@yielded/auth-persistence 0.1.0-beta.30 → 0.1.0-beta.32

package/README.md

@@ -28,13 +28,17 @@ Applications own subject provisioning, policy, claims, delivery, and their datab
 connection and migration runner.
 
 The composed Layer covers password sign-in and management, email address verification
-and changes, phone sign-in, and passkey sign-in and management with stateful sessions
-on PostgreSQL and SQLite. The `/Adapter` module has two integration levels:
-typed table mappings, or `NativeSqlTables` with shared strategy factories. The same
-native statements and commit owner serve direct SQL and Drizzle; drivers translate
-physical columns and expressions and supply transaction or atomic-batch execution.
-Plain reads use no transaction. Protected mutations retain their named final checks
-when an application joins additional work to the owner.
+and changes, phone sign-in, passkey sign-in and management, OAuth sign-in with optional
+retained access, and connected accounts with stateful sessions on PostgreSQL and SQLite.
+OAuth-only definitions also support stateless sessions without a session table; identity
+authority and OAuth flows remain durable. Other stateless combinations and state-assisted
+sessions require explicit persistence services.
+OAuth registration and login linking/unlinking still use explicit `OAuthPersistence`
+mappings. Applications provision login identities and supply OAuth action evidence,
+use authorization, provider configuration, and encryption keys.
+Adapter authors use typed table mappings or
+`NativeSqlTables` through `/Adapter`. Use the explicit coordinators when auth and
+application writes must share one commit; independent transaction owners are not atomic.
 See [persistence examples](../../docs/src/content/docs/reference/adapters.md#runnable-examples) for all
 four ownership models and their current limits.
 

package/dist/Adapter.d.mts

@@ -14,11 +14,11 @@ import { OAuthProxySqlTable, makeOAuthProxyPersistence } from "./internal/oauth-
 import { StorageRole, StorageTable, storageTables } from "./internal/storage-tables.mjs";
 import { BoundPersistence, ClaimsCodec, Definition, MappingInput, PersistenceApi, PersistenceConfigurationError } from "./internal/configuration.mjs";
 import { NativeSqlTables, SqlTable, makeNativeSqlTables, nativeSqlAlias } from "./internal/native-sql-table.mjs";
+import { SqlBatchCommit, SqlNativeCommit, captureSqlBatchStatements, makeSqlCommitExecutor } from "./internal/sql-commit.mjs";
 import { Backend, createPersistence } from "./internal/persistence.mjs";
 import { makeMappings } from "./internal/storage-mapping.mjs";
 import { PasswordRegistrationAuthority } from "./internal/registration-contract.mjs";
 import { PhysicalStorageTable, StorageValidation, validateStorage, validateStorageBatch, withStorageValidation } from "./internal/storage-validation.mjs";
-import { SqlBatchCommit, SqlNativeCommit, captureSqlBatchStatements, makeSqlCommitExecutor } from "./internal/sql-commit.mjs";
 import { PasskeyNativeMapping, PasskeyNativeRead } from "./internal/passkey-native-state.mjs";
 import { makeBatchPasskeyServices, makeNativePasskeyCredentialServices, makeNativePasskeyServices } from "./internal/passkey-native.mjs";
 import { NativePasskeyCeremonyMapping, makeNativePasskeyCeremonyServices } from "./internal/passkey-native-ceremony.mjs";

package/dist/Adapter.mjs

@@ -5,10 +5,17 @@ import { requireStandalone } from "./internal/standalone.mjs";
 import { SqlBatchCommit, SqlNativeCommit, captureSqlBatchStatements, makeSqlCommitExecutor } from "./internal/sql-commit.mjs";
 import { makeNativeProofServices } from "./internal/proof-native.mjs";
 import { makeNativeEmailAddressServices, makeNativeEmailSignInServices } from "./internal/email-native.mjs";
+import { requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints } from "./internal/models/oauth-connected-model.mjs";
+import { oauthCleanupTable, oauthEligibilityTable, oauthRegistrationGuardTable, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints } from "./internal/models/oauth-model.mjs";
+import { validateStorage, validateStorageBatch, withStorageValidation } from "./internal/storage-validation.mjs";
+import { captureOAuthMapping } from "./internal/oauth/state.mjs";
+import { makeNativeOAuthSignInServices } from "./internal/oauth/native-sign-in.mjs";
+import { makeNativeOAuthConnectedServices } from "./internal/oauth/native-connected.mjs";
+import { makeNativeOAuthRevocationServices } from "./internal/oauth/native-revocations.mjs";
+import { storageTables } from "./internal/storage-tables.mjs";
 import { passkeyCredentialsLayer, passkeyPersistenceLayer, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "./internal/models/passkey-model.mjs";
 import { makeBatchPasskeyServices, makeNativePasskeyCredentialServices, makeNativePasskeyServices } from "./internal/passkey-native.mjs";
 import { makePasskeyNativeManagement } from "./internal/passkey-native-write.mjs";
-import { storageTables } from "./internal/storage-tables.mjs";
 import { makeNativePasswordServices } from "./internal/password-native.mjs";
 import { requiredPhoneConstraints } from "./internal/models/phone-model.mjs";
 import { makeNativePhoneServices } from "./internal/phone-native.mjs";
@@ -22,18 +29,11 @@ import { requiredEmailAddressConstraints, requiredEmailRegistrationConstraints,
 import { requiredPasswordConstraints, requiredPasswordRegistrationConstraints } from "./internal/models/password-model.mjs";
 import { requiredProofConstraints } from "./internal/models/proof-model.mjs";
 import { makeMappings } from "./internal/storage-mapping.mjs";
-import { validateStorage, validateStorageBatch, withStorageValidation } from "./internal/storage-validation.mjs";
 import { createPersistence } from "./internal/persistence.mjs";
 import { makeOAuthProxyPersistence } from "./internal/oauth-proxy.mjs";
-import { oauthCleanupTable, oauthEligibilityTable, oauthRegistrationGuardTable, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints } from "./internal/models/oauth-model.mjs";
-import { captureOAuthMapping } from "./internal/oauth/state.mjs";
-import { makeNativeOAuthSignInServices } from "./internal/oauth/native-sign-in.mjs";
 import { makeNativeOAuthAccountsServices } from "./internal/oauth/native-accounts.mjs";
-import { makeNativeOAuthConnectedServices } from "./internal/oauth/native-connected.mjs";
 import { makeNativeOAuthRegistrationIntentServices, makeNativeOAuthRegistrationServices } from "./internal/oauth/native-registration.mjs";
-import { makeNativeOAuthRevocationServices } from "./internal/oauth/native-revocations.mjs";
 import { storageKeyPlans } from "./internal/storage-plans.mjs";
-import { requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints } from "./internal/models/oauth-connected-model.mjs";
 import { oauthAccountsPersistenceLayer, oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer, oauthRegistrationAuthorityLayer, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer } from "./internal/oauth/native-layers.mjs";
 import { passkeyInvalidationMutation } from "./internal/models/passkey-write-model.mjs";
 import { requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints } from "./internal/models/session-model.mjs";

package/dist/OAuthPersistence.mjs

@@ -5,22 +5,24 @@ import { SqlExpression, and, eq, sql } from "./internal/sql-expression.mjs";
 import { makeNativeSqlTables } from "./internal/native-sql-table.mjs";
 import { requireStandalone } from "./internal/standalone.mjs";
 import { makeSqlCommitExecutor } from "./internal/sql-commit.mjs";
+import { requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints } from "./internal/models/oauth-connected-model.mjs";
 import { requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints } from "./internal/models/oauth-model.mjs";
+import { withStorageValidation } from "./internal/storage-validation.mjs";
 import { captureOAuthMapping } from "./internal/oauth/state.mjs";
 import { makeNativeOAuthSignInServices } from "./internal/oauth/native-sign-in.mjs";
-import { makeNativeOAuthAccountsServices } from "./internal/oauth/native-accounts.mjs";
 import { makeNativeOAuthConnectedServices } from "./internal/oauth/native-connected.mjs";
-import { makeNativeOAuthRegistrationIntentServices, makeNativeOAuthRegistrationServices } from "./internal/oauth/native-registration.mjs";
 import { makeNativeOAuthRevocationServices } from "./internal/oauth/native-revocations.mjs";
+import { makeNativeOAuthAccountsServices } from "./internal/oauth/native-accounts.mjs";
+import { makeNativeOAuthRegistrationIntentServices, makeNativeOAuthRegistrationServices } from "./internal/oauth/native-registration.mjs";
 import { validateSqlStorage } from "./internal/sql-storage-validation.mjs";
 import { oauthCleanupTable, oauthEligibilityTable, oauthRegistrationGuardTable } from "./internal/sql-oauth-model.mjs";
-import { requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints } from "./internal/models/oauth-connected-model.mjs";
 import { oauthAccountsPersistenceLayer, oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer, oauthRegistrationAuthorityLayer, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer } from "./internal/oauth/native-layers.mjs";
 import { makeAuthenticationAuthorityServices } from "./internal/sql-authority.mjs";
 import { Effect, Predicate, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 import { hasCommitScope } from "@yielded/auth/Hooks";
 import { OAuthAccountsPersistence, OAuthConnectedPersistence, OAuthConnectedRevocations, OAuthRegistrationIntents, OAuthSignInPersistence, OAuthUnavailable } from "@yielded/auth/OAuth";
+import { reportAuthDiagnostic } from "@yielded/auth/Persistence";
 //#region src/OAuthPersistence.ts
 /** Direct PostgreSQL and SQLite owners for upstream OAuth. Provider exchange stays outside these transactions. */
 var OAuthPersistence_exports = /* @__PURE__ */ __exportAll({
@@ -74,7 +76,10 @@ const acquire = Effect.gen(function* () {
 		pg: () => true,
 		sqlite: () => true,
 		orElse: () => false
-	}) || Predicate.hasProperty(client, "~@effect/sql-d1/D1Client")) return yield* PersistenceConfigurationError.make({ reason: "OAuth persistence requires PostgreSQL or SQLite with interactive transactions" });
+	}) || Predicate.hasProperty(client, "~@effect/sql-d1/D1Client")) {
+		yield* reportAuthDiagnostic("persistence-validation", "configuration");
+		return yield* PersistenceConfigurationError.make({ reason: "OAuth persistence requires PostgreSQL or SQLite with interactive transactions" });
+	}
 	return {
 		client,
 		tables: makeNativeSqlTables(client)
@@ -85,7 +90,7 @@ const using = (original, make) => Effect.gen(function* () {
 	const mapping = captureOAuthMapping(original);
 	yield* validateSqlStorage(mapping).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
 	return yield* make(target.tables, mapping);
-});
+}).pipe(withStorageValidation);
 const coordinate = (make, body) => Effect.gen(function* () {
 	const { client } = yield* acquire;
 	if (yield* hasCommitScope) return yield* OAuthUnavailable.make({});

package/dist/OAuthPersistence.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"OAuthPersistence.mjs","names":[],"sources":["../src/OAuthPersistence.ts"],"sourcesContent":["/** Direct PostgreSQL and SQLite owners for upstream OAuth. Provider exchange stays outside these transactions. */\nimport { hasCommitScope, type LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthAccountsPersistence,\n  OAuthSignInPersistence,\n  OAuthRegistrationIntents,\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport { type Context, type Crypto, Effect, Predicate, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { PersistenceConfigurationError } from \"./internal/configuration\";\nimport { makeNativeSqlTables } from \"./internal/native-sql-table\";\nimport {\n  makeNativeOAuthAccountsServices,\n  type OAuthNativeAccountsMapping,\n} from \"./internal/oauth/native-accounts\";\nimport { makeNativeOAuthConnectedServices } from \"./internal/oauth/native-connected\";\nimport type { OAuthNativeConnectedMapping } from \"./internal/oauth/native-connected-state\";\nimport {\n  makeNativeOAuthRegistrationIntentServices,\n  makeNativeOAuthRegistrationServices,\n  type OAuthNativeRegistrationIntentMapping,\n  type OAuthNativeRegistrationMapping,\n} from \"./internal/oauth/native-registration\";\nimport {\n  makeNativeOAuthRevocationServices,\n  type OAuthNativeRevocationMapping,\n} from \"./internal/oauth/native-revocations\";\nimport { makeNativeOAuthSignInServices } from \"./internal/oauth/native-sign-in\";\nimport { type OAuthNativeReadMapping } from \"./internal/oauth/native-state\";\nimport { captureOAuthMapping } from \"./internal/oauth/state\";\nimport { makeSqlCommitExecutor } from \"./internal/sql-commit\";\nimport { sql, SqlExpression } from \"./internal/sql-expression\";\nimport type {\n  OAuthConnectedMapping,\n  OAuthConnectedRevocationMapping,\n} from \"./internal/sql-oauth-connected-model\";\nimport type {\n  OAuthAccountsMapping,\n  OAuthSignInMapping,\n  OAuthRegistrationIntentMapping,\n  OAuthRegistrationMapping,\n  OAuthRegistrationAuthority,\n} from \"./internal/sql-oauth-model\";\nimport { validateSqlStorage } from \"./internal/sql-storage-validation\";\nimport { Table } from \"./internal/sql-table\";\nimport { requireStandalone } from \"./internal/standalone\";\nimport type { StorageTable } from \"./internal/storage-tables\";\nexport * from \"./internal/sql-oauth-model\";\nexport * from \"./internal/sql-oauth-connected-model\";\nexport * from \"./internal/oauth/native-layers\";\nexport { sql, and, eq } from \"./internal/sql-expression\";\nexport { makeAuthenticationAuthorityServices } from \"./internal/sql-authority\";\n\nexport const table = (definition: StorageTable) =>\n  new Table(definition.name, definition.columns, definition.unique, definition.schema);\n\nexport const clock = {\n  encodeInstant: Schema.encodeSync(Schema.Int),\n  decodeInstant: Schema.decodeUnknownSync(Schema.Int),\n  engineNowMillis: new SqlExpression((client) =>\n    client.onDialectOrElse({\n      pg: () => client`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)`,\n      orElse: () => client`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`,\n    }),\n  ),\n  toMillis: (expression: SqlExpression) => expression,\n  fromMillis: (expression: SqlExpression) => expression,\n};\n\nconst acquire = Effect.gen(function* () {\n  const client = yield* SqlClient.SqlClient;\n\n  if (\n    !client.onDialectOrElse({ pg: () => true, sqlite: () => true, orElse: () => false }) ||\n    Predicate.hasProperty(client, \"~@effect/sql-d1/D1Client\")\n  )\n    return yield* PersistenceConfigurationError.make({\n      reason: \"OAuth persistence requires PostgreSQL or SQLite with interactive transactions\",\n    });\n\n  return { client, tables: makeNativeSqlTables(client) };\n});\n\nconst using = <M, A, E, R>(\n  original: M,\n  make: (tables: ReturnType<typeof makeNativeSqlTables>, mapping: M) => Effect.Effect<A, E, R>,\n) =>\n  Effect.gen(function* () {\n    const target = yield* acquire;\n    const mapping = captureOAuthMapping(original);\n\n    yield* validateSqlStorage(mapping).pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n\n    return yield* make(target.tables, mapping);\n  });\n\nconst coordinate = <S, A, E, R, ES, RS>(\n  make: Effect.Effect<S, ES, RS>,\n  body: (services: S) => Effect.Effect<A, E, R>,\n) =>\n  Effect.gen(function* () {\n    const { client } = yield* acquire;\n\n    if (yield* hasCommitScope) return yield* OAuthUnavailable.make({});\n    yield* requireStandalone(() => OAuthUnavailable.make({}), client.transactionService);\n    const executor = yield* makeSqlCommitExecutor(() => OAuthUnavailable.make({}));\n\n    return yield* executor.coordinate(\n      Effect.flatMap(make.pipe(Effect.mapError(() => OAuthUnavailable.make({}))), body),\n    );\n  });\n\nexport const makeOAuthSignInServices = <N>(\n  mapping: OAuthSignInMapping<Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthSignInPersistence: OAuthSignInPersistence[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthSignInServices(tables, value as unknown as OAuthNativeReadMapping),\n  );\n\nexport const coordinateOAuthSignIn = <N, A, E, R>(\n  options: { readonly mapping: OAuthSignInMapping<Table, Table, Table, Table, Table, N> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, OAuthSignInPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthSignInServices(options.mapping), (services) =>\n    Effect.provideService(body, OAuthSignInPersistence, services.oauthSignInPersistence),\n  );\n\nexport const makeOAuthAccountsServices = <N>(\n  mapping: OAuthAccountsMapping<Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthAccountsPersistence: OAuthAccountsPersistence[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthAccountsServices(tables, value as unknown as OAuthNativeAccountsMapping),\n  );\n\nexport const coordinateOAuthAccounts = <N, A, E, R>(\n  options: { readonly mapping: OAuthAccountsMapping<Table, Table, Table, Table, Table, N> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, OAuthAccountsPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthAccountsServices(options.mapping), (services) =>\n    Effect.provideService(body, OAuthAccountsPersistence, services.oauthAccountsPersistence),\n  );\n\nexport const makeOAuthRegistrationIntentServices = <N>(\n  mapping: OAuthRegistrationIntentMapping<Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthRegistrationIntents: OAuthRegistrationIntents[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthRegistrationIntentServices(\n      tables,\n      value as unknown as OAuthNativeRegistrationIntentMapping,\n    ),\n  );\n\nexport const coordinateOAuthRegistrationIntents = <N, A, E, R>(\n  options: { readonly mapping: OAuthRegistrationIntentMapping<Table, Table, N> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, OAuthRegistrationIntents> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthRegistrationIntentServices(options.mapping), (services) =>\n    Effect.provideService(body, OAuthRegistrationIntents, services.oauthRegistrationIntents),\n  );\n\nexport const makeOAuthConnectedServices = <N>(\n  mapping: OAuthConnectedMapping<Table, Table, Table, Table, Table, N, Table>,\n): Effect.Effect<\n  { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthConnectedServices(tables, value as unknown as OAuthNativeConnectedMapping),\n  );\n\nexport const coordinateOAuthConnected = <N, A, E, R>(\n  options: { readonly mapping: OAuthConnectedMapping<Table, Table, Table, Table, Table, N, Table> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, OAuthConnectedPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthConnectedServices(options.mapping), (services) =>\n    Effect.provideService(body, OAuthConnectedPersistence, services.oauthConnectedPersistence),\n  );\n\nexport const makeOAuthConnectedRevocationServices = <N>(\n  mapping: OAuthConnectedRevocationMapping<Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthRevocationServices(tables, value as unknown as OAuthNativeRevocationMapping),\n  );\n\nexport const coordinateOAuthConnectedRevocations = <N, A, E, R>(\n  options: { readonly mapping: OAuthConnectedRevocationMapping<Table, Table, Table, N> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, OAuthConnectedRevocations> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthConnectedRevocationServices(options.mapping), (services) =>\n    Effect.provideService(body, OAuthConnectedRevocations, services.oauthConnectedRevocations),\n  );\n\nexport const makeOAuthRegistrationServices = <Registration, N>(\n  mapping: OAuthRegistrationMapping<Registration, Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthRegistrationServices(\n      tables,\n      value as unknown as OAuthNativeRegistrationMapping<Registration>,\n    ),\n  );\n\nexport const coordinateOAuthRegistration = <Id, Registration, N, A, E, R>(\n  options: {\n    readonly mapping: OAuthRegistrationMapping<\n      NoInfer<Registration>,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      N\n    >;\n    readonly target: Context.Key<Id, OAuthRegistrationAuthority<Registration>>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, Id> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthRegistrationServices(options.mapping), (services) =>\n    Effect.provideService(body, options.target, services.registrationAuthority),\n  );\n\nexport const oauthConnectedOwnershipReferences = <N>(\n  mapping: OAuthConnectedMapping<Table, Table, Table, Table, Table, N, Table>,\n) => ({\n  connectedReference: (input: { readonly identityKey: string; readonly subjectId: N }) => {\n    const g = mapping.grant;\n    const grant = sql`exists(select 1 from ${g.table} where ${g.table.columns[g.identityKey]} = ${input.identityKey} and ${g.table.columns[g.subjectId]} = ${input.subjectId})`;\n\n    if (mapping.revocation.mode === \"unsupported\") return grant;\n    const j = mapping.revocation.job;\n\n    return sql`(${grant}) or exists(select 1 from ${j.table} where ${j.table.columns[j.identityKey]} = ${input.identityKey} and ${j.table.columns[j.subjectId]} = ${input.subjectId})`;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,MAAa,SAAS,eACpB,IAAI,MAAM,WAAW,MAAM,WAAW,SAAS,WAAW,QAAQ,WAAW,MAAM;AAErF,MAAa,QAAQ;CACnB,eAAe,OAAO,WAAW,OAAO,GAAG;CAC3C,eAAe,OAAO,kBAAkB,OAAO,GAAG;CAClD,iBAAiB,IAAI,eAAe,WAClC,OAAO,gBAAgB;EACrB,UAAU,MAAM;EAChB,cAAc,MAAM;CACtB,CAAC,CACH;CACA,WAAW,eAA8B;CACzC,aAAa,eAA8B;AAC7C;AAEA,MAAM,UAAU,OAAO,IAAI,aAAa;CACtC,MAAM,SAAS,OAAO,UAAU;CAEhC,IACE,CAAC,OAAO,gBAAgB;EAAE,UAAU;EAAM,cAAc;EAAM,cAAc;CAAM,CAAC,KACnF,UAAU,YAAY,QAAQ,0BAA0B,GAExD,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,gFACV,CAAC;CAEH,OAAO;EAAE;EAAQ,QAAQ,oBAAoB,MAAM;CAAE;AACvD,CAAC;AAED,MAAM,SACJ,UACA,SAEA,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,OAAO;CACtB,MAAM,UAAU,oBAAoB,QAAQ;CAE5C,OAAO,mBAAmB,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;CAExF,OAAO,OAAO,KAAK,OAAO,QAAQ,OAAO;AAC3C,CAAC;AAEH,MAAM,cACJ,MACA,SAEA,OAAO,IAAI,aAAa;CACtB,MAAM,EAAE,WAAW,OAAO;CAE1B,IAAI,OAAO,gBAAgB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;CACjE,OAAO,wBAAwB,iBAAiB,KAAK,CAAC,CAAC,GAAG,OAAO,kBAAkB;CAGnF,OAAO,QAAO,OAFU,4BAA4B,iBAAiB,KAAK,CAAC,CAAC,CAAC,EAAA,CAEtD,WACrB,OAAO,QAAQ,KAAK,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAClF;AACF,CAAC;AAEH,MAAa,2BACX,YAMA,MAAM,UAAU,QAAQ,UACtB,8BAA8B,QAAQ,KAA0C,CAClF;AAEF,MAAa,yBACX,SACA,SAMA,WAAW,wBAAwB,QAAQ,OAAO,IAAI,aACpD,OAAO,eAAe,MAAM,wBAAwB,SAAS,sBAAsB,CACrF;AAEF,MAAa,6BACX,YAMA,MAAM,UAAU,QAAQ,UACtB,gCAAgC,QAAQ,KAA8C,CACxF;AAEF,MAAa,2BACX,SACA,SAMA,WAAW,0BAA0B,QAAQ,OAAO,IAAI,aACtD,OAAO,eAAe,MAAM,0BAA0B,SAAS,wBAAwB,CACzF;AAEF,MAAa,uCACX,YAMA,MAAM,UAAU,QAAQ,UACtB,0CACE,QACA,KACF,CACF;AAEF,MAAa,sCACX,SACA,SAMA,WAAW,oCAAoC,QAAQ,OAAO,IAAI,aAChE,OAAO,eAAe,MAAM,0BAA0B,SAAS,wBAAwB,CACzF;AAEF,MAAa,8BACX,YAMA,MAAM,UAAU,QAAQ,UACtB,iCAAiC,QAAQ,KAA+C,CAC1F;AAEF,MAAa,4BACX,SACA,SAMA,WAAW,2BAA2B,QAAQ,OAAO,IAAI,aACvD,OAAO,eAAe,MAAM,2BAA2B,SAAS,yBAAyB,CAC3F;AAEF,MAAa,wCACX,YAMA,MAAM,UAAU,QAAQ,UACtB,kCAAkC,QAAQ,KAAgD,CAC5F;AAEF,MAAa,uCACX,SACA,SAMA,WAAW,qCAAqC,QAAQ,OAAO,IAAI,aACjE,OAAO,eAAe,MAAM,2BAA2B,SAAS,yBAAyB,CAC3F;AAEF,MAAa,iCACX,YAMA,MAAM,UAAU,QAAQ,UACtB,oCACE,QACA,KACF,CACF;AAEF,MAAa,+BACX,SAYA,SAMA,WAAW,8BAA8B,QAAQ,OAAO,IAAI,aAC1D,OAAO,eAAe,MAAM,QAAQ,QAAQ,SAAS,qBAAqB,CAC5E;AAEF,MAAa,qCACX,aACI,EACJ,qBAAqB,UAAmE;CACtF,MAAM,IAAI,QAAQ;CAClB,MAAM,QAAQ,GAAG,wBAAwB,EAAE,MAAM,SAAS,EAAE,MAAM,QAAQ,EAAE,aAAa,KAAK,MAAM,YAAY,OAAO,EAAE,MAAM,QAAQ,EAAE,WAAW,KAAK,MAAM,UAAU;CAEzK,IAAI,QAAQ,WAAW,SAAS,eAAe,OAAO;CACtD,MAAM,IAAI,QAAQ,WAAW;CAE7B,OAAO,GAAG,IAAI,MAAM,4BAA4B,EAAE,MAAM,SAAS,EAAE,MAAM,QAAQ,EAAE,aAAa,KAAK,MAAM,YAAY,OAAO,EAAE,MAAM,QAAQ,EAAE,WAAW,KAAK,MAAM,UAAU;AAClL,EACF"}
+{"version":3,"file":"OAuthPersistence.mjs","names":[],"sources":["../src/OAuthPersistence.ts"],"sourcesContent":["/** Direct PostgreSQL and SQLite owners for upstream OAuth. Provider exchange stays outside these transactions. */\nimport { hasCommitScope, type LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthAccountsPersistence,\n  OAuthSignInPersistence,\n  OAuthRegistrationIntents,\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport { reportAuthDiagnostic } from \"@yielded/auth/Persistence\";\nimport { type Context, type Crypto, Effect, Predicate, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { PersistenceConfigurationError } from \"./internal/configuration\";\nimport { makeNativeSqlTables } from \"./internal/native-sql-table\";\nimport {\n  makeNativeOAuthAccountsServices,\n  type OAuthNativeAccountsMapping,\n} from \"./internal/oauth/native-accounts\";\nimport { makeNativeOAuthConnectedServices } from \"./internal/oauth/native-connected\";\nimport type { OAuthNativeConnectedMapping } from \"./internal/oauth/native-connected-state\";\nimport {\n  makeNativeOAuthRegistrationIntentServices,\n  makeNativeOAuthRegistrationServices,\n  type OAuthNativeRegistrationIntentMapping,\n  type OAuthNativeRegistrationMapping,\n} from \"./internal/oauth/native-registration\";\nimport {\n  makeNativeOAuthRevocationServices,\n  type OAuthNativeRevocationMapping,\n} from \"./internal/oauth/native-revocations\";\nimport { makeNativeOAuthSignInServices } from \"./internal/oauth/native-sign-in\";\nimport { type OAuthNativeReadMapping } from \"./internal/oauth/native-state\";\nimport { captureOAuthMapping } from \"./internal/oauth/state\";\nimport { makeSqlCommitExecutor } from \"./internal/sql-commit\";\nimport { sql, SqlExpression } from \"./internal/sql-expression\";\nimport type {\n  OAuthConnectedMapping,\n  OAuthConnectedRevocationMapping,\n} from \"./internal/sql-oauth-connected-model\";\nimport type {\n  OAuthAccountsMapping,\n  OAuthSignInMapping,\n  OAuthRegistrationIntentMapping,\n  OAuthRegistrationMapping,\n  OAuthRegistrationAuthority,\n} from \"./internal/sql-oauth-model\";\nimport { validateSqlStorage } from \"./internal/sql-storage-validation\";\nimport { Table } from \"./internal/sql-table\";\nimport { requireStandalone } from \"./internal/standalone\";\nimport type { StorageTable } from \"./internal/storage-tables\";\nimport { withStorageValidation } from \"./internal/storage-validation\";\nexport * from \"./internal/sql-oauth-model\";\nexport * from \"./internal/sql-oauth-connected-model\";\nexport * from \"./internal/oauth/native-layers\";\nexport { sql, and, eq } from \"./internal/sql-expression\";\nexport { makeAuthenticationAuthorityServices } from \"./internal/sql-authority\";\n\nexport const table = (definition: StorageTable) =>\n  new Table(definition.name, definition.columns, definition.unique, definition.schema);\n\nexport const clock = {\n  encodeInstant: Schema.encodeSync(Schema.Int),\n  decodeInstant: Schema.decodeUnknownSync(Schema.Int),\n  engineNowMillis: new SqlExpression((client) =>\n    client.onDialectOrElse({\n      pg: () => client`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)`,\n      orElse: () => client`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`,\n    }),\n  ),\n  toMillis: (expression: SqlExpression) => expression,\n  fromMillis: (expression: SqlExpression) => expression,\n};\n\nconst acquire = Effect.gen(function* () {\n  const client = yield* SqlClient.SqlClient;\n\n  if (\n    !client.onDialectOrElse({ pg: () => true, sqlite: () => true, orElse: () => false }) ||\n    Predicate.hasProperty(client, \"~@effect/sql-d1/D1Client\")\n  ) {\n    yield* reportAuthDiagnostic(\"persistence-validation\", \"configuration\");\n\n    return yield* PersistenceConfigurationError.make({\n      reason: \"OAuth persistence requires PostgreSQL or SQLite with interactive transactions\",\n    });\n  }\n\n  return { client, tables: makeNativeSqlTables(client) };\n});\n\nconst using = <M, A, E, R>(\n  original: M,\n  make: (tables: ReturnType<typeof makeNativeSqlTables>, mapping: M) => Effect.Effect<A, E, R>,\n) =>\n  Effect.gen(function* () {\n    const target = yield* acquire;\n    const mapping = captureOAuthMapping(original);\n\n    yield* validateSqlStorage(mapping).pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n\n    return yield* make(target.tables, mapping);\n  }).pipe(withStorageValidation);\n\nconst coordinate = <S, A, E, R, ES, RS>(\n  make: Effect.Effect<S, ES, RS>,\n  body: (services: S) => Effect.Effect<A, E, R>,\n) =>\n  Effect.gen(function* () {\n    const { client } = yield* acquire;\n\n    if (yield* hasCommitScope) return yield* OAuthUnavailable.make({});\n    yield* requireStandalone(() => OAuthUnavailable.make({}), client.transactionService);\n    const executor = yield* makeSqlCommitExecutor(() => OAuthUnavailable.make({}));\n\n    return yield* executor.coordinate(\n      Effect.flatMap(make.pipe(Effect.mapError(() => OAuthUnavailable.make({}))), body),\n    );\n  });\n\nexport const makeOAuthSignInServices = <N>(\n  mapping: OAuthSignInMapping<Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthSignInPersistence: OAuthSignInPersistence[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthSignInServices(tables, value as unknown as OAuthNativeReadMapping),\n  );\n\nexport const coordinateOAuthSignIn = <N, A, E, R>(\n  options: { readonly mapping: OAuthSignInMapping<Table, Table, Table, Table, Table, N> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, OAuthSignInPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthSignInServices(options.mapping), (services) =>\n    Effect.provideService(body, OAuthSignInPersistence, services.oauthSignInPersistence),\n  );\n\nexport const makeOAuthAccountsServices = <N>(\n  mapping: OAuthAccountsMapping<Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthAccountsPersistence: OAuthAccountsPersistence[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthAccountsServices(tables, value as unknown as OAuthNativeAccountsMapping),\n  );\n\nexport const coordinateOAuthAccounts = <N, A, E, R>(\n  options: { readonly mapping: OAuthAccountsMapping<Table, Table, Table, Table, Table, N> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, OAuthAccountsPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthAccountsServices(options.mapping), (services) =>\n    Effect.provideService(body, OAuthAccountsPersistence, services.oauthAccountsPersistence),\n  );\n\nexport const makeOAuthRegistrationIntentServices = <N>(\n  mapping: OAuthRegistrationIntentMapping<Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthRegistrationIntents: OAuthRegistrationIntents[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthRegistrationIntentServices(\n      tables,\n      value as unknown as OAuthNativeRegistrationIntentMapping,\n    ),\n  );\n\nexport const coordinateOAuthRegistrationIntents = <N, A, E, R>(\n  options: { readonly mapping: OAuthRegistrationIntentMapping<Table, Table, N> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, OAuthRegistrationIntents> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthRegistrationIntentServices(options.mapping), (services) =>\n    Effect.provideService(body, OAuthRegistrationIntents, services.oauthRegistrationIntents),\n  );\n\nexport const makeOAuthConnectedServices = <N>(\n  mapping: OAuthConnectedMapping<Table, Table, Table, Table, Table, N, Table>,\n): Effect.Effect<\n  { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthConnectedServices(tables, value as unknown as OAuthNativeConnectedMapping),\n  );\n\nexport const coordinateOAuthConnected = <N, A, E, R>(\n  options: { readonly mapping: OAuthConnectedMapping<Table, Table, Table, Table, Table, N, Table> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, OAuthConnectedPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthConnectedServices(options.mapping), (services) =>\n    Effect.provideService(body, OAuthConnectedPersistence, services.oauthConnectedPersistence),\n  );\n\nexport const makeOAuthConnectedRevocationServices = <N>(\n  mapping: OAuthConnectedRevocationMapping<Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthRevocationServices(tables, value as unknown as OAuthNativeRevocationMapping),\n  );\n\nexport const coordinateOAuthConnectedRevocations = <N, A, E, R>(\n  options: { readonly mapping: OAuthConnectedRevocationMapping<Table, Table, Table, N> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, OAuthConnectedRevocations> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthConnectedRevocationServices(options.mapping), (services) =>\n    Effect.provideService(body, OAuthConnectedRevocations, services.oauthConnectedRevocations),\n  );\n\nexport const makeOAuthRegistrationServices = <Registration, N>(\n  mapping: OAuthRegistrationMapping<Registration, Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthRegistrationServices(\n      tables,\n      value as unknown as OAuthNativeRegistrationMapping<Registration>,\n    ),\n  );\n\nexport const coordinateOAuthRegistration = <Id, Registration, N, A, E, R>(\n  options: {\n    readonly mapping: OAuthRegistrationMapping<\n      NoInfer<Registration>,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      N\n    >;\n    readonly target: Context.Key<Id, OAuthRegistrationAuthority<Registration>>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, Id> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthRegistrationServices(options.mapping), (services) =>\n    Effect.provideService(body, options.target, services.registrationAuthority),\n  );\n\nexport const oauthConnectedOwnershipReferences = <N>(\n  mapping: OAuthConnectedMapping<Table, Table, Table, Table, Table, N, Table>,\n) => ({\n  connectedReference: (input: { readonly identityKey: string; readonly subjectId: N }) => {\n    const g = mapping.grant;\n    const grant = sql`exists(select 1 from ${g.table} where ${g.table.columns[g.identityKey]} = ${input.identityKey} and ${g.table.columns[g.subjectId]} = ${input.subjectId})`;\n\n    if (mapping.revocation.mode === \"unsupported\") return grant;\n    const j = mapping.revocation.job;\n\n    return sql`(${grant}) or exists(select 1 from ${j.table} where ${j.table.columns[j.identityKey]} = ${input.identityKey} and ${j.table.columns[j.subjectId]} = ${input.subjectId})`;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,MAAa,SAAS,eACpB,IAAI,MAAM,WAAW,MAAM,WAAW,SAAS,WAAW,QAAQ,WAAW,MAAM;AAErF,MAAa,QAAQ;CACnB,eAAe,OAAO,WAAW,OAAO,GAAG;CAC3C,eAAe,OAAO,kBAAkB,OAAO,GAAG;CAClD,iBAAiB,IAAI,eAAe,WAClC,OAAO,gBAAgB;EACrB,UAAU,MAAM;EAChB,cAAc,MAAM;CACtB,CAAC,CACH;CACA,WAAW,eAA8B;CACzC,aAAa,eAA8B;AAC7C;AAEA,MAAM,UAAU,OAAO,IAAI,aAAa;CACtC,MAAM,SAAS,OAAO,UAAU;CAEhC,IACE,CAAC,OAAO,gBAAgB;EAAE,UAAU;EAAM,cAAc;EAAM,cAAc;CAAM,CAAC,KACnF,UAAU,YAAY,QAAQ,0BAA0B,GACxD;EACA,OAAO,qBAAqB,0BAA0B,eAAe;EAErE,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,gFACV,CAAC;CACH;CAEA,OAAO;EAAE;EAAQ,QAAQ,oBAAoB,MAAM;CAAE;AACvD,CAAC;AAED,MAAM,SACJ,UACA,SAEA,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,OAAO;CACtB,MAAM,UAAU,oBAAoB,QAAQ;CAE5C,OAAO,mBAAmB,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;CAExF,OAAO,OAAO,KAAK,OAAO,QAAQ,OAAO;AAC3C,CAAC,CAAC,CAAC,KAAK,qBAAqB;AAE/B,MAAM,cACJ,MACA,SAEA,OAAO,IAAI,aAAa;CACtB,MAAM,EAAE,WAAW,OAAO;CAE1B,IAAI,OAAO,gBAAgB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;CACjE,OAAO,wBAAwB,iBAAiB,KAAK,CAAC,CAAC,GAAG,OAAO,kBAAkB;CAGnF,OAAO,QAAO,OAFU,4BAA4B,iBAAiB,KAAK,CAAC,CAAC,CAAC,EAAA,CAEtD,WACrB,OAAO,QAAQ,KAAK,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAClF;AACF,CAAC;AAEH,MAAa,2BACX,YAMA,MAAM,UAAU,QAAQ,UACtB,8BAA8B,QAAQ,KAA0C,CAClF;AAEF,MAAa,yBACX,SACA,SAMA,WAAW,wBAAwB,QAAQ,OAAO,IAAI,aACpD,OAAO,eAAe,MAAM,wBAAwB,SAAS,sBAAsB,CACrF;AAEF,MAAa,6BACX,YAMA,MAAM,UAAU,QAAQ,UACtB,gCAAgC,QAAQ,KAA8C,CACxF;AAEF,MAAa,2BACX,SACA,SAMA,WAAW,0BAA0B,QAAQ,OAAO,IAAI,aACtD,OAAO,eAAe,MAAM,0BAA0B,SAAS,wBAAwB,CACzF;AAEF,MAAa,uCACX,YAMA,MAAM,UAAU,QAAQ,UACtB,0CACE,QACA,KACF,CACF;AAEF,MAAa,sCACX,SACA,SAMA,WAAW,oCAAoC,QAAQ,OAAO,IAAI,aAChE,OAAO,eAAe,MAAM,0BAA0B,SAAS,wBAAwB,CACzF;AAEF,MAAa,8BACX,YAMA,MAAM,UAAU,QAAQ,UACtB,iCAAiC,QAAQ,KAA+C,CAC1F;AAEF,MAAa,4BACX,SACA,SAMA,WAAW,2BAA2B,QAAQ,OAAO,IAAI,aACvD,OAAO,eAAe,MAAM,2BAA2B,SAAS,yBAAyB,CAC3F;AAEF,MAAa,wCACX,YAMA,MAAM,UAAU,QAAQ,UACtB,kCAAkC,QAAQ,KAAgD,CAC5F;AAEF,MAAa,uCACX,SACA,SAMA,WAAW,qCAAqC,QAAQ,OAAO,IAAI,aACjE,OAAO,eAAe,MAAM,2BAA2B,SAAS,yBAAyB,CAC3F;AAEF,MAAa,iCACX,YAMA,MAAM,UAAU,QAAQ,UACtB,oCACE,QACA,KACF,CACF;AAEF,MAAa,+BACX,SAYA,SAMA,WAAW,8BAA8B,QAAQ,OAAO,IAAI,aAC1D,OAAO,eAAe,MAAM,QAAQ,QAAQ,SAAS,qBAAqB,CAC5E;AAEF,MAAa,qCACX,aACI,EACJ,qBAAqB,UAAmE;CACtF,MAAM,IAAI,QAAQ;CAClB,MAAM,QAAQ,GAAG,wBAAwB,EAAE,MAAM,SAAS,EAAE,MAAM,QAAQ,EAAE,aAAa,KAAK,MAAM,YAAY,OAAO,EAAE,MAAM,QAAQ,EAAE,WAAW,KAAK,MAAM,UAAU;CAEzK,IAAI,QAAQ,WAAW,SAAS,eAAe,OAAO;CACtD,MAAM,IAAI,QAAQ,WAAW;CAE7B,OAAO,GAAG,IAAI,MAAM,4BAA4B,EAAE,MAAM,SAAS,EAAE,MAAM,QAAQ,EAAE,aAAa,KAAK,MAAM,YAAY,OAAO,EAAE,MAAM,QAAQ,EAAE,WAAW,KAAK,MAAM,UAAU;AAClL,EACF"}

package/dist/internal/configuration.d.mts

@@ -3,6 +3,7 @@ import { StorageRole } from "./storage-tables.mjs";
 import { Context, Crypto, Effect, Layer, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 import { EmailAction, EmailAddressPersistence } from "@yielded/auth/Email";
+import { OAuthConnectedPersistence, OAuthConnectedPolicy, OAuthConnectedRevocations, OAuthSignInPersistence } from "@yielded/auth/OAuth";
 import { PasskeyActionChallenge, PasskeyConfig, PasskeyConfigurationError, PasskeyCredentials, PasskeyManagementPersistence, PasskeyManagementPolicy, PasskeyMethodPolicy, PasskeyPersistence } from "@yielded/auth/Passkey";
 import { PasswordAction, PasswordPersistence, PasswordUnavailable } from "@yielded/auth/Password";
 import { PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
@@ -23,9 +24,16 @@ export interface PasskeyFeature {
   readonly management?: boolean;
   readonly managementPolicy?: PasskeyManagementPolicy;
 }
+export interface OAuthFeature {
+  readonly kind: "oauth";
+  readonly moduleId: string;
+  readonly signIn: boolean;
+  readonly connected?: OAuthConnectedPolicy;
+}
 export interface Strategy {
   readonly strategy: object;
-  readonly persistence?: PasskeyFeature | {
+  /** Absent metadata leaves the strategy's persistence services application-supplied. */
+  readonly persistence?: PasskeyFeature | OAuthFeature | {
     readonly kind: "password" | "phone" | "email";
     readonly moduleId: string;
     readonly lifecycle?: boolean;
@@ -44,7 +52,7 @@ export interface Definition<C extends ClaimsCodec, Id extends string> {
 type KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;
 type Enabled<A extends {
   readonly strategies: Readonly<Record<string, Strategy>>;
-}, Kind extends "password" | "phone" | "email" | "passkey"> = Extract<A["strategies"][keyof A["strategies"]], {
+}, Kind extends "password" | "phone" | "email" | "passkey" | "oauth"> = Extract<A["strategies"][keyof A["strategies"]], {
   persistence: {
     kind: Kind;
   };
@@ -66,6 +74,20 @@ type ManagedPasskey<A extends {
 type PasskeyRequirement$1<A extends {
   readonly strategies: Readonly<Record<string, Strategy>>;
 }> = Enabled<A, "passkey"> extends never ? never : PasskeyConfig;
+type OAuthSignIn<A extends {
+  readonly strategies: Readonly<Record<string, Strategy>>;
+}> = Extract<Enabled<A, "oauth">, {
+  persistence: {
+    signIn: true;
+  };
+}>;
+type OAuthConnected<A extends {
+  readonly strategies: Readonly<Record<string, Strategy>>;
+}> = Extract<Enabled<A, "oauth">, {
+  persistence: {
+    connected: OAuthConnectedPolicy;
+  };
+}>;
 type RegistrationKey<S> = S extends {
   readonly RegistrationAuthority: infer K;
 } ? K : never;
@@ -78,6 +100,19 @@ export interface ProvisioningId<Id extends string> {
   readonly authNamespace: Id;
   readonly service: "PersistenceProvisioning";
 }
+export interface SubjectProvisioningInput<Registration> {
+  readonly requestId: string;
+  readonly identifier: LoginIdentifier;
+  readonly registration: Registration;
+}
+/** Return application subject values for insertion by the auth commit owner.
+ * Include the allocated native ID, active status, and initial security revision.
+ * Preparing values may allocate IDs, but must not write to the database or perform
+ * external side effects. Interactive drivers also accept an existing insert callback.
+ */
+export type SubjectProvisioning<Registration> = {
+  readonly values: (input: SubjectProvisioningInput<Registration>) => Effect.Effect<Readonly<Record<string, unknown>>, PasswordUnavailable>;
+} | ((input: SubjectProvisioningInput<Registration>) => Effect.Effect<SubjectId, PasswordUnavailable>);
 export type Provisioning<A extends {
   readonly strategies: Readonly<Record<string, Strategy>>;
 }> = { readonly [K in keyof A["strategies"] as A["strategies"][K] extends {
@@ -85,11 +120,7 @@ export type Provisioning<A extends {
     kind: "password";
     management: true;
   };
-} ? K : never]: (input: {
-  readonly requestId: string;
-  readonly identifier: LoginIdentifier;
-  readonly registration: Registration<A["strategies"][K]>;
-}) => Effect.Effect<SubjectId, PasswordUnavailable>; };
+} ? K : never]: SubjectProvisioning<Registration<A["strategies"][K]>>; };
 export type ProvisioningRequirement<A extends {
   readonly namespace: string;
   readonly strategies: Readonly<Record<string, Strategy>>;
@@ -98,8 +129,8 @@ type ProofRoles = "proofs";
 type UsesProofs<A extends {
   readonly strategies: Readonly<Record<string, Strategy>>;
 }> = Enabled<A, "phone"> | Enabled<A, "email"> | ManagedPassword<A>;
-export type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> = AuthenticationAuthority | KeyId<A["sessions"]["StatefulSessionPersistence"]> | KeyId<A["sessions"]["SessionRepository"]> | KeyId<A["sessions"]["PendingAuthentication"]> | KeyId<A["sessions"]["SessionStepUpPersistence"]> | KeyId<A["sessions"]["SessionCleanup"]> | (Enabled<A, "password"> extends never ? never : PasswordPersistence) | KeyId<RegistrationKey<ManagedPassword<A>>> | (Enabled<A, "passkey"> extends never ? never : PasskeyPersistence | PasskeyCredentials) | (ManagedPasskey<A> extends never ? never : PasskeyManagementPersistence) | (Enabled<A, "email"> extends never ? never : EmailAddressPersistence) | (UsesProofs<A> extends never ? never : ProofPersistence) | (Enabled<A, "phone"> extends never ? never : PhoneSignInTargets);
-export type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> = "identifiers" | "credentials" | "sessions" | "pending" | (Enabled<A, "password"> extends never ? never : "passwords") | (Enabled<A, "email"> extends never ? never : "emailCredentials") | (Enabled<A, "passkey"> extends never ? never : "passkeyCredentials" | "passkeyFlows") | (UsesProofs<A> extends never ? never : ProofRoles);
+export type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> = AuthenticationAuthority | ("stateful" extends A["sessionMode"] ? KeyId<A["sessions"]["StatefulSessionPersistence"]> | KeyId<A["sessions"]["SessionRepository"]> : never) | KeyId<A["sessions"]["PendingAuthentication"]> | KeyId<A["sessions"]["SessionStepUpPersistence"]> | KeyId<A["sessions"]["SessionCleanup"]> | (Enabled<A, "password"> extends never ? never : PasswordPersistence) | KeyId<RegistrationKey<ManagedPassword<A>>> | (Enabled<A, "passkey"> extends never ? never : PasskeyPersistence | PasskeyCredentials) | (ManagedPasskey<A> extends never ? never : PasskeyManagementPersistence) | (Enabled<A, "email"> extends never ? never : EmailAddressPersistence) | (UsesProofs<A> extends never ? never : ProofPersistence) | (Enabled<A, "phone"> extends never ? never : PhoneSignInTargets) | (OAuthSignIn<A> extends never ? never : OAuthSignInPersistence) | (OAuthConnected<A> extends never ? never : OAuthConnectedPersistence | OAuthConnectedRevocations);
+export type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> = "identifiers" | "credentials" | ("stateful" extends A["sessionMode"] ? "sessions" : never) | "pending" | (Enabled<A, "password"> extends never ? never : "passwords") | (Enabled<A, "email"> extends never ? never : "emailCredentials") | (Enabled<A, "passkey"> extends never ? never : "passkeyCredentials" | "passkeyFlows") | (UsesProofs<A> extends never ? never : ProofRoles) | (Enabled<A, "oauth"> extends never ? never : "oauthIdentities" | "oauthCredentials") | (OAuthSignIn<A> extends never ? never : "oauthSignInFlows") | (OAuthConnected<A> extends never ? never : "oauthConnectedFlows" | "oauthConnectedGrants" | "oauthConnectedRevocations");
 export interface SubjectOptions<T extends object, NativeId> {
   readonly table: T;
   readonly id: string;
@@ -148,14 +179,19 @@ export interface BoundPersistence<T extends object, R, C extends ClaimsCodec, Id
   readonly Config: Context.Service<ConfigId<A["namespace"]>, StorageLayout<T, Roles<C, Id, A>>> & {
     readonly layer: (value: StorageLayout<T, Roles<C, Id, A>>) => Layer.Layer<ConfigId<A["namespace"]>>;
   };
-  /** Create only the application subject. Runs inside the owning auth SQL transaction;
-   * use that SqlClient (including Drizzle over it), and return the new subject ID.
-   * Do not perform external side effects or open an independent transaction here.
+  /** Supply subject values through `{ values }` on every driver, including D1.
+   * Interactive drivers also accept callbacks that insert through the owning
+   * SqlClient and return the new subject ID. Never open an independent transaction
+   * or perform external side effects while preparing a subject.
    */
   readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;
-  /** Capture dependencies at acquisition; validate SQL metadata and configure storage
+  /** Stateful sessions and OAuth-only stateless sessions are supported. Other session
+   * configurations fail acquisition with PersistenceConfigurationError.
+   * Capture dependencies at acquisition; validate SQL metadata and configure storage
    * once on the first service operation. Initialization failures become that port's
    * unavailable error. Failure or interruption remains cached until layer reacquisition.
+   * Managed OAuth metadata/token-use authorizations bind policyRevision to the subject's
+   * securityRevision; changes to application authorization policy must advance it.
    */
   readonly layer: Layer.Layer<Ports<C, Id, A>, PersistenceConfigurationError, Crypto.Crypto | ConfigId<A["namespace"]> | ProvisioningRequirement<A> | PasskeyRequirement$1<A> | SqlClient.SqlClient | R>;
   readonly managed: <N, Instant = number>(options: {

package/dist/internal/configuration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.mjs","names":[],"sources":["../../src/internal/configuration.ts"],"sourcesContent":["import type { EmailAction, EmailAddressPersistence } from \"@yielded/auth/Email\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasskeyActionChallenge,\n  PasskeyConfig,\n  PasskeyCredentials,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  PasskeyPersistence,\n  PasskeyConfigurationError,\n} from \"@yielded/auth/Passkey\";\nimport type {\n  PasswordAction,\n  PasswordPersistence,\n  PasswordUnavailable,\n} from \"@yielded/auth/Password\";\nimport type { PhoneSignInTargets } from \"@yielded/auth/PhoneOtp\";\nimport type { ProofPersistence } from \"@yielded/auth/Proofs\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type {\n  AuthenticationAuthority,\n  AuthenticationRequirement,\n  make as makeSessions,\n} from \"@yielded/auth/Sessions\";\nimport { type Context, type Crypto, type Effect, type Layer, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { StorageRole } from \"./storage-tables\";\n\nexport class PersistenceConfigurationError extends Schema.TaggedError<PersistenceConfigurationError>()(\n  \"PersistenceConfigurationError\",\n  { reason: Schema.String },\n) {}\n\nexport type ClaimsCodec = Schema.Codec<unknown, unknown, never, never>;\n\nexport interface PasskeyFeature {\n  readonly kind: \"passkey\";\n  readonly moduleId: string;\n  readonly policy: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError, PasskeyConfig>;\n  readonly management?: boolean;\n  readonly managementPolicy?: PasskeyManagementPolicy;\n}\n\nexport interface Strategy {\n  readonly strategy: object;\n  readonly persistence?:\n    | PasskeyFeature\n    | {\n        readonly kind: \"password\" | \"phone\" | \"email\";\n        readonly moduleId: string;\n        readonly lifecycle?: boolean;\n        readonly management?: boolean;\n        readonly addresses?: boolean;\n      };\n  readonly RegistrationAuthority?: Context.Key<unknown, unknown>;\n}\n\nexport interface Definition<C extends ClaimsCodec, Id extends string> {\n  readonly namespace: string;\n  readonly claims: C;\n  readonly sessionMode?: string | undefined;\n  readonly sessions: ReturnType<typeof makeSessions<C, Id>>;\n  readonly strategies: Readonly<Record<string, Strategy>>;\n}\n\ntype KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;\ntype Enabled<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n  Kind extends \"password\" | \"phone\" | \"email\" | \"passkey\",\n> = Extract<A[\"strategies\"][keyof A[\"strategies\"]], { persistence: { kind: Kind } }>;\n\ntype ManagedPassword<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"password\">, { persistence: { management: true } }>;\n\ntype ManagedPasskey<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"passkey\">, { persistence: { management: true } }>;\n\nexport type PasskeyRequirement<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n> = Enabled<A, \"passkey\"> extends never ? never : PasskeyConfig;\n\ntype RegistrationKey<S> = S extends { readonly RegistrationAuthority: infer K } ? K : never;\ntype Registration<S> =\n  RegistrationKey<S> extends Context.Key<infer _Id, infer Service>\n    ? Service extends { readonly register: (input: infer Input, ...args: never[]) => unknown }\n      ? Input extends { readonly registration: infer Value }\n        ? Value\n        : never\n      : never\n    : never;\n\nexport interface ProvisioningId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceProvisioning\";\n}\n\nexport type Provisioning<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = {\n  readonly [\n    K in keyof A[\"strategies\"] as A[\"strategies\"][K] extends {\n      persistence: { kind: \"password\"; management: true };\n    }\n      ? K\n      : never\n  ]: (input: {\n    readonly requestId: string;\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration<A[\"strategies\"][K]>;\n  }) => Effect.Effect<SubjectId, PasswordUnavailable>;\n};\n\nexport type ProvisioningRequirement<\n  A extends { readonly namespace: string; readonly strategies: Readonly<Record<string, Strategy>> },\n> = ManagedPassword<A> extends never ? never : ProvisioningId<A[\"namespace\"]>;\n\ntype ProofRoles = \"proofs\";\n\ntype UsesProofs<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  | Enabled<A, \"phone\">\n  | Enabled<A, \"email\">\n  | ManagedPassword<A>;\n\nexport type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | AuthenticationAuthority\n  | KeyId<A[\"sessions\"][\"StatefulSessionPersistence\"]>\n  | KeyId<A[\"sessions\"][\"SessionRepository\"]>\n  | KeyId<A[\"sessions\"][\"PendingAuthentication\"]>\n  | KeyId<A[\"sessions\"][\"SessionStepUpPersistence\"]>\n  | KeyId<A[\"sessions\"][\"SessionCleanup\"]>\n  | (Enabled<A, \"password\"> extends never ? never : PasswordPersistence)\n  | KeyId<RegistrationKey<ManagedPassword<A>>>\n  | (Enabled<A, \"passkey\"> extends never ? never : PasskeyPersistence | PasskeyCredentials)\n  | (ManagedPasskey<A> extends never ? never : PasskeyManagementPersistence)\n  | (Enabled<A, \"email\"> extends never ? never : EmailAddressPersistence)\n  | (UsesProofs<A> extends never ? never : ProofPersistence)\n  | (Enabled<A, \"phone\"> extends never ? never : PhoneSignInTargets);\n\nexport type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | \"identifiers\"\n  | \"credentials\"\n  | \"sessions\"\n  | \"pending\"\n  | (Enabled<A, \"password\"> extends never ? never : \"passwords\")\n  | (Enabled<A, \"email\"> extends never ? never : \"emailCredentials\")\n  | (Enabled<A, \"passkey\"> extends never ? never : \"passkeyCredentials\" | \"passkeyFlows\")\n  | (UsesProofs<A> extends never ? never : ProofRoles);\n\nexport interface SubjectOptions<T extends object, NativeId> {\n  readonly table: T;\n  readonly id: string;\n  readonly status: string;\n  readonly activeValue: unknown;\n  readonly securityRevision: string;\n  readonly idCodec: Schema.Codec<SubjectId, NativeId>;\n  readonly requirements: (\n    row: Readonly<Record<string, unknown>>,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Defaults to sign-in requirements. Recovery can have a distinct application policy. */\n  readonly actionRequirements?: (\n    row: Readonly<Record<string, unknown>>,\n    action: PasswordAction | EmailAction | PasskeyActionChallenge[\"action\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n}\n\n/** Codecs at the application-owned subject and timestamp boundary. */\nexport interface SubjectMapping {\n  readonly table: object;\n  readonly id: string;\n  readonly status: string;\n  readonly securityRevision: string;\n  readonly activeValue: unknown;\n  readonly requirements: SubjectOptions<object, unknown>[\"requirements\"];\n  readonly actionRequirements: NonNullable<SubjectOptions<object, unknown>[\"actionRequirements\"]>;\n  readonly toSubject: (value: unknown) => Effect.Effect<SubjectId, PersistenceMappingError>;\n  readonly toNative: (value: SubjectId) => Effect.Effect<unknown, PersistenceMappingError>;\n  readonly toSubjectSync: (value: unknown) => SubjectId;\n  readonly toNativeSync: (value: SubjectId) => unknown;\n}\n\nexport interface MappingInput {\n  readonly tables: Partial<Record<StorageRole, object>>;\n  readonly subjects: SubjectMapping;\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly decodeInstantSync: (value: unknown) => number;\n}\n\nexport interface StorageLayout<\n  T extends object,\n  Role extends StorageRole = StorageRole,\n> extends MappingInput {\n  readonly namespace: string;\n  readonly schema: Readonly<Record<Role, T>>;\n}\n\nexport interface ConfigId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceConfig\";\n}\n\nexport interface TimestampOptions<Instant> {\n  readonly type: \"text\" | \"integer\";\n  readonly codec: Schema.Codec<number, Instant>;\n}\n\nexport interface BoundPersistence<\n  T extends object,\n  R,\n  C extends ClaimsCodec,\n  Id extends string,\n  A extends Definition<C, Id>,\n> {\n  readonly Config: Context.Service<ConfigId<A[\"namespace\"]>, StorageLayout<T, Roles<C, Id, A>>> & {\n    readonly layer: (\n      value: StorageLayout<T, Roles<C, Id, A>>,\n    ) => Layer.Layer<ConfigId<A[\"namespace\"]>>;\n  };\n  /** Create only the application subject. Runs inside the owning auth SQL transaction;\n   * use that SqlClient (including Drizzle over it), and return the new subject ID.\n   * Do not perform external side effects or open an independent transaction here.\n   */\n  readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;\n  /** Capture dependencies at acquisition; validate SQL metadata and configure storage\n   * once on the first service operation. Initialization failures become that port's\n   * unavailable error. Failure or interruption remains cached until layer reacquisition.\n   */\n  readonly layer: Layer.Layer<\n    Ports<C, Id, A>,\n    PersistenceConfigurationError,\n    | Crypto.Crypto\n    | ConfigId<A[\"namespace\"]>\n    | ProvisioningRequirement<A>\n    | PasskeyRequirement<A>\n    | SqlClient.SqlClient\n    | R\n  >;\n  readonly managed: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n    /** Stable SQL identifier prefix; reuse the deployed prefix for existing tables. */\n    readonly prefix: string;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n  readonly map: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables: Readonly<Record<Roles<C, Id, A>, T>>;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n}\n\n/** Shared configuration shape. The backend chooses table types and service requirements. */\nexport interface PersistenceApi<T extends object, R = never> {\n  readonly make: <\n    C extends ClaimsCodec,\n    const Id extends string,\n    const A extends Definition<C, Id>,\n  >(\n    auth: A & Definition<C, Id>,\n  ) => BoundPersistence<T, R, C, Id, A>;\n}\n"],"mappings":";;AA+BA,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA,EAAE,QAAQ,OAAO,OAAO,CAC1B,CAAC,CAAC,CAAC"}
+{"version":3,"file":"configuration.mjs","names":[],"sources":["../../src/internal/configuration.ts"],"sourcesContent":["import type { EmailAction, EmailAddressPersistence } from \"@yielded/auth/Email\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  OAuthConnectedPersistence,\n  OAuthConnectedPolicy,\n  OAuthConnectedRevocations,\n  OAuthSignInPersistence,\n} from \"@yielded/auth/OAuth\";\nimport type {\n  PasskeyActionChallenge,\n  PasskeyConfig,\n  PasskeyCredentials,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  PasskeyPersistence,\n  PasskeyConfigurationError,\n} from \"@yielded/auth/Passkey\";\nimport type {\n  PasswordAction,\n  PasswordPersistence,\n  PasswordUnavailable,\n} from \"@yielded/auth/Password\";\nimport type { PhoneSignInTargets } from \"@yielded/auth/PhoneOtp\";\nimport type { ProofPersistence } from \"@yielded/auth/Proofs\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type {\n  AuthenticationAuthority,\n  AuthenticationRequirement,\n  make as makeSessions,\n} from \"@yielded/auth/Sessions\";\nimport { type Context, type Crypto, type Effect, type Layer, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { StorageRole } from \"./storage-tables\";\n\nexport class PersistenceConfigurationError extends Schema.TaggedError<PersistenceConfigurationError>()(\n  \"PersistenceConfigurationError\",\n  { reason: Schema.String },\n) {}\n\nexport type ClaimsCodec = Schema.Codec<unknown, unknown, never, never>;\n\nexport interface PasskeyFeature {\n  readonly kind: \"passkey\";\n  readonly moduleId: string;\n  readonly policy: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError, PasskeyConfig>;\n  readonly management?: boolean;\n  readonly managementPolicy?: PasskeyManagementPolicy;\n}\n\nexport interface OAuthFeature {\n  readonly kind: \"oauth\";\n  readonly moduleId: string;\n  readonly signIn: boolean;\n  readonly connected?: OAuthConnectedPolicy;\n}\n\nexport interface Strategy {\n  readonly strategy: object;\n  /** Absent metadata leaves the strategy's persistence services application-supplied. */\n  readonly persistence?:\n    | PasskeyFeature\n    | OAuthFeature\n    | {\n        readonly kind: \"password\" | \"phone\" | \"email\";\n        readonly moduleId: string;\n        readonly lifecycle?: boolean;\n        readonly management?: boolean;\n        readonly addresses?: boolean;\n      };\n  readonly RegistrationAuthority?: Context.Key<unknown, unknown>;\n}\n\nexport interface Definition<C extends ClaimsCodec, Id extends string> {\n  readonly namespace: string;\n  readonly claims: C;\n  readonly sessionMode?: string | undefined;\n  readonly sessions: ReturnType<typeof makeSessions<C, Id>>;\n  readonly strategies: Readonly<Record<string, Strategy>>;\n}\n\ntype KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;\ntype Enabled<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n  Kind extends \"password\" | \"phone\" | \"email\" | \"passkey\" | \"oauth\",\n> = Extract<A[\"strategies\"][keyof A[\"strategies\"]], { persistence: { kind: Kind } }>;\n\ntype ManagedPassword<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"password\">, { persistence: { management: true } }>;\n\ntype ManagedPasskey<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"passkey\">, { persistence: { management: true } }>;\n\nexport type PasskeyRequirement<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n> = Enabled<A, \"passkey\"> extends never ? never : PasskeyConfig;\n\ntype OAuthSignIn<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = Extract<\n  Enabled<A, \"oauth\">,\n  { persistence: { signIn: true } }\n>;\n\ntype OAuthConnected<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"oauth\">, { persistence: { connected: OAuthConnectedPolicy } }>;\n\ntype RegistrationKey<S> = S extends { readonly RegistrationAuthority: infer K } ? K : never;\ntype Registration<S> =\n  RegistrationKey<S> extends Context.Key<infer _Id, infer Service>\n    ? Service extends { readonly register: (input: infer Input, ...args: never[]) => unknown }\n      ? Input extends { readonly registration: infer Value }\n        ? Value\n        : never\n      : never\n    : never;\n\nexport interface ProvisioningId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceProvisioning\";\n}\n\nexport interface SubjectProvisioningInput<Registration> {\n  readonly requestId: string;\n  readonly identifier: LoginIdentifier;\n  readonly registration: Registration;\n}\n\n/** Return application subject values for insertion by the auth commit owner.\n * Include the allocated native ID, active status, and initial security revision.\n * Preparing values may allocate IDs, but must not write to the database or perform\n * external side effects. Interactive drivers also accept an existing insert callback.\n */\nexport type SubjectProvisioning<Registration> =\n  | {\n      readonly values: (\n        input: SubjectProvisioningInput<Registration>,\n      ) => Effect.Effect<Readonly<Record<string, unknown>>, PasswordUnavailable>;\n    }\n  | ((\n      input: SubjectProvisioningInput<Registration>,\n    ) => Effect.Effect<SubjectId, PasswordUnavailable>);\n\nexport type Provisioning<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = {\n  readonly [\n    K in keyof A[\"strategies\"] as A[\"strategies\"][K] extends {\n      persistence: { kind: \"password\"; management: true };\n    }\n      ? K\n      : never\n  ]: SubjectProvisioning<Registration<A[\"strategies\"][K]>>;\n};\n\nexport type ProvisioningRequirement<\n  A extends { readonly namespace: string; readonly strategies: Readonly<Record<string, Strategy>> },\n> = ManagedPassword<A> extends never ? never : ProvisioningId<A[\"namespace\"]>;\n\ntype ProofRoles = \"proofs\";\n\ntype UsesProofs<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  | Enabled<A, \"phone\">\n  | Enabled<A, \"email\">\n  | ManagedPassword<A>;\n\nexport type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | AuthenticationAuthority\n  | (\"stateful\" extends A[\"sessionMode\"]\n      ?\n          | KeyId<A[\"sessions\"][\"StatefulSessionPersistence\"]>\n          | KeyId<A[\"sessions\"][\"SessionRepository\"]>\n      : never)\n  | KeyId<A[\"sessions\"][\"PendingAuthentication\"]>\n  | KeyId<A[\"sessions\"][\"SessionStepUpPersistence\"]>\n  | KeyId<A[\"sessions\"][\"SessionCleanup\"]>\n  | (Enabled<A, \"password\"> extends never ? never : PasswordPersistence)\n  | KeyId<RegistrationKey<ManagedPassword<A>>>\n  | (Enabled<A, \"passkey\"> extends never ? never : PasskeyPersistence | PasskeyCredentials)\n  | (ManagedPasskey<A> extends never ? never : PasskeyManagementPersistence)\n  | (Enabled<A, \"email\"> extends never ? never : EmailAddressPersistence)\n  | (UsesProofs<A> extends never ? never : ProofPersistence)\n  | (Enabled<A, \"phone\"> extends never ? never : PhoneSignInTargets)\n  | (OAuthSignIn<A> extends never ? never : OAuthSignInPersistence)\n  | (OAuthConnected<A> extends never\n      ? never\n      : OAuthConnectedPersistence | OAuthConnectedRevocations);\n\nexport type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | \"identifiers\"\n  | \"credentials\"\n  | (\"stateful\" extends A[\"sessionMode\"] ? \"sessions\" : never)\n  | \"pending\"\n  | (Enabled<A, \"password\"> extends never ? never : \"passwords\")\n  | (Enabled<A, \"email\"> extends never ? never : \"emailCredentials\")\n  | (Enabled<A, \"passkey\"> extends never ? never : \"passkeyCredentials\" | \"passkeyFlows\")\n  | (UsesProofs<A> extends never ? never : ProofRoles)\n  | (Enabled<A, \"oauth\"> extends never ? never : \"oauthIdentities\" | \"oauthCredentials\")\n  | (OAuthSignIn<A> extends never ? never : \"oauthSignInFlows\")\n  | (OAuthConnected<A> extends never\n      ? never\n      : \"oauthConnectedFlows\" | \"oauthConnectedGrants\" | \"oauthConnectedRevocations\");\n\nexport interface SubjectOptions<T extends object, NativeId> {\n  readonly table: T;\n  readonly id: string;\n  readonly status: string;\n  readonly activeValue: unknown;\n  readonly securityRevision: string;\n  readonly idCodec: Schema.Codec<SubjectId, NativeId>;\n  readonly requirements: (\n    row: Readonly<Record<string, unknown>>,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Defaults to sign-in requirements. Recovery can have a distinct application policy. */\n  readonly actionRequirements?: (\n    row: Readonly<Record<string, unknown>>,\n    action: PasswordAction | EmailAction | PasskeyActionChallenge[\"action\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n}\n\n/** Codecs at the application-owned subject and timestamp boundary. */\nexport interface SubjectMapping {\n  readonly table: object;\n  readonly id: string;\n  readonly status: string;\n  readonly securityRevision: string;\n  readonly activeValue: unknown;\n  readonly requirements: SubjectOptions<object, unknown>[\"requirements\"];\n  readonly actionRequirements: NonNullable<SubjectOptions<object, unknown>[\"actionRequirements\"]>;\n  readonly toSubject: (value: unknown) => Effect.Effect<SubjectId, PersistenceMappingError>;\n  readonly toNative: (value: SubjectId) => Effect.Effect<unknown, PersistenceMappingError>;\n  readonly toSubjectSync: (value: unknown) => SubjectId;\n  readonly toNativeSync: (value: SubjectId) => unknown;\n}\n\nexport interface MappingInput {\n  readonly tables: Partial<Record<StorageRole, object>>;\n  readonly subjects: SubjectMapping;\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly decodeInstantSync: (value: unknown) => number;\n}\n\nexport interface StorageLayout<\n  T extends object,\n  Role extends StorageRole = StorageRole,\n> extends MappingInput {\n  readonly namespace: string;\n  readonly schema: Readonly<Record<Role, T>>;\n}\n\nexport interface ConfigId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceConfig\";\n}\n\nexport interface TimestampOptions<Instant> {\n  readonly type: \"text\" | \"integer\";\n  readonly codec: Schema.Codec<number, Instant>;\n}\n\nexport interface BoundPersistence<\n  T extends object,\n  R,\n  C extends ClaimsCodec,\n  Id extends string,\n  A extends Definition<C, Id>,\n> {\n  readonly Config: Context.Service<ConfigId<A[\"namespace\"]>, StorageLayout<T, Roles<C, Id, A>>> & {\n    readonly layer: (\n      value: StorageLayout<T, Roles<C, Id, A>>,\n    ) => Layer.Layer<ConfigId<A[\"namespace\"]>>;\n  };\n  /** Supply subject values through `{ values }` on every driver, including D1.\n   * Interactive drivers also accept callbacks that insert through the owning\n   * SqlClient and return the new subject ID. Never open an independent transaction\n   * or perform external side effects while preparing a subject.\n   */\n  readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;\n  /** Stateful sessions and OAuth-only stateless sessions are supported. Other session\n   * configurations fail acquisition with PersistenceConfigurationError.\n   * Capture dependencies at acquisition; validate SQL metadata and configure storage\n   * once on the first service operation. Initialization failures become that port's\n   * unavailable error. Failure or interruption remains cached until layer reacquisition.\n   * Managed OAuth metadata/token-use authorizations bind policyRevision to the subject's\n   * securityRevision; changes to application authorization policy must advance it.\n   */\n  readonly layer: Layer.Layer<\n    Ports<C, Id, A>,\n    PersistenceConfigurationError,\n    | Crypto.Crypto\n    | ConfigId<A[\"namespace\"]>\n    | ProvisioningRequirement<A>\n    | PasskeyRequirement<A>\n    | SqlClient.SqlClient\n    | R\n  >;\n  readonly managed: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n    /** Stable SQL identifier prefix; reuse the deployed prefix for existing tables. */\n    readonly prefix: string;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n  readonly map: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables: Readonly<Record<Roles<C, Id, A>, T>>;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n}\n\n/** Shared configuration shape. The backend chooses table types and service requirements. */\nexport interface PersistenceApi<T extends object, R = never> {\n  readonly make: <\n    C extends ClaimsCodec,\n    const Id extends string,\n    const A extends Definition<C, Id>,\n  >(\n    auth: A & Definition<C, Id>,\n  ) => BoundPersistence<T, R, C, Id, A>;\n}\n"],"mappings":";;AAqCA,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA,EAAE,QAAQ,OAAO,OAAO,CAC1B,CAAC,CAAC,CAAC"}

package/dist/internal/email-native.mjs

@@ -97,7 +97,15 @@ const makeNativeEmailAddressServices = Effect.fnUntraced(function* (tables, mapp
 			requirement: Effect.succeed(requirement)
 		}, current.now))) return yield* prepare("rejected", project);
 		const requirements = [input.authorization.requirement, requirement];
-		const deadline = [...new Set(input.authorization.evidence.proofs.flatMap((proof) => requirements.map((r) => DateTime.toEpochMillis(proof.verifiedAt) + r.maximumAgeMillis)))].filter((time) => time > current.now).sort((a, b) => a - b).find((time) => requirements.some((r) => !passwordEvidenceSatisfiedAt(input.authorization.evidence, r, time)));
+		const boundaries = [...new Set(input.authorization.evidence.proofs.flatMap((proof) => requirements.map((r) => DateTime.toEpochMillis(proof.verifiedAt) + r.maximumAgeMillis)))].filter((time) => time > current.now).sort((a, b) => a - b);
+		let deadline;
+		for (const time of boundaries) {
+			for (const requirement of requirements) if (!(yield* passwordEvidenceSatisfiedAt(input.authorization.evidence, requirement, time))) {
+				deadline = time;
+				break;
+			}
+			if (deadline !== void 0) break;
+		}
 		ensureEmail(deadline !== void 0);
 		const freshness = sql`${now} >= ${current.now} and ${now} < ${deadline}`;
 		const factorCondition = (revision) => sql.and([sql`(select count(*) from ${authority.name} where ${id(authority, a.subjectId, native)} and ${activeAuthority}) = ${revision.credentials.length}`, ...revision.credentials.map((f) => sql`exists(select 1 from ${authority.name} where ${id(authority, a.subjectId, native)} and ${exact(authority, a.credentialId, f.credentialId)} and ${exact(authority, a.revision, f.revision)} and ${activeAuthority})`)]);
@@ -224,7 +232,7 @@ const makeNativeEmailAddressServices = Effect.fnUntraced(function* (tables, mapp
 				});
 				ensureEmail(final !== void 0 && sameEmailRevision(final.revision, revision) && final.now >= current.now && final.now < deadline && final.targetSnapshot !== void 0 && final.targetSnapshot.credentialId === targetCredentialId && final.targetSnapshot.credentialRevision === targetCredentialRevision && final.targetSnapshot.identifierRevision === targetIdentifierRevision && (yield* mapping.decodeInstant(final.targetIdentifier[i.verifiedAt])) === current.now);
 				const policy = yield* s.decodeActionRequirement(final.subject, action);
-				ensureEmail(passwordEvidenceSatisfiedAt(input.authorization.evidence, policy, final.now));
+				ensureEmail(yield* passwordEvidenceSatisfiedAt(input.authorization.evidence, policy, final.now));
 				if (source !== void 0) ensureEmail(final.sourceIdentifier !== void 0 && final.sourceCredential !== void 0 && final.sourceAuthority !== void 0 && (yield* mapping.subjectId.toSubject(final.sourceAuthority[a.subjectId])) === revision.subjectId && final.sourceAuthority[a.credentialId] === source.credentialId && final.sourceAuthority[a.revision] === sourceCredentialRevision && !a.isActiveStatus(final.sourceAuthority[a.status]) && (yield* mapping.subjectId.toSubject(final.sourceIdentifier[i.subjectId])) === revision.subjectId && final.sourceIdentifier[i.bindingRevision] === sourceIdentifierRevision && !i.isCurrent(final.sourceIdentifier) && final.sourceCredential[c.credentialRevision] === sourceCredentialRevision && !c.isActiveStatus(final.sourceCredential[c.status]));
 			}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
 				operation: "decode",