@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/internal/PasswordPreparedPostconditions.d.mts

@@ -1,22 +0,0 @@
-import { PasswordSqlDatabase } from "./password-kernel.mjs";
-import { Context, Effect } from "effect";
-import { PreparedCommit } from "@yielded/auth/Hooks";
-import { ProofUnavailable } from "@yielded/auth/Proofs";
-import { PasswordUnavailable } from "@yielded/auth/Password";
-//#region src/internal/PasswordPreparedPostconditions.d.ts
-declare const CurrentPasswordPreparedTransaction_base: Context.ServiceClass<CurrentPasswordPreparedTransaction, "effect-auth/drizzle/CurrentPasswordPreparedTransaction", PasswordSqlDatabase>;
-/** Final reads resolve the current physical owner, never a released savepoint. */
-export declare class CurrentPasswordPreparedTransaction extends CurrentPasswordPreparedTransaction_base {}
-export type PasswordPreparedPostcondition = Effect.Effect<void, PasswordUnavailable | ProofUnavailable, CurrentPasswordPreparedTransaction>;
-declare const PasswordPreparedPostconditions_base: Context.ServiceClass<PasswordPreparedPostconditions, "effect-auth/drizzle/PasswordPreparedPostconditions", {
-  readonly register: (check: PasswordPreparedPostcondition) => boolean;
-}>;
-/** Registration ends when the application owner returns, before final validation. */
-export declare class PasswordPreparedPostconditions extends PasswordPreparedPostconditions_base {}
-declare const PasswordPreparedJournalGuards_base: Context.ServiceClass<PasswordPreparedJournalGuards, "effect-auth/drizzle/PasswordPreparedJournalGuards", {
-  readonly register: (guard: PreparedCommit<void>) => boolean;
-}>;
-/** Journal registration closes with the prepared-password owner callback. */
-export declare class PasswordPreparedJournalGuards extends PasswordPreparedJournalGuards_base {}
-//#endregion
-//# sourceMappingURL=PasswordPreparedPostconditions.d.mts.map

package/dist/internal/PasswordPreparedPostconditions.mjs

@@ -1,12 +0,0 @@
-import { Context } from "effect";
-//#region src/internal/PasswordPreparedPostconditions.ts
-/** Final reads resolve the current physical owner, never a released savepoint. */
-var CurrentPasswordPreparedTransaction = class extends Context.Service()("effect-auth/drizzle/CurrentPasswordPreparedTransaction") {};
-/** Registration ends when the application owner returns, before final validation. */
-var PasswordPreparedPostconditions = class extends Context.Service()("effect-auth/drizzle/PasswordPreparedPostconditions") {};
-/** Journal registration closes with the prepared-password owner callback. */
-var PasswordPreparedJournalGuards = class extends Context.Service()("effect-auth/drizzle/PasswordPreparedJournalGuards") {};
-//#endregion
-export { CurrentPasswordPreparedTransaction, PasswordPreparedJournalGuards, PasswordPreparedPostconditions };
-
-//# sourceMappingURL=PasswordPreparedPostconditions.mjs.map

package/dist/internal/PasswordPreparedPostconditions.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"PasswordPreparedPostconditions.mjs","names":[],"sources":["../../src/internal/PasswordPreparedPostconditions.ts"],"sourcesContent":["import type { PreparedCommit } from \"@yielded/auth/Hooks\";\nimport type { PasswordUnavailable } from \"@yielded/auth/Password\";\nimport type { ProofUnavailable } from \"@yielded/auth/Proofs\";\nimport { Context, type Effect } from \"effect\";\n\nimport type { PasswordSqlDatabase } from \"./password-kernel\";\n\n/** Final reads resolve the current physical owner, never a released savepoint. */\nexport class CurrentPasswordPreparedTransaction extends Context.Service<\n  CurrentPasswordPreparedTransaction,\n  PasswordSqlDatabase\n>()(\"effect-auth/drizzle/CurrentPasswordPreparedTransaction\") {}\n\nexport type PasswordPreparedPostcondition = Effect.Effect<\n  void,\n  PasswordUnavailable | ProofUnavailable,\n  CurrentPasswordPreparedTransaction\n>;\n\n/** Registration ends when the application owner returns, before final validation. */\nexport class PasswordPreparedPostconditions extends Context.Service<\n  PasswordPreparedPostconditions,\n  { readonly register: (check: PasswordPreparedPostcondition) => boolean }\n>()(\"effect-auth/drizzle/PasswordPreparedPostconditions\") {}\n\n/** Journal registration closes with the prepared-password owner callback. */\nexport class PasswordPreparedJournalGuards extends Context.Service<\n  PasswordPreparedJournalGuards,\n  { readonly register: (guard: PreparedCommit<void>) => boolean }\n>()(\"effect-auth/drizzle/PasswordPreparedJournalGuards\") {}\n"],"mappings":";;;AAQA,IAAa,qCAAb,cAAwD,QAAQ,QAG9D,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC;;AAS/D,IAAa,iCAAb,cAAoD,QAAQ,QAG1D,CAAC,CAAC,oDAAoD,CAAC,CAAC,CAAC;;AAG3D,IAAa,gCAAb,cAAmD,QAAQ,QAGzD,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC"}

package/dist/internal/authority-snapshot.mjs

@@ -1,53 +0,0 @@
-import { sqlMapping } from "./native-sql-table.mjs";
-import { NativeDatabase } from "./transaction-kernel.mjs";
-import { Effect, Schema } from "effect";
-import { AuthenticationRevision, StaleAuthentication } from "@yielded/auth/Sessions";
-//#region src/internal/authority-snapshot.ts
-/** One unlocked statement reads the subject and requested credentials: a coherent
-* preflight view, or a commit owner's view where writers are already serialized.
-* Row-locking commit owners lock and revalidate through their ordered reads.
-*/
-const makeAuthoritySnapshot = (tables, mapping) => Effect.fnUntraced(function* (subjectId, credentialIds) {
-	const sql = (yield* NativeDatabase).$client.withoutTransforms();
-	if (new Set(credentialIds).size !== credentialIds.length) return yield* StaleAuthentication.make({});
-	const { s, c } = yield* sqlMapping(() => ({
-		s: tables(mapping.subject.table).as("auth_subject"),
-		c: tables(mapping.credential.table).as("auth_credential")
-	}));
-	const nativeId = yield* sqlMapping(() => mapping.subjectId.toNative(subjectId)).pipe(Effect.flatten);
-	const requested = [...credentialIds].sort((a, b) => a.localeCompare(b));
-	const rows = yield* sqlMapping(() => sql`select ${s.fields("s_")}
-      ${requested.length === 0 ? sql.literal("") : sql`, ${c.fields("c_")}`}
-      from ${s.name}
-      ${requested.length === 0 ? sql.literal("") : sql`inner join ${c.name} on
-        ${c.column(mapping.credential.subjectId)} = ${c.value(mapping.credential.subjectId, nativeId)}
-        and ${sql.or(requested.map((id) => sql`${c.column(mapping.credential.credentialId)} = ${c.value(mapping.credential.credentialId, id)}`))}`}
-      where ${s.column(mapping.subject.id)} = ${s.value(mapping.subject.id, nativeId)}`).pipe(Effect.flatten);
-	const first = rows[0];
-	if (first === void 0 || rows.length !== Math.max(1, requested.length)) return yield* StaleAuthentication.make({});
-	const subject = yield* sqlMapping(() => s.decode(first, "s_"));
-	if (!(yield* sqlMapping(() => mapping.subject.isActiveStatus(subject[mapping.subject.status])))) return yield* StaleAuthentication.make({});
-	const credentials = yield* sqlMapping(() => requested.length === 0 ? [] : rows.map((row) => c.decode(row, "c_")));
-	if (yield* sqlMapping(() => credentials.some((row) => mapping.credential.status !== void 0 && mapping.credential.isActiveStatus?.(row[mapping.credential.status]) !== true))) return yield* StaleAuthentication.make({});
-	const revision = yield* Schema.decodeUnknownEffect(AuthenticationRevision)({
-		subjectId,
-		securityRevision: subject[mapping.subject.securityRevision],
-		credentials: credentials.map((row) => ({
-			credentialId: row[mapping.credential.credentialId],
-			revision: row[mapping.credential.revision]
-		}))
-	});
-	const sorted = [...revision.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId));
-	if (sorted.some((item, index) => item.credentialId !== requested[index])) return yield* StaleAuthentication.make({});
-	return {
-		subject,
-		revision: {
-			...revision,
-			credentials: sorted
-		}
-	};
-});
-//#endregion
-export { makeAuthoritySnapshot };
-
-//# sourceMappingURL=authority-snapshot.mjs.map

package/dist/internal/authority-snapshot.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"authority-snapshot.mjs","names":[],"sources":["../../src/internal/authority-snapshot.ts"],"sourcesContent":["import type { SubjectId } from \"@yielded/auth/Schema\";\nimport { AuthenticationRevision, StaleAuthentication } from \"@yielded/auth/Sessions\";\nimport { Effect, Schema } from \"effect\";\n\nimport type { SessionAuthorityTables } from \"./models/session-model\";\nimport { sqlMapping, type NativeSqlTables } from \"./native-sql-table\";\nimport type { AnyTableModel } from \"./query-operations\";\nimport { NativeDatabase } from \"./transaction-kernel\";\n\n/** One unlocked statement reads the subject and requested credentials: a coherent\n * preflight view, or a commit owner's view where writers are already serialized.\n * Row-locking commit owners lock and revalidate through their ordered reads.\n */\nexport const makeAuthoritySnapshot = (\n  tables: NativeSqlTables,\n  mapping: SessionAuthorityTables<AnyTableModel, AnyTableModel, unknown>,\n) =>\n  Effect.fnUntraced(function* (subjectId: SubjectId, credentialIds: ReadonlyArray<string>) {\n    const sql = (yield* NativeDatabase).$client.withoutTransforms();\n\n    if (new Set(credentialIds).size !== credentialIds.length)\n      return yield* StaleAuthentication.make({});\n\n    const { s, c } = yield* sqlMapping(() => ({\n      s: tables(mapping.subject.table).as(\"auth_subject\"),\n      c: tables(mapping.credential.table).as(\"auth_credential\"),\n    }));\n\n    const nativeId = yield* sqlMapping(() => mapping.subjectId.toNative(subjectId)).pipe(\n      Effect.flatten,\n    );\n\n    const requested = [...credentialIds].sort((a, b) => a.localeCompare(b));\n\n    const rows = yield* sqlMapping(\n      () => sql<Record<string, unknown>>`select ${s.fields(\"s_\")}\n      ${requested.length === 0 ? sql.literal(\"\") : sql`, ${c.fields(\"c_\")}`}\n      from ${s.name}\n      ${\n        requested.length === 0\n          ? sql.literal(\"\")\n          : sql`inner join ${c.name} on\n        ${c.column(mapping.credential.subjectId)} = ${c.value(mapping.credential.subjectId, nativeId)}\n        and ${sql.or(requested.map((id) => sql`${c.column(mapping.credential.credentialId)} = ${c.value(mapping.credential.credentialId, id)}`))}`\n      }\n      where ${s.column(mapping.subject.id)} = ${s.value(mapping.subject.id, nativeId)}`,\n    ).pipe(Effect.flatten);\n\n    const first = rows[0];\n\n    if (first === undefined || rows.length !== Math.max(1, requested.length))\n      return yield* StaleAuthentication.make({});\n\n    const subject = yield* sqlMapping(() => s.decode(first, \"s_\"));\n\n    if (!(yield* sqlMapping(() => mapping.subject.isActiveStatus(subject[mapping.subject.status]))))\n      return yield* StaleAuthentication.make({});\n\n    const credentials = yield* sqlMapping(() =>\n      requested.length === 0 ? [] : rows.map((row) => c.decode(row, \"c_\")),\n    );\n\n    if (\n      yield* sqlMapping(() =>\n        credentials.some(\n          (row) =>\n            mapping.credential.status !== undefined &&\n            mapping.credential.isActiveStatus?.(row[mapping.credential.status]) !== true,\n        ),\n      )\n    )\n      return yield* StaleAuthentication.make({});\n\n    const revision = yield* Schema.decodeUnknownEffect(AuthenticationRevision)({\n      subjectId,\n      securityRevision: subject[mapping.subject.securityRevision],\n      credentials: credentials.map((row) => ({\n        credentialId: row[mapping.credential.credentialId],\n        revision: row[mapping.credential.revision],\n      })),\n    });\n\n    const sorted = [...revision.credentials].sort((a, b) =>\n      a.credentialId.localeCompare(b.credentialId),\n    );\n\n    if (sorted.some((item, index) => item.credentialId !== requested[index]))\n      return yield* StaleAuthentication.make({});\n\n    return { subject, revision: { ...revision, credentials: sorted } };\n  });\n"],"mappings":";;;;;;;;;AAaA,MAAa,yBACX,QACA,YAEA,OAAO,WAAW,WAAW,WAAsB,eAAsC;CACvF,MAAM,OAAO,OAAO,eAAA,CAAgB,QAAQ,kBAAkB;CAE9D,IAAI,IAAI,IAAI,aAAa,CAAC,CAAC,SAAS,cAAc,QAChD,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAE3C,MAAM,EAAE,GAAG,MAAM,OAAO,kBAAkB;EACxC,GAAG,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,GAAG,cAAc;EAClD,GAAG,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,GAAG,iBAAiB;CAC1D,EAAE;CAEF,MAAM,WAAW,OAAO,iBAAiB,QAAQ,UAAU,SAAS,SAAS,CAAC,CAAC,CAAC,KAC9E,OAAO,OACT;CAEA,MAAM,YAAY,CAAC,GAAG,aAAa,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;CAEtE,MAAM,OAAO,OAAO,iBACZ,GAA4B,UAAU,EAAE,OAAO,IAAI,EAAE;QACzD,UAAU,WAAW,IAAI,IAAI,QAAQ,EAAE,IAAI,GAAG,KAAK,EAAE,OAAO,IAAI,IAAI;aAC/D,EAAE,KAAK;QAEZ,UAAU,WAAW,IACjB,IAAI,QAAQ,EAAE,IACd,GAAG,cAAc,EAAE,KAAK;UAC1B,EAAE,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;cACxF,IAAI,GAAG,UAAU,KAAK,OAAO,GAAG,GAAG,EAAE,OAAO,QAAQ,WAAW,YAAY,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,cAAc,EAAE,GAAG,CAAC,IACxI;cACO,EAAE,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,GAChF,CAAC,CAAC,KAAK,OAAO,OAAO;CAErB,MAAM,QAAQ,KAAK;CAEnB,IAAI,UAAU,KAAA,KAAa,KAAK,WAAW,KAAK,IAAI,GAAG,UAAU,MAAM,GACrE,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAE3C,MAAM,UAAU,OAAO,iBAAiB,EAAE,OAAO,OAAO,IAAI,CAAC;CAE7D,IAAI,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,CAAC,IAC3F,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAE3C,MAAM,cAAc,OAAO,iBACzB,UAAU,WAAW,IAAI,CAAC,IAAI,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,CACrE;CAEA,IACE,OAAO,iBACL,YAAY,MACT,QACC,QAAQ,WAAW,WAAW,KAAA,KAC9B,QAAQ,WAAW,iBAAiB,IAAI,QAAQ,WAAW,OAAO,MAAM,IAC5E,CACF,GAEA,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAE3C,MAAM,WAAW,OAAO,OAAO,oBAAoB,sBAAsB,CAAC,CAAC;EACzE;EACA,kBAAkB,QAAQ,QAAQ,QAAQ;EAC1C,aAAa,YAAY,KAAK,SAAS;GACrC,cAAc,IAAI,QAAQ,WAAW;GACrC,UAAU,IAAI,QAAQ,WAAW;EACnC,EAAE;CACJ,CAAC;CAED,MAAM,SAAS,CAAC,GAAG,SAAS,WAAW,CAAC,CAAC,MAAM,GAAG,MAChD,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C;CAEA,IAAI,OAAO,MAAM,MAAM,UAAU,KAAK,iBAAiB,UAAU,MAAM,GACrE,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CAE3C,OAAO;EAAE;EAAS,UAAU;GAAE,GAAG;GAAU,aAAa;EAAO;CAAE;AACnE,CAAC"}

package/dist/internal/email-kernel.d.mts

@@ -1,276 +0,0 @@
-import { PersistenceMappingError } from "./mapping-error.mjs";
-import { NativeDatabase } from "./transaction-kernel.mjs";
-import { QueryFailure, QueryOperations, SqlColumn, SqlFragment } from "./query-operations.mjs";
-import { AnyEmailAddressMapping, AnyEmailSignInMapping } from "./models/email-model.mjs";
-import { ProofSqlConfiguration, makeProofKernel } from "./proof-kernel.mjs";
-import { Context, DateTime, Effect, Option } from "effect";
-import { LifecycleHooks, PreparedCommit } from "@yielded/auth/Hooks";
-import { AuthenticationRevision, SecurityRevision } from "@yielded/auth/Sessions";
-import { ProofCompletionInput } from "@yielded/auth/Proofs";
-import { EmailAddressMutation, EmailCredentialSnapshot, EmailUnavailable } from "@yielded/auth/Email";
-import { LoginIdentifier } from "@yielded/auth/Identity";
-import * as SqlError$1 from "effect/sql/SqlError";
-//#region src/internal/email-kernel.d.ts
-type AdapterFailure = QueryFailure | PersistenceMappingError | SqlError$1.SqlError;
-type SignInMapping = AnyEmailSignInMapping;
-export interface EmailSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {
-  readonly getSQL: () => ReturnType<QueryOperations["sql"]>;
-  readonly from: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
-  readonly where: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
-  readonly limit: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
-  readonly orderBy: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
-  readonly for: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
-  readonly set: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
-  readonly values: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
-  readonly returning: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
-  readonly innerJoin: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
-  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
-  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
-  readonly $returningId: (...args: ReadonlyArray<any>) => EmailSqlQuery<A>;
-}
-export interface EmailSqlDatabase {
-  readonly select: (...args: ReadonlyArray<any>) => EmailSqlQuery;
-  readonly insert: (...args: ReadonlyArray<any>) => EmailSqlQuery;
-  readonly update: (...args: ReadonlyArray<any>) => EmailSqlQuery;
-  readonly delete: (...args: ReadonlyArray<any>) => EmailSqlQuery;
-  readonly transaction: <A, E, R>(body: (transaction: EmailSqlDatabase) => Effect.Effect<A, E, R>) => Effect.Effect<A, E | SqlError$1.SqlError, R>;
-}
-declare const CurrentEmailSql_base: Context.ServiceClass<CurrentEmailSql, "effect-auth/CurrentEmailSql", EmailSqlDatabase>;
-export declare class CurrentEmailSql extends CurrentEmailSql_base {}
-export interface EmailSqlConfiguration {
-  readonly mode: "interactive" | "synchronous";
-  readonly locking: boolean;
-  readonly standaloneGuard: Effect.Effect<void, EmailUnavailable>;
-  readonly coordinated?: boolean;
-  readonly proof?: {
-    readonly mapping: any;
-    readonly configuration: ProofSqlConfiguration;
-  };
-}
-export interface CurrentAddress {
-  readonly nativeSubjectId: unknown;
-  readonly subject: any;
-  readonly revision: AuthenticationRevision;
-  readonly source?: {
-    readonly credential: any;
-    readonly identifier: any;
-    readonly snapshot: EmailCredentialSnapshot;
-  };
-  readonly targetIdentifier?: any;
-  readonly targetCredential?: any;
-  readonly targetIdentifierRevision?: SecurityRevision;
-  readonly eligible: boolean;
-}
-export declare const makeEmailKernel: <Fragment extends SqlFragment = SqlFragment, Column extends SqlColumn = SqlColumn>(operations: QueryOperations<Fragment, Column>, proofs: Pick<ReturnType<typeof makeProofKernel>, "completeProofPlanIn">) => {
-  validEmailSignInConstraints: (mapping: SignInMapping) => boolean;
-  emailLookupQuery: (mapping: SignInMapping, moduleId: string, identifier: LoginIdentifier) => {
-    fields: {
-      subject: any;
-      identifier: any;
-      credential: any;
-    };
-    from: any;
-    subjectTable: any;
-    subjectJoin: Fragment;
-    credentialTable: any;
-    credentialJoin: Fragment | undefined;
-    predicate: Fragment | undefined;
-    limit: number;
-  };
-  decodeEmailSnapshot: (mapping: AnyEmailSignInMapping, moduleId: string, requested: LoginIdentifier, row: any) => Effect.Effect<Readonly<{
-    moduleId: string;
-    identifierRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    verifiedAtMillis: number;
-    credentialId: string;
-    credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-    identifier: Readonly<LoginIdentifier>;
-    revision: {
-      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly credentials: readonly {
-        readonly credentialId: string;
-        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      }[];
-    };
-  }> | undefined, EmailUnavailable | PersistenceMappingError, never>;
-  makeSqlEmailSignInTargets: (mapping: AnyEmailSignInMapping, configuration: EmailSqlConfiguration) => Effect.Effect<{
-    readonly lookup: (input: {
-      readonly moduleId: string;
-      readonly identifier: LoginIdentifier;
-    }) => Effect.Effect<Option.Option<EmailCredentialSnapshot>, EmailUnavailable>;
-  }, EmailUnavailable, CurrentEmailSql | NativeDatabase>;
-  currentAddress: (mapping: AnyEmailAddressMapping<Fragment>, input: {
-    readonly moduleId: string;
-    readonly subjectId: string;
-    readonly target: LoginIdentifier;
-    readonly sourceCredentialId?: string;
-  }, locking: boolean) => Effect.Effect<{
-    nativeSubjectId: unknown;
-    subject: any;
-    revision: {
-      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly credentials: readonly {
-        readonly credentialId: string;
-        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      }[];
-    };
-    source?: {
-      readonly credential: any;
-      readonly identifier: any;
-      readonly snapshot: EmailCredentialSnapshot;
-    };
-    targetIdentifier?: any;
-    targetCredential?: any;
-    targetIdentifierRevision?: any;
-    eligible: boolean;
-  } | undefined, EmailUnavailable | QueryFailure, CurrentEmailSql>;
-  sameEmailRevision: (left: AuthenticationRevision, right: AuthenticationRevision) => boolean;
-  snapshotEmailMutation: (input: EmailAddressMutation) => Effect.Effect<Readonly<{
-    moduleId: string;
-    commandId: import("@yielded/auth/Email").EmailCommandId;
-    completion: import("@yielded/auth/Proofs").ProofCompletionPlan;
-    invalidation?: Readonly<{
-      trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-      existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
-      maximumExposureMillis: number;
-      oldAuthenticationEvidence: "rejected";
-    }>;
-    target: Readonly<{
-      namespace: string;
-      value: string;
-    }>;
-    captured: Readonly<{
-      eligible: boolean;
-      revision: {
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly credentials: readonly {
-          readonly credentialId: string;
-          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        }[];
-      };
-      targetIdentifierRevision?: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      source?: Readonly<{
-        moduleId: string;
-        identifierRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        verifiedAtMillis: number;
-        credentialId: string;
-        credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        identifier: Readonly<LoginIdentifier>;
-        revision: {
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly credentials: readonly {
-            readonly credentialId: string;
-            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          }[];
-        };
-      }>;
-    }>;
-    authorization: Readonly<{
-      challenge: Readonly<{
-        moduleId: string;
-        action: "change-address" | "verify-address";
-        commandId: string & import("effect/Brand").Brand<"effect-auth/EmailCommandId">;
-        sourceCredentialId?: string;
-        targetIdentifierRevision?: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-        target: Readonly<{
-          namespace: string;
-          value: string;
-        }>;
-        revision: {
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly credentials: readonly {
-            readonly credentialId: string;
-            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          }[];
-        };
-      }>;
-      evidence: Readonly<{
-        flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
-        bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-        revision: Readonly<{
-          subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          credentials: readonly Readonly<{
-            credentialId: string;
-            revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          }>[];
-        }>;
-        proofs: readonly [Readonly<{
-          method: string;
-          credentialId: string;
-          userVerified: boolean;
-          phishingResistant: boolean;
-          factors: readonly ("inherence" | "knowledge" | "possession")[];
-          verifiedAt: DateTime.Utc;
-        }>, ...Readonly<{
-          method: string;
-          credentialId: string;
-          userVerified: boolean;
-          phishingResistant: boolean;
-          factors: readonly ("inherence" | "knowledge" | "possession")[];
-          verifiedAt: DateTime.Utc;
-        }>[]];
-      }>;
-      requirement: Readonly<{
-        maximumAgeMillis: number;
-        alternatives: readonly [Readonly<{
-          userVerified: boolean;
-          phishingResistant: boolean;
-          minimumCredentials: number;
-          factors: readonly ("inherence" | "knowledge" | "possession")[];
-        }>, ...Readonly<{
-          userVerified: boolean;
-          phishingResistant: boolean;
-          minimumCredentials: number;
-          factors: readonly ("inherence" | "knowledge" | "possession")[];
-        }>[]];
-      }>;
-    }>;
-  }>, EmailUnavailable, never>;
-  validateEmailAuthority: (mapping: AnyEmailAddressMapping<Fragment>, configuration: EmailSqlConfiguration, input: EmailAddressMutation, action: "change-address" | "verify-address") => Effect.Effect<{
-    nativeSubjectId: unknown;
-    subject: any;
-    revision: {
-      readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-      readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      readonly credentials: readonly {
-        readonly credentialId: string;
-        readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-      }[];
-    };
-    source?: {
-      readonly credential: any;
-      readonly identifier: any;
-      readonly snapshot: EmailCredentialSnapshot;
-    };
-    targetIdentifier?: any;
-    targetCredential?: any;
-    targetIdentifierRevision?: any;
-    eligible: boolean;
-  } | undefined, EmailUnavailable | QueryFailure, CurrentEmailSql>;
-  makeSqlEmailAddressPersistence: (mapping: AnyEmailAddressMapping<Fragment>, configuration: EmailSqlConfiguration) => Effect.Effect<{
-    readonly target: (input: {
-      readonly moduleId: string;
-      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-      readonly target: LoginIdentifier;
-      readonly sourceCredentialId?: string;
-    }) => Effect.Effect<import("@yielded/auth/Email").EmailAddressTarget, EmailUnavailable>;
-    readonly checkCompletion: (input: ProofCompletionInput) => Effect.Effect<boolean, EmailUnavailable>;
-    readonly verifyWithProof: <A>(input: EmailAddressMutation, prepare: import("@yielded/auth/Email").PrepareEmailCommit<import("@yielded/auth/Email").EmailAddressDecision, A>) => Effect.Effect<PreparedCommit<A>, EmailUnavailable>;
-    readonly changeWithProof: <A>(input: EmailAddressMutation, prepare: import("@yielded/auth/Email").PrepareEmailCommit<import("@yielded/auth/Email").EmailAddressDecision, A>) => Effect.Effect<PreparedCommit<A>, EmailUnavailable>;
-    readonly cleanup: <A>(input: {
-      readonly moduleId: string;
-      readonly limit: number;
-    }, prepare: import("@yielded/auth/Email").PrepareEmailCommit<{
-      readonly removed: number;
-      readonly hasMore: boolean;
-    }, A>) => Effect.Effect<PreparedCommit<A>, EmailUnavailable>;
-  }, EmailUnavailable, CurrentEmailSql | LifecycleHooks | NativeDatabase>;
-};
-//#endregion
-//# sourceMappingURL=email-kernel.d.mts.map