@yielded/auth-persistence 0.1.0-beta.7

package/dist/drizzle/passkey-write-model.d.mts

@@ -0,0 +1,190 @@
+import { PersistenceMappingError } from "../internal/mapping-error.mjs";
+import "./model.mjs";
+import { PasskeyColumn, PasskeyCredentialMapping, PasskeyFlowTable, PasskeyHandleReservationTable, PasskeyPersistenceMapping, PasskeyPersistenceServices } from "./passkey-model.mjs";
+import { PasskeyRegistrationIntentReadTable } from "./passkey-registration-ceremony-model.mjs";
+import { Effect, Schema } from "effect";
+import { PasskeyActionAuthorization, PasskeyCeremony, PasskeyClaim, PasskeyCredential, PasskeyCredentialSummary, PasskeyIssueDecision, PasskeyManagementPersistence, PasskeyManagementPolicy, PasskeyMethodPolicy, PasskeyRegistrationResult, PasskeyRegistrationVerified, PasskeyRequirement, PasskeyRevision, PasskeyUnavailable, PreparePasskeyCommit } from "@yielded/auth/Passkey";
+import { TokenDigest } from "@yielded/auth/Schema";
+import { PreparedCommit } from "@yielded/auth/Hooks";
+import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/passkey-write-model.d.ts
+interface PasskeyCredentialInsert<N> {
+  readonly subjectId: N;
+  readonly credential: PasskeyCredential;
+  readonly summary: PasskeyCredentialSummary;
+  readonly marker: string;
+}
+interface PasskeyWriteTables<S extends Table, C extends Table, F extends Table, O extends Table, H extends Table, N> {
+  readonly credential: {
+    readonly name: PasskeyColumn<C>;
+    readonly createdAt: PasskeyColumn<C>;
+    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => InferInsertModel<C>;
+    readonly encodePrimarySignIn: (value: boolean) => unknown;
+    readonly encodeEnrollmentUserVerified: (value: boolean) => unknown;
+    readonly encodeBackupEligible: (value: boolean) => unknown;
+    readonly activeStatus: unknown;
+    readonly removedStatus: unknown;
+  };
+  readonly authority: {
+    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => InferInsertModel<F>;
+    readonly activeStatus: unknown;
+    readonly removedStatus: unknown;
+  };
+  readonly credentialOwnership: {
+    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => InferInsertModel<O>;
+    readonly ownedState: unknown;
+    readonly removedState: unknown;
+  };
+  readonly handleOwnership: {
+    readonly encodeInsert: (input: {
+      readonly subjectId: N;
+      readonly rpId: string;
+      readonly userHandle: string;
+      readonly marker: string;
+    }) => InferInsertModel<H>;
+    readonly ownedState: unknown;
+  };
+  /** All mutable policy dependencies must be subject columns or declared module guards. */
+  readonly policy: {
+    readonly subjectColumns: ReadonlyArray<PasskeyColumn<S>>;
+    readonly management: (row: Readonly<Partial<InferSelectModel<S>>>) => PasskeyManagementPolicy;
+    readonly requirement: (row: Readonly<Partial<InferSelectModel<S>>>, action: PasskeyActionAuthorization["challenge"]["action"]) => Effect.Effect<typeof PasskeyRequirement.Type, PersistenceMappingError>;
+    readonly metadata: (subjectId: N) => SQL;
+    readonly action: (subjectId: N, authorization: PasskeyActionAuthorization) => SQL;
+    /** Usable primary/recovery path AND required remaining factors. Evaluated with the target excluded, before and after removal. Connected grants/factor-only credentials are not primary paths. */
+    readonly remainingSignIn: (subjectId: N, removedCredentialId: string, row: Readonly<Partial<InferSelectModel<S>>>) => Effect.Effect<SQL, PersistenceMappingError>;
+  };
+}
+interface PasskeyInvalidationInput<N> {
+  readonly subjectId: N;
+  readonly previousRevision: typeof PasskeyRevision.Type.securityRevision;
+  readonly securityRevision: typeof PasskeyRevision.Type.securityRevision;
+  readonly invalidation: SessionInvalidationWindow;
+}
+interface PasskeyInvalidationMutation<N> {
+  readonly table: Table;
+  readonly where: (input: PasskeyInvalidationInput<N>) => SQL;
+  readonly values: (input: PasskeyInvalidationInput<N>) => Readonly<Record<string, unknown>>;
+  readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;
+}
+/** Same-owner updates for consumer session/pending tables. No external effects or callbacks after commit. */
+declare const passkeyInvalidationMutation: <T extends Table, N>(input: {
+  readonly table: T;
+  readonly where: (input: PasskeyInvalidationInput<N>) => SQL;
+  readonly values: (input: PasskeyInvalidationInput<N>) => Partial<InferInsertModel<T>>;
+  readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;
+}) => PasskeyInvalidationMutation<N>;
+interface PasskeyCommandTable<T extends Table, N> {
+  readonly table: T;
+  readonly moduleId: PasskeyColumn<T>;
+  readonly commandId: PasskeyColumn<T>;
+  readonly subjectId: PasskeyColumn<T>;
+  readonly credentialId: PasskeyColumn<T>;
+  readonly intent: PasskeyColumn<T>;
+  readonly decision: PasskeyColumn<T>;
+  readonly retentionUntil: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly commandId: string;
+    readonly subjectId: N;
+    readonly credentialId: string;
+  }) => InferInsertModel<T>;
+}
+interface PasskeyManagementMapping<S extends Table, C extends Table, F extends Table, O extends Table, H extends Table, M extends Table, Flow extends Table, A extends Table, Charge extends Table, Command extends Table, N> extends PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, Flow, A, Charge, N> {
+  readonly write: PasskeyWriteTables<S, C, F, O, H, N>;
+  readonly command: PasskeyCommandTable<Command, N>;
+  readonly managementConstraints: typeof requiredPasskeyManagementConstraints;
+  /** Removal must match the installed session strategy and change the subject revision; immediate sessions must consult that authority or be updated here. Enrollment preserves existing authentication. */
+  readonly invalidation: {
+    readonly window: SessionInvalidationWindow;
+    readonly mutations: ReadonlyArray<PasskeyInvalidationMutation<N>>;
+    readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;
+  };
+}
+declare const requiredPasskeyManagementConstraints: {
+  readonly command: readonly ["moduleId", "commandId"];
+};
+interface PasskeyManagementServices extends PasskeyPersistenceServices {
+  readonly passkeyManagementPersistence: PasskeyManagementPersistence["Service"];
+}
+interface PasskeyRegistrationWriter<R> {
+  readonly inspect: (registration: R) => Effect.Effect<{
+    readonly fingerprint: TokenDigest;
+    readonly eligible: boolean;
+    readonly name: string;
+    readonly displayName: string;
+  }, PasskeyUnavailable>;
+  readonly issueRegistration: <A>(input: {
+    readonly ceremony: PasskeyCeremony;
+    readonly policy: PasskeyMethodPolicy;
+    readonly registration: R;
+  }, prepare: PreparePasskeyCommit<PasskeyIssueDecision, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
+  readonly completeRegistration: <A>(input: {
+    readonly claim: PasskeyClaim;
+    readonly verified: PasskeyRegistrationVerified;
+    readonly nowMillis: number;
+  }, prepare: PreparePasskeyCommit<PasskeyRegistrationResult | {
+    readonly _tag: "Rejected";
+  }, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
+}
+interface PasskeyRegistrationServices<R> extends PasskeyPersistenceServices {
+  readonly passkeyRegistrationAuthority: PasskeyRegistrationWriter<R>;
+}
+interface PasskeyRegistrationMapping<S extends Table, C extends Table, F extends Table, O extends Table, H extends Table, M extends Table, Flow extends Table, A extends Table, Charge extends Table, Intent extends Table, N, R> extends PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, Flow, A, Charge, N> {
+  readonly write: PasskeyWriteTables<S, C, F, O, H, N>;
+  readonly flow: PasskeyFlowTable<Flow>;
+  readonly handle: PasskeyHandleReservationTable<H> & {
+    readonly reservedState: unknown;
+    readonly encodeInsert: (input: {
+      readonly ceremony: PasskeyCeremony;
+      readonly reservationId: string;
+    }) => InferInsertModel<H>;
+  };
+  readonly intent: PasskeyRegistrationIntentReadTable<Intent> & {
+    readonly pendingState: unknown;
+    readonly acceptedState: unknown;
+    readonly rejectedState: unknown;
+    readonly encodeInsert: (input: {
+      readonly ceremony: PasskeyCeremony;
+      readonly registration: R;
+      readonly reservationId: string;
+    }) => InferInsertModel<Intent>;
+  };
+  /** Consumer-owned data and identity, synchronously encoded inside the owner. A SQL-local registration creates no session and needs no email address. */
+  readonly registration: {
+    readonly schema: Schema.Codec<R, unknown, never, never>;
+    readonly describe: (registration: R) => {
+      readonly name: string;
+      readonly displayName: string;
+    };
+    readonly eligible: (registration: R) => SQL;
+    /** Commit-time application policy after provisioning. Unlike `eligible`, this
+     * must permit the newly created subject and retain every mutable prerequisite.
+     * Declare mutable external policy rows in module.guards so native locking
+     * owners serialize revocation through commit; this predicate alone is not a lock. */
+    readonly finalEligibility: (input: {
+      readonly registration: R;
+      readonly subjectId: N;
+    }) => SQL;
+    readonly subject: (input: {
+      readonly registration: R;
+      readonly ceremony: PasskeyCeremony;
+      readonly marker: string;
+    }) => {
+      readonly subjectId: N;
+      readonly values: InferInsertModel<S>;
+    };
+    readonly activeStatus: unknown;
+  };
+  readonly registrationConstraints: typeof requiredPasskeyRegistrationWriteConstraints;
+}
+declare const requiredPasskeyRegistrationWriteConstraints: {
+  readonly intentFlow: readonly ["moduleId", "flowId"];
+  readonly intentCommand: readonly ["moduleId", "commandId"];
+  readonly handle: readonly ["handleKey"];
+};
+//#endregion
+export { PasskeyCommandTable, PasskeyCredentialInsert, PasskeyInvalidationInput, PasskeyInvalidationMutation, PasskeyManagementMapping, PasskeyManagementServices, PasskeyRegistrationMapping, PasskeyRegistrationServices, PasskeyRegistrationWriter, PasskeyWriteTables, passkeyInvalidationMutation, requiredPasskeyManagementConstraints, requiredPasskeyRegistrationWriteConstraints };
+//# sourceMappingURL=passkey-write-model.d.mts.map

package/dist/drizzle/passkey-write-model.mjs

@@ -0,0 +1,13 @@
+//#region src/drizzle/passkey-write-model.ts
+/** Same-owner updates for consumer session/pending tables. No external effects or callbacks after commit. */
+const passkeyInvalidationMutation = (input) => input;
+const requiredPasskeyManagementConstraints = { command: ["moduleId", "commandId"] };
+const requiredPasskeyRegistrationWriteConstraints = {
+	intentFlow: ["moduleId", "flowId"],
+	intentCommand: ["moduleId", "commandId"],
+	handle: ["handleKey"]
+};
+//#endregion
+export { passkeyInvalidationMutation, requiredPasskeyManagementConstraints, requiredPasskeyRegistrationWriteConstraints };
+
+//# sourceMappingURL=passkey-write-model.mjs.map

package/dist/drizzle/passkey-write-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-write-model.mjs","names":[],"sources":["../../src/drizzle/passkey-write-model.ts"],"sourcesContent":["import type { PreparedCommit } from \"@yielded/auth/Hooks\";\nimport type {\n  PasskeyUnavailable,\n  PasskeyActionAuthorization,\n  PasskeyCeremony,\n  PasskeyClaim,\n  PasskeyCredential,\n  PasskeyCredentialSummary,\n  PasskeyIssueDecision,\n  PasskeyRegistrationResult,\n  PasskeyRegistrationVerified,\n  PasskeyRequirement,\n  PasskeyRevision,\n  PasskeyManagementPersistence,\n  PreparePasskeyCommit,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n} from \"@yielded/auth/Passkey\";\nimport type { TokenDigest } from \"@yielded/auth/Schema\";\nimport type { SessionInvalidationWindow } from \"@yielded/auth/Sessions\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { Effect, Schema } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport type {\n  PasskeyColumn,\n  PasskeyCredentialMapping,\n  PasskeyFlowTable,\n  PasskeyHandleReservationTable,\n  PasskeyPersistenceMapping,\n  PasskeyPersistenceServices,\n} from \"./passkey-model\";\nimport type { PasskeyRegistrationIntentReadTable } from \"./passkey-registration-ceremony-model\";\n\nexport interface PasskeyCredentialInsert<N> {\n  readonly subjectId: N;\n  readonly credential: PasskeyCredential;\n  readonly summary: PasskeyCredentialSummary;\n  readonly marker: string;\n}\n\nexport interface PasskeyWriteTables<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  N,\n> {\n  readonly credential: {\n    readonly name: PasskeyColumn<C>;\n    readonly createdAt: PasskeyColumn<C>;\n    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => InferInsertModel<C>;\n    readonly encodePrimarySignIn: (value: boolean) => unknown;\n    readonly encodeEnrollmentUserVerified: (value: boolean) => unknown;\n    readonly encodeBackupEligible: (value: boolean) => unknown;\n    readonly activeStatus: unknown;\n    readonly removedStatus: unknown;\n  };\n  readonly authority: {\n    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => InferInsertModel<F>;\n    readonly activeStatus: unknown;\n    readonly removedStatus: unknown;\n  };\n  readonly credentialOwnership: {\n    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => InferInsertModel<O>;\n    readonly ownedState: unknown;\n    readonly removedState: unknown;\n  };\n  readonly handleOwnership: {\n    readonly encodeInsert: (input: {\n      readonly subjectId: N;\n      readonly rpId: string;\n      readonly userHandle: string;\n      readonly marker: string;\n    }) => InferInsertModel<H>;\n    readonly ownedState: unknown;\n  };\n  /** All mutable policy dependencies must be subject columns or declared module guards. */\n  readonly policy: {\n    readonly subjectColumns: ReadonlyArray<PasskeyColumn<S>>;\n    readonly management: (row: Readonly<Partial<InferSelectModel<S>>>) => PasskeyManagementPolicy;\n    readonly requirement: (\n      row: Readonly<Partial<InferSelectModel<S>>>,\n      action: PasskeyActionAuthorization[\"challenge\"][\"action\"],\n    ) => Effect.Effect<typeof PasskeyRequirement.Type, PersistenceMappingError>;\n    readonly metadata: (subjectId: N) => SQL;\n    readonly action: (subjectId: N, authorization: PasskeyActionAuthorization) => SQL;\n    /** Usable primary/recovery path AND required remaining factors. Evaluated with the target excluded, before and after removal. Connected grants/factor-only credentials are not primary paths. */\n    readonly remainingSignIn: (\n      subjectId: N,\n      removedCredentialId: string,\n      row: Readonly<Partial<InferSelectModel<S>>>,\n    ) => Effect.Effect<SQL, PersistenceMappingError>;\n  };\n}\n\nexport interface PasskeyInvalidationInput<N> {\n  readonly subjectId: N;\n  readonly previousRevision: typeof PasskeyRevision.Type.securityRevision;\n  readonly securityRevision: typeof PasskeyRevision.Type.securityRevision;\n  readonly invalidation: SessionInvalidationWindow;\n}\n\nexport interface PasskeyInvalidationMutation<N> {\n  readonly table: Table;\n  readonly where: (input: PasskeyInvalidationInput<N>) => SQL;\n  readonly values: (input: PasskeyInvalidationInput<N>) => Readonly<Record<string, unknown>>;\n  readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;\n}\n\n/** Same-owner updates for consumer session/pending tables. No external effects or callbacks after commit. */\nexport const passkeyInvalidationMutation = <T extends Table, N>(input: {\n  readonly table: T;\n  readonly where: (input: PasskeyInvalidationInput<N>) => SQL;\n  readonly values: (input: PasskeyInvalidationInput<N>) => Partial<InferInsertModel<T>>;\n  readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;\n}): PasskeyInvalidationMutation<N> => input;\n\nexport interface PasskeyCommandTable<T extends Table, N> {\n  readonly table: T;\n  readonly moduleId: PasskeyColumn<T>;\n  readonly commandId: PasskeyColumn<T>;\n  readonly subjectId: PasskeyColumn<T>;\n  readonly credentialId: PasskeyColumn<T>;\n  readonly intent: PasskeyColumn<T>;\n  readonly decision: PasskeyColumn<T>;\n  readonly retentionUntil: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly subjectId: N;\n    readonly credentialId: string;\n  }) => InferInsertModel<T>;\n}\n\nexport interface PasskeyManagementMapping<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  M extends Table,\n  Flow extends Table,\n  A extends Table,\n  Charge extends Table,\n  Command extends Table,\n  N,\n> extends PasskeyPersistenceMapping<\n  PasskeyCredentialMapping<S, C, F, O, H, N>,\n  M,\n  Flow,\n  A,\n  Charge,\n  N\n> {\n  readonly write: PasskeyWriteTables<S, C, F, O, H, N>;\n  readonly command: PasskeyCommandTable<Command, N>;\n  readonly managementConstraints: typeof requiredPasskeyManagementConstraints;\n  /** Removal must match the installed session strategy and change the subject revision; immediate sessions must consult that authority or be updated here. Enrollment preserves existing authentication. */\n  readonly invalidation: {\n    readonly window: SessionInvalidationWindow;\n    readonly mutations: ReadonlyArray<PasskeyInvalidationMutation<N>>;\n    readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;\n  };\n}\n\nexport const requiredPasskeyManagementConstraints = { command: [\"moduleId\", \"commandId\"] } as const;\n\nexport interface PasskeyManagementServices extends PasskeyPersistenceServices {\n  readonly passkeyManagementPersistence: PasskeyManagementPersistence[\"Service\"];\n}\n\nexport interface PasskeyRegistrationWriter<R> {\n  readonly inspect: (registration: R) => Effect.Effect<\n    {\n      readonly fingerprint: TokenDigest;\n      readonly eligible: boolean;\n      readonly name: string;\n      readonly displayName: string;\n    },\n    PasskeyUnavailable\n  >;\n  readonly issueRegistration: <A>(\n    input: {\n      readonly ceremony: PasskeyCeremony;\n      readonly policy: PasskeyMethodPolicy;\n      readonly registration: R;\n    },\n    prepare: PreparePasskeyCommit<PasskeyIssueDecision, A>,\n  ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n  readonly completeRegistration: <A>(\n    input: {\n      readonly claim: PasskeyClaim;\n      readonly verified: PasskeyRegistrationVerified;\n      readonly nowMillis: number;\n    },\n    prepare: PreparePasskeyCommit<PasskeyRegistrationResult | { readonly _tag: \"Rejected\" }, A>,\n  ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n}\n\nexport interface PasskeyRegistrationServices<R> extends PasskeyPersistenceServices {\n  readonly passkeyRegistrationAuthority: PasskeyRegistrationWriter<R>;\n}\n\nexport interface PasskeyRegistrationMapping<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  M extends Table,\n  Flow extends Table,\n  A extends Table,\n  Charge extends Table,\n  Intent extends Table,\n  N,\n  R,\n> extends PasskeyPersistenceMapping<\n  PasskeyCredentialMapping<S, C, F, O, H, N>,\n  M,\n  Flow,\n  A,\n  Charge,\n  N\n> {\n  readonly write: PasskeyWriteTables<S, C, F, O, H, N>;\n  readonly flow: PasskeyFlowTable<Flow>;\n  readonly handle: PasskeyHandleReservationTable<H> & {\n    readonly reservedState: unknown;\n    readonly encodeInsert: (input: {\n      readonly ceremony: PasskeyCeremony;\n      readonly reservationId: string;\n    }) => InferInsertModel<H>;\n  };\n  readonly intent: PasskeyRegistrationIntentReadTable<Intent> & {\n    readonly pendingState: unknown;\n    readonly acceptedState: unknown;\n    readonly rejectedState: unknown;\n    readonly encodeInsert: (input: {\n      readonly ceremony: PasskeyCeremony;\n      readonly registration: R;\n      readonly reservationId: string;\n    }) => InferInsertModel<Intent>;\n  };\n  /** Consumer-owned data and identity, synchronously encoded inside the owner. A SQL-local registration creates no session and needs no email address. */\n  readonly registration: {\n    readonly schema: Schema.Codec<R, unknown, never, never>;\n    readonly describe: (registration: R) => { readonly name: string; readonly displayName: string };\n    readonly eligible: (registration: R) => SQL;\n    /** Commit-time application policy after provisioning. Unlike `eligible`, this\n     * must permit the newly created subject and retain every mutable prerequisite.\n     * Declare mutable external policy rows in module.guards so native locking\n     * owners serialize revocation through commit; this predicate alone is not a lock. */\n    readonly finalEligibility: (input: { readonly registration: R; readonly subjectId: N }) => SQL;\n    readonly subject: (input: {\n      readonly registration: R;\n      readonly ceremony: PasskeyCeremony;\n      readonly marker: string;\n    }) => { readonly subjectId: N; readonly values: InferInsertModel<S> };\n    readonly activeStatus: unknown;\n  };\n  readonly registrationConstraints: typeof requiredPasskeyRegistrationWriteConstraints;\n}\n\nexport const requiredPasskeyRegistrationWriteConstraints = {\n  intentFlow: [\"moduleId\", \"flowId\"],\n  intentCommand: [\"moduleId\", \"commandId\"],\n  handle: [\"handleKey\"],\n} as const;\n"],"mappings":";;AAgHA,MAAa,+BAAmD,UAK1B;AAmDtC,MAAa,uCAAuC,EAAE,SAAS,CAAC,YAAY,WAAW,EAAE;AAkGzF,MAAa,8CAA8C;CACzD,YAAY,CAAC,YAAY,QAAQ;CACjC,eAAe,CAAC,YAAY,WAAW;CACvC,QAAQ,CAAC,WAAW;AACtB"}

package/dist/drizzle/passkey-write-target.d.mts

@@ -0,0 +1,11 @@
+import { PersistenceMappingError } from "../internal/mapping-error.mjs";
+import "./model.mjs";
+import { PasskeyMappingSource } from "./passkey-model.mjs";
+import { PasskeyManagementServices, PasskeyRegistrationServices } from "./passkey-write-model.mjs";
+import { PasskeyCoordinatorError, PasskeyTargetConfiguration } from "../internal/passkey/target.mjs";
+import "./passkey-target.mjs";
+//#region src/drizzle/passkey-write-target.d.ts
+declare const passkeyManagementPersistenceLayer: <E, R>(services: import("effect/Effect").Effect<PasskeyManagementServices, E, R>) => import("effect/Layer").Layer<import("@yielded/auth/Passkey").PasskeyManagementPersistence, E, Exclude<R, import("effect/Scope").Scope>>, makeTargetPasskeyManagement: <M, RSetup>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyManagementServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks>, makeTargetPasskeyRegistrationWriter: <M, R, RSetup>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyRegistrationServices<R>, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateTargetPasskeyManagement: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, body: (transaction: Transaction, services: PasskeyManagementServices, append: (statement: import("effect/unstable/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks>, coordinateTargetPasskeyRegistrationWriter: <M, Value, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, body: (transaction: Transaction, services: PasskeyRegistrationServices<Value>, append: (statement: import("effect/unstable/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks>;
+//#endregion
+export { passkeyManagementPersistenceLayer };
+//# sourceMappingURL=passkey-write-target.d.mts.map

package/dist/drizzle/passkey-write-target.mjs

@@ -0,0 +1,7 @@
+import { passkeyKernel } from "./passkey-kernel.mjs";
+//#region src/drizzle/passkey-write-target.ts
+const { passkeyManagementPersistenceLayer, makeTargetPasskeyManagement, makeTargetPasskeyRegistrationWriter, coordinateTargetPasskeyManagement, coordinateTargetPasskeyRegistrationWriter } = passkeyKernel.writeTarget;
+//#endregion
+export { coordinateTargetPasskeyManagement, coordinateTargetPasskeyRegistrationWriter, makeTargetPasskeyManagement, makeTargetPasskeyRegistrationWriter, passkeyManagementPersistenceLayer };
+
+//# sourceMappingURL=passkey-write-target.mjs.map

package/dist/drizzle/passkey-write-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-write-target.mjs","names":[],"sources":["../../src/drizzle/passkey-write-target.ts"],"sourcesContent":["import { passkeyKernel } from \"./passkey-kernel\";\n\nexport const {\n  passkeyManagementPersistenceLayer,\n  makeTargetPasskeyManagement,\n  makeTargetPasskeyRegistrationWriter,\n  coordinateTargetPasskeyManagement,\n  coordinateTargetPasskeyRegistrationWriter,\n} = passkeyKernel.writeTarget;\n"],"mappings":";;AAEA,MAAa,EACX,mCACA,6BACA,qCACA,mCACA,8CACE,cAAc"}

package/dist/drizzle/password-model.d.mts

@@ -0,0 +1,329 @@
+import { PersistenceMappingError } from "../internal/mapping-error.mjs";
+import { SubjectIdCodec } from "./model.mjs";
+import { Effect, Redacted } from "effect";
+import { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
+import { EncodedPasswordHash, PasswordAction, PasswordAttemptId, PasswordCredentialSnapshot, PasswordRegistrationDecision, PasswordReplacement } from "@yielded/auth/Password";
+import { LoginIdentifier, RecoveryReference } from "@yielded/auth/Identity";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/password-model.d.ts
+type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+type PasswordAttemptAction = "sign-in" | "change";
+type PasswordAttemptState = "pending" | "verified" | "rejected";
+type PasswordRateScopeKind = "action" | "identifier" | "subject";
+interface PasswordScopeKeys {
+  readonly action: string;
+  readonly identifier: string;
+  readonly subject?: string;
+}
+interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {
+  readonly table: Subject;
+  readonly id: ColumnKey<Subject>;
+  readonly status: ColumnKey<Subject>;
+  readonly securityRevision: ColumnKey<Subject>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly decodeRequirement: (row: InferSelectModel<Subject>) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
+  /** Current policy for this exact credential mutation, decoded under the subject lock. */
+  readonly decodeActionRequirement: (row: InferSelectModel<Subject>, action: PasswordAction) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
+  readonly nextSecurityRevision?: (current: SecurityRevision) => Effect.Effect<SecurityRevision, PersistenceMappingError>;
+  readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;
+  /** Required only by D1 conditional statements. */
+  readonly d1ActiveStatusValue?: unknown;
+}
+interface PasswordIdentifierTable<Identifier extends Table, NativeSubjectId> {
+  readonly table: Identifier;
+  readonly namespace: ColumnKey<Identifier>;
+  readonly value: ColumnKey<Identifier>;
+  readonly subjectId: ColumnKey<Identifier>;
+  readonly verifiedAt: ColumnKey<Identifier>;
+  readonly bindingRevision: ColumnKey<Identifier>;
+  /** Consumer-owned current login/recovery eligibility, including row status. */
+  readonly isCurrent: (row: InferSelectModel<Identifier>) => boolean;
+  /** Required by D1 so current ownership/eligibility is rechecked in the batch. */
+  readonly d1CurrentCondition?: (input: {
+    readonly identifier: LoginIdentifier;
+    readonly nativeSubjectId: NativeSubjectId;
+  }) => SQL;
+  readonly encodeInitialInsert: (identifier: LoginIdentifier, subjectId: NativeSubjectId, bindingRevision: SecurityRevision) => InferInsertModel<Identifier>;
+}
+interface PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {
+  readonly table: Credential;
+  readonly subjectId: ColumnKey<Credential>;
+  readonly credentialId: ColumnKey<Credential>;
+  readonly revision: ColumnKey<Credential>;
+  readonly status?: ColumnKey<Credential>;
+  readonly isActiveStatus?: (value: unknown) => boolean;
+  readonly d1ActiveStatusValue?: unknown;
+  readonly encodeInsert: (input: {
+    readonly subjectId: NativeSubjectId;
+    readonly credentialId: string;
+    readonly revision: SecurityRevision;
+  }) => InferInsertModel<Credential>;
+  readonly encodeRevision: (revision: SecurityRevision) => Partial<InferInsertModel<Credential>>;
+}
+interface PasswordCredentialTable<Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> {
+  readonly table: Credential;
+  readonly moduleId: ColumnKey<Credential>;
+  readonly subjectId: ColumnKey<Credential>;
+  readonly credentialId: ColumnKey<Credential>;
+  readonly credentialRevision: ColumnKey<Credential>;
+  readonly verifierVersion: ColumnKey<Credential>;
+  readonly verifier: ColumnKey<Credential>;
+  readonly normalization: ColumnKey<Credential>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly subjectId: NativeSubjectId;
+    readonly credentialId: string;
+    readonly credentialRevision: SecurityRevision;
+    readonly verifierVersion: SecurityRevision;
+    readonly replacement: PasswordReplacement;
+  }) => InferInsertModel<Credential>;
+  readonly encodeVerifier: (verifier: Redacted.Redacted<EncodedPasswordHash>, verifierVersion: SecurityRevision) => Partial<InferInsertModel<Credential>>;
+  readonly encodeReplacement: (input: {
+    readonly replacement: PasswordReplacement;
+    readonly credentialRevision: SecurityRevision;
+    readonly verifierVersion: SecurityRevision;
+  }) => Partial<InferInsertModel<Credential>>;
+  readonly decode: (input: {
+    readonly moduleId: string;
+    readonly subject: InferSelectModel<Subject>;
+    readonly identifier: InferSelectModel<Identifier>;
+    readonly credential: InferSelectModel<Credential>;
+  }) => Effect.Effect<PasswordCredentialSnapshot, PersistenceMappingError>;
+}
+interface PasswordAttemptRecord {
+  readonly moduleId: string;
+  readonly action: PasswordAttemptAction;
+  readonly attemptId: PasswordAttemptId;
+  readonly identifier: LoginIdentifier;
+  readonly subjectId?: string;
+  readonly credentialId?: string;
+  readonly securityRevision?: SecurityRevision;
+  readonly credentialRevision?: SecurityRevision;
+  readonly verifierVersion?: SecurityRevision;
+  readonly identifierBindingRevision?: SecurityRevision;
+  readonly admittedAtMillis: number;
+  readonly deadlineMillis: number;
+  readonly retentionUntilMillis: number;
+}
+interface PasswordAttemptTable<Attempt extends Table, NativeSubjectId> {
+  readonly table: Attempt;
+  readonly moduleId: ColumnKey<Attempt>;
+  readonly action: ColumnKey<Attempt>;
+  readonly attemptId: ColumnKey<Attempt>;
+  readonly identifierNamespace: ColumnKey<Attempt>;
+  readonly identifierValue: ColumnKey<Attempt>;
+  readonly subjectId: ColumnKey<Attempt>;
+  readonly credentialId: ColumnKey<Attempt>;
+  readonly securityRevision: ColumnKey<Attempt>;
+  readonly credentialRevision: ColumnKey<Attempt>;
+  readonly verifierVersion: ColumnKey<Attempt>;
+  readonly identifierBindingRevision: ColumnKey<Attempt>;
+  readonly admittedAt: ColumnKey<Attempt>;
+  readonly deadline: ColumnKey<Attempt>;
+  readonly retentionUntil: ColumnKey<Attempt>;
+  readonly state: ColumnKey<Attempt>;
+  readonly encodeInsert: (record: PasswordAttemptRecord, input: {
+    readonly nativeSubjectId?: NativeSubjectId;
+    readonly state: "pending";
+  }) => InferInsertModel<Attempt>;
+}
+interface PasswordRateScopeTable<RateScope extends Table> {
+  readonly table: RateScope;
+  readonly moduleId: ColumnKey<RateScope>;
+  readonly action: ColumnKey<RateScope>;
+  readonly scopeKind: ColumnKey<RateScope>;
+  readonly scopeKey: ColumnKey<RateScope>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly action: PasswordAttemptAction;
+    readonly scopeKind: PasswordRateScopeKind;
+    readonly scopeKey: string;
+  }) => InferInsertModel<RateScope>;
+}
+interface PasswordChargeTable<Charge extends Table> {
+  readonly table: Charge;
+  readonly moduleId: ColumnKey<Charge>;
+  readonly action: ColumnKey<Charge>;
+  readonly scopeKind: ColumnKey<Charge>;
+  readonly scopeKey: ColumnKey<Charge>;
+  readonly attemptId: ColumnKey<Charge>;
+  readonly occurredAt: ColumnKey<Charge>;
+  readonly retentionUntil: ColumnKey<Charge>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly action: PasswordAttemptAction;
+    readonly scopeKind: PasswordRateScopeKind;
+    readonly scopeKey: string;
+    readonly attemptId: PasswordAttemptId;
+    readonly occurredAtMillis: number;
+    readonly retentionUntilMillis: number;
+  }) => InferInsertModel<Charge>;
+}
+interface PasswordCommandTable<Command extends Table> {
+  readonly table: Command;
+  readonly moduleId: ColumnKey<Command>;
+  readonly commandId: ColumnKey<Command>;
+  readonly action: ColumnKey<Command>;
+  readonly bindingDigest: ColumnKey<Command>;
+  readonly decision: ColumnKey<Command>;
+  readonly retentionUntil: ColumnKey<Command>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly commandId: string;
+    readonly action: string;
+    readonly bindingDigest: string;
+    readonly decision: "changed";
+    readonly retentionUntilMillis: number;
+  }) => InferInsertModel<Command>;
+}
+interface RequiredPasswordConstraints {
+  readonly identifier: "unique(identifier.namespace,identifier.value)";
+  readonly authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)";
+  readonly credentialSubject: "unique(credential.moduleId,credential.subjectId)";
+  readonly credentialId: "unique(credential.moduleId,credential.credentialId)";
+  readonly attempt: "unique(attempt.moduleId,attempt.attemptId)";
+  readonly rateScope: "unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)";
+  readonly charge: "unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)";
+  readonly command: "unique(command.moduleId,command.commandId)";
+}
+declare const requiredPasswordConstraints: RequiredPasswordConstraints;
+interface PasswordConstraintClassifier {
+  /** Match only the mapped command uniqueness constraint. */
+  readonly isCommandConflict: (cause: unknown) => boolean;
+  /** Match only the mapped rate-scope uniqueness constraint. */
+  readonly isRateScopeConflict: (cause: unknown) => boolean;
+}
+interface PasswordD1Clock {
+  readonly engineNow: SQL;
+  readonly engineNowMillis: SQL;
+  readonly engineInstantMinus: (millis: number) => SQL;
+  readonly engineInstantPlus: (millis: number) => SQL;
+}
+interface PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, NativeSubjectId> extends PasswordConstraintClassifier {
+  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;
+  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId>;
+  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;
+  /** Every factor revision named by action evidence, including non-password factors. */
+  readonly authorityCredential: PasswordAuthorityCredentialTable<AuthorityCredential, NativeSubjectId>;
+  readonly attempt: PasswordAttemptTable<Attempt, NativeSubjectId>;
+  readonly rateScope: PasswordRateScopeTable<RateScope>;
+  readonly charge: PasswordChargeTable<Charge>;
+  readonly command: PasswordCommandTable<Command>;
+  readonly subjectId: SubjectIdCodec<NativeSubjectId>;
+  readonly constraints: RequiredPasswordConstraints;
+  readonly scopeKeys: (input: {
+    readonly moduleId: string;
+    readonly action: PasswordAttemptAction;
+    readonly identifier: LoginIdentifier;
+    readonly subjectId?: string;
+  }) => PasswordScopeKeys;
+  readonly encodeInstant: (epochMillis: number) => unknown;
+  readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;
+  readonly allocateAttemptId?: Effect.Effect<PasswordAttemptId, PersistenceMappingError>;
+  readonly allocateAttemptIdSync?: () => PasswordAttemptId;
+  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;
+  readonly allocateCredentialIdSync?: () => string;
+  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
+  readonly allocateRevisionSync?: () => SecurityRevision;
+  readonly commandRetentionMillis: number;
+  /** All semantic replacements still bump subject revision. This flag only declares bearer invalidation latency. */
+  readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
+  readonly d1?: PasswordD1Clock;
+}
+type D1PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, NativeSubjectId> = PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, NativeSubjectId> & {
+  readonly d1: PasswordD1Clock;
+  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId> & {
+    readonly d1ActiveStatusValue: unknown;
+  };
+  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId> & {
+    readonly d1CurrentCondition: (input: {
+      readonly identifier: LoginIdentifier;
+      readonly nativeSubjectId: NativeSubjectId;
+    }) => SQL;
+  };
+  readonly authorityCredential: PasswordAuthorityCredentialTable<AuthorityCredential, NativeSubjectId> & {
+    readonly d1ActiveStatusValue: unknown;
+  };
+};
+type PasswordRegistrationState = "pending" | "created";
+interface PasswordRegistrationIntent<Registration> {
+  readonly moduleId: string;
+  readonly requestId: string;
+  readonly identifier: LoginIdentifier;
+  readonly registration: Registration;
+  readonly replacement: PasswordReplacement;
+}
+interface PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> {
+  readonly table: Request;
+  readonly moduleId: ColumnKey<Request>;
+  readonly requestId: ColumnKey<Request>;
+  readonly state: ColumnKey<Request>;
+  readonly subjectId: ColumnKey<Request>;
+  readonly recoveryReference: ColumnKey<Request>;
+  readonly encodeInsert: (input: PasswordRegistrationIntent<Registration>, state: {
+    readonly state: PasswordRegistrationState;
+    readonly nativeSubjectId?: NativeSubjectId;
+    readonly recoveryReference?: typeof RecoveryReference.Type;
+  }) => InferInsertModel<Request>;
+  /** Replay projection must never expose a stored subject or decode protected intent. */
+  readonly decodeReplay: (row: InferSelectModel<Request>) => Effect.Effect<Exclude<PasswordRegistrationDecision, {
+    readonly _tag: "Created";
+  }>, PersistenceMappingError>;
+}
+interface PasswordRegistrationProvisioning<Registration, Subject extends Table, NativeSubjectId> {
+  readonly encodeSubjectInsert: (input: PasswordRegistrationIntent<Registration>, values: {
+    readonly nativeSubjectId: NativeSubjectId | undefined;
+    readonly securityRevision: SecurityRevision;
+  }) => InferInsertModel<Subject>;
+  readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, PersistenceMappingError>;
+  readonly allocateSubjectIdSync?: () => NativeSubjectId;
+  /** Interactive targets use this for database-generated/autoincrement keys. */
+  readonly decodeGeneratedId?: (rows: ReadonlyArray<unknown>) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;
+}
+interface RequiredPasswordRegistrationConstraints {
+  readonly request: "unique(registration.moduleId,registration.requestId)";
+  readonly recoveryReference: "unique(registration.recoveryReference)";
+  readonly identifier: "unique(identifier.namespace,identifier.value)";
+  readonly credentialSubject: "unique(credential.moduleId,credential.subjectId)";
+  readonly authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)";
+}
+declare const requiredPasswordRegistrationConstraints: RequiredPasswordRegistrationConstraints;
+interface PasswordRegistrationConstraintClassifier {
+  readonly isRequestConflict: (cause: unknown) => boolean;
+  readonly isIdentifierConflict: (cause: unknown) => boolean;
+  readonly isCredentialConflict: (cause: unknown) => boolean;
+}
+type PasswordRegistrationMapping<Registration, Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Request extends Table, NativeSubjectId> = PasswordRegistrationConstraintClassifier & {
+  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;
+  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId>;
+  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;
+  readonly authorityCredential: PasswordAuthorityCredentialTable<AuthorityCredential, NativeSubjectId>;
+  readonly registration: PasswordRegistrationTable<Registration, Request, NativeSubjectId>;
+  readonly subjectId: SubjectIdCodec<NativeSubjectId>;
+  readonly constraints: RequiredPasswordRegistrationConstraints;
+  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;
+  readonly allocateCredentialIdSync?: () => string;
+  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
+  readonly allocateRevisionSync?: () => SecurityRevision;
+} & ({
+  readonly mode: "atomic";
+  readonly provisioning: PasswordRegistrationProvisioning<Registration, Subject, NativeSubjectId> & ({
+    readonly idMode: "allocated";
+    readonly allocateSubjectId: Effect.Effect<NativeSubjectId, PersistenceMappingError>;
+  } | {
+    readonly idMode: "synchronous";
+    readonly allocateSubjectIdSync: () => NativeSubjectId;
+  } | {
+    readonly idMode: "generated";
+    readonly decodeGeneratedId: (rows: ReadonlyArray<unknown>) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;
+  });
+} | {
+  readonly mode: "pending";
+  readonly allocateRecoveryReference?: Effect.Effect<typeof RecoveryReference.Type, PersistenceMappingError>;
+  readonly allocateRecoveryReferenceSync?: () => typeof RecoveryReference.Type;
+});
+type AnyPasswordPersistenceMapping = PasswordPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
+type AnyPasswordRegistrationMapping<Registration = unknown> = PasswordRegistrationMapping<Registration, Table, Table, Table, Table, Table, unknown>;
+//#endregion
+export { AnyPasswordPersistenceMapping, AnyPasswordRegistrationMapping, D1PasswordPersistenceMapping, PasswordAttemptAction, PasswordAttemptRecord, PasswordAttemptState, PasswordAttemptTable, PasswordAuthorityCredentialTable, PasswordChargeTable, PasswordCommandTable, PasswordConstraintClassifier, PasswordCredentialTable, PasswordD1Clock, PasswordIdentifierTable, PasswordPersistenceMapping, PasswordRateScopeKind, PasswordRateScopeTable, PasswordRegistrationConstraintClassifier, PasswordRegistrationIntent, PasswordRegistrationMapping, PasswordRegistrationProvisioning, PasswordRegistrationState, PasswordRegistrationTable, PasswordScopeKeys, PasswordSubjectTable, RequiredPasswordConstraints, RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints };
+//# sourceMappingURL=password-model.d.mts.map

package/dist/drizzle/password-model.mjs

@@ -0,0 +1,23 @@
+import "@yielded/auth/Identity";
+//#region src/drizzle/password-model.ts
+const requiredPasswordConstraints = {
+	identifier: "unique(identifier.namespace,identifier.value)",
+	authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)",
+	credentialSubject: "unique(credential.moduleId,credential.subjectId)",
+	credentialId: "unique(credential.moduleId,credential.credentialId)",
+	attempt: "unique(attempt.moduleId,attempt.attemptId)",
+	rateScope: "unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)",
+	charge: "unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)",
+	command: "unique(command.moduleId,command.commandId)"
+};
+const requiredPasswordRegistrationConstraints = {
+	request: "unique(registration.moduleId,registration.requestId)",
+	recoveryReference: "unique(registration.recoveryReference)",
+	identifier: "unique(identifier.namespace,identifier.value)",
+	credentialSubject: "unique(credential.moduleId,credential.subjectId)",
+	authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)"
+};
+//#endregion
+export { requiredPasswordConstraints, requiredPasswordRegistrationConstraints };
+
+//# sourceMappingURL=password-model.mjs.map