@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/internal/oauth-kernel.mjs

@@ -1,187 +0,0 @@
-import { requireStandalone } from "./standalone.mjs";
-import { makeTransactionKernel } from "./transaction-kernel.mjs";
-import { makeTransactionExecutionKernel } from "./transaction-execution-kernel.mjs";
-import { OAuthTransactionExecution } from "./oauth/owner.mjs";
-import { OAuthQueryCompiler } from "./oauth/query-compiler.mjs";
-import { captureOAuthMapping, unavailable } from "./oauth/state.mjs";
-import { OAuthFlow } from "./oauth/flow.mjs";
-import { OAuthRegistration } from "./oauth/registration.mjs";
-import { OAuthAccounts } from "./oauth/accounts.mjs";
-import { OAuthConnectedState } from "./oauth/connected-state.mjs";
-import { OAuthConnectedCustody } from "./oauth/connected-custody.mjs";
-import { OAuthConnectedFlow } from "./oauth/connected-flow.mjs";
-import { OAuthConnectedSettlement } from "./oauth/connected-settlement.mjs";
-import { OAuthConnectedAccess } from "./oauth/connected-access.mjs";
-import { OAuthConnectedCollection } from "./oauth/connected-collection.mjs";
-import { OAuthConnectedMaintenance } from "./oauth/connected-maintenance.mjs";
-import { OAuthConnectedManagement } from "./oauth/connected-management.mjs";
-import { makeOAuthConnectedReferenceKernel } from "./oauth/connected-reference.mjs";
-import { OAuthConnectedSignIn } from "./oauth/connected-sign-in.mjs";
-import { OAuthTarget, oauthAccountsPersistenceLayer, oauthRegistrationAuthorityLayer, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer } from "./oauth/target.mjs";
-import { OAuthConnectedTarget, oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer } from "./oauth/connected-target.mjs";
-import { Effect, Layer } from "effect";
-//#region src/internal/oauth-kernel.ts
-/** Adapter composition root. Shared operation Layers acquire their dependencies;
-* database and transaction services are still resolved by each operation. */
-const makeOAuthKernel = (operations, dialect) => {
-	const transactions = makeTransactionKernel(operations);
-	const connectedReference = makeOAuthConnectedReferenceKernel(operations, dialect);
-	const compilerLive = Layer.succeed(OAuthQueryCompiler, {
-		...operations,
-		...transactions.makeTransactionRows(unavailable),
-		both: transactions.both,
-		connectedReferenceCondition: connectedReference.connectedReferenceCondition
-	});
-	const executionLive = Layer.succeed(OAuthTransactionExecution, makeTransactionExecutionKernel(transactions));
-	const flowLive = OAuthFlow.layer.pipe(Layer.provide([compilerLive]));
-	const registrationLive = OAuthRegistration.layer.pipe(Layer.provide([compilerLive, flowLive]));
-	const accountsLive = OAuthAccounts.layer.pipe(Layer.provide([
-		compilerLive,
-		flowLive,
-		registrationLive
-	]));
-	const targetLive = OAuthTarget.layer.pipe(Layer.provide([
-		compilerLive,
-		accountsLive,
-		flowLive,
-		registrationLive,
-		executionLive
-	]));
-	const connectedStateLive = OAuthConnectedState.layer.pipe(Layer.provide([compilerLive, flowLive]));
-	const connectedFlowLive = OAuthConnectedFlow.layer.pipe(Layer.provide([
-		compilerLive,
-		connectedStateLive,
-		registrationLive
-	]));
-	const connectedCustodyLive = OAuthConnectedCustody.layer.pipe(Layer.provide([compilerLive, connectedStateLive]));
-	const connectedCollectionLive = OAuthConnectedCollection.layer.pipe(Layer.provide([
-		compilerLive,
-		connectedCustodyLive,
-		connectedFlowLive,
-		connectedStateLive
-	]));
-	const connectedSettlementLive = OAuthConnectedSettlement.layer.pipe(Layer.provide([
-		compilerLive,
-		connectedCustodyLive,
-		connectedFlowLive,
-		connectedStateLive
-	]));
-	const connectedAccessLive = OAuthConnectedAccess.layer.pipe(Layer.provide([
-		compilerLive,
-		connectedCustodyLive,
-		connectedFlowLive,
-		connectedSettlementLive,
-		connectedStateLive
-	]));
-	const connectedManagementLive = OAuthConnectedManagement.layer.pipe(Layer.provide([
-		compilerLive,
-		connectedAccessLive,
-		connectedCustodyLive,
-		connectedFlowLive,
-		connectedStateLive
-	]));
-	const connectedMaintenanceLive = OAuthConnectedMaintenance.layer.pipe(Layer.provide([
-		compilerLive,
-		connectedCollectionLive,
-		connectedCustodyLive,
-		connectedFlowLive,
-		connectedStateLive
-	]));
-	const connectedSignInLive = OAuthConnectedSignIn.layer.pipe(Layer.provide([
-		compilerLive,
-		connectedCustodyLive,
-		connectedFlowLive,
-		connectedSettlementLive,
-		connectedStateLive,
-		flowLive
-	]));
-	const connectedTargetLive = OAuthConnectedTarget.layer.pipe(Layer.provide([
-		connectedAccessLive,
-		connectedFlowLive,
-		connectedMaintenanceLive,
-		connectedManagementLive,
-		connectedSettlementLive,
-		connectedSignInLive,
-		connectedStateLive,
-		targetLive
-	]));
-	const makeTargetOAuthSignInServices = (mapping, configuration) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.flatMap(OAuthTarget, (service) => service.makeTargetOAuthSignInServices(captured, configuration)).pipe(Effect.provide(targetLive, { local: true }));
-	};
-	const makeTargetOAuthRegistrationIntentServices = (mapping, configuration) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.flatMap(OAuthTarget, (service) => service.makeTargetOAuthRegistrationIntentServices(captured, configuration)).pipe(Effect.provide(targetLive, { local: true }));
-	};
-	const makeTargetOAuthRegistrationServices = (mapping, configuration) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.flatMap(OAuthTarget, (service) => service.makeTargetOAuthRegistrationServices(captured, configuration)).pipe(Effect.provide(targetLive, { local: true }));
-	};
-	const makeTargetOAuthAccountsServices = (mapping, configuration) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.flatMap(OAuthTarget, (service) => service.makeTargetOAuthAccountsServices(captured, configuration)).pipe(Effect.provide(targetLive, { local: true }));
-	};
-	const coordinateTargetOAuthRegistration = (database, mapping, configuration, owner) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.flatMap(OAuthTarget, (service) => service.coordinateTargetOAuthRegistration(database, captured, configuration, owner)).pipe(Effect.provide(targetLive, { local: true }));
-	};
-	const coordinateTargetOAuthSignIn = (database, mapping, configuration, owner) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.flatMap(OAuthTarget, (service) => service.coordinateTargetOAuthSignIn(database, captured, configuration, owner)).pipe(Effect.provide(targetLive, { local: true }));
-	};
-	const coordinateTargetOAuthRegistrationIntents = (database, mapping, configuration, owner) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.flatMap(OAuthTarget, (service) => service.coordinateTargetOAuthRegistrationIntents(database, captured, configuration, owner)).pipe(Effect.provide(targetLive, { local: true }));
-	};
-	const coordinateTargetOAuthAccounts = (database, mapping, configuration, owner) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.flatMap(OAuthTarget, (service) => service.coordinateTargetOAuthAccounts(database, captured, configuration, owner)).pipe(Effect.provide(targetLive, { local: true }));
-	};
-	const makeTargetOAuthConnectedServices = (mapping, configuration) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.flatMap(OAuthConnectedTarget, (service) => service.makeTargetOAuthConnectedServices(captured, configuration)).pipe(Effect.provide(connectedTargetLive, { local: true }));
-	};
-	const makeTargetOAuthConnectedRevocationServices = (mapping, configuration) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.flatMap(OAuthConnectedTarget, (service) => service.makeTargetOAuthConnectedRevocationServices(captured, configuration)).pipe(Effect.provide(connectedTargetLive, { local: true }));
-	};
-	const coordinateTargetOAuthConnected = (database, mapping, configuration, owner) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.flatMap(OAuthConnectedTarget, (service) => service.coordinateTargetOAuthConnected(database, captured, configuration, owner)).pipe(Effect.provide(connectedTargetLive, { local: true }));
-	};
-	const coordinateTargetOAuthConnectedRevocations = (database, mapping, configuration, owner) => {
-		const captured = captureOAuthMapping(mapping);
-		return Effect.flatMap(OAuthConnectedTarget, (service) => service.coordinateTargetOAuthConnectedRevocations(database, captured, configuration, owner)).pipe(Effect.provide(connectedTargetLive, { local: true }));
-	};
-	const sqlClientOAuthStandaloneGuard = (service) => requireStandalone(unavailable, service);
-	return {
-		target: {
-			makeTargetOAuthSignInServices,
-			makeTargetOAuthRegistrationIntentServices,
-			makeTargetOAuthRegistrationServices,
-			makeTargetOAuthAccountsServices,
-			coordinateTargetOAuthRegistration,
-			coordinateTargetOAuthSignIn,
-			coordinateTargetOAuthRegistrationIntents,
-			coordinateTargetOAuthAccounts,
-			sqlClientOAuthStandaloneGuard,
-			oauthAccountsPersistenceLayer,
-			oauthSignInPersistenceLayer,
-			oauthRegistrationIntentsLayer,
-			oauthRegistrationAuthorityLayer
-		},
-		connectedTarget: {
-			makeTargetOAuthConnectedServices,
-			makeTargetOAuthConnectedRevocationServices,
-			coordinateTargetOAuthConnected,
-			coordinateTargetOAuthConnectedRevocations,
-			oauthConnectedPersistenceLayer,
-			oauthConnectedRevocationsLayer
-		},
-		connectedReference
-	};
-};
-//#endregion
-export { makeOAuthKernel };
-
-//# sourceMappingURL=oauth-kernel.mjs.map

package/dist/internal/oauth-kernel.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-kernel.mjs","names":[],"sources":["../../src/internal/oauth-kernel.ts"],"sourcesContent":["import { Effect, Layer } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\n\nimport { OAuthAccounts } from \"./oauth/accounts\";\nimport { OAuthConnectedAccess } from \"./oauth/connected-access\";\nimport { OAuthConnectedCollection } from \"./oauth/connected-collection\";\nimport { OAuthConnectedCustody } from \"./oauth/connected-custody\";\nimport { OAuthConnectedFlow } from \"./oauth/connected-flow\";\nimport { OAuthConnectedMaintenance } from \"./oauth/connected-maintenance\";\nimport { OAuthConnectedManagement } from \"./oauth/connected-management\";\nimport { makeOAuthConnectedReferenceKernel } from \"./oauth/connected-reference\";\nimport { OAuthConnectedSettlement } from \"./oauth/connected-settlement\";\nimport { OAuthConnectedSignIn } from \"./oauth/connected-sign-in\";\nimport { OAuthConnectedState } from \"./oauth/connected-state\";\nimport {\n  OAuthConnectedTarget,\n  oauthConnectedPersistenceLayer,\n  oauthConnectedRevocationsLayer,\n} from \"./oauth/connected-target\";\nimport { OAuthFlow } from \"./oauth/flow\";\nimport { OAuthTransactionExecution } from \"./oauth/owner\";\nimport { OAuthQueryCompiler } from \"./oauth/query-compiler\";\nimport { OAuthRegistration } from \"./oauth/registration\";\nimport { captureOAuthMapping, unavailable } from \"./oauth/state\";\nimport {\n  OAuthTarget,\n  oauthAccountsPersistenceLayer,\n  oauthSignInPersistenceLayer,\n  oauthRegistrationIntentsLayer,\n  oauthRegistrationAuthorityLayer,\n} from \"./oauth/target\";\nimport type { QueryOperations } from \"./query-operations\";\nimport { requireStandalone } from \"./standalone\";\nimport { makeTransactionExecutionKernel } from \"./transaction-execution-kernel\";\nimport { makeTransactionKernel } from \"./transaction-kernel\";\n\nexport type OAuthKernel = ReturnType<typeof makeOAuthKernel>;\n\n/** Adapter composition root. Shared operation Layers acquire their dependencies;\n * database and transaction services are still resolved by each operation. */\nexport const makeOAuthKernel = (\n  operations: QueryOperations,\n  dialect: (table: object) => \"pg\" | \"sqlite\" | \"mysql\",\n) => {\n  const transactions = makeTransactionKernel(operations);\n  const connectedReference = makeOAuthConnectedReferenceKernel(operations, dialect);\n\n  const compilerLive = Layer.succeed(OAuthQueryCompiler, {\n    ...operations,\n    ...transactions.makeTransactionRows(unavailable),\n    both: transactions.both,\n    connectedReferenceCondition: connectedReference.connectedReferenceCondition,\n  });\n\n  const executionLive = Layer.succeed(\n    OAuthTransactionExecution,\n    makeTransactionExecutionKernel(transactions),\n  );\n\n  const flowLive = OAuthFlow.layer.pipe(Layer.provide([compilerLive]));\n  const registrationLive = OAuthRegistration.layer.pipe(Layer.provide([compilerLive, flowLive]));\n\n  const accountsLive = OAuthAccounts.layer.pipe(\n    Layer.provide([compilerLive, flowLive, registrationLive]),\n  );\n\n  const targetLive = OAuthTarget.layer.pipe(\n    Layer.provide([compilerLive, accountsLive, flowLive, registrationLive, executionLive]),\n  );\n\n  const connectedStateLive = OAuthConnectedState.layer.pipe(\n    Layer.provide([compilerLive, flowLive]),\n  );\n\n  const connectedFlowLive = OAuthConnectedFlow.layer.pipe(\n    Layer.provide([compilerLive, connectedStateLive, registrationLive]),\n  );\n\n  const connectedCustodyLive = OAuthConnectedCustody.layer.pipe(\n    Layer.provide([compilerLive, connectedStateLive]),\n  );\n\n  const connectedCollectionLive = OAuthConnectedCollection.layer.pipe(\n    Layer.provide([compilerLive, connectedCustodyLive, connectedFlowLive, connectedStateLive]),\n  );\n\n  const connectedSettlementLive = OAuthConnectedSettlement.layer.pipe(\n    Layer.provide([compilerLive, connectedCustodyLive, connectedFlowLive, connectedStateLive]),\n  );\n\n  const connectedAccessLive = OAuthConnectedAccess.layer.pipe(\n    Layer.provide([\n      compilerLive,\n      connectedCustodyLive,\n      connectedFlowLive,\n      connectedSettlementLive,\n      connectedStateLive,\n    ]),\n  );\n\n  const connectedManagementLive = OAuthConnectedManagement.layer.pipe(\n    Layer.provide([\n      compilerLive,\n      connectedAccessLive,\n      connectedCustodyLive,\n      connectedFlowLive,\n      connectedStateLive,\n    ]),\n  );\n\n  const connectedMaintenanceLive = OAuthConnectedMaintenance.layer.pipe(\n    Layer.provide([\n      compilerLive,\n      connectedCollectionLive,\n      connectedCustodyLive,\n      connectedFlowLive,\n      connectedStateLive,\n    ]),\n  );\n\n  const connectedSignInLive = OAuthConnectedSignIn.layer.pipe(\n    Layer.provide([\n      compilerLive,\n      connectedCustodyLive,\n      connectedFlowLive,\n      connectedSettlementLive,\n      connectedStateLive,\n      flowLive,\n    ]),\n  );\n\n  const connectedTargetLive = OAuthConnectedTarget.layer.pipe(\n    Layer.provide([\n      connectedAccessLive,\n      connectedFlowLive,\n      connectedMaintenanceLive,\n      connectedManagementLive,\n      connectedSettlementLive,\n      connectedSignInLive,\n      connectedStateLive,\n      targetLive,\n    ]),\n  );\n\n  // Keep shared operation Layers local to this adapter compiler, even inside another\n  // coordinator. Preserve constructor-time snapshots before deferred acquisition.\n  const makeTargetOAuthSignInServices: OAuthTarget[\"Service\"][\"makeTargetOAuthSignInServices\"] = (\n    mapping,\n    configuration,\n  ) => {\n    const captured = captureOAuthMapping(mapping);\n\n    return Effect.flatMap(OAuthTarget, (service) =>\n      service.makeTargetOAuthSignInServices(captured, configuration),\n    ).pipe(Effect.provide(targetLive, { local: true }));\n  };\n\n  const makeTargetOAuthRegistrationIntentServices: OAuthTarget[\"Service\"][\"makeTargetOAuthRegistrationIntentServices\"] =\n    (mapping, configuration) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthTarget, (service) =>\n        service.makeTargetOAuthRegistrationIntentServices(captured, configuration),\n      ).pipe(Effect.provide(targetLive, { local: true }));\n    };\n\n  const makeTargetOAuthRegistrationServices: OAuthTarget[\"Service\"][\"makeTargetOAuthRegistrationServices\"] =\n    (mapping, configuration) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthTarget, (service) =>\n        service.makeTargetOAuthRegistrationServices(captured, configuration),\n      ).pipe(Effect.provide(targetLive, { local: true }));\n    };\n\n  const makeTargetOAuthAccountsServices: OAuthTarget[\"Service\"][\"makeTargetOAuthAccountsServices\"] =\n    (mapping, configuration) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthTarget, (service) =>\n        service.makeTargetOAuthAccountsServices(captured, configuration),\n      ).pipe(Effect.provide(targetLive, { local: true }));\n    };\n\n  const coordinateTargetOAuthRegistration: OAuthTarget[\"Service\"][\"coordinateTargetOAuthRegistration\"] =\n    (database, mapping, configuration, owner) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthTarget, (service) =>\n        service.coordinateTargetOAuthRegistration(database, captured, configuration, owner),\n      ).pipe(Effect.provide(targetLive, { local: true }));\n    };\n\n  const coordinateTargetOAuthSignIn: OAuthTarget[\"Service\"][\"coordinateTargetOAuthSignIn\"] = (\n    database,\n    mapping,\n    configuration,\n    owner,\n  ) => {\n    const captured = captureOAuthMapping(mapping);\n\n    return Effect.flatMap(OAuthTarget, (service) =>\n      service.coordinateTargetOAuthSignIn(database, captured, configuration, owner),\n    ).pipe(Effect.provide(targetLive, { local: true }));\n  };\n\n  const coordinateTargetOAuthRegistrationIntents: OAuthTarget[\"Service\"][\"coordinateTargetOAuthRegistrationIntents\"] =\n    (database, mapping, configuration, owner) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthTarget, (service) =>\n        service.coordinateTargetOAuthRegistrationIntents(database, captured, configuration, owner),\n      ).pipe(Effect.provide(targetLive, { local: true }));\n    };\n\n  const coordinateTargetOAuthAccounts: OAuthTarget[\"Service\"][\"coordinateTargetOAuthAccounts\"] = (\n    database,\n    mapping,\n    configuration,\n    owner,\n  ) => {\n    const captured = captureOAuthMapping(mapping);\n\n    return Effect.flatMap(OAuthTarget, (service) =>\n      service.coordinateTargetOAuthAccounts(database, captured, configuration, owner),\n    ).pipe(Effect.provide(targetLive, { local: true }));\n  };\n\n  const makeTargetOAuthConnectedServices: OAuthConnectedTarget[\"Service\"][\"makeTargetOAuthConnectedServices\"] =\n    (mapping, configuration) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthConnectedTarget, (service) =>\n        service.makeTargetOAuthConnectedServices(captured, configuration),\n      ).pipe(Effect.provide(connectedTargetLive, { local: true }));\n    };\n\n  const makeTargetOAuthConnectedRevocationServices: OAuthConnectedTarget[\"Service\"][\"makeTargetOAuthConnectedRevocationServices\"] =\n    (mapping, configuration) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthConnectedTarget, (service) =>\n        service.makeTargetOAuthConnectedRevocationServices(captured, configuration),\n      ).pipe(Effect.provide(connectedTargetLive, { local: true }));\n    };\n\n  const coordinateTargetOAuthConnected: OAuthConnectedTarget[\"Service\"][\"coordinateTargetOAuthConnected\"] =\n    (database, mapping, configuration, owner) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthConnectedTarget, (service) =>\n        service.coordinateTargetOAuthConnected(database, captured, configuration, owner),\n      ).pipe(Effect.provide(connectedTargetLive, { local: true }));\n    };\n\n  const coordinateTargetOAuthConnectedRevocations: OAuthConnectedTarget[\"Service\"][\"coordinateTargetOAuthConnectedRevocations\"] =\n    (database, mapping, configuration, owner) => {\n      const captured = captureOAuthMapping(mapping);\n\n      return Effect.flatMap(OAuthConnectedTarget, (service) =>\n        service.coordinateTargetOAuthConnectedRevocations(database, captured, configuration, owner),\n      ).pipe(Effect.provide(connectedTargetLive, { local: true }));\n    };\n\n  const sqlClientOAuthStandaloneGuard = (service: SqlClient[\"transactionService\"] | undefined) =>\n    requireStandalone(unavailable, service);\n\n  return {\n    target: {\n      makeTargetOAuthSignInServices,\n      makeTargetOAuthRegistrationIntentServices,\n      makeTargetOAuthRegistrationServices,\n      makeTargetOAuthAccountsServices,\n      coordinateTargetOAuthRegistration,\n      coordinateTargetOAuthSignIn,\n      coordinateTargetOAuthRegistrationIntents,\n      coordinateTargetOAuthAccounts,\n      sqlClientOAuthStandaloneGuard,\n      oauthAccountsPersistenceLayer,\n      oauthSignInPersistenceLayer,\n      oauthRegistrationIntentsLayer,\n      oauthRegistrationAuthorityLayer,\n    },\n    connectedTarget: {\n      makeTargetOAuthConnectedServices,\n      makeTargetOAuthConnectedRevocationServices,\n      coordinateTargetOAuthConnected,\n      coordinateTargetOAuthConnectedRevocations,\n      oauthConnectedPersistenceLayer,\n      oauthConnectedRevocationsLayer,\n    },\n    connectedReference,\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAa,mBACX,YACA,YACG;CACH,MAAM,eAAe,sBAAsB,UAAU;CACrD,MAAM,qBAAqB,kCAAkC,YAAY,OAAO;CAEhF,MAAM,eAAe,MAAM,QAAQ,oBAAoB;EACrD,GAAG;EACH,GAAG,aAAa,oBAAoB,WAAW;EAC/C,MAAM,aAAa;EACnB,6BAA6B,mBAAmB;CAClD,CAAC;CAED,MAAM,gBAAgB,MAAM,QAC1B,2BACA,+BAA+B,YAAY,CAC7C;CAEA,MAAM,WAAW,UAAU,MAAM,KAAK,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;CACnE,MAAM,mBAAmB,kBAAkB,MAAM,KAAK,MAAM,QAAQ,CAAC,cAAc,QAAQ,CAAC,CAAC;CAE7F,MAAM,eAAe,cAAc,MAAM,KACvC,MAAM,QAAQ;EAAC;EAAc;EAAU;CAAgB,CAAC,CAC1D;CAEA,MAAM,aAAa,YAAY,MAAM,KACnC,MAAM,QAAQ;EAAC;EAAc;EAAc;EAAU;EAAkB;CAAa,CAAC,CACvF;CAEA,MAAM,qBAAqB,oBAAoB,MAAM,KACnD,MAAM,QAAQ,CAAC,cAAc,QAAQ,CAAC,CACxC;CAEA,MAAM,oBAAoB,mBAAmB,MAAM,KACjD,MAAM,QAAQ;EAAC;EAAc;EAAoB;CAAgB,CAAC,CACpE;CAEA,MAAM,uBAAuB,sBAAsB,MAAM,KACvD,MAAM,QAAQ,CAAC,cAAc,kBAAkB,CAAC,CAClD;CAEA,MAAM,0BAA0B,yBAAyB,MAAM,KAC7D,MAAM,QAAQ;EAAC;EAAc;EAAsB;EAAmB;CAAkB,CAAC,CAC3F;CAEA,MAAM,0BAA0B,yBAAyB,MAAM,KAC7D,MAAM,QAAQ;EAAC;EAAc;EAAsB;EAAmB;CAAkB,CAAC,CAC3F;CAEA,MAAM,sBAAsB,qBAAqB,MAAM,KACrD,MAAM,QAAQ;EACZ;EACA;EACA;EACA;EACA;CACF,CAAC,CACH;CAEA,MAAM,0BAA0B,yBAAyB,MAAM,KAC7D,MAAM,QAAQ;EACZ;EACA;EACA;EACA;EACA;CACF,CAAC,CACH;CAEA,MAAM,2BAA2B,0BAA0B,MAAM,KAC/D,MAAM,QAAQ;EACZ;EACA;EACA;EACA;EACA;CACF,CAAC,CACH;CAEA,MAAM,sBAAsB,qBAAqB,MAAM,KACrD,MAAM,QAAQ;EACZ;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CACH;CAEA,MAAM,sBAAsB,qBAAqB,MAAM,KACrD,MAAM,QAAQ;EACZ;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CACH;CAIA,MAAM,iCACJ,SACA,kBACG;EACH,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,cAAc,YAClC,QAAQ,8BAA8B,UAAU,aAAa,CAC/D,CAAC,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;CACpD;CAEA,MAAM,6CACH,SAAS,kBAAkB;EAC1B,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,cAAc,YAClC,QAAQ,0CAA0C,UAAU,aAAa,CAC3E,CAAC,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;CACpD;CAEF,MAAM,uCACH,SAAS,kBAAkB;EAC1B,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,cAAc,YAClC,QAAQ,oCAAoC,UAAU,aAAa,CACrE,CAAC,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;CACpD;CAEF,MAAM,mCACH,SAAS,kBAAkB;EAC1B,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,cAAc,YAClC,QAAQ,gCAAgC,UAAU,aAAa,CACjE,CAAC,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;CACpD;CAEF,MAAM,qCACH,UAAU,SAAS,eAAe,UAAU;EAC3C,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,cAAc,YAClC,QAAQ,kCAAkC,UAAU,UAAU,eAAe,KAAK,CACpF,CAAC,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;CACpD;CAEF,MAAM,+BACJ,UACA,SACA,eACA,UACG;EACH,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,cAAc,YAClC,QAAQ,4BAA4B,UAAU,UAAU,eAAe,KAAK,CAC9E,CAAC,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;CACpD;CAEA,MAAM,4CACH,UAAU,SAAS,eAAe,UAAU;EAC3C,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,cAAc,YAClC,QAAQ,yCAAyC,UAAU,UAAU,eAAe,KAAK,CAC3F,CAAC,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;CACpD;CAEF,MAAM,iCACJ,UACA,SACA,eACA,UACG;EACH,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,cAAc,YAClC,QAAQ,8BAA8B,UAAU,UAAU,eAAe,KAAK,CAChF,CAAC,CAAC,KAAK,OAAO,QAAQ,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;CACpD;CAEA,MAAM,oCACH,SAAS,kBAAkB;EAC1B,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,uBAAuB,YAC3C,QAAQ,iCAAiC,UAAU,aAAa,CAClE,CAAC,CAAC,KAAK,OAAO,QAAQ,qBAAqB,EAAE,OAAO,KAAK,CAAC,CAAC;CAC7D;CAEF,MAAM,8CACH,SAAS,kBAAkB;EAC1B,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,uBAAuB,YAC3C,QAAQ,2CAA2C,UAAU,aAAa,CAC5E,CAAC,CAAC,KAAK,OAAO,QAAQ,qBAAqB,EAAE,OAAO,KAAK,CAAC,CAAC;CAC7D;CAEF,MAAM,kCACH,UAAU,SAAS,eAAe,UAAU;EAC3C,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,uBAAuB,YAC3C,QAAQ,+BAA+B,UAAU,UAAU,eAAe,KAAK,CACjF,CAAC,CAAC,KAAK,OAAO,QAAQ,qBAAqB,EAAE,OAAO,KAAK,CAAC,CAAC;CAC7D;CAEF,MAAM,6CACH,UAAU,SAAS,eAAe,UAAU;EAC3C,MAAM,WAAW,oBAAoB,OAAO;EAE5C,OAAO,OAAO,QAAQ,uBAAuB,YAC3C,QAAQ,0CAA0C,UAAU,UAAU,eAAe,KAAK,CAC5F,CAAC,CAAC,KAAK,OAAO,QAAQ,qBAAqB,EAAE,OAAO,KAAK,CAAC,CAAC;CAC7D;CAEF,MAAM,iCAAiC,YACrC,kBAAkB,aAAa,OAAO;CAExC,OAAO;EACL,QAAQ;GACN;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF;EACA,iBAAiB;GACf;GACA;GACA;GACA;GACA;GACA;EACF;EACA;CACF;AACF"}

package/dist/internal/passkey/admission.d.mts

@@ -1,6 +0,0 @@
-import "../transaction-kernel.mjs";
-import "../query-operations.mjs";
-import "../models/passkey-model.mjs";
-import "./state.mjs";
-import { Effect } from "effect";
-import { PasskeyCeremony, PasskeyMethodPolicy } from "@yielded/auth/Passkey";

package/dist/internal/passkey/admission.mjs

@@ -1,220 +0,0 @@
-import { CurrentPasskeyTransaction } from "./state.mjs";
-import { Effect } from "effect";
-//#region src/internal/passkey/admission.ts
-const makePasskeyAdmissionKernel = (operations, state, transactions) => {
-	const { sql } = operations;
-	const { col, equal, existsExact, key, mappedColumns, subjectScope, targetScope } = state;
-	const invariant = state.invariant;
-	const { both } = transactions;
-	const chargeRetentionMillis = 864e5;
-	const chargeScopes = Effect.fnUntraced(function* (ceremony, subjectId) {
-		const scopes = [{
-			kind: "global",
-			scope: yield* key("global", [ceremony.moduleId])
-		}];
-		if (subjectId !== void 0) scopes.push({
-			kind: "subject",
-			scope: yield* subjectScope(subjectId)
-		});
-		const target = yield* targetScope(ceremony);
-		if (target !== null) scopes.push({
-			kind: "target",
-			scope: target
-		});
-		return scopes;
-	});
-	const lockAdmission = Effect.fn("passkey.lockAdmission")(function* (mapping) {
-		const owner = yield* CurrentPasskeyTransaction;
-		const table = mapping.admission;
-		const identity = {
-			[table.authorityScope]: mapping.authorityScope,
-			[table.moduleId]: mapping.moduleId
-		};
-		const found = yield* owner.read(table.table, equal(table.table, identity), {
-			limit: 1,
-			observe: false,
-			columns: [table.authorityScope, table.moduleId]
-		});
-		invariant(found.rows.length === 1);
-		invariant(found.rows[0][table.authorityScope] === mapping.authorityScope && found.rows[0][table.moduleId] === mapping.moduleId);
-		const marked = {
-			...identity,
-			[table.version]: owner.marker,
-			[table.ownerMarker]: owner.marker
-		};
-		yield* owner.updateGuarded(table.table, owner.exact(table.table, identity), {
-			[table.version]: owner.marker,
-			[table.ownerMarker]: owner.marker,
-			[table.admittedAt]: null
-		}, {
-			rows: 1,
-			postcondition: yield* existsExact(table.table, marked)
-		});
-	});
-	const pendingCount = (mapping, scope) => {
-		const table = mapping.flow;
-		return sql`(select count(*) from ${table.table} where ${both(equal(table.table, { [table.moduleId]: mapping.moduleId }), sql`${col(table.table, table.state)} in (${table.states.Pending}, ${table.states.Claimed})`, scope === void 0 ? void 0 : equal(table.table, { [table.subjectScope]: scope }))})`;
-	};
-	const chargedCount = (mapping, kind, scope, window) => {
-		const table = mapping.charge;
-		const clock = mapping.clock;
-		return sql`(select count(*) from ${table.table} where ${both(equal(table.table, {
-			[table.moduleId]: mapping.moduleId,
-			[table.kind]: kind
-		}), kind === "global" ? void 0 : equal(table.table, { [table.scope]: scope }), sql`${col(table.table, table.admittedAt)} is not null`, sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} > ${clock.engineNowMillis} - ${window}`)})`;
-	};
-	const admissionCondition = Effect.fnUntraced(function* (mapping, policies, ceremony, subjectId, added, newFlow, resolvedSubject) {
-		const subject = subjectId === void 0 ? void 0 : yield* subjectScope(subjectId);
-		const scopes = yield* chargeScopes(ceremony, subjectId);
-		return both(...policies.flatMap((policy) => [
-			sql`${pendingCount(mapping)} + ${newFlow ? 1 : 0} <= ${policy.maximumPending}`,
-			subjectId === void 0 ? void 0 : sql`${pendingCount(mapping, subject)} + ${newFlow || resolvedSubject ? 1 : 0} <= ${policy.maximumPendingPerSubject}`,
-			...scopes.map(({ kind, scope }) => sql`${chargedCount(mapping, kind, scope, policy.admission[kind].windowMillis)} + ${added.includes(kind) ? 1 : 0} <= ${policy.admission[kind].limit}`)
-		]));
-	});
-	const guardAdmission = (mapping, policies, ceremony, subjectId) => Effect.gen(function* () {
-		(yield* CurrentPasskeyTransaction).postconditions.push(yield* admissionCondition(mapping, policies, ceremony, subjectId, [], false, false));
-	});
-	const readCharges = Effect.fn("passkey.readCharges")(function* (mapping, ceremony, policy, subjectId) {
-		const owner = yield* CurrentPasskeyTransaction;
-		const table = mapping.charge;
-		const where = equal(table.table, {
-			[table.moduleId]: ceremony.moduleId,
-			[table.flowId]: ceremony.flowId
-		});
-		const found = yield* owner.read(table.table, where, {
-			limit: 3,
-			observe: false,
-			columns: mappedColumns(table)
-		});
-		const scopes = yield* chargeScopes(ceremony, subjectId);
-		invariant(found.rows.length === scopes.length);
-		for (const { kind, scope } of scopes) {
-			const rows = found.rows.filter((row) => row[table.kind] === kind);
-			invariant(rows.length === 1);
-			const row = rows[0];
-			const admitted = mapping.clock.decodeInstant(row[table.admittedAt]);
-			const retained = mapping.clock.decodeInstant(row[table.retainUntil]);
-			invariant(Number.isSafeInteger(admitted) && admitted >= 0 && retained === admitted + chargeRetentionMillis);
-			invariant(row[table.moduleId] === ceremony.moduleId && row[table.flowId] === ceremony.flowId && row[table.purpose] === ceremony.purpose);
-			invariant(row[table.scope] === scope && row[table.originalWindowMillis] === policy.admission[kind].windowMillis);
-			owner.observations.push({
-				table: table.table,
-				where: equal(table.table, {
-					[table.moduleId]: ceremony.moduleId,
-					[table.flowId]: ceremony.flowId,
-					[table.kind]: kind
-				}),
-				rows: [row]
-			});
-		}
-	});
-	const guardChargeSet = (mapping, ceremony, subjectId) => Effect.flatMap(CurrentPasskeyTransaction, (owner) => Effect.gen(function* () {
-		const table = mapping.charge;
-		const scopes = yield* chargeScopes(ceremony, subjectId);
-		const where = equal(table.table, {
-			[table.moduleId]: ceremony.moduleId,
-			[table.flowId]: ceremony.flowId
-		});
-		owner.postconditions.push(sql`(select count(*) from ${table.table} where ${where}) = ${scopes.length}`);
-		for (const { kind, scope } of scopes) owner.postconditions.push(yield* existsExact(table.table, {
-			[table.moduleId]: ceremony.moduleId,
-			[table.flowId]: ceremony.flowId,
-			[table.purpose]: ceremony.purpose,
-			[table.kind]: kind,
-			[table.scope]: scope
-		}));
-	}));
-	return {
-		chargeRetentionMillis,
-		chargeScopes,
-		lockAdmission,
-		admissionCondition,
-		guardAdmission,
-		readCharges,
-		guardChargeSet,
-		insertCharges: Effect.fn("passkey.insertCharges")(function* (mapping, ceremony, policy, kinds, subjectId) {
-			const owner = yield* CurrentPasskeyTransaction;
-			if (kinds.length === 0) return;
-			const table = mapping.charge;
-			const anchor = mapping.admission;
-			const clock = mapping.clock;
-			const earliest = yield* owner.now(clock);
-			const identities = [];
-			for (const { kind, scope } of (yield* chargeScopes(ceremony, subjectId)).filter((item) => kinds.includes(item.kind))) {
-				const identity = {
-					[table.moduleId]: ceremony.moduleId,
-					[table.flowId]: ceremony.flowId,
-					[table.kind]: kind
-				};
-				const values = {
-					...table.encodeInsert({
-						moduleId: ceremony.moduleId,
-						flowId: ceremony.flowId,
-						purpose: ceremony.purpose,
-						kind,
-						scope,
-						originalWindowMillis: policy.admission[kind].windowMillis,
-						marker: owner.marker
-					}),
-					...identity,
-					[table.purpose]: ceremony.purpose,
-					[table.scope]: scope,
-					[table.originalWindowMillis]: policy.admission[kind].windowMillis,
-					[table.admittedAt]: null,
-					[table.retainUntil]: null,
-					[table.version]: owner.marker,
-					[table.ownerMarker]: owner.marker
-				};
-				const observation = yield* owner.insert(table.table, values, identity);
-				observation.rows = observation.rows.map((row) => Object.fromEntries(Object.entries(row).filter(([name]) => name !== table.admittedAt && name !== table.retainUntil)));
-				identities.push(identity);
-			}
-			invariant(identities.length === kinds.length);
-			const anchorIdentity = {
-				[anchor.authorityScope]: mapping.authorityScope,
-				[anchor.moduleId]: mapping.moduleId,
-				[anchor.version]: owner.marker,
-				[anchor.ownerMarker]: owner.marker
-			};
-			const stamp = sql`(select ${col(anchor.table, anchor.admittedAt)} from ${anchor.table} where ${owner.exact(anchor.table, anchorIdentity)})`;
-			const stampMillis = clock.toMillis(stamp);
-			const validStamp = both(yield* existsExact(anchor.table, anchorIdentity), sql`${stamp} is not null`, sql`${stampMillis} >= ${earliest}`, sql`${stampMillis} <= ${clock.engineNowMillis}`, sql`${stampMillis} <= ${86399999136e5}`);
-			yield* owner.finalUpdate(anchor.table, owner.exact(anchor.table, {
-				...anchorIdentity,
-				[anchor.admittedAt]: null
-			}), { [anchor.admittedAt]: clock.fromMillis(clock.engineNowMillis) }, {
-				rows: 1,
-				postcondition: validStamp
-			});
-			for (const identity of identities) {
-				const expected = {
-					...identity,
-					[table.version]: owner.marker,
-					[table.ownerMarker]: owner.marker
-				};
-				const postcondition = yield* existsExact(table.table, expected, both(sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} = ${stampMillis}`, sql`${clock.toMillis(sql`${col(table.table, table.retainUntil)}`)} = ${stampMillis} + ${chargeRetentionMillis}`));
-				yield* owner.finalUpdate(table.table, owner.exact(table.table, {
-					...expected,
-					[table.admittedAt]: null,
-					[table.retainUntil]: null
-				}), {
-					[table.admittedAt]: stamp,
-					[table.retainUntil]: clock.fromMillis(sql`${stampMillis} + ${chargeRetentionMillis}`)
-				}, {
-					rows: 1,
-					postcondition
-				});
-			}
-			owner.postconditions.push(sql`(select count(*) from ${table.table} where ${owner.exact(table.table, {
-				[table.moduleId]: ceremony.moduleId,
-				[table.flowId]: ceremony.flowId,
-				[table.ownerMarker]: owner.marker
-			})}) = ${identities.length}`);
-		})
-	};
-};
-//#endregion
-export { makePasskeyAdmissionKernel };
-
-//# sourceMappingURL=admission.mjs.map

package/dist/internal/passkey/admission.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"admission.mjs","names":[],"sources":["../../../src/internal/passkey/admission.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport type { PasskeyCeremony, PasskeyMethodPolicy } from \"@yielded/auth/Passkey\";\nimport { Effect } from \"effect\";\n\nimport type { PasskeyChargeKind } from \"../models/passkey-model\";\nimport type { SqlExpression as SQL, QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport const makePasskeyAdmissionKernel = (\n  operations: QueryOperations,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    | \"col\"\n    | \"equal\"\n    | \"existsExact\"\n    | \"invariant\"\n    | \"key\"\n    | \"mappedColumns\"\n    | \"subjectScope\"\n    | \"targetScope\"\n  >,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n  const { sql } = operations;\n  const { col, equal, existsExact, key, mappedColumns, subjectScope, targetScope } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n  const { both } = transactions;\n\n  const chargeRetentionMillis = 86_400_000;\n\n  const chargeScopes = Effect.fnUntraced(function* (ceremony: PasskeyCeremony, subjectId?: string) {\n    const scopes: { kind: PasskeyChargeKind; scope: string }[] = [\n      { kind: \"global\", scope: yield* key(\"global\", [ceremony.moduleId]) },\n    ];\n\n    if (subjectId !== undefined)\n      scopes.push({ kind: \"subject\", scope: yield* subjectScope(subjectId) });\n    const target = yield* targetScope(ceremony);\n\n    if (target !== null) scopes.push({ kind: \"target\", scope: target });\n\n    return scopes;\n  });\n\n  const lockAdmission = Effect.fn(\"passkey.lockAdmission\")(function* (mapping: any) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.admission;\n\n    const identity = {\n      [table.authorityScope]: mapping.authorityScope,\n      [table.moduleId]: mapping.moduleId,\n    };\n\n    // The previous marker/time is telemetry, not an authentication CAS. Actual\n    // engine predicates serialize admission, including separately planned D1 batches.\n    const found = yield* owner.read(table.table, equal(table.table, identity), {\n      limit: 1,\n      observe: false,\n      columns: [table.authorityScope, table.moduleId],\n    });\n\n    invariant(found.rows.length === 1);\n    invariant(\n      found.rows[0]![table.authorityScope] === mapping.authorityScope &&\n        found.rows[0]![table.moduleId] === mapping.moduleId,\n    );\n\n    const marked = {\n      ...identity,\n      [table.version]: owner.marker,\n      [table.ownerMarker]: owner.marker,\n    };\n\n    yield* owner.updateGuarded(\n      table.table,\n      owner.exact(table.table, identity),\n      {\n        [table.version]: owner.marker,\n        [table.ownerMarker]: owner.marker,\n        [table.admittedAt]: null,\n      },\n      { rows: 1, postcondition: yield* existsExact(table.table, marked) },\n    );\n  });\n\n  const pendingCount = (mapping: any, scope?: string) => {\n    const table = mapping.flow;\n\n    return sql`(select count(*) from ${table.table} where ${both(\n      equal(table.table, { [table.moduleId]: mapping.moduleId }),\n      sql`${col(table.table, table.state)} in (${table.states.Pending}, ${table.states.Claimed})`,\n      scope === undefined ? undefined : equal(table.table, { [table.subjectScope]: scope }),\n    )})`;\n  };\n\n  const chargedCount = (mapping: any, kind: PasskeyChargeKind, scope: string, window: number) => {\n    const table = mapping.charge;\n    const clock = mapping.clock;\n\n    return sql`(select count(*) from ${table.table} where ${both(\n      equal(table.table, { [table.moduleId]: mapping.moduleId, [table.kind]: kind }),\n      kind === \"global\" ? undefined : equal(table.table, { [table.scope]: scope }),\n      sql`${col(table.table, table.admittedAt)} is not null`,\n      sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} > ${clock.engineNowMillis} - ${window}`,\n    )})`;\n  };\n\n  const admissionCondition = Effect.fnUntraced(function* (\n    mapping: any,\n    policies: ReadonlyArray<PasskeyMethodPolicy>,\n    ceremony: PasskeyCeremony,\n    subjectId: string | undefined,\n    added: ReadonlyArray<PasskeyChargeKind>,\n    newFlow: boolean,\n    resolvedSubject: boolean,\n  ) {\n    const subject = subjectId === undefined ? undefined : yield* subjectScope(subjectId);\n    const scopes = yield* chargeScopes(ceremony, subjectId);\n\n    return both(\n      ...policies.flatMap((policy) => [\n        sql`${pendingCount(mapping)} + ${newFlow ? 1 : 0} <= ${policy.maximumPending}`,\n        subjectId === undefined\n          ? undefined\n          : sql`${pendingCount(mapping, subject)} + ${newFlow || resolvedSubject ? 1 : 0} <= ${policy.maximumPendingPerSubject}`,\n        ...scopes.map(\n          ({ kind, scope }) =>\n            sql`${chargedCount(mapping, kind, scope, policy.admission[kind].windowMillis)} + ${added.includes(kind) ? 1 : 0} <= ${policy.admission[kind].limit}`,\n        ),\n      ]),\n    );\n  });\n\n  const guardAdmission = (\n    mapping: any,\n    policies: ReadonlyArray<PasskeyMethodPolicy>,\n    ceremony: PasskeyCeremony,\n    subjectId?: string,\n  ) =>\n    Effect.gen(function* () {\n      const owner = yield* CurrentPasskeyTransaction;\n\n      owner.postconditions.push(\n        yield* admissionCondition(mapping, policies, ceremony, subjectId, [], false, false),\n      );\n    });\n\n  const readCharges = Effect.fn(\"passkey.readCharges\")(function* (\n    mapping: any,\n    ceremony: PasskeyCeremony,\n    policy: PasskeyMethodPolicy,\n    subjectId?: string,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.charge;\n\n    const where = equal(table.table, {\n      [table.moduleId]: ceremony.moduleId,\n      [table.flowId]: ceremony.flowId,\n    });\n\n    const found = yield* owner.read(table.table, where, {\n      limit: 3,\n      observe: false,\n      columns: mappedColumns(table),\n    });\n\n    const scopes = yield* chargeScopes(ceremony, subjectId);\n\n    invariant(found.rows.length === scopes.length);\n    for (const { kind, scope } of scopes) {\n      const rows = found.rows.filter((row) => row[table.kind] === kind);\n\n      invariant(rows.length === 1);\n      const row = rows[0]!;\n      const admitted = mapping.clock.decodeInstant(row[table.admittedAt]);\n      const retained = mapping.clock.decodeInstant(row[table.retainUntil]);\n\n      invariant(\n        Number.isSafeInteger(admitted) &&\n          admitted >= 0 &&\n          retained === admitted + chargeRetentionMillis,\n      );\n      invariant(\n        row[table.moduleId] === ceremony.moduleId &&\n          row[table.flowId] === ceremony.flowId &&\n          row[table.purpose] === ceremony.purpose,\n      );\n      invariant(\n        row[table.scope] === scope &&\n          row[table.originalWindowMillis] === policy.admission[kind].windowMillis,\n      );\n      owner.observations.push({\n        table: table.table,\n        where: equal(table.table, {\n          [table.moduleId]: ceremony.moduleId,\n          [table.flowId]: ceremony.flowId,\n          [table.kind]: kind,\n        }),\n        rows: [row],\n      });\n    }\n  });\n\n  const guardChargeSet = (mapping: any, ceremony: PasskeyCeremony, subjectId?: string) =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      Effect.gen(function* () {\n        const table = mapping.charge;\n        const scopes = yield* chargeScopes(ceremony, subjectId);\n\n        const where = equal(table.table, {\n          [table.moduleId]: ceremony.moduleId,\n          [table.flowId]: ceremony.flowId,\n        });\n\n        owner.postconditions.push(\n          sql`(select count(*) from ${table.table} where ${where}) = ${scopes.length}`,\n        );\n        for (const { kind, scope } of scopes)\n          owner.postconditions.push(\n            yield* existsExact(table.table, {\n              [table.moduleId]: ceremony.moduleId,\n              [table.flowId]: ceremony.flowId,\n              [table.purpose]: ceremony.purpose,\n              [table.kind]: kind,\n              [table.scope]: scope,\n            }),\n          );\n      }),\n    );\n\n  const insertCharges = Effect.fn(\"passkey.insertCharges\")(function* (\n    mapping: any,\n    ceremony: PasskeyCeremony,\n    policy: PasskeyMethodPolicy,\n    kinds: ReadonlyArray<PasskeyChargeKind>,\n    subjectId?: string,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    if (kinds.length === 0) return;\n    const table = mapping.charge;\n    const anchor = mapping.admission;\n    const clock = mapping.clock;\n    const earliest = yield* owner.now(clock);\n    const identities: Record<string, unknown>[] = [];\n\n    for (const { kind, scope } of (yield* chargeScopes(ceremony, subjectId)).filter((item) =>\n      kinds.includes(item.kind),\n    )) {\n      const identity = {\n        [table.moduleId]: ceremony.moduleId,\n        [table.flowId]: ceremony.flowId,\n        [table.kind]: kind,\n      };\n\n      const values = {\n        ...table.encodeInsert({\n          moduleId: ceremony.moduleId,\n          flowId: ceremony.flowId,\n          purpose: ceremony.purpose,\n          kind,\n          scope,\n          originalWindowMillis: policy.admission[kind].windowMillis,\n          marker: owner.marker,\n        }),\n        ...identity,\n        [table.purpose]: ceremony.purpose,\n        [table.scope]: scope,\n        [table.originalWindowMillis]: policy.admission[kind].windowMillis,\n        [table.admittedAt]: null,\n        [table.retainUntil]: null,\n        [table.version]: owner.marker,\n        [table.ownerMarker]: owner.marker,\n      };\n\n      const observation = yield* owner.insert(table.table, values, identity);\n\n      observation.rows = observation.rows.map((row) =>\n        Object.fromEntries(\n          Object.entries(row).filter(\n            ([name]) => name !== table.admittedAt && name !== table.retainUntil,\n          ),\n        ),\n      );\n      identities.push(identity);\n    }\n    invariant(identities.length === kinds.length);\n\n    const anchorIdentity = {\n      [anchor.authorityScope]: mapping.authorityScope,\n      [anchor.moduleId]: mapping.moduleId,\n      [anchor.version]: owner.marker,\n      [anchor.ownerMarker]: owner.marker,\n    };\n\n    const stamp = sql`(select ${col(anchor.table, anchor.admittedAt)} from ${anchor.table} where ${owner.exact(anchor.table, anchorIdentity)})`;\n    const stampMillis = clock.toMillis(stamp);\n\n    const validStamp: SQL = both(\n      yield* existsExact(anchor.table, anchorIdentity),\n      sql`${stamp} is not null`,\n      sql`${stampMillis} >= ${earliest}`,\n      sql`${stampMillis} <= ${clock.engineNowMillis}`,\n      sql`${stampMillis} <= ${8640000000000000 - chargeRetentionMillis}`,\n    );\n\n    yield* owner.finalUpdate(\n      anchor.table,\n      owner.exact(anchor.table, { ...anchorIdentity, [anchor.admittedAt]: null }),\n      {\n        [anchor.admittedAt]: clock.fromMillis(clock.engineNowMillis),\n      },\n      { rows: 1, postcondition: validStamp },\n    );\n    for (const identity of identities) {\n      const expected = {\n        ...identity,\n        [table.version]: owner.marker,\n        [table.ownerMarker]: owner.marker,\n      };\n\n      const postcondition = yield* existsExact(\n        table.table,\n        expected,\n        both(\n          sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} = ${stampMillis}`,\n          sql`${clock.toMillis(sql`${col(table.table, table.retainUntil)}`)} = ${stampMillis} + ${chargeRetentionMillis}`,\n        ),\n      );\n\n      yield* owner.finalUpdate(\n        table.table,\n        owner.exact(table.table, {\n          ...expected,\n          [table.admittedAt]: null,\n          [table.retainUntil]: null,\n        }),\n        {\n          [table.admittedAt]: stamp,\n          [table.retainUntil]: clock.fromMillis(sql`${stampMillis} + ${chargeRetentionMillis}`),\n        },\n        { rows: 1, postcondition },\n      );\n    }\n    owner.postconditions.push(\n      sql`(select count(*) from ${table.table} where ${owner.exact(table.table, {\n        [table.moduleId]: ceremony.moduleId,\n        [table.flowId]: ceremony.flowId,\n        [table.ownerMarker]: owner.marker,\n      })}) = ${identities.length}`,\n    );\n  });\n\n  return {\n    chargeRetentionMillis,\n    chargeScopes,\n    lockAdmission,\n    admissionCondition,\n    guardAdmission,\n    readCharges,\n    guardChargeSet,\n    insertCharges,\n  };\n};\n"],"mappings":";;;AAWA,MAAa,8BACX,YACA,OAWA,iBACG;CACH,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,KAAK,OAAO,aAAa,KAAK,eAAe,cAAc,gBAAgB;CACnF,MAAM,YAA+C,MAAM;CAC3D,MAAM,EAAE,SAAS;CAEjB,MAAM,wBAAwB;CAE9B,MAAM,eAAe,OAAO,WAAW,WAAW,UAA2B,WAAoB;EAC/F,MAAM,SAAuD,CAC3D;GAAE,MAAM;GAAU,OAAO,OAAO,IAAI,UAAU,CAAC,SAAS,QAAQ,CAAC;EAAE,CACrE;EAEA,IAAI,cAAc,KAAA,GAChB,OAAO,KAAK;GAAE,MAAM;GAAW,OAAO,OAAO,aAAa,SAAS;EAAE,CAAC;EACxE,MAAM,SAAS,OAAO,YAAY,QAAQ;EAE1C,IAAI,WAAW,MAAM,OAAO,KAAK;GAAE,MAAM;GAAU,OAAO;EAAO,CAAC;EAElE,OAAO;CACT,CAAC;CAED,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,SAAc;EAChF,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAEtB,MAAM,WAAW;IACd,MAAM,iBAAiB,QAAQ;IAC/B,MAAM,WAAW,QAAQ;EAC5B;EAIA,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,OAAO,QAAQ,GAAG;GACzE,OAAO;GACP,SAAS;GACT,SAAS,CAAC,MAAM,gBAAgB,MAAM,QAAQ;EAChD,CAAC;EAED,UAAU,MAAM,KAAK,WAAW,CAAC;EACjC,UACE,MAAM,KAAK,EAAE,CAAE,MAAM,oBAAoB,QAAQ,kBAC/C,MAAM,KAAK,EAAE,CAAE,MAAM,cAAc,QAAQ,QAC/C;EAEA,MAAM,SAAS;GACb,GAAG;IACF,MAAM,UAAU,MAAM;IACtB,MAAM,cAAc,MAAM;EAC7B;EAEA,OAAO,MAAM,cACX,MAAM,OACN,MAAM,MAAM,MAAM,OAAO,QAAQ,GACjC;IACG,MAAM,UAAU,MAAM;IACtB,MAAM,cAAc,MAAM;IAC1B,MAAM,aAAa;EACtB,GACA;GAAE,MAAM;GAAG,eAAe,OAAO,YAAY,MAAM,OAAO,MAAM;EAAE,CACpE;CACF,CAAC;CAED,MAAM,gBAAgB,SAAc,UAAmB;EACrD,MAAM,QAAQ,QAAQ;EAEtB,OAAO,GAAG,yBAAyB,MAAM,MAAM,SAAS,KACtD,MAAM,MAAM,OAAO,GAAG,MAAM,WAAW,QAAQ,SAAS,CAAC,GACzD,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,OAAO,QAAQ,IAAI,MAAM,OAAO,QAAQ,IACzF,UAAU,KAAA,IAAY,KAAA,IAAY,MAAM,MAAM,OAAO,GAAG,MAAM,eAAe,MAAM,CAAC,CACtF,EAAE;CACJ;CAEA,MAAM,gBAAgB,SAAc,MAAyB,OAAe,WAAmB;EAC7F,MAAM,QAAQ,QAAQ;EACtB,MAAM,QAAQ,QAAQ;EAEtB,OAAO,GAAG,yBAAyB,MAAM,MAAM,SAAS,KACtD,MAAM,MAAM,OAAO;IAAG,MAAM,WAAW,QAAQ;IAAW,MAAM,OAAO;EAAK,CAAC,GAC7E,SAAS,WAAW,KAAA,IAAY,MAAM,MAAM,OAAO,GAAG,MAAM,QAAQ,MAAM,CAAC,GAC3E,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,UAAU,EAAE,eACzC,GAAG,GAAG,MAAM,SAAS,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,UAAU,GAAG,EAAE,KAAK,MAAM,gBAAgB,KAAK,QACnG,EAAE;CACJ;CAEA,MAAM,qBAAqB,OAAO,WAAW,WAC3C,SACA,UACA,UACA,WACA,OACA,SACA,iBACA;EACA,MAAM,UAAU,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,aAAa,SAAS;EACnF,MAAM,SAAS,OAAO,aAAa,UAAU,SAAS;EAEtD,OAAO,KACL,GAAG,SAAS,SAAS,WAAW;GAC9B,GAAG,GAAG,aAAa,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,MAAM,OAAO;GAC9D,cAAc,KAAA,IACV,KAAA,IACA,GAAG,GAAG,aAAa,SAAS,OAAO,EAAE,KAAK,WAAW,kBAAkB,IAAI,EAAE,MAAM,OAAO;GAC9F,GAAG,OAAO,KACP,EAAE,MAAM,YACP,GAAG,GAAG,aAAa,SAAS,MAAM,OAAO,OAAO,UAAU,KAAK,CAAC,YAAY,EAAE,KAAK,MAAM,SAAS,IAAI,IAAI,IAAI,EAAE,MAAM,OAAO,UAAU,KAAK,CAAC,OACjJ;EACF,CAAC,CACH;CACF,CAAC;CAED,MAAM,kBACJ,SACA,UACA,UACA,cAEA,OAAO,IAAI,aAAa;EAGtB,CAAA,OAFqB,0BAAA,CAEf,eAAe,KACnB,OAAO,mBAAmB,SAAS,UAAU,UAAU,WAAW,CAAC,GAAG,OAAO,KAAK,CACpF;CACF,CAAC;CAEH,MAAM,cAAc,OAAO,GAAG,qBAAqB,CAAC,CAAC,WACnD,SACA,UACA,QACA,WACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAEtB,MAAM,QAAQ,MAAM,MAAM,OAAO;IAC9B,MAAM,WAAW,SAAS;IAC1B,MAAM,SAAS,SAAS;EAC3B,CAAC;EAED,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM,OAAO,OAAO;GAClD,OAAO;GACP,SAAS;GACT,SAAS,cAAc,KAAK;EAC9B,CAAC;EAED,MAAM,SAAS,OAAO,aAAa,UAAU,SAAS;EAEtD,UAAU,MAAM,KAAK,WAAW,OAAO,MAAM;EAC7C,KAAK,MAAM,EAAE,MAAM,WAAW,QAAQ;GACpC,MAAM,OAAO,MAAM,KAAK,QAAQ,QAAQ,IAAI,MAAM,UAAU,IAAI;GAEhE,UAAU,KAAK,WAAW,CAAC;GAC3B,MAAM,MAAM,KAAK;GACjB,MAAM,WAAW,QAAQ,MAAM,cAAc,IAAI,MAAM,WAAW;GAClE,MAAM,WAAW,QAAQ,MAAM,cAAc,IAAI,MAAM,YAAY;GAEnE,UACE,OAAO,cAAc,QAAQ,KAC3B,YAAY,KACZ,aAAa,WAAW,qBAC5B;GACA,UACE,IAAI,MAAM,cAAc,SAAS,YAC/B,IAAI,MAAM,YAAY,SAAS,UAC/B,IAAI,MAAM,aAAa,SAAS,OACpC;GACA,UACE,IAAI,MAAM,WAAW,SACnB,IAAI,MAAM,0BAA0B,OAAO,UAAU,KAAK,CAAC,YAC/D;GACA,MAAM,aAAa,KAAK;IACtB,OAAO,MAAM;IACb,OAAO,MAAM,MAAM,OAAO;MACvB,MAAM,WAAW,SAAS;MAC1B,MAAM,SAAS,SAAS;MACxB,MAAM,OAAO;IAChB,CAAC;IACD,MAAM,CAAC,GAAG;GACZ,CAAC;EACH;CACF,CAAC;CAED,MAAM,kBAAkB,SAAc,UAA2B,cAC/D,OAAO,QAAQ,4BAA4B,UACzC,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,QAAQ;EACtB,MAAM,SAAS,OAAO,aAAa,UAAU,SAAS;EAEtD,MAAM,QAAQ,MAAM,MAAM,OAAO;IAC9B,MAAM,WAAW,SAAS;IAC1B,MAAM,SAAS,SAAS;EAC3B,CAAC;EAED,MAAM,eAAe,KACnB,GAAG,yBAAyB,MAAM,MAAM,SAAS,MAAM,MAAM,OAAO,QACtE;EACA,KAAK,MAAM,EAAE,MAAM,WAAW,QAC5B,MAAM,eAAe,KACnB,OAAO,YAAY,MAAM,OAAO;IAC7B,MAAM,WAAW,SAAS;IAC1B,MAAM,SAAS,SAAS;IACxB,MAAM,UAAU,SAAS;IACzB,MAAM,OAAO;IACb,MAAM,QAAQ;EACjB,CAAC,CACH;CACJ,CAAC,CACH;CA6HF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA,eAnIoB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,UACA,QACA,OACA,WACA;GACA,MAAM,QAAQ,OAAO;GAErB,IAAI,MAAM,WAAW,GAAG;GACxB,MAAM,QAAQ,QAAQ;GACtB,MAAM,SAAS,QAAQ;GACvB,MAAM,QAAQ,QAAQ;GACtB,MAAM,WAAW,OAAO,MAAM,IAAI,KAAK;GACvC,MAAM,aAAwC,CAAC;GAE/C,KAAK,MAAM,EAAE,MAAM,YAAY,OAAO,aAAa,UAAU,SAAS,EAAA,CAAG,QAAQ,SAC/E,MAAM,SAAS,KAAK,IAAI,CAC1B,GAAG;IACD,MAAM,WAAW;MACd,MAAM,WAAW,SAAS;MAC1B,MAAM,SAAS,SAAS;MACxB,MAAM,OAAO;IAChB;IAEA,MAAM,SAAS;KACb,GAAG,MAAM,aAAa;MACpB,UAAU,SAAS;MACnB,QAAQ,SAAS;MACjB,SAAS,SAAS;MAClB;MACA;MACA,sBAAsB,OAAO,UAAU,KAAK,CAAC;MAC7C,QAAQ,MAAM;KAChB,CAAC;KACD,GAAG;MACF,MAAM,UAAU,SAAS;MACzB,MAAM,QAAQ;MACd,MAAM,uBAAuB,OAAO,UAAU,KAAK,CAAC;MACpD,MAAM,aAAa;MACnB,MAAM,cAAc;MACpB,MAAM,UAAU,MAAM;MACtB,MAAM,cAAc,MAAM;IAC7B;IAEA,MAAM,cAAc,OAAO,MAAM,OAAO,MAAM,OAAO,QAAQ,QAAQ;IAErE,YAAY,OAAO,YAAY,KAAK,KAAK,QACvC,OAAO,YACL,OAAO,QAAQ,GAAG,CAAC,CAAC,QACjB,CAAC,UAAU,SAAS,MAAM,cAAc,SAAS,MAAM,WAC1D,CACF,CACF;IACA,WAAW,KAAK,QAAQ;GAC1B;GACA,UAAU,WAAW,WAAW,MAAM,MAAM;GAE5C,MAAM,iBAAiB;KACpB,OAAO,iBAAiB,QAAQ;KAChC,OAAO,WAAW,QAAQ;KAC1B,OAAO,UAAU,MAAM;KACvB,OAAO,cAAc,MAAM;GAC9B;GAEA,MAAM,QAAQ,GAAG,WAAW,IAAI,OAAO,OAAO,OAAO,UAAU,EAAE,QAAQ,OAAO,MAAM,SAAS,MAAM,MAAM,OAAO,OAAO,cAAc,EAAE;GACzI,MAAM,cAAc,MAAM,SAAS,KAAK;GAExC,MAAM,aAAkB,KACtB,OAAO,YAAY,OAAO,OAAO,cAAc,GAC/C,GAAG,GAAG,MAAM,eACZ,GAAG,GAAG,YAAY,MAAM,YACxB,GAAG,GAAG,YAAY,MAAM,MAAM,mBAC9B,GAAG,GAAG,YAAY,MAAM,eAC1B;GAEA,OAAO,MAAM,YACX,OAAO,OACP,MAAM,MAAM,OAAO,OAAO;IAAE,GAAG;KAAiB,OAAO,aAAa;GAAK,CAAC,GAC1E,GACG,OAAO,aAAa,MAAM,WAAW,MAAM,eAAe,EAC7D,GACA;IAAE,MAAM;IAAG,eAAe;GAAW,CACvC;GACA,KAAK,MAAM,YAAY,YAAY;IACjC,MAAM,WAAW;KACf,GAAG;MACF,MAAM,UAAU,MAAM;MACtB,MAAM,cAAc,MAAM;IAC7B;IAEA,MAAM,gBAAgB,OAAO,YAC3B,MAAM,OACN,UACA,KACE,GAAG,GAAG,MAAM,SAAS,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,UAAU,GAAG,EAAE,KAAK,eACtE,GAAG,GAAG,MAAM,SAAS,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,WAAW,GAAG,EAAE,KAAK,YAAY,KAAK,uBAC1F,CACF;IAEA,OAAO,MAAM,YACX,MAAM,OACN,MAAM,MAAM,MAAM,OAAO;KACvB,GAAG;MACF,MAAM,aAAa;MACnB,MAAM,cAAc;IACvB,CAAC,GACD;MACG,MAAM,aAAa;MACnB,MAAM,cAAc,MAAM,WAAW,GAAG,GAAG,YAAY,KAAK,uBAAuB;IACtF,GACA;KAAE,MAAM;KAAG;IAAc,CAC3B;GACF;GACA,MAAM,eAAe,KACnB,GAAG,yBAAyB,MAAM,MAAM,SAAS,MAAM,MAAM,MAAM,OAAO;KACvE,MAAM,WAAW,SAAS;KAC1B,MAAM,SAAS,SAAS;KACxB,MAAM,cAAc,MAAM;GAC7B,CAAC,EAAE,MAAM,WAAW,QACtB;EACF,CAUc;CACd;AACF"}

package/dist/internal/passkey/credentials.d.mts

@@ -1,14 +0,0 @@
-import "../transaction-kernel.mjs";
-import "../query-operations.mjs";
-import "./state.mjs";
-import { Effect } from "effect";
-import { PasskeyCredential, PasskeyRevision } from "@yielded/auth/Passkey";
-import { SubjectId } from "@yielded/auth/Schema";
-//#region src/internal/passkey/credentials.d.ts
-export interface SubjectRead {
-  readonly nativeId: unknown;
-  readonly subjectId: SubjectId;
-  readonly securityRevision: typeof PasskeyRevision.Type.securityRevision;
-}
-//#endregion
-//# sourceMappingURL=credentials.d.mts.map