internal/storage-validation.d.mts

@@ -1,7 +1,6 @@
-import "./transaction-kernel.mjs";
 import "./storage-tables.mjs";
 import { PersistenceConfigurationError } from "./configuration.mjs";
-import { Effect, Schema } from "effect";
+import { Effect } from "effect";
 import { SqlClient } from "effect/sql/SqlClient";
 //#region src/internal/storage-validation.d.ts
 /** Physical metadata needed for catalog validation; value codecs remain adapter-owned. */
@@ -12,10 +11,6 @@ export interface PhysicalStorageTable {
     readonly name: string;
   }>>;
 }
-export interface PhysicalTextColumn {
-  readonly table: Pick<PhysicalStorageTable, "name" | "schema">;
-  readonly name: string;
-}
 /** Share metadata only while constructing one service graph. Captured contexts
  * cannot reuse it after acquisition succeeds, fails, or is interrupted. */
 export declare const withStorageValidation: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;

package/dist/internal/storage-validation.mjs

@@ -1,5 +1,4 @@
 import { PersistenceConfigurationError } from "./configuration.mjs";
-import { NativeDatabase } from "./transaction-kernel.mjs";
 import { Context, Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql/SqlClient";
 //#region src/internal/storage-validation.ts
@@ -28,46 +27,6 @@ const MysqlIndexes = Schema.Array(Schema.Struct({
 }));
 const quote = (value) => "\"" + value.replaceAll("\"", "\"\"") + "\"";
 const qualifiedTableName = (table) => (table.schema === void 0 ? "" : quote(table.schema) + ".") + quote(table.name);
-const TextColumns = Schema.Array(Schema.Struct({
-	type: Schema.String,
-	collation: Schema.String
-}));
-/** One acquisition-only read: presence/unique-key validation does not establish
-* equality compatibility. SQLite's pragma omits column collations, so only
-* ordinary TEXT tables with no COLLATE declaration qualify (default BINARY). */
-const canJoinTextColumns = Effect.fnUntraced(function* (left, right) {
-	if (left === void 0 || right === void 0) return false;
-	const { $client } = yield* NativeDatabase;
-	const client = $client.withoutTransforms();
-	const columns = [left, right];
-	if (client.onDialectOrElse({
-		sqlite: () => true,
-		orElse: () => false
-	}) && columns.some((c) => c.table.schema !== void 0 && c.table.schema !== "main")) return false;
-	const rows = yield* client.onDialectOrElse({
-		pg: () => client`
-      select a.atttypid::text as type, a.attcollation::text as collation
-      from (values ${client.join(", ", false)(columns.map((c) => client`(${qualifiedTableName(c.table)}::text, ${c.name}::text)`))}) requested(relation, name)
-      join pg_attribute a on a.attrelid = to_regclass(requested.relation)
-        and a.attname = requested.name and a.attnum > 0 and not a.attisdropped
-      where a.atttypid in ('text'::regtype, 'varchar'::regtype)`,
-		sqlite: () => client`
-      with requested(relation, name) as (values ${client.join(", ", false)(columns.map((c) => client`(${c.table.name}, ${c.name})`))})
-      select 'text' as type, 'BINARY' as collation from requested
-      join sqlite_schema s on s.name = requested.relation and s.type = 'table'
-      join pragma_table_info(requested.relation) c on c.name = requested.name
-      where upper(c.type) = 'TEXT' and instr(lower(s.sql), 'collate') = 0`,
-		mysql: () => client`
-      select c.data_type as type, c.collation_name as collation
-      from (${client.join(" union all ", false)(columns.map((c) => client`select ${c.table.schema ?? null} as schema_name, ${c.table.name} as table_name, ${c.name} as column_name`))}) requested
-      join information_schema.columns c
-        on c.table_schema = coalesce(requested.schema_name, database())
-        and c.table_name = requested.table_name and c.column_name = requested.column_name
-      where c.data_type in ('varchar', 'text', 'tinytext', 'mediumtext', 'longtext')`,
-		orElse: () => Effect.succeed([])
-	}).pipe(Effect.flatMap(Schema.decodeUnknownEffect(TextColumns)));
-	return rows.length === 2 && rows[0]?.type === rows[1]?.type && rows[0]?.collation === rows[1]?.collation;
-});
 const validateKeys = Effect.fnUntraced(function* (table, required, physicalKeys) {
 	for (const keys of required) {
 		const columns = keys.map((key) => table.columns[key]?.name);
@@ -181,6 +140,6 @@ const validateStorage = (dialect, table, required) => validateStorageBatch(diale
 	required
 }]);
 //#endregion
-export { canJoinTextColumns, qualifiedTableName, validateStorage, validateStorageBatch, withStorageValidation };
+export { qualifiedTableName, validateStorage, validateStorageBatch, withStorageValidation };
 
 //# sourceMappingURL=storage-validation.mjs.map

package/dist/internal/storage-validation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"storage-validation.mjs","names":[],"sources":["../../src/internal/storage-validation.ts"],"sourcesContent":["import { Context, Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\n\nimport { PersistenceConfigurationError } from \"./configuration\";\nimport type { StorageTable } from \"./storage-tables\";\nimport { NativeDatabase } from \"./transaction-kernel\";\n\nconst Columns = Schema.Array(Schema.String);\nconst Keys = Schema.Array(Columns);\nconst Metadata = Schema.Struct({ relation: Schema.String, columns: Columns, keys: Keys });\nconst PgMetadata = Schema.Array(Metadata);\n\nconst SqliteMetadata = Schema.Array(\n  Schema.Struct({\n    relation: Schema.String,\n    columns: Schema.fromJsonString(Columns),\n    keys: Schema.fromJsonString(Keys),\n  }),\n);\n\nconst MysqlColumns = Schema.Array(Schema.Struct({ relation: Schema.String, name: Schema.String }));\n\nconst MysqlIndexes = Schema.Array(\n  Schema.Struct({\n    relation: Schema.String,\n    name: Schema.String,\n    columnName: Schema.NullOr(Schema.String),\n    prefix: Schema.NullOr(Schema.Number),\n  }),\n);\n\nconst quote = (value: string) => '\"' + value.replaceAll('\"', '\"\"') + '\"';\n\n/** Physical metadata needed for catalog validation; value codecs remain adapter-owned. */\nexport interface PhysicalStorageTable {\n  readonly name: string;\n  readonly schema?: string;\n  readonly columns: Readonly<Record<string, { readonly name: string }>>;\n}\n\nexport const qualifiedTableName = (table: Pick<StorageTable, \"name\" | \"schema\">) =>\n  (table.schema === undefined ? \"\" : quote(table.schema) + \".\") + quote(table.name);\n\nexport interface PhysicalTextColumn {\n  readonly table: Pick<PhysicalStorageTable, \"name\" | \"schema\">;\n  readonly name: string;\n}\n\nconst TextColumns = Schema.Array(Schema.Struct({ type: Schema.String, collation: Schema.String }));\n\n/** One acquisition-only read: presence/unique-key validation does not establish\n * equality compatibility. SQLite's pragma omits column collations, so only\n * ordinary TEXT tables with no COLLATE declaration qualify (default BINARY). */\nexport const canJoinTextColumns = Effect.fnUntraced(function* (\n  left: PhysicalTextColumn | undefined,\n  right: PhysicalTextColumn | undefined,\n) {\n  if (left === undefined || right === undefined) return false;\n  const { $client } = yield* NativeDatabase;\n  const client = $client.withoutTransforms();\n  const columns = [left, right];\n\n  if (\n    client.onDialectOrElse({ sqlite: () => true, orElse: () => false }) &&\n    columns.some((c) => c.table.schema !== undefined && c.table.schema !== \"main\")\n  )\n    return false;\n\n  const query = client.onDialectOrElse({\n    pg: () => client`\n      select a.atttypid::text as type, a.attcollation::text as collation\n      from (values ${client.join(\", \", false)(columns.map((c) => client`(${qualifiedTableName(c.table)}::text, ${c.name}::text)`))}) requested(relation, name)\n      join pg_attribute a on a.attrelid = to_regclass(requested.relation)\n        and a.attname = requested.name and a.attnum > 0 and not a.attisdropped\n      where a.atttypid in ('text'::regtype, 'varchar'::regtype)`,\n    sqlite: () => client`\n      with requested(relation, name) as (values ${client.join(\", \", false)(columns.map((c) => client`(${c.table.name}, ${c.name})`))})\n      select 'text' as type, 'BINARY' as collation from requested\n      join sqlite_schema s on s.name = requested.relation and s.type = 'table'\n      join pragma_table_info(requested.relation) c on c.name = requested.name\n      where upper(c.type) = 'TEXT' and instr(lower(s.sql), 'collate') = 0`,\n    mysql: () => client`\n      select c.data_type as type, c.collation_name as collation\n      from (${client.join(\" union all \", false)(columns.map((c) => client`select ${c.table.schema ?? null} as schema_name, ${c.table.name} as table_name, ${c.name} as column_name`))}) requested\n      join information_schema.columns c\n        on c.table_schema = coalesce(requested.schema_name, database())\n        and c.table_name = requested.table_name and c.column_name = requested.column_name\n      where c.data_type in ('varchar', 'text', 'tinytext', 'mediumtext', 'longtext')`,\n    orElse: () => Effect.succeed([]),\n  });\n\n  const rows = yield* query.pipe(Effect.flatMap(Schema.decodeUnknownEffect(TextColumns)));\n\n  return (\n    rows.length === 2 &&\n    rows[0]?.type === rows[1]?.type &&\n    rows[0]?.collation === rows[1]?.collation\n  );\n});\n\nconst validateKeys = Effect.fnUntraced(function* (\n  table: PhysicalStorageTable,\n  required: ReadonlyArray<ReadonlyArray<string>>,\n  physicalKeys: ReadonlyArray<ReadonlyArray<string>>,\n) {\n  for (const keys of required) {\n    const columns = keys.map((key) => table.columns[key]?.name);\n\n    if (\n      columns.some((column) => column === undefined) ||\n      !physicalKeys.some(\n        // A stronger key also guarantees the required tuple's uniqueness.\n        (actual) =>\n          actual.length > 0 &&\n          actual.length <= columns.length &&\n          actual.every((column) => columns.includes(column)),\n      )\n    )\n      return yield* PersistenceConfigurationError.make({\n        reason: `Missing unique key on ${table.name} (${keys.join(\", \")})`,\n      });\n  }\n});\n\ninterface MetadataCache {\n  active: boolean;\n  readonly clients: Map<SqlClient, Map<string, typeof Metadata.Type>>;\n}\n\nconst CurrentMetadata = Context.Reference<MetadataCache | undefined>(\n  \"@yielded/auth-persistence/StorageMetadata\",\n  { defaultValue: () => undefined },\n);\n\n/** Share metadata only while constructing one service graph. Captured contexts\n * cannot reuse it after acquisition succeeds, fails, or is interrupted. */\nexport const withStorageValidation = Effect.fnUntraced(function* <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.fn.Return<A, E, R> {\n  const parent = yield* CurrentMetadata;\n\n  if (parent?.active) return yield* effect;\n  const cache: MetadataCache = { active: true, clients: new Map() };\n\n  return yield* effect.pipe(\n    Effect.provideService(CurrentMetadata, cache),\n    Effect.ensuring(\n      Effect.sync(() => {\n        cache.active = false;\n        cache.clients.clear();\n      }),\n    ),\n  );\n});\n\n/** Requirements checked against one physical catalog snapshot. */\nexport interface StorageValidation {\n  readonly table: PhysicalStorageTable;\n  readonly required: ReadonlyArray<ReadonlyArray<string>>;\n}\n\n/** Batch physical metadata reads, reusing only the current acquisition snapshot.\n * Every requirement is still checked; later acquisitions read fresh metadata. */\nexport const validateStorageBatch = Effect.fnUntraced(\n  function* (dialect: \"pg\" | \"mysql\" | \"sqlite\", requirements: ReadonlyArray<StorageValidation>) {\n    if (requirements.length === 0) return;\n    if (\n      dialect === \"sqlite\" &&\n      requirements.some(({ table }) => table.schema !== undefined && table.schema !== \"main\")\n    )\n      return yield* PersistenceConfigurationError.make({\n        reason: \"SQLite storage must belong to the main database\",\n      });\n    const client = yield* SqlClient;\n    const cache = yield* CurrentMetadata;\n\n    const byRelation = cache?.active\n      ? (cache.clients.get(client) ?? new Map<string, typeof Metadata.Type>())\n      : new Map<string, typeof Metadata.Type>();\n\n    if (cache?.active) cache.clients.set(client, byRelation);\n\n    const tables = new Map(requirements.map(({ table }) => [qualifiedTableName(table), table]));\n\n    const missing = [...tables.entries()].filter(\n      ([relation]) => !byRelation.has(`${dialect}:${relation}`),\n    );\n\n    const relations = missing.map(([relation]) => relation);\n\n    if (relations.length > 0) {\n      const metadata = yield* dialect === \"sqlite\"\n        ? Effect.gen(function* () {\n            const requested = client.join(\n              \", \",\n              false,\n            )(missing.map(([relation, table]) => client`(${relation}, ${table.name})`));\n\n            return yield* client`\n          with requested(relation, name) as (values ${requested})\n          select requested.relation,\n            (select json_group_array(name) from pragma_table_info(requested.name)) as columns,\n            (select json_group_array(json(storage_key.columns)) from (\n              select json_group_array(name) as columns from (\n                select name from pragma_table_info(requested.name) where pk > 0 order by pk\n              )\n              union all\n              select (select json_group_array(name) from pragma_index_info(i.name)) as columns\n              from pragma_index_list(requested.name) i\n              where i.\"unique\" = 1 and i.partial = 0\n                and not exists(select 1 from pragma_index_info(i.name) where name is null)\n            ) storage_key where json_array_length(storage_key.columns) > 0) as keys\n          from requested\n        `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(SqliteMetadata)));\n          })\n        : dialect === \"mysql\"\n          ? Effect.gen(function* () {\n              const requested = client.join(\n                \" union all \",\n                false,\n              )(\n                missing.map(\n                  ([relation, table]) =>\n                    client`select ${relation} as relation, ${table.schema ?? null} as schemaName, ${table.name} as tableName`,\n                ),\n              );\n\n              const columns = yield* client`\n          select requested.relation, c.column_name as name\n          from (${requested}) requested join information_schema.columns c\n            on c.table_schema = coalesce(requested.schemaName, database()) and c.table_name = requested.tableName\n        `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(MysqlColumns)));\n\n              const indexes = yield* client`\n          select requested.relation, i.index_name as name, i.column_name as columnName, i.sub_part as prefix\n          from (${requested}) requested join information_schema.statistics i\n            on i.table_schema = coalesce(requested.schemaName, database()) and i.table_name = requested.tableName\n          where i.non_unique = 0 order by requested.relation, i.index_name, i.seq_in_index\n        `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(MysqlIndexes)));\n\n              return relations.map((relation) => {\n                const grouped = new Map<string, Array<(typeof indexes)[number]>>();\n\n                for (const index of indexes) {\n                  if (index.relation !== relation) continue;\n                  const entries = grouped.get(index.name) ?? [];\n\n                  entries.push(index);\n                  grouped.set(index.name, entries);\n                }\n\n                return {\n                  relation,\n                  columns: columns\n                    .filter((column) => column.relation === relation)\n                    .map((column) => column.name),\n                  keys: [...grouped.values()]\n                    .filter((entries) =>\n                      entries.every((entry) => entry.columnName !== null && entry.prefix === null),\n                    )\n                    .map((entries) =>\n                      entries.flatMap((entry) =>\n                        entry.columnName === null ? [] : [entry.columnName],\n                      ),\n                    ),\n                };\n              });\n            })\n          : Effect.gen(function* () {\n              const requested = client.join(\n                \", \",\n                false,\n              )(relations.map((relation) => client`(${relation}::text)`));\n\n              return yield* client`\n      select requested.relation,\n        array(select a.attname::text from pg_attribute a\n          where a.attrelid = to_regclass(requested.relation)\n            and a.attnum > 0 and not a.attisdropped) as columns,\n        coalesce((select jsonb_agg(storage_key.columns) from (\n          select array_agg(a.attname::text order by k.ordinality) as columns\n          from pg_index i\n          cross join lateral unnest(i.indkey) with ordinality as k(attnum, ordinality)\n          join pg_attribute a on a.attrelid = i.indrelid and a.attnum = k.attnum\n          where i.indrelid = to_regclass(requested.relation)\n            and i.indisunique and i.indisvalid and i.indimmediate\n            and i.indpred is null and i.indexprs is null\n            and k.ordinality <= i.indnkeyatts\n          group by i.indexrelid\n        ) storage_key), '[]'::jsonb) as keys\n      from (values ${requested}) requested(relation)\n    `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(PgMetadata)));\n            });\n\n      for (const row of metadata) byRelation.set(`${dialect}:${row.relation}`, row);\n    }\n\n    for (const { table, required } of requirements) {\n      const relation = qualifiedTableName(table);\n      const actual = byRelation.get(`${dialect}:${relation}`);\n\n      for (const column of Object.values(table.columns)) {\n        if (actual === undefined || !actual.columns.includes(column.name))\n          return yield* PersistenceConfigurationError.make({\n            reason: `Missing SQL column ${relation}.${column.name}`,\n          });\n      }\n      yield* validateKeys(table, required, actual?.keys ?? []);\n    }\n  },\n  Effect.mapError((error) =>\n    Schema.is(PersistenceConfigurationError)(error)\n      ? error\n      : PersistenceConfigurationError.make({ reason: \"Cannot validate SQL storage metadata\" }),\n  ),\n);\n\n/** Validate physical columns and unconditional uniqueness before operations run. */\nexport const validateStorage = (\n  dialect: \"pg\" | \"mysql\" | \"sqlite\",\n  table: PhysicalStorageTable,\n  required: ReadonlyArray<ReadonlyArray<string>>,\n) => validateStorageBatch(dialect, [{ table, required }]);\n"],"mappings":";;;;;AAOA,MAAM,UAAU,OAAO,MAAM,OAAO,MAAM;AAC1C,MAAM,OAAO,OAAO,MAAM,OAAO;AACjC,MAAM,WAAW,OAAO,OAAO;CAAE,UAAU,OAAO;CAAQ,SAAS;CAAS,MAAM;AAAK,CAAC;AACxF,MAAM,aAAa,OAAO,MAAM,QAAQ;AAExC,MAAM,iBAAiB,OAAO,MAC5B,OAAO,OAAO;CACZ,UAAU,OAAO;CACjB,SAAS,OAAO,eAAe,OAAO;CACtC,MAAM,OAAO,eAAe,IAAI;AAClC,CAAC,CACH;AAEA,MAAM,eAAe,OAAO,MAAM,OAAO,OAAO;CAAE,UAAU,OAAO;CAAQ,MAAM,OAAO;AAAO,CAAC,CAAC;AAEjG,MAAM,eAAe,OAAO,MAC1B,OAAO,OAAO;CACZ,UAAU,OAAO;CACjB,MAAM,OAAO;CACb,YAAY,OAAO,OAAO,OAAO,MAAM;CACvC,QAAQ,OAAO,OAAO,OAAO,MAAM;AACrC,CAAC,CACH;AAEA,MAAM,SAAS,UAAkB,OAAM,MAAM,WAAW,MAAK,MAAI,IAAI;AASrE,MAAa,sBAAsB,WAChC,MAAM,WAAW,KAAA,IAAY,KAAK,MAAM,MAAM,MAAM,IAAI,OAAO,MAAM,MAAM,IAAI;AAOlF,MAAM,cAAc,OAAO,MAAM,OAAO,OAAO;CAAE,MAAM,OAAO;CAAQ,WAAW,OAAO;AAAO,CAAC,CAAC;;;;AAKjG,MAAa,qBAAqB,OAAO,WAAW,WAClD,MACA,OACA;CACA,IAAI,SAAS,KAAA,KAAa,UAAU,KAAA,GAAW,OAAO;CACtD,MAAM,EAAE,YAAY,OAAO;CAC3B,MAAM,SAAS,QAAQ,kBAAkB;CACzC,MAAM,UAAU,CAAC,MAAM,KAAK;CAE5B,IACE,OAAO,gBAAgB;EAAE,cAAc;EAAM,cAAc;CAAM,CAAC,KAClE,QAAQ,MAAM,MAAM,EAAE,MAAM,WAAW,KAAA,KAAa,EAAE,MAAM,WAAW,MAAM,GAE7E,OAAO;CAyBT,MAAM,OAAO,OAvBC,OAAO,gBAAgB;EACnC,UAAU,MAAM;;qBAEC,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,QAAQ,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,QAAQ,CAAC,EAAE;;;;EAI/H,cAAc,MAAM;kDAC0B,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,QAAQ,KAAK,MAAM,MAAM,IAAI,EAAE,MAAM,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE;;;;;EAKjI,aAAa,MAAM;;cAET,OAAO,KAAK,eAAe,KAAK,CAAC,CAAC,QAAQ,KAAK,MAAM,MAAM,UAAU,EAAE,MAAM,UAAU,KAAK,mBAAmB,EAAE,MAAM,KAAK,kBAAkB,EAAE,KAAK,gBAAgB,CAAC,EAAE;;;;;EAKlL,cAAc,OAAO,QAAQ,CAAC,CAAC;CACjC,CAEwB,CAAC,CAAC,KAAK,OAAO,QAAQ,OAAO,oBAAoB,WAAW,CAAC,CAAC;CAEtF,OACE,KAAK,WAAW,KAChB,KAAK,EAAE,EAAE,SAAS,KAAK,EAAE,EAAE,QAC3B,KAAK,EAAE,EAAE,cAAc,KAAK,EAAE,EAAE;AAEpC,CAAC;AAED,MAAM,eAAe,OAAO,WAAW,WACrC,OACA,UACA,cACA;CACA,KAAK,MAAM,QAAQ,UAAU;EAC3B,MAAM,UAAU,KAAK,KAAK,QAAQ,MAAM,QAAQ,IAAI,EAAE,IAAI;EAE1D,IACE,QAAQ,MAAM,WAAW,WAAW,KAAA,CAAS,KAC7C,CAAC,aAAa,MAEX,WACC,OAAO,SAAS,KAChB,OAAO,UAAU,QAAQ,UACzB,OAAO,OAAO,WAAW,QAAQ,SAAS,MAAM,CAAC,CACrD,GAEA,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,yBAAyB,MAAM,KAAK,IAAI,KAAK,KAAK,IAAI,EAAE,GAClE,CAAC;CACL;AACF,CAAC;AAOD,MAAM,kBAAkB,QAAQ,UAC9B,6CACA,EAAE,oBAAoB,KAAA,EAAU,CAClC;;;AAIA,MAAa,wBAAwB,OAAO,WAAW,WACrD,QAC2B;CAG3B,KAAI,OAFkB,gBAAA,EAEV,QAAQ,OAAO,OAAO;CAClC,MAAM,QAAuB;EAAE,QAAQ;EAAM,yBAAS,IAAI,IAAI;CAAE;CAEhE,OAAO,OAAO,OAAO,KACnB,OAAO,eAAe,iBAAiB,KAAK,GAC5C,OAAO,SACL,OAAO,WAAW;EAChB,MAAM,SAAS;EACf,MAAM,QAAQ,MAAM;CACtB,CAAC,CACH,CACF;AACF,CAAC;;;AAUD,MAAa,uBAAuB,OAAO,WACzC,WAAW,SAAoC,cAAgD;CAC7F,IAAI,aAAa,WAAW,GAAG;CAC/B,IACE,YAAY,YACZ,aAAa,MAAM,EAAE,YAAY,MAAM,WAAW,KAAA,KAAa,MAAM,WAAW,MAAM,GAEtF,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,kDACV,CAAC;CACH,MAAM,SAAS,OAAO;CACtB,MAAM,QAAQ,OAAO;CAErB,MAAM,aAAa,OAAO,SACrB,MAAM,QAAQ,IAAI,MAAM,qBAAK,IAAI,IAAkC,oBACpE,IAAI,IAAkC;CAE1C,IAAI,OAAO,QAAQ,MAAM,QAAQ,IAAI,QAAQ,UAAU;CAIvD,MAAM,UAAU,CAAC,GAAG,IAFD,IAAI,aAAa,KAAK,EAAE,YAAY,CAAC,mBAAmB,KAAK,GAAG,KAAK,CAAC,CAEhE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QACnC,CAAC,cAAc,CAAC,WAAW,IAAI,GAAG,QAAQ,GAAG,UAAU,CAC1D;CAEA,MAAM,YAAY,QAAQ,KAAK,CAAC,cAAc,QAAQ;CAEtD,IAAI,UAAU,SAAS,GAAG;EACxB,MAAM,WAAW,OAAO,YAAY,WAChC,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,KACvB,MACA,KACF,CAAC,CAAC,QAAQ,KAAK,CAAC,UAAU,WAAW,MAAM,IAAI,SAAS,IAAI,MAAM,KAAK,EAAE,CAAC;GAE1E,OAAO,OAAO,MAAM;sDACsB,UAAU;;;;;;;;;;;;;;UActD,KAAK,OAAO,QAAQ,OAAO,oBAAoB,cAAc,CAAC,CAAC;EAC/D,CAAC,IACD,YAAY,UACV,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,KACvB,eACA,KACF,CAAC,CACC,QAAQ,KACL,CAAC,UAAU,WACV,MAAM,UAAU,SAAS,gBAAgB,MAAM,UAAU,KAAK,kBAAkB,MAAM,KAAK,cAC/F,CACF;GAEA,MAAM,UAAU,OAAO,MAAM;;kBAEzB,UAAU;;UAElB,KAAK,OAAO,QAAQ,OAAO,oBAAoB,YAAY,CAAC,CAAC;GAEzD,MAAM,UAAU,OAAO,MAAM;;kBAEzB,UAAU;;;UAGlB,KAAK,OAAO,QAAQ,OAAO,oBAAoB,YAAY,CAAC,CAAC;GAEzD,OAAO,UAAU,KAAK,aAAa;IACjC,MAAM,0BAAU,IAAI,IAA6C;IAEjE,KAAK,MAAM,SAAS,SAAS;KAC3B,IAAI,MAAM,aAAa,UAAU;KACjC,MAAM,UAAU,QAAQ,IAAI,MAAM,IAAI,KAAK,CAAC;KAE5C,QAAQ,KAAK,KAAK;KAClB,QAAQ,IAAI,MAAM,MAAM,OAAO;IACjC;IAEA,OAAO;KACL;KACA,SAAS,QACN,QAAQ,WAAW,OAAO,aAAa,QAAQ,CAAC,CAChD,KAAK,WAAW,OAAO,IAAI;KAC9B,MAAM,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CACxB,QAAQ,YACP,QAAQ,OAAO,UAAU,MAAM,eAAe,QAAQ,MAAM,WAAW,IAAI,CAC7E,CAAC,CACA,KAAK,YACJ,QAAQ,SAAS,UACf,MAAM,eAAe,OAAO,CAAC,IAAI,CAAC,MAAM,UAAU,CACpD,CACF;IACJ;GACF,CAAC;EACH,CAAC,IACD,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,KACvB,MACA,KACF,CAAC,CAAC,UAAU,KAAK,aAAa,MAAM,IAAI,SAAS,QAAQ,CAAC;GAE1D,OAAO,OAAO,MAAM;;;;;;;;;;;;;;;;qBAgBb,UAAU;MACzB,KAAK,OAAO,QAAQ,OAAO,oBAAoB,UAAU,CAAC,CAAC;EACrD,CAAC;EAEP,KAAK,MAAM,OAAO,UAAU,WAAW,IAAI,GAAG,QAAQ,GAAG,IAAI,YAAY,GAAG;CAC9E;CAEA,KAAK,MAAM,EAAE,OAAO,cAAc,cAAc;EAC9C,MAAM,WAAW,mBAAmB,KAAK;EACzC,MAAM,SAAS,WAAW,IAAI,GAAG,QAAQ,GAAG,UAAU;EAEtD,KAAK,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,GAC9C,IAAI,WAAW,KAAA,KAAa,CAAC,OAAO,QAAQ,SAAS,OAAO,IAAI,GAC9D,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,sBAAsB,SAAS,GAAG,OAAO,OACnD,CAAC;EAEL,OAAO,aAAa,OAAO,UAAU,QAAQ,QAAQ,CAAC,CAAC;CACzD;AACF,GACA,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,8BAA8B,KAAK,EAAE,QAAQ,uCAAuC,CAAC,CAC3F,CACF;;AAGA,MAAa,mBACX,SACA,OACA,aACG,qBAAqB,SAAS,CAAC;CAAE;CAAO;AAAS,CAAC,CAAC"}
+{"version":3,"file":"storage-validation.mjs","names":[],"sources":["../../src/internal/storage-validation.ts"],"sourcesContent":["import { Context, Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql/SqlClient\";\n\nimport { PersistenceConfigurationError } from \"./configuration\";\nimport type { StorageTable } from \"./storage-tables\";\n\nconst Columns = Schema.Array(Schema.String);\nconst Keys = Schema.Array(Columns);\nconst Metadata = Schema.Struct({ relation: Schema.String, columns: Columns, keys: Keys });\nconst PgMetadata = Schema.Array(Metadata);\n\nconst SqliteMetadata = Schema.Array(\n  Schema.Struct({\n    relation: Schema.String,\n    columns: Schema.fromJsonString(Columns),\n    keys: Schema.fromJsonString(Keys),\n  }),\n);\n\nconst MysqlColumns = Schema.Array(Schema.Struct({ relation: Schema.String, name: Schema.String }));\n\nconst MysqlIndexes = Schema.Array(\n  Schema.Struct({\n    relation: Schema.String,\n    name: Schema.String,\n    columnName: Schema.NullOr(Schema.String),\n    prefix: Schema.NullOr(Schema.Number),\n  }),\n);\n\nconst quote = (value: string) => '\"' + value.replaceAll('\"', '\"\"') + '\"';\n\n/** Physical metadata needed for catalog validation; value codecs remain adapter-owned. */\nexport interface PhysicalStorageTable {\n  readonly name: string;\n  readonly schema?: string;\n  readonly columns: Readonly<Record<string, { readonly name: string }>>;\n}\n\nexport const qualifiedTableName = (table: Pick<StorageTable, \"name\" | \"schema\">) =>\n  (table.schema === undefined ? \"\" : quote(table.schema) + \".\") + quote(table.name);\n\nconst validateKeys = Effect.fnUntraced(function* (\n  table: PhysicalStorageTable,\n  required: ReadonlyArray<ReadonlyArray<string>>,\n  physicalKeys: ReadonlyArray<ReadonlyArray<string>>,\n) {\n  for (const keys of required) {\n    const columns = keys.map((key) => table.columns[key]?.name);\n\n    if (\n      columns.some((column) => column === undefined) ||\n      !physicalKeys.some(\n        // A stronger key also guarantees the required tuple's uniqueness.\n        (actual) =>\n          actual.length > 0 &&\n          actual.length <= columns.length &&\n          actual.every((column) => columns.includes(column)),\n      )\n    )\n      return yield* PersistenceConfigurationError.make({\n        reason: `Missing unique key on ${table.name} (${keys.join(\", \")})`,\n      });\n  }\n});\n\ninterface MetadataCache {\n  active: boolean;\n  readonly clients: Map<SqlClient, Map<string, typeof Metadata.Type>>;\n}\n\nconst CurrentMetadata = Context.Reference<MetadataCache | undefined>(\n  \"@yielded/auth-persistence/StorageMetadata\",\n  { defaultValue: () => undefined },\n);\n\n/** Share metadata only while constructing one service graph. Captured contexts\n * cannot reuse it after acquisition succeeds, fails, or is interrupted. */\nexport const withStorageValidation = Effect.fnUntraced(function* <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.fn.Return<A, E, R> {\n  const parent = yield* CurrentMetadata;\n\n  if (parent?.active) return yield* effect;\n  const cache: MetadataCache = { active: true, clients: new Map() };\n\n  return yield* effect.pipe(\n    Effect.provideService(CurrentMetadata, cache),\n    Effect.ensuring(\n      Effect.sync(() => {\n        cache.active = false;\n        cache.clients.clear();\n      }),\n    ),\n  );\n});\n\n/** Requirements checked against one physical catalog snapshot. */\nexport interface StorageValidation {\n  readonly table: PhysicalStorageTable;\n  readonly required: ReadonlyArray<ReadonlyArray<string>>;\n}\n\n/** Batch physical metadata reads, reusing only the current acquisition snapshot.\n * Every requirement is still checked; later acquisitions read fresh metadata. */\nexport const validateStorageBatch = Effect.fnUntraced(\n  function* (dialect: \"pg\" | \"mysql\" | \"sqlite\", requirements: ReadonlyArray<StorageValidation>) {\n    if (requirements.length === 0) return;\n    if (\n      dialect === \"sqlite\" &&\n      requirements.some(({ table }) => table.schema !== undefined && table.schema !== \"main\")\n    )\n      return yield* PersistenceConfigurationError.make({\n        reason: \"SQLite storage must belong to the main database\",\n      });\n    const client = yield* SqlClient;\n    const cache = yield* CurrentMetadata;\n\n    const byRelation = cache?.active\n      ? (cache.clients.get(client) ?? new Map<string, typeof Metadata.Type>())\n      : new Map<string, typeof Metadata.Type>();\n\n    if (cache?.active) cache.clients.set(client, byRelation);\n\n    const tables = new Map(requirements.map(({ table }) => [qualifiedTableName(table), table]));\n\n    const missing = [...tables.entries()].filter(\n      ([relation]) => !byRelation.has(`${dialect}:${relation}`),\n    );\n\n    const relations = missing.map(([relation]) => relation);\n\n    if (relations.length > 0) {\n      const metadata = yield* dialect === \"sqlite\"\n        ? Effect.gen(function* () {\n            const requested = client.join(\n              \", \",\n              false,\n            )(missing.map(([relation, table]) => client`(${relation}, ${table.name})`));\n\n            return yield* client`\n          with requested(relation, name) as (values ${requested})\n          select requested.relation,\n            (select json_group_array(name) from pragma_table_info(requested.name)) as columns,\n            (select json_group_array(json(storage_key.columns)) from (\n              select json_group_array(name) as columns from (\n                select name from pragma_table_info(requested.name) where pk > 0 order by pk\n              )\n              union all\n              select (select json_group_array(name) from pragma_index_info(i.name)) as columns\n              from pragma_index_list(requested.name) i\n              where i.\"unique\" = 1 and i.partial = 0\n                and not exists(select 1 from pragma_index_info(i.name) where name is null)\n            ) storage_key where json_array_length(storage_key.columns) > 0) as keys\n          from requested\n        `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(SqliteMetadata)));\n          })\n        : dialect === \"mysql\"\n          ? Effect.gen(function* () {\n              const requested = client.join(\n                \" union all \",\n                false,\n              )(\n                missing.map(\n                  ([relation, table]) =>\n                    client`select ${relation} as relation, ${table.schema ?? null} as schemaName, ${table.name} as tableName`,\n                ),\n              );\n\n              const columns = yield* client`\n          select requested.relation, c.column_name as name\n          from (${requested}) requested join information_schema.columns c\n            on c.table_schema = coalesce(requested.schemaName, database()) and c.table_name = requested.tableName\n        `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(MysqlColumns)));\n\n              const indexes = yield* client`\n          select requested.relation, i.index_name as name, i.column_name as columnName, i.sub_part as prefix\n          from (${requested}) requested join information_schema.statistics i\n            on i.table_schema = coalesce(requested.schemaName, database()) and i.table_name = requested.tableName\n          where i.non_unique = 0 order by requested.relation, i.index_name, i.seq_in_index\n        `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(MysqlIndexes)));\n\n              return relations.map((relation) => {\n                const grouped = new Map<string, Array<(typeof indexes)[number]>>();\n\n                for (const index of indexes) {\n                  if (index.relation !== relation) continue;\n                  const entries = grouped.get(index.name) ?? [];\n\n                  entries.push(index);\n                  grouped.set(index.name, entries);\n                }\n\n                return {\n                  relation,\n                  columns: columns\n                    .filter((column) => column.relation === relation)\n                    .map((column) => column.name),\n                  keys: [...grouped.values()]\n                    .filter((entries) =>\n                      entries.every((entry) => entry.columnName !== null && entry.prefix === null),\n                    )\n                    .map((entries) =>\n                      entries.flatMap((entry) =>\n                        entry.columnName === null ? [] : [entry.columnName],\n                      ),\n                    ),\n                };\n              });\n            })\n          : Effect.gen(function* () {\n              const requested = client.join(\n                \", \",\n                false,\n              )(relations.map((relation) => client`(${relation}::text)`));\n\n              return yield* client`\n      select requested.relation,\n        array(select a.attname::text from pg_attribute a\n          where a.attrelid = to_regclass(requested.relation)\n            and a.attnum > 0 and not a.attisdropped) as columns,\n        coalesce((select jsonb_agg(storage_key.columns) from (\n          select array_agg(a.attname::text order by k.ordinality) as columns\n          from pg_index i\n          cross join lateral unnest(i.indkey) with ordinality as k(attnum, ordinality)\n          join pg_attribute a on a.attrelid = i.indrelid and a.attnum = k.attnum\n          where i.indrelid = to_regclass(requested.relation)\n            and i.indisunique and i.indisvalid and i.indimmediate\n            and i.indpred is null and i.indexprs is null\n            and k.ordinality <= i.indnkeyatts\n          group by i.indexrelid\n        ) storage_key), '[]'::jsonb) as keys\n      from (values ${requested}) requested(relation)\n    `.pipe(Effect.flatMap(Schema.decodeUnknownEffect(PgMetadata)));\n            });\n\n      for (const row of metadata) byRelation.set(`${dialect}:${row.relation}`, row);\n    }\n\n    for (const { table, required } of requirements) {\n      const relation = qualifiedTableName(table);\n      const actual = byRelation.get(`${dialect}:${relation}`);\n\n      for (const column of Object.values(table.columns)) {\n        if (actual === undefined || !actual.columns.includes(column.name))\n          return yield* PersistenceConfigurationError.make({\n            reason: `Missing SQL column ${relation}.${column.name}`,\n          });\n      }\n      yield* validateKeys(table, required, actual?.keys ?? []);\n    }\n  },\n  Effect.mapError((error) =>\n    Schema.is(PersistenceConfigurationError)(error)\n      ? error\n      : PersistenceConfigurationError.make({ reason: \"Cannot validate SQL storage metadata\" }),\n  ),\n);\n\n/** Validate physical columns and unconditional uniqueness before operations run. */\nexport const validateStorage = (\n  dialect: \"pg\" | \"mysql\" | \"sqlite\",\n  table: PhysicalStorageTable,\n  required: ReadonlyArray<ReadonlyArray<string>>,\n) => validateStorageBatch(dialect, [{ table, required }]);\n"],"mappings":";;;;AAMA,MAAM,UAAU,OAAO,MAAM,OAAO,MAAM;AAC1C,MAAM,OAAO,OAAO,MAAM,OAAO;AACjC,MAAM,WAAW,OAAO,OAAO;CAAE,UAAU,OAAO;CAAQ,SAAS;CAAS,MAAM;AAAK,CAAC;AACxF,MAAM,aAAa,OAAO,MAAM,QAAQ;AAExC,MAAM,iBAAiB,OAAO,MAC5B,OAAO,OAAO;CACZ,UAAU,OAAO;CACjB,SAAS,OAAO,eAAe,OAAO;CACtC,MAAM,OAAO,eAAe,IAAI;AAClC,CAAC,CACH;AAEA,MAAM,eAAe,OAAO,MAAM,OAAO,OAAO;CAAE,UAAU,OAAO;CAAQ,MAAM,OAAO;AAAO,CAAC,CAAC;AAEjG,MAAM,eAAe,OAAO,MAC1B,OAAO,OAAO;CACZ,UAAU,OAAO;CACjB,MAAM,OAAO;CACb,YAAY,OAAO,OAAO,OAAO,MAAM;CACvC,QAAQ,OAAO,OAAO,OAAO,MAAM;AACrC,CAAC,CACH;AAEA,MAAM,SAAS,UAAkB,OAAM,MAAM,WAAW,MAAK,MAAI,IAAI;AASrE,MAAa,sBAAsB,WAChC,MAAM,WAAW,KAAA,IAAY,KAAK,MAAM,MAAM,MAAM,IAAI,OAAO,MAAM,MAAM,IAAI;AAElF,MAAM,eAAe,OAAO,WAAW,WACrC,OACA,UACA,cACA;CACA,KAAK,MAAM,QAAQ,UAAU;EAC3B,MAAM,UAAU,KAAK,KAAK,QAAQ,MAAM,QAAQ,IAAI,EAAE,IAAI;EAE1D,IACE,QAAQ,MAAM,WAAW,WAAW,KAAA,CAAS,KAC7C,CAAC,aAAa,MAEX,WACC,OAAO,SAAS,KAChB,OAAO,UAAU,QAAQ,UACzB,OAAO,OAAO,WAAW,QAAQ,SAAS,MAAM,CAAC,CACrD,GAEA,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,yBAAyB,MAAM,KAAK,IAAI,KAAK,KAAK,IAAI,EAAE,GAClE,CAAC;CACL;AACF,CAAC;AAOD,MAAM,kBAAkB,QAAQ,UAC9B,6CACA,EAAE,oBAAoB,KAAA,EAAU,CAClC;;;AAIA,MAAa,wBAAwB,OAAO,WAAW,WACrD,QAC2B;CAG3B,KAAI,OAFkB,gBAAA,EAEV,QAAQ,OAAO,OAAO;CAClC,MAAM,QAAuB;EAAE,QAAQ;EAAM,yBAAS,IAAI,IAAI;CAAE;CAEhE,OAAO,OAAO,OAAO,KACnB,OAAO,eAAe,iBAAiB,KAAK,GAC5C,OAAO,SACL,OAAO,WAAW;EAChB,MAAM,SAAS;EACf,MAAM,QAAQ,MAAM;CACtB,CAAC,CACH,CACF;AACF,CAAC;;;AAUD,MAAa,uBAAuB,OAAO,WACzC,WAAW,SAAoC,cAAgD;CAC7F,IAAI,aAAa,WAAW,GAAG;CAC/B,IACE,YAAY,YACZ,aAAa,MAAM,EAAE,YAAY,MAAM,WAAW,KAAA,KAAa,MAAM,WAAW,MAAM,GAEtF,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,kDACV,CAAC;CACH,MAAM,SAAS,OAAO;CACtB,MAAM,QAAQ,OAAO;CAErB,MAAM,aAAa,OAAO,SACrB,MAAM,QAAQ,IAAI,MAAM,qBAAK,IAAI,IAAkC,oBACpE,IAAI,IAAkC;CAE1C,IAAI,OAAO,QAAQ,MAAM,QAAQ,IAAI,QAAQ,UAAU;CAIvD,MAAM,UAAU,CAAC,GAAG,IAFD,IAAI,aAAa,KAAK,EAAE,YAAY,CAAC,mBAAmB,KAAK,GAAG,KAAK,CAAC,CAEhE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QACnC,CAAC,cAAc,CAAC,WAAW,IAAI,GAAG,QAAQ,GAAG,UAAU,CAC1D;CAEA,MAAM,YAAY,QAAQ,KAAK,CAAC,cAAc,QAAQ;CAEtD,IAAI,UAAU,SAAS,GAAG;EACxB,MAAM,WAAW,OAAO,YAAY,WAChC,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,KACvB,MACA,KACF,CAAC,CAAC,QAAQ,KAAK,CAAC,UAAU,WAAW,MAAM,IAAI,SAAS,IAAI,MAAM,KAAK,EAAE,CAAC;GAE1E,OAAO,OAAO,MAAM;sDACsB,UAAU;;;;;;;;;;;;;;UActD,KAAK,OAAO,QAAQ,OAAO,oBAAoB,cAAc,CAAC,CAAC;EAC/D,CAAC,IACD,YAAY,UACV,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,KACvB,eACA,KACF,CAAC,CACC,QAAQ,KACL,CAAC,UAAU,WACV,MAAM,UAAU,SAAS,gBAAgB,MAAM,UAAU,KAAK,kBAAkB,MAAM,KAAK,cAC/F,CACF;GAEA,MAAM,UAAU,OAAO,MAAM;;kBAEzB,UAAU;;UAElB,KAAK,OAAO,QAAQ,OAAO,oBAAoB,YAAY,CAAC,CAAC;GAEzD,MAAM,UAAU,OAAO,MAAM;;kBAEzB,UAAU;;;UAGlB,KAAK,OAAO,QAAQ,OAAO,oBAAoB,YAAY,CAAC,CAAC;GAEzD,OAAO,UAAU,KAAK,aAAa;IACjC,MAAM,0BAAU,IAAI,IAA6C;IAEjE,KAAK,MAAM,SAAS,SAAS;KAC3B,IAAI,MAAM,aAAa,UAAU;KACjC,MAAM,UAAU,QAAQ,IAAI,MAAM,IAAI,KAAK,CAAC;KAE5C,QAAQ,KAAK,KAAK;KAClB,QAAQ,IAAI,MAAM,MAAM,OAAO;IACjC;IAEA,OAAO;KACL;KACA,SAAS,QACN,QAAQ,WAAW,OAAO,aAAa,QAAQ,CAAC,CAChD,KAAK,WAAW,OAAO,IAAI;KAC9B,MAAM,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CACxB,QAAQ,YACP,QAAQ,OAAO,UAAU,MAAM,eAAe,QAAQ,MAAM,WAAW,IAAI,CAC7E,CAAC,CACA,KAAK,YACJ,QAAQ,SAAS,UACf,MAAM,eAAe,OAAO,CAAC,IAAI,CAAC,MAAM,UAAU,CACpD,CACF;IACJ;GACF,CAAC;EACH,CAAC,IACD,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,KACvB,MACA,KACF,CAAC,CAAC,UAAU,KAAK,aAAa,MAAM,IAAI,SAAS,QAAQ,CAAC;GAE1D,OAAO,OAAO,MAAM;;;;;;;;;;;;;;;;qBAgBb,UAAU;MACzB,KAAK,OAAO,QAAQ,OAAO,oBAAoB,UAAU,CAAC,CAAC;EACrD,CAAC;EAEP,KAAK,MAAM,OAAO,UAAU,WAAW,IAAI,GAAG,QAAQ,GAAG,IAAI,YAAY,GAAG;CAC9E;CAEA,KAAK,MAAM,EAAE,OAAO,cAAc,cAAc;EAC9C,MAAM,WAAW,mBAAmB,KAAK;EACzC,MAAM,SAAS,WAAW,IAAI,GAAG,QAAQ,GAAG,UAAU;EAEtD,KAAK,MAAM,UAAU,OAAO,OAAO,MAAM,OAAO,GAC9C,IAAI,WAAW,KAAA,KAAa,CAAC,OAAO,QAAQ,SAAS,OAAO,IAAI,GAC9D,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,sBAAsB,SAAS,GAAG,OAAO,OACnD,CAAC;EAEL,OAAO,aAAa,OAAO,UAAU,QAAQ,QAAQ,CAAC,CAAC;CACzD;AACF,GACA,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,8BAA8B,KAAK,EAAE,QAAQ,uCAAuC,CAAC,CAC3F,CACF;;AAGA,MAAa,mBACX,SACA,OACA,aACG,qBAAqB,SAAS,CAAC;CAAE;CAAO;AAAS,CAAC,CAAC"}

package/dist/internal/table-model.d.mts

@@ -0,0 +1,21 @@
+import { SqlExpression as SqlExpression$1 } from "./sql-expression.mjs";
+import { Fragment } from "effect/sql/Statement";
+//#region src/internal/table-model.d.ts
+/** Adapter-owned table metadata. No driver or ORM type enters the shared models. */
+export interface TableModel {
+  readonly table: object;
+  readonly column: string;
+  readonly select: Record<string, unknown>;
+  readonly insert: Record<string, unknown>;
+}
+/** The owning adapter validates the physical table metadata; domain values
+ * remain subject to the mapping codecs. */
+export interface AnyTableModel extends TableModel {
+  readonly table: any;
+}
+/** Opaque native SQL expression for explicit adapter mappings. */
+export type SqlExpression = Fragment | SqlExpression$1 | {
+  readonly getSQL: () => SqlExpression;
+};
+//#endregion
+//# sourceMappingURL=table-model.d.mts.map

package/dist/internal/totp-native.d.mts

@@ -0,0 +1,15 @@
+import { AnyTableModel } from "./table-model.mjs";
+import { NativeSqlTables } from "./native-sql-table.mjs";
+import { SqlBatchCommit } from "./sql-commit.mjs";
+import { TotpMapping } from "./models/totp-model.mjs";
+import { Crypto, Effect } from "effect";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { SqlClient } from "effect/sql/SqlClient";
+import { TotpPersistence } from "@yielded/auth/Totp";
+//#region src/internal/totp-native.d.ts
+export type NativeTotpMapping = TotpMapping<AnyTableModel, AnyTableModel, AnyTableModel, unknown, AnyTableModel>;
+export declare const makeNativeTotpServices: (tables: NativeSqlTables, mapping: NativeTotpMapping) => Effect.Effect<{
+  readonly totpPersistence: TotpPersistence["Service"];
+}, never, Crypto.Crypto | LifecycleHooks | SqlBatchCommit | SqlClient>;
+//#endregion
+//# sourceMappingURL=totp-native.d.mts.map