@yielded/auth-persistence 0.1.0-beta.7 → 0.1.0-beta.9

package/dist/drizzle/passkey-model.d.mts

@@ -5,35 +5,35 @@ import { PasskeyCeremony, PasskeyCredential, PasskeyCredentials, PasskeyEnrollme
 import { SubjectId } from "@yielded/auth/Schema";
 import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
 //#region src/drizzle/passkey-model.d.ts
-type PasskeyColumn<T extends Table> = Extract<keyof T["_"]["columns"], string>;
-type PasskeyMappingSource<M, RSetup = never> = M | Effect.Effect<M, PersistenceMappingError, RSetup>;
-interface PasskeyCredentialServices {
+export type PasskeyColumn<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+export type PasskeyMappingSource<M, RSetup = never> = M | Effect.Effect<M, PersistenceMappingError, RSetup>;
+export interface PasskeyCredentialServices {
   readonly passkeyCredentials: PasskeyCredentials["Service"];
 }
-interface PasskeyPersistenceServices {
+export interface PasskeyPersistenceServices {
   readonly passkeyPersistence: PasskeyPersistence["Service"];
 }
-interface PasskeyEnrollmentContextServices {
+export interface PasskeyEnrollmentContextServices {
   readonly passkeyEnrollmentContext: PasskeyEnrollmentContext["Service"];
 }
-declare const passkeyCredentialsLayer: <E, R>(services: Effect.Effect<PasskeyCredentialServices, E, R>) => Layer.Layer<PasskeyCredentials, E, R>;
-declare const passkeyPersistenceLayer: <E, R>(services: Effect.Effect<PasskeyPersistenceServices, E, R>) => Layer.Layer<PasskeyPersistence, E, R>;
-declare const passkeyEnrollmentContextLayer: <E, R>(services: Effect.Effect<PasskeyEnrollmentContextServices, E, R>) => Layer.Layer<PasskeyEnrollmentContext, E, R>;
+export declare const passkeyCredentialsLayer: <E, R>(services: Effect.Effect<PasskeyCredentialServices, E, R>) => Layer.Layer<PasskeyCredentials, E, R>;
+export declare const passkeyPersistenceLayer: <E, R>(services: Effect.Effect<PasskeyPersistenceServices, E, R>) => Layer.Layer<PasskeyPersistence, E, R>;
+export declare const passkeyEnrollmentContextLayer: <E, R>(services: Effect.Effect<PasskeyEnrollmentContextServices, E, R>) => Layer.Layer<PasskeyEnrollmentContext, E, R>;
 /** Native IDs roundtrip exactly; protocol IDs and authentication references are
  * different identities. These callbacks never suspend inside an owner. */
-interface PasskeySubjectIdCodec<N> {
+export interface PasskeySubjectIdCodec<N> {
   readonly toNative: (id: SubjectId) => N;
   readonly toSubject: (id: N) => SubjectId;
   readonly equals: (left: N, right: N) => boolean;
 }
-interface PasskeyClock {
+export interface PasskeyClock {
   readonly encodeInstant: (millis: number) => unknown;
   readonly decodeInstant: (value: unknown) => number;
   readonly engineNowMillis: SQL;
   readonly toMillis: (expression: SQL) => SQL;
   readonly fromMillis: (expression: SQL) => SQL;
 }
-interface PasskeySubjectReadTable<T extends Table, N> {
+export interface PasskeySubjectReadTable<T extends Table, N> {
   readonly table: T;
   readonly id: PasskeyColumn<T>;
   readonly status: PasskeyColumn<T>;
@@ -42,7 +42,7 @@ interface PasskeySubjectReadTable<T extends Table, N> {
   readonly isActiveStatus: (value: unknown) => boolean;
   readonly activeCondition: SQL;
 }
-interface PasskeyFactorReadTable<T extends Table> {
+export interface PasskeyFactorReadTable<T extends Table> {
   readonly table: T;
   readonly subjectId: PasskeyColumn<T>;
   readonly credentialId: PasskeyColumn<T>;
@@ -53,7 +53,7 @@ interface PasskeyFactorReadTable<T extends Table> {
 }
 /** decode uses only these declared columns. Counter columns are native integral
  * numbers; BS may use a consumer enum. Name/creation metadata is not required. */
-interface PasskeyCredentialReadTable<T extends Table, N> {
+export interface PasskeyCredentialReadTable<T extends Table, N> {
   readonly table: T;
   readonly credentialId: PasskeyColumn<T>;
   readonly subjectId: PasskeyColumn<T>;
@@ -78,7 +78,7 @@ interface PasskeyCredentialReadTable<T extends Table, N> {
   readonly isActiveStatus: (value: unknown) => boolean;
   readonly activeCondition: SQL;
 }
-interface PasskeyCredentialOwnershipTable<T extends Table, N> {
+export interface PasskeyCredentialOwnershipTable<T extends Table, N> {
   readonly table: T;
   readonly credentialKey: PasskeyColumn<T>;
   readonly rpId: PasskeyColumn<T>;
@@ -93,7 +93,7 @@ interface PasskeyCredentialOwnershipTable<T extends Table, N> {
   readonly decodeSubjectId: (row: Readonly<Partial<InferSelectModel<T>>>) => N;
 }
 /** Reservations do not manufacture a subject; bound handles are RP-global. */
-interface PasskeyHandleReadTable<T extends Table> {
+export interface PasskeyHandleReadTable<T extends Table> {
   readonly table: T;
   readonly handleKey: PasskeyColumn<T>;
   readonly rpId: PasskeyColumn<T>;
@@ -102,24 +102,24 @@ interface PasskeyHandleReadTable<T extends Table> {
   readonly version: PasskeyColumn<T>;
   readonly reservationId: PasskeyColumn<T>;
 }
-interface PasskeyHandleReservationTable<T extends Table> extends PasskeyHandleReadTable<T> {
+export interface PasskeyHandleReservationTable<T extends Table> extends PasskeyHandleReadTable<T> {
   readonly reservedCondition: SQL;
   readonly isReservedState: (value: unknown) => boolean;
 }
-interface PasskeyHandleOwnershipTable<T extends Table, N> extends PasskeyHandleReadTable<T> {
+export interface PasskeyHandleOwnershipTable<T extends Table, N> extends PasskeyHandleReadTable<T> {
   readonly subjectId: PasskeyColumn<T>;
   readonly ownedCondition: SQL;
   readonly isOwnedState: (value: unknown) => boolean;
   readonly decodeSubjectId: (row: Readonly<Partial<InferSelectModel<T>>>) => N;
 }
-declare const requiredPasskeyCredentialConstraints: {
+export declare const requiredPasskeyCredentialConstraints: {
   readonly credentialId: readonly ["credentialId"];
   readonly factor: readonly ["subjectId", "credentialId"];
   readonly credentialOwnership: readonly ["credentialKey"];
   readonly handleOwnership: readonly ["handleKey"];
   readonly boundSubjectHandle: readonly ["rpId", "subjectId"];
 };
-interface PasskeyCredentialMapping<S extends Table, C extends Table, F extends Table, Ownership extends Table, Handle extends Table, N> {
+export interface PasskeyCredentialMapping<S extends Table, C extends Table, F extends Table, Ownership extends Table, Handle extends Table, N> {
   readonly subject: PasskeySubjectReadTable<S, N>;
   readonly credential: PasskeyCredentialReadTable<C, N>;
   readonly authority: PasskeyFactorReadTable<F>;
@@ -131,7 +131,7 @@ interface PasskeyCredentialMapping<S extends Table, C extends Table, F extends T
 /** A stable additional policy row, acquired before RP/credential locks. The
  * factory checks column names without erasing the consumer table at its input. */
 declare const PasskeyPolicyGuardTypeId: unique symbol;
-interface PasskeyPolicyGuard {
+export interface PasskeyPolicyGuard {
   readonly [PasskeyPolicyGuardTypeId]: true;
   readonly scope: string;
   readonly table: Table;
@@ -139,14 +139,14 @@ interface PasskeyPolicyGuard {
   readonly where: (moduleId: string) => SQL;
   readonly condition: (moduleId: string) => SQL;
 }
-declare const passkeyPolicyGuard: <T extends Table>(input: {
+export declare const passkeyPolicyGuard: <T extends Table>(input: {
   readonly scope: string;
   readonly table: T;
   readonly columns: ReadonlyArray<PasskeyColumn<T>>;
   readonly where: (moduleId: string) => SQL;
   readonly condition: (moduleId: string) => SQL;
 }) => PasskeyPolicyGuard;
-interface PasskeyModuleTable<T extends Table> {
+export interface PasskeyModuleTable<T extends Table> {
   readonly table: T;
   readonly moduleId: PasskeyColumn<T>;
   readonly status: PasskeyColumn<T>;
@@ -158,13 +158,13 @@ interface PasskeyModuleTable<T extends Table> {
   readonly decodeMethodPolicy: (row: Readonly<Partial<InferSelectModel<T>>>) => PasskeyMethodPolicy;
   readonly guards?: ReadonlyArray<PasskeyPolicyGuard>;
 }
-type PasskeyFlowState = "Pending" | "Claimed" | "Verified" | "Rejected" | "Ambiguous" | "RegistrationAccepted" | "ProvisioningPending";
-interface PasskeyFlowInsert {
+export type PasskeyFlowState = "Pending" | "Claimed" | "Verified" | "Rejected" | "Ambiguous" | "RegistrationAccepted" | "ProvisioningPending";
+export interface PasskeyFlowInsert {
   readonly ceremony: PasskeyCeremony;
   readonly policy: PasskeyMethodPolicy;
   readonly marker: string;
 }
-interface PasskeyFlowTable<T extends Table> {
+export interface PasskeyFlowTable<T extends Table> {
   readonly table: T;
   readonly moduleId: PasskeyColumn<T>;
   readonly flowId: PasskeyColumn<T>;
@@ -190,7 +190,7 @@ interface PasskeyFlowTable<T extends Table> {
   readonly states: Readonly<Record<PasskeyFlowState, unknown>>;
   readonly encodeInsert: (input: PasskeyFlowInsert) => InferInsertModel<T>;
 }
-interface PasskeyAdmissionTable<T extends Table> {
+export interface PasskeyAdmissionTable<T extends Table> {
   readonly table: T;
   readonly authorityScope: PasskeyColumn<T>;
   readonly moduleId: PasskeyColumn<T>;
@@ -199,8 +199,8 @@ interface PasskeyAdmissionTable<T extends Table> {
   /** One physical clock sample, reused by every charge of this decision. */
   readonly admittedAt: PasskeyColumn<T>;
 }
-type PasskeyChargeKind = "global" | "subject" | "target";
-interface PasskeyChargeInsert {
+export type PasskeyChargeKind = "global" | "subject" | "target";
+export interface PasskeyChargeInsert {
   readonly moduleId: string;
   readonly flowId: string;
   readonly purpose: PasskeyCeremony["purpose"];
@@ -211,7 +211,7 @@ interface PasskeyChargeInsert {
 }
 /** Charge scope is canonical core identity text; this subject-free descriptor
  * can count all purposes without decoding any unrelated native subject. */
-interface PasskeyChargeTable<T extends Table> {
+export interface PasskeyChargeTable<T extends Table> {
   readonly table: T;
   readonly moduleId: PasskeyColumn<T>;
   readonly flowId: PasskeyColumn<T>;
@@ -225,13 +225,13 @@ interface PasskeyChargeTable<T extends Table> {
   readonly ownerMarker: PasskeyColumn<T>;
   readonly encodeInsert: (input: PasskeyChargeInsert) => InferInsertModel<T>;
 }
-declare const requiredPasskeyPersistenceConstraints: {
+export declare const requiredPasskeyPersistenceConstraints: {
   readonly flow: readonly ["moduleId", "flowId"];
   readonly command: readonly ["moduleId", "commandId"];
   readonly admission: readonly ["authorityScope", "moduleId"];
   readonly charge: readonly ["moduleId", "flowId", "kind"];
 };
-interface PasskeyCeremonyMapping<Module extends Table, Flow extends Table, Admission extends Table, Charge extends Table> {
+export interface PasskeyCeremonyMapping<Module extends Table, Flow extends Table, Admission extends Table, Charge extends Table> {
   readonly moduleId: string;
   readonly authorityScope: string;
   readonly module: PasskeyModuleTable<Module>;
@@ -246,7 +246,7 @@ type CredentialTable<Read> = Read extends {
     readonly table: infer T extends Table;
   };
 } ? T : never;
-interface PasskeyPersistenceMapping<Read, Module extends Table, Flow extends Table, Admission extends Table, Charge extends Table, N> extends PasskeyCeremonyMapping<Module, Flow, Admission, Charge> {
+export interface PasskeyPersistenceMapping<Read, Module extends Table, Flow extends Table, Admission extends Table, Charge extends Table, N> extends PasskeyCeremonyMapping<Module, Flow, Admission, Charge> {
   readonly read: Read & {
     readonly subjectIds: PasskeySubjectIdCodec<N>;
   };
@@ -255,18 +255,17 @@ interface PasskeyPersistenceMapping<Read, Module extends Table, Flow extends Tab
     readonly encodeBackupState: (value: boolean) => unknown;
   };
 }
-interface PasskeyEnrollmentContextMapping<Read, Module extends Table, N> {
+export interface PasskeyEnrollmentContextMapping<Read, Module extends Table, N> {
   readonly moduleId: string;
   readonly read: Read & {
     readonly subjectIds: PasskeySubjectIdCodec<N>;
   };
   readonly module: PasskeyModuleTable<Module>;
 }
-interface D1PasskeyMapping {
+export interface D1PasskeyMapping {
   readonly d1: {
     readonly primary: true;
   };
 }
 //#endregion
-export { D1PasskeyMapping, PasskeyAdmissionTable, PasskeyCeremonyMapping, PasskeyChargeInsert, PasskeyChargeKind, PasskeyChargeTable, PasskeyClock, PasskeyColumn, PasskeyCredentialMapping, PasskeyCredentialOwnershipTable, PasskeyCredentialReadTable, PasskeyCredentialServices, PasskeyEnrollmentContextMapping, PasskeyEnrollmentContextServices, PasskeyFactorReadTable, PasskeyFlowInsert, PasskeyFlowState, PasskeyFlowTable, PasskeyHandleOwnershipTable, PasskeyHandleReadTable, PasskeyHandleReservationTable, PasskeyMappingSource, PasskeyModuleTable, PasskeyPersistenceMapping, PasskeyPersistenceServices, PasskeyPolicyGuard, PasskeySubjectIdCodec, PasskeySubjectReadTable, passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyPersistenceLayer, passkeyPolicyGuard, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints };
 //# sourceMappingURL=passkey-model.d.mts.map

package/dist/drizzle/passkey-registration-ceremony-model.d.mts

@@ -1,17 +1,17 @@
 import { PasskeyCeremonyMapping, PasskeyChargeTable, PasskeyColumn, PasskeyFlowTable, PasskeyHandleReservationTable, PasskeyPersistenceServices } from "./passkey-model.mjs";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/passkey-registration-ceremony-model.d.ts
-interface PasskeyRegistrationCeremonyCapabilities {
+export interface PasskeyRegistrationCeremonyCapabilities {
   readonly purposes: readonly ["registration"];
   readonly issue: "registration-authority";
   readonly assertionSettlement: false;
 }
-interface PasskeyRegistrationCeremonyServices extends PasskeyPersistenceServices {
+export interface PasskeyRegistrationCeremonyServices extends PasskeyPersistenceServices {
   readonly capabilities: PasskeyRegistrationCeremonyCapabilities;
 }
 /** Read-only custody supplied by a separate registration issuance authority.
  * No application payload codec, subject codec or provisioning callback runs here. */
-interface PasskeyRegistrationIntentReadTable<T extends Table> {
+export interface PasskeyRegistrationIntentReadTable<T extends Table> {
   readonly table: T;
   readonly moduleId: PasskeyColumn<T>;
   readonly flowId: PasskeyColumn<T>;
@@ -29,7 +29,7 @@ interface PasskeyRegistrationIntentReadTable<T extends Table> {
   /** Any unresolved initial intent or provisioning job; cleanup never releases it. */
   readonly custodyCondition: SQL;
 }
-declare const requiredPasskeyRegistrationCeremonyConstraints: {
+export declare const requiredPasskeyRegistrationCeremonyConstraints: {
   readonly flow: readonly ["moduleId", "flowId"];
   readonly command: readonly ["moduleId", "commandId"];
   readonly admission: readonly ["authorityScope", "moduleId"];
@@ -38,7 +38,7 @@ declare const requiredPasskeyRegistrationCeremonyConstraints: {
   readonly intentCommand: readonly ["moduleId", "commandId"];
   readonly handle: readonly ["handleKey"];
 };
-interface PasskeyRegistrationCeremonyMapping<Module extends Table, Flow extends Table, Admission extends Table, Charge extends Table, Intent extends Table, Handle extends Table> extends Omit<PasskeyCeremonyMapping<Module, Flow, Admission, Charge>, "constraints" | "flow" | "charge"> {
+export interface PasskeyRegistrationCeremonyMapping<Module extends Table, Flow extends Table, Admission extends Table, Charge extends Table, Intent extends Table, Handle extends Table> extends Omit<PasskeyCeremonyMapping<Module, Flow, Admission, Charge>, "constraints" | "flow" | "charge"> {
   readonly flow: Omit<PasskeyFlowTable<Flow>, "encodeInsert">;
   readonly charge: Omit<PasskeyChargeTable<Charge>, "encodeInsert">;
   readonly intent: PasskeyRegistrationIntentReadTable<Intent>;
@@ -46,5 +46,4 @@ interface PasskeyRegistrationCeremonyMapping<Module extends Table, Flow extends
   readonly constraints: typeof requiredPasskeyRegistrationCeremonyConstraints;
 }
 //#endregion
-export { PasskeyRegistrationCeremonyCapabilities, PasskeyRegistrationCeremonyMapping, PasskeyRegistrationCeremonyServices, PasskeyRegistrationIntentReadTable, requiredPasskeyRegistrationCeremonyConstraints };
 //# sourceMappingURL=passkey-registration-ceremony-model.d.mts.map

package/dist/drizzle/passkey-write-model.d.mts

@@ -9,13 +9,13 @@ import { PreparedCommit } from "@yielded/auth/Hooks";
 import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
 import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
 //#region src/drizzle/passkey-write-model.d.ts
-interface PasskeyCredentialInsert<N> {
+export interface PasskeyCredentialInsert<N> {
   readonly subjectId: N;
   readonly credential: PasskeyCredential;
   readonly summary: PasskeyCredentialSummary;
   readonly marker: string;
 }
-interface PasskeyWriteTables<S extends Table, C extends Table, F extends Table, O extends Table, H extends Table, N> {
+export interface PasskeyWriteTables<S extends Table, C extends Table, F extends Table, O extends Table, H extends Table, N> {
   readonly credential: {
     readonly name: PasskeyColumn<C>;
     readonly createdAt: PasskeyColumn<C>;
@@ -56,26 +56,26 @@ interface PasskeyWriteTables<S extends Table, C extends Table, F extends Table,
     readonly remainingSignIn: (subjectId: N, removedCredentialId: string, row: Readonly<Partial<InferSelectModel<S>>>) => Effect.Effect<SQL, PersistenceMappingError>;
   };
 }
-interface PasskeyInvalidationInput<N> {
+export interface PasskeyInvalidationInput<N> {
   readonly subjectId: N;
   readonly previousRevision: typeof PasskeyRevision.Type.securityRevision;
   readonly securityRevision: typeof PasskeyRevision.Type.securityRevision;
   readonly invalidation: SessionInvalidationWindow;
 }
-interface PasskeyInvalidationMutation<N> {
+export interface PasskeyInvalidationMutation<N> {
   readonly table: Table;
   readonly where: (input: PasskeyInvalidationInput<N>) => SQL;
   readonly values: (input: PasskeyInvalidationInput<N>) => Readonly<Record<string, unknown>>;
   readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;
 }
 /** Same-owner updates for consumer session/pending tables. No external effects or callbacks after commit. */
-declare const passkeyInvalidationMutation: <T extends Table, N>(input: {
+export declare const passkeyInvalidationMutation: <T extends Table, N>(input: {
   readonly table: T;
   readonly where: (input: PasskeyInvalidationInput<N>) => SQL;
   readonly values: (input: PasskeyInvalidationInput<N>) => Partial<InferInsertModel<T>>;
   readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;
 }) => PasskeyInvalidationMutation<N>;
-interface PasskeyCommandTable<T extends Table, N> {
+export interface PasskeyCommandTable<T extends Table, N> {
   readonly table: T;
   readonly moduleId: PasskeyColumn<T>;
   readonly commandId: PasskeyColumn<T>;
@@ -92,7 +92,7 @@ interface PasskeyCommandTable<T extends Table, N> {
     readonly credentialId: string;
   }) => InferInsertModel<T>;
 }
-interface PasskeyManagementMapping<S extends Table, C extends Table, F extends Table, O extends Table, H extends Table, M extends Table, Flow extends Table, A extends Table, Charge extends Table, Command extends Table, N> extends PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, Flow, A, Charge, N> {
+export interface PasskeyManagementMapping<S extends Table, C extends Table, F extends Table, O extends Table, H extends Table, M extends Table, Flow extends Table, A extends Table, Charge extends Table, Command extends Table, N> extends PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, Flow, A, Charge, N> {
   readonly write: PasskeyWriteTables<S, C, F, O, H, N>;
   readonly command: PasskeyCommandTable<Command, N>;
   readonly managementConstraints: typeof requiredPasskeyManagementConstraints;
@@ -103,13 +103,13 @@ interface PasskeyManagementMapping<S extends Table, C extends Table, F extends T
     readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;
   };
 }
-declare const requiredPasskeyManagementConstraints: {
+export declare const requiredPasskeyManagementConstraints: {
   readonly command: readonly ["moduleId", "commandId"];
 };
-interface PasskeyManagementServices extends PasskeyPersistenceServices {
+export interface PasskeyManagementServices extends PasskeyPersistenceServices {
   readonly passkeyManagementPersistence: PasskeyManagementPersistence["Service"];
 }
-interface PasskeyRegistrationWriter<R> {
+export interface PasskeyRegistrationWriter<R> {
   readonly inspect: (registration: R) => Effect.Effect<{
     readonly fingerprint: TokenDigest;
     readonly eligible: boolean;
@@ -129,10 +129,10 @@ interface PasskeyRegistrationWriter<R> {
     readonly _tag: "Rejected";
   }, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
 }
-interface PasskeyRegistrationServices<R> extends PasskeyPersistenceServices {
+export interface PasskeyRegistrationServices<R> extends PasskeyPersistenceServices {
   readonly passkeyRegistrationAuthority: PasskeyRegistrationWriter<R>;
 }
-interface PasskeyRegistrationMapping<S extends Table, C extends Table, F extends Table, O extends Table, H extends Table, M extends Table, Flow extends Table, A extends Table, Charge extends Table, Intent extends Table, N, R> extends PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, Flow, A, Charge, N> {
+export interface PasskeyRegistrationMapping<S extends Table, C extends Table, F extends Table, O extends Table, H extends Table, M extends Table, Flow extends Table, A extends Table, Charge extends Table, Intent extends Table, N, R> extends PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, Flow, A, Charge, N> {
   readonly write: PasskeyWriteTables<S, C, F, O, H, N>;
   readonly flow: PasskeyFlowTable<Flow>;
   readonly handle: PasskeyHandleReservationTable<H> & {
@@ -180,11 +180,10 @@ interface PasskeyRegistrationMapping<S extends Table, C extends Table, F extends
   };
   readonly registrationConstraints: typeof requiredPasskeyRegistrationWriteConstraints;
 }
-declare const requiredPasskeyRegistrationWriteConstraints: {
+export declare const requiredPasskeyRegistrationWriteConstraints: {
   readonly intentFlow: readonly ["moduleId", "flowId"];
   readonly intentCommand: readonly ["moduleId", "commandId"];
   readonly handle: readonly ["handleKey"];
 };
 //#endregion
-export { PasskeyCommandTable, PasskeyCredentialInsert, PasskeyInvalidationInput, PasskeyInvalidationMutation, PasskeyManagementMapping, PasskeyManagementServices, PasskeyRegistrationMapping, PasskeyRegistrationServices, PasskeyRegistrationWriter, PasskeyWriteTables, passkeyInvalidationMutation, requiredPasskeyManagementConstraints, requiredPasskeyRegistrationWriteConstraints };
 //# sourceMappingURL=passkey-write-model.d.mts.map

package/dist/drizzle/password-model.d.mts

@@ -7,15 +7,15 @@ import { LoginIdentifier, RecoveryReference } from "@yielded/auth/Identity";
 import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
 //#region src/drizzle/password-model.d.ts
 type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
-type PasswordAttemptAction = "sign-in" | "change";
-type PasswordAttemptState = "pending" | "verified" | "rejected";
-type PasswordRateScopeKind = "action" | "identifier" | "subject";
-interface PasswordScopeKeys {
+export type PasswordAttemptAction = "sign-in" | "change";
+export type PasswordAttemptState = "pending" | "verified" | "rejected";
+export type PasswordRateScopeKind = "action" | "identifier" | "subject";
+export interface PasswordScopeKeys {
   readonly action: string;
   readonly identifier: string;
   readonly subject?: string;
 }
-interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {
+export interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {
   readonly table: Subject;
   readonly id: ColumnKey<Subject>;
   readonly status: ColumnKey<Subject>;
@@ -29,7 +29,7 @@ interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {
   /** Required only by D1 conditional statements. */
   readonly d1ActiveStatusValue?: unknown;
 }
-interface PasswordIdentifierTable<Identifier extends Table, NativeSubjectId> {
+export interface PasswordIdentifierTable<Identifier extends Table, NativeSubjectId> {
   readonly table: Identifier;
   readonly namespace: ColumnKey<Identifier>;
   readonly value: ColumnKey<Identifier>;
@@ -45,7 +45,7 @@ interface PasswordIdentifierTable<Identifier extends Table, NativeSubjectId> {
   }) => SQL;
   readonly encodeInitialInsert: (identifier: LoginIdentifier, subjectId: NativeSubjectId, bindingRevision: SecurityRevision) => InferInsertModel<Identifier>;
 }
-interface PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {
+export interface PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {
   readonly table: Credential;
   readonly subjectId: ColumnKey<Credential>;
   readonly credentialId: ColumnKey<Credential>;
@@ -60,7 +60,7 @@ interface PasswordAuthorityCredentialTable<Credential extends Table, NativeSubje
   }) => InferInsertModel<Credential>;
   readonly encodeRevision: (revision: SecurityRevision) => Partial<InferInsertModel<Credential>>;
 }
-interface PasswordCredentialTable<Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> {
+export interface PasswordCredentialTable<Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> {
   readonly table: Credential;
   readonly moduleId: ColumnKey<Credential>;
   readonly subjectId: ColumnKey<Credential>;
@@ -90,7 +90,7 @@ interface PasswordCredentialTable<Subject extends Table, Identifier extends Tabl
     readonly credential: InferSelectModel<Credential>;
   }) => Effect.Effect<PasswordCredentialSnapshot, PersistenceMappingError>;
 }
-interface PasswordAttemptRecord {
+export interface PasswordAttemptRecord {
   readonly moduleId: string;
   readonly action: PasswordAttemptAction;
   readonly attemptId: PasswordAttemptId;
@@ -105,7 +105,7 @@ interface PasswordAttemptRecord {
   readonly deadlineMillis: number;
   readonly retentionUntilMillis: number;
 }
-interface PasswordAttemptTable<Attempt extends Table, NativeSubjectId> {
+export interface PasswordAttemptTable<Attempt extends Table, NativeSubjectId> {
   readonly table: Attempt;
   readonly moduleId: ColumnKey<Attempt>;
   readonly action: ColumnKey<Attempt>;
@@ -127,7 +127,7 @@ interface PasswordAttemptTable<Attempt extends Table, NativeSubjectId> {
     readonly state: "pending";
   }) => InferInsertModel<Attempt>;
 }
-interface PasswordRateScopeTable<RateScope extends Table> {
+export interface PasswordRateScopeTable<RateScope extends Table> {
   readonly table: RateScope;
   readonly moduleId: ColumnKey<RateScope>;
   readonly action: ColumnKey<RateScope>;
@@ -140,7 +140,7 @@ interface PasswordRateScopeTable<RateScope extends Table> {
     readonly scopeKey: string;
   }) => InferInsertModel<RateScope>;
 }
-interface PasswordChargeTable<Charge extends Table> {
+export interface PasswordChargeTable<Charge extends Table> {
   readonly table: Charge;
   readonly moduleId: ColumnKey<Charge>;
   readonly action: ColumnKey<Charge>;
@@ -159,7 +159,7 @@ interface PasswordChargeTable<Charge extends Table> {
     readonly retentionUntilMillis: number;
   }) => InferInsertModel<Charge>;
 }
-interface PasswordCommandTable<Command extends Table> {
+export interface PasswordCommandTable<Command extends Table> {
   readonly table: Command;
   readonly moduleId: ColumnKey<Command>;
   readonly commandId: ColumnKey<Command>;
@@ -176,7 +176,7 @@ interface PasswordCommandTable<Command extends Table> {
     readonly retentionUntilMillis: number;
   }) => InferInsertModel<Command>;
 }
-interface RequiredPasswordConstraints {
+export interface RequiredPasswordConstraints {
   readonly identifier: "unique(identifier.namespace,identifier.value)";
   readonly authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)";
   readonly credentialSubject: "unique(credential.moduleId,credential.subjectId)";
@@ -186,20 +186,20 @@ interface RequiredPasswordConstraints {
   readonly charge: "unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)";
   readonly command: "unique(command.moduleId,command.commandId)";
 }
-declare const requiredPasswordConstraints: RequiredPasswordConstraints;
-interface PasswordConstraintClassifier {
+export declare const requiredPasswordConstraints: RequiredPasswordConstraints;
+export interface PasswordConstraintClassifier {
   /** Match only the mapped command uniqueness constraint. */
   readonly isCommandConflict: (cause: unknown) => boolean;
   /** Match only the mapped rate-scope uniqueness constraint. */
   readonly isRateScopeConflict: (cause: unknown) => boolean;
 }
-interface PasswordD1Clock {
+export interface PasswordD1Clock {
   readonly engineNow: SQL;
   readonly engineNowMillis: SQL;
   readonly engineInstantMinus: (millis: number) => SQL;
   readonly engineInstantPlus: (millis: number) => SQL;
 }
-interface PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, NativeSubjectId> extends PasswordConstraintClassifier {
+export interface PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, NativeSubjectId> extends PasswordConstraintClassifier {
   readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;
   readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId>;
   readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;
@@ -230,7 +230,7 @@ interface PasswordPersistenceMapping<Subject extends Table, Identifier extends T
   readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
   readonly d1?: PasswordD1Clock;
 }
-type D1PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, NativeSubjectId> = PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, NativeSubjectId> & {
+export type D1PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, NativeSubjectId> = PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, NativeSubjectId> & {
   readonly d1: PasswordD1Clock;
   readonly subject: PasswordSubjectTable<Subject, NativeSubjectId> & {
     readonly d1ActiveStatusValue: unknown;
@@ -245,15 +245,15 @@ type D1PasswordPersistenceMapping<Subject extends Table, Identifier extends Tabl
     readonly d1ActiveStatusValue: unknown;
   };
 };
-type PasswordRegistrationState = "pending" | "created";
-interface PasswordRegistrationIntent<Registration> {
+export type PasswordRegistrationState = "pending" | "created";
+export interface PasswordRegistrationIntent<Registration> {
   readonly moduleId: string;
   readonly requestId: string;
   readonly identifier: LoginIdentifier;
   readonly registration: Registration;
   readonly replacement: PasswordReplacement;
 }
-interface PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> {
+export interface PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> {
   readonly table: Request;
   readonly moduleId: ColumnKey<Request>;
   readonly requestId: ColumnKey<Request>;
@@ -270,7 +270,7 @@ interface PasswordRegistrationTable<Registration, Request extends Table, NativeS
     readonly _tag: "Created";
   }>, PersistenceMappingError>;
 }
-interface PasswordRegistrationProvisioning<Registration, Subject extends Table, NativeSubjectId> {
+export interface PasswordRegistrationProvisioning<Registration, Subject extends Table, NativeSubjectId> {
   readonly encodeSubjectInsert: (input: PasswordRegistrationIntent<Registration>, values: {
     readonly nativeSubjectId: NativeSubjectId | undefined;
     readonly securityRevision: SecurityRevision;
@@ -280,20 +280,20 @@ interface PasswordRegistrationProvisioning<Registration, Subject extends Table,
   /** Interactive targets use this for database-generated/autoincrement keys. */
   readonly decodeGeneratedId?: (rows: ReadonlyArray<unknown>) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;
 }
-interface RequiredPasswordRegistrationConstraints {
+export interface RequiredPasswordRegistrationConstraints {
   readonly request: "unique(registration.moduleId,registration.requestId)";
   readonly recoveryReference: "unique(registration.recoveryReference)";
   readonly identifier: "unique(identifier.namespace,identifier.value)";
   readonly credentialSubject: "unique(credential.moduleId,credential.subjectId)";
   readonly authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)";
 }
-declare const requiredPasswordRegistrationConstraints: RequiredPasswordRegistrationConstraints;
-interface PasswordRegistrationConstraintClassifier {
+export declare const requiredPasswordRegistrationConstraints: RequiredPasswordRegistrationConstraints;
+export interface PasswordRegistrationConstraintClassifier {
   readonly isRequestConflict: (cause: unknown) => boolean;
   readonly isIdentifierConflict: (cause: unknown) => boolean;
   readonly isCredentialConflict: (cause: unknown) => boolean;
 }
-type PasswordRegistrationMapping<Registration, Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Request extends Table, NativeSubjectId> = PasswordRegistrationConstraintClassifier & {
+export type PasswordRegistrationMapping<Registration, Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Request extends Table, NativeSubjectId> = PasswordRegistrationConstraintClassifier & {
   readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;
   readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId>;
   readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;
@@ -322,8 +322,7 @@ type PasswordRegistrationMapping<Registration, Subject extends Table, Identifier
   readonly allocateRecoveryReference?: Effect.Effect<typeof RecoveryReference.Type, PersistenceMappingError>;
   readonly allocateRecoveryReferenceSync?: () => typeof RecoveryReference.Type;
 });
-type AnyPasswordPersistenceMapping = PasswordPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
-type AnyPasswordRegistrationMapping<Registration = unknown> = PasswordRegistrationMapping<Registration, Table, Table, Table, Table, Table, unknown>;
+export type AnyPasswordPersistenceMapping = PasswordPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
+export type AnyPasswordRegistrationMapping<Registration = unknown> = PasswordRegistrationMapping<Registration, Table, Table, Table, Table, Table, unknown>;
 //#endregion
-export { AnyPasswordPersistenceMapping, AnyPasswordRegistrationMapping, D1PasswordPersistenceMapping, PasswordAttemptAction, PasswordAttemptRecord, PasswordAttemptState, PasswordAttemptTable, PasswordAuthorityCredentialTable, PasswordChargeTable, PasswordCommandTable, PasswordConstraintClassifier, PasswordCredentialTable, PasswordD1Clock, PasswordIdentifierTable, PasswordPersistenceMapping, PasswordRateScopeKind, PasswordRateScopeTable, PasswordRegistrationConstraintClassifier, PasswordRegistrationIntent, PasswordRegistrationMapping, PasswordRegistrationProvisioning, PasswordRegistrationState, PasswordRegistrationTable, PasswordScopeKeys, PasswordSubjectTable, RequiredPasswordConstraints, RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints };
 //# sourceMappingURL=password-model.d.mts.map