@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/src/internal/models/password-model.ts

@@ -1,16 +1,16 @@
-import { type RecoveryReference, type LoginIdentifier } from "@yielded/auth/Identity";
+import { type LoginIdentifier } from "@yielded/auth/Identity";
 import type {
   PasswordAction,
   PasswordCredentialSnapshot,
   PasswordReplacement,
-  PasswordRegistrationDecision,
   EncodedPasswordHash,
 } from "@yielded/auth/Password";
 import type { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
 import type { Effect, Redacted } from "effect";
 
-import type { AnyTableModel, TableModel as Table, SqlExpression } from "../query-operations";
+import type { AnyTableModel, TableModel as Table, SqlExpression } from "../table-model";
 import type { PersistenceMappingError, SubjectIdCodec } from "./common";
+import type { ProofClock } from "./proof-model";
 
 type ColumnKey<T extends Table> = T["column"];
 
@@ -116,30 +116,11 @@ export interface PasswordCredentialTable<
   }) => Effect.Effect<PasswordCredentialSnapshot, PersistenceMappingError>;
 }
 
-export interface PasswordCommandTable<Command extends Table> {
-  readonly table: Command["table"];
-  readonly moduleId: ColumnKey<Command>;
-  readonly commandId: ColumnKey<Command>;
-  readonly action: ColumnKey<Command>;
-  readonly bindingDigest: ColumnKey<Command>;
-  readonly decision: ColumnKey<Command>;
-  readonly retentionUntil: ColumnKey<Command>;
-  readonly encodeInsert: (input: {
-    readonly moduleId: string;
-    readonly commandId: string;
-    readonly action: string;
-    readonly bindingDigest: string;
-    readonly decision: "changed";
-    readonly retentionUntilMillis: number;
-  }) => Command["insert"];
-}
-
 export interface RequiredPasswordConstraints {
   readonly identifier: "unique(identifier.namespace,identifier.value)";
   readonly authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)";
   readonly credentialSubject: "unique(credential.moduleId,credential.subjectId)";
   readonly credentialId: "unique(credential.moduleId,credential.credentialId)";
-  readonly command: "unique(command.moduleId,command.commandId)";
 }
 
 export const requiredPasswordConstraints: RequiredPasswordConstraints = {
@@ -147,30 +128,16 @@ export const requiredPasswordConstraints: RequiredPasswordConstraints = {
   authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)",
   credentialSubject: "unique(credential.moduleId,credential.subjectId)",
   credentialId: "unique(credential.moduleId,credential.credentialId)",
-  command: "unique(command.moduleId,command.commandId)",
 };
 
-export interface PasswordConstraintClassifier {
-  /** Match only the mapped command uniqueness constraint. */
-  readonly isCommandConflict: (cause: unknown) => boolean;
-}
-
-export interface PasswordD1Clock<Expression extends SqlExpression = SqlExpression> {
-  readonly engineNow: Expression;
-  readonly engineNowMillis: Expression;
-  readonly engineInstantMinus: (millis: number) => Expression;
-  readonly engineInstantPlus: (millis: number) => Expression;
-}
-
 export interface PasswordPersistenceMapping<
   Subject extends Table,
   Identifier extends Table,
   Credential extends Table,
   AuthorityCredential extends Table,
-  Command extends Table,
   NativeSubjectId,
   Expression extends SqlExpression = SqlExpression,
-> extends PasswordConstraintClassifier {
+> {
   readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;
   readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression>;
   readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;
@@ -179,7 +146,6 @@ export interface PasswordPersistenceMapping<
     AuthorityCredential,
     NativeSubjectId
   >;
-  readonly command: PasswordCommandTable<Command>;
   readonly subjectId: SubjectIdCodec<NativeSubjectId>;
   readonly constraints: RequiredPasswordConstraints;
   readonly encodeInstant: (epochMillis: number) => unknown;
@@ -188,50 +154,13 @@ export interface PasswordPersistenceMapping<
   readonly allocateCredentialIdSync?: () => string;
   readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
   readonly allocateRevisionSync?: () => SecurityRevision;
-  readonly commandRetentionMillis: number;
   /** All semantic replacements still bump subject revision. This flag declares
    * authoritative verification's invalidation latency; cookie exposure is separate. */
   readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
-  readonly d1?: PasswordD1Clock<Expression>;
+  readonly clock: ProofClock<Expression>;
+  readonly d1?: { readonly primary: true };
 }
 
-export type D1PasswordPersistenceMapping<
-  Subject extends Table,
-  Identifier extends Table,
-  Credential extends Table,
-  AuthorityCredential extends Table,
-  Command extends Table,
-  NativeSubjectId,
-  Expression extends SqlExpression = SqlExpression,
-> = PasswordPersistenceMapping<
-  Subject,
-  Identifier,
-  Credential,
-  AuthorityCredential,
-  Command,
-  NativeSubjectId,
-  Expression
-> & {
-  readonly d1: PasswordD1Clock<Expression>;
-  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId> & {
-    readonly d1ActiveStatusValue: unknown;
-  };
-  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId, Expression> & {
-    readonly d1CurrentCondition: (input: {
-      readonly identifier: LoginIdentifier;
-      readonly nativeSubjectId: NativeSubjectId;
-    }) => Expression;
-  };
-  readonly authorityCredential: PasswordAuthorityCredentialTable<
-    AuthorityCredential,
-    NativeSubjectId
-  > & {
-    readonly d1ActiveStatusValue: unknown;
-  };
-};
-
-export type PasswordRegistrationState = "pending" | "created";
-
 export interface PasswordRegistrationIntent<Registration> {
   readonly moduleId: string;
   readonly requestId: string;
@@ -240,33 +169,6 @@ export interface PasswordRegistrationIntent<Registration> {
   readonly replacement: PasswordReplacement;
 }
 
-export interface PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> {
-  readonly table: Request["table"];
-  readonly moduleId: ColumnKey<Request>;
-  readonly requestId: ColumnKey<Request>;
-  readonly state: ColumnKey<Request>;
-  readonly subjectId: ColumnKey<Request>;
-  readonly recoveryReference: ColumnKey<Request>;
-  readonly encodeInsert: (
-    input: PasswordRegistrationIntent<Registration>,
-    state: {
-      readonly state: PasswordRegistrationState;
-      readonly nativeSubjectId?: NativeSubjectId;
-      readonly recoveryReference?: typeof RecoveryReference.Type;
-    },
-  ) => Request["insert"];
-  /** Replay projection must never expose a stored subject or decode protected intent. */
-  readonly decodeReplay: (row: Request["select"]) => Effect.Effect<
-    Exclude<
-      PasswordRegistrationDecision,
-      {
-        readonly _tag: "Created";
-      }
-    >,
-    PersistenceMappingError
-  >;
-}
-
 export interface PasswordRegistrationProvisioning<
   Registration,
   Subject extends Table,
@@ -288,23 +190,18 @@ export interface PasswordRegistrationProvisioning<
 }
 
 export interface RequiredPasswordRegistrationConstraints {
-  readonly request: "unique(registration.moduleId,registration.requestId)";
-  readonly recoveryReference: "unique(registration.recoveryReference)";
   readonly identifier: "unique(identifier.namespace,identifier.value)";
   readonly credentialSubject: "unique(credential.moduleId,credential.subjectId)";
   readonly authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)";
 }
 
 export const requiredPasswordRegistrationConstraints: RequiredPasswordRegistrationConstraints = {
-  request: "unique(registration.moduleId,registration.requestId)",
-  recoveryReference: "unique(registration.recoveryReference)",
   identifier: "unique(identifier.namespace,identifier.value)",
   credentialSubject: "unique(credential.moduleId,credential.subjectId)",
   authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)",
 };
 
 export interface PasswordRegistrationConstraintClassifier {
-  readonly isRequestConflict: (cause: unknown) => boolean;
   readonly isIdentifierConflict: (cause: unknown) => boolean;
   readonly isCredentialConflict: (cause: unknown) => boolean;
 }
@@ -315,7 +212,6 @@ export type PasswordRegistrationMapping<
   Identifier extends Table,
   Credential extends Table,
   AuthorityCredential extends Table,
-  Request extends Table,
   NativeSubjectId,
   Expression extends SqlExpression = SqlExpression,
 > = PasswordRegistrationConstraintClassifier & {
@@ -326,47 +222,32 @@ export type PasswordRegistrationMapping<
     AuthorityCredential,
     NativeSubjectId
   >;
-  readonly registration: PasswordRegistrationTable<Registration, Request, NativeSubjectId>;
   readonly subjectId: SubjectIdCodec<NativeSubjectId>;
   readonly constraints: RequiredPasswordRegistrationConstraints;
   readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;
   readonly allocateCredentialIdSync?: () => string;
   readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
   readonly allocateRevisionSync?: () => SecurityRevision;
-} & (
-    | {
-        readonly mode: "atomic";
-        readonly provisioning: PasswordRegistrationProvisioning<
-          Registration,
-          Subject,
-          NativeSubjectId
-        > &
-          (
-            | {
-                readonly idMode: "allocated";
-                readonly allocateSubjectId: Effect.Effect<NativeSubjectId, PersistenceMappingError>;
-              }
-            | {
-                readonly idMode: "synchronous";
-                readonly allocateSubjectIdSync: () => NativeSubjectId;
-              }
-            | {
-                readonly idMode: "generated";
-                readonly decodeGeneratedId: (
-                  rows: ReadonlyArray<unknown>,
-                ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;
-              }
-          );
-      }
-    | {
-        readonly mode: "pending";
-        readonly allocateRecoveryReference?: Effect.Effect<
-          typeof RecoveryReference.Type,
-          PersistenceMappingError
-        >;
-        readonly allocateRecoveryReferenceSync?: () => typeof RecoveryReference.Type;
-      }
-  );
+} & {
+  readonly mode: "atomic";
+  readonly provisioning: PasswordRegistrationProvisioning<Registration, Subject, NativeSubjectId> &
+    (
+      | {
+          readonly idMode: "allocated";
+          readonly allocateSubjectId: Effect.Effect<NativeSubjectId, PersistenceMappingError>;
+        }
+      | {
+          readonly idMode: "synchronous";
+          readonly allocateSubjectIdSync: () => NativeSubjectId;
+        }
+      | {
+          readonly idMode: "generated";
+          readonly decodeGeneratedId: (
+            rows: ReadonlyArray<unknown>,
+          ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;
+        }
+    );
+};
 
 export type AnyPasswordPersistenceMapping<Expression extends SqlExpression = SqlExpression> =
   PasswordPersistenceMapping<
@@ -374,7 +255,6 @@ export type AnyPasswordPersistenceMapping<Expression extends SqlExpression = Sql
     AnyTableModel,
     AnyTableModel,
     AnyTableModel,
-    AnyTableModel,
     unknown,
     Expression
   >;
@@ -388,7 +268,6 @@ export type AnyPasswordRegistrationMapping<
   AnyTableModel,
   AnyTableModel,
   AnyTableModel,
-  AnyTableModel,
   unknown,
   Expression
 >;

package/src/internal/models/phone-model.ts

@@ -0,0 +1,110 @@
+import type { PhoneLifecyclePolicy, PhoneNumber } from "@yielded/auth/PhoneOtp";
+import type { SubjectId } from "@yielded/auth/Schema";
+import type { AuthenticationRequirement } from "@yielded/auth/Sessions";
+import type { Effect } from "effect";
+
+import type { AnyTableModel, TableModel as Table, SqlExpression } from "../table-model";
+import type { PersistenceMappingError } from "./common";
+import type { ProofPersistenceMapping } from "./proof-model";
+
+type PhoneColumn<T extends Table> = T["column"];
+
+export const requiredPhoneConstraints = {
+  subject: "unique(id)",
+  identifier: "unique(namespace,value)",
+  credential: "unique(credentialId)",
+} as const;
+
+/** Consumer-owned schema; encoders and allocators are synchronous and side-effect free.
+ * Identifiers store permanent number custody. Never delete retired rows to make a recycled number eligible. A consumer's
+ * explicit recovery workflow may resolve custody only after independent authentication.
+ * Subject defaults own account provisioning; no email/profile schema is prescribed. */
+export interface PhoneMapping<
+  S extends Table,
+  I extends Table,
+  C extends Table,
+  P extends Table,
+  N,
+  Expression extends SqlExpression = SqlExpression,
+> {
+  readonly moduleId: string;
+  readonly policy: PhoneLifecyclePolicy;
+  readonly constraints: typeof requiredPhoneConstraints;
+  readonly proofs: ProofPersistenceMapping<P, S, N, Expression>;
+  readonly subjectIds: {
+    readonly toNative: (id: SubjectId) => N | Effect.Effect<N, PersistenceMappingError>;
+    readonly toSubject: (id: N) => SubjectId | Effect.Effect<SubjectId, PersistenceMappingError>;
+    readonly allocate?: () => N | Effect.Effect<N, PersistenceMappingError>;
+  };
+  readonly subject: {
+    readonly table: S["table"];
+    readonly id: PhoneColumn<S>;
+    readonly securityRevision: PhoneColumn<S>;
+    readonly activeCondition: Expression;
+    readonly decodeRequirement: (
+      row: S["select"],
+    ) =>
+      | AuthenticationRequirement
+      | Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
+    /** Current action policy, independently from primary sign-in assurance. */
+    readonly decodeActionRequirement?: (
+      row: S["select"],
+      action: "verify" | "change",
+    ) =>
+      | AuthenticationRequirement
+      | Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
+    readonly encodeInsert?: (input: {
+      readonly id: N;
+      readonly securityRevision: string;
+      readonly phoneNumber: PhoneNumber;
+    }) => S["insert"];
+  };
+  readonly identifier: {
+    readonly table: I["table"];
+    readonly moduleId: PhoneColumn<I>;
+    readonly credentialId: PhoneColumn<I>;
+    readonly namespace: PhoneColumn<I>;
+    readonly value: PhoneColumn<I>;
+    readonly subjectId: PhoneColumn<I>;
+    readonly revision: PhoneColumn<I>;
+    readonly verifiedAt: PhoneColumn<I>;
+    readonly status: PhoneColumn<I>;
+    readonly activeCondition: Expression;
+    readonly encodeStatus: (active: boolean) => unknown;
+    readonly encodeInsert: (input: {
+      readonly moduleId: string;
+      readonly credentialId: string;
+      readonly phoneNumber: PhoneNumber;
+      readonly subjectId: N;
+      readonly revision: string;
+      readonly verifiedAtMillis: number;
+      readonly active: boolean;
+    }) => I["insert"];
+  };
+  readonly credential: {
+    readonly table: C["table"];
+    readonly id: PhoneColumn<C>;
+    readonly subjectId: PhoneColumn<C>;
+    readonly revision: PhoneColumn<C>;
+    readonly status: PhoneColumn<C>;
+    readonly activeCondition: Expression;
+    readonly encodeStatus: (active: boolean) => unknown;
+    readonly encodeInsert: (input: {
+      readonly credentialId: string;
+      readonly subjectId: N;
+      readonly revision: string;
+      readonly active: boolean;
+    }) => C["insert"];
+  };
+  readonly encodeInstant: (millis: number) => unknown;
+  readonly engineNowMillis: Expression;
+}
+
+export type AnyPhoneMapping<Expression extends SqlExpression = SqlExpression> = PhoneMapping<
+  AnyTableModel,
+  AnyTableModel,
+  AnyTableModel,
+  AnyTableModel,
+  unknown,
+  Expression
+>;