@yielded/auth-persistence 0.1.0-beta.7

package/dist/drizzle/password-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-model.mjs","names":[],"sources":["../../src/drizzle/password-model.ts"],"sourcesContent":["import { type RecoveryReference, type LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasswordAction,\n  PasswordAttemptId,\n  PasswordCredentialSnapshot,\n  PasswordReplacement,\n  PasswordRegistrationDecision,\n  EncodedPasswordHash,\n} from \"@yielded/auth/Password\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { Effect, Redacted } from \"effect\";\n\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./model\";\n\ntype ColumnKey<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\n\nexport type PasswordAttemptAction = \"sign-in\" | \"change\";\nexport type PasswordAttemptState = \"pending\" | \"verified\" | \"rejected\";\nexport type PasswordRateScopeKind = \"action\" | \"identifier\" | \"subject\";\n\nexport interface PasswordScopeKeys {\n  readonly action: string;\n  readonly identifier: string;\n  readonly subject?: string;\n}\n\nexport interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {\n  readonly table: Subject;\n  readonly id: ColumnKey<Subject>;\n  readonly status: ColumnKey<Subject>;\n  readonly securityRevision: ColumnKey<Subject>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly decodeRequirement: (\n    row: InferSelectModel<Subject>,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Current policy for this exact credential mutation, decoded under the subject lock. */\n  readonly decodeActionRequirement: (\n    row: InferSelectModel<Subject>,\n    action: PasswordAction,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  readonly nextSecurityRevision?: (\n    current: SecurityRevision,\n  ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  /** Required only by D1 conditional statements. */\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface PasswordIdentifierTable<Identifier extends Table, NativeSubjectId> {\n  readonly table: Identifier;\n  readonly namespace: ColumnKey<Identifier>;\n  readonly value: ColumnKey<Identifier>;\n  readonly subjectId: ColumnKey<Identifier>;\n  readonly verifiedAt: ColumnKey<Identifier>;\n  readonly bindingRevision: ColumnKey<Identifier>;\n  /** Consumer-owned current login/recovery eligibility, including row status. */\n  readonly isCurrent: (row: InferSelectModel<Identifier>) => boolean;\n  /** Required by D1 so current ownership/eligibility is rechecked in the batch. */\n  readonly d1CurrentCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n  }) => SQL;\n  readonly encodeInitialInsert: (\n    identifier: LoginIdentifier,\n    subjectId: NativeSubjectId,\n    bindingRevision: SecurityRevision,\n  ) => InferInsertModel<Identifier>;\n}\n\nexport interface PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {\n  readonly table: Credential;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly revision: ColumnKey<Credential>;\n  readonly status?: ColumnKey<Credential>;\n  readonly isActiveStatus?: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n  readonly encodeInsert: (input: {\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => InferInsertModel<Credential>;\n  readonly encodeRevision: (revision: SecurityRevision) => Partial<InferInsertModel<Credential>>;\n}\n\nexport interface PasswordCredentialTable<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> {\n  readonly table: Credential;\n  readonly moduleId: ColumnKey<Credential>;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly credentialRevision: ColumnKey<Credential>;\n  readonly verifierVersion: ColumnKey<Credential>;\n  readonly verifier: ColumnKey<Credential>;\n  readonly normalization: ColumnKey<Credential>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly replacement: PasswordReplacement;\n  }) => InferInsertModel<Credential>;\n  readonly encodeVerifier: (\n    verifier: Redacted.Redacted<EncodedPasswordHash>,\n    verifierVersion: SecurityRevision,\n  ) => Partial<InferInsertModel<Credential>>;\n  readonly encodeReplacement: (input: {\n    readonly replacement: PasswordReplacement;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n  }) => Partial<InferInsertModel<Credential>>;\n  readonly decode: (input: {\n    readonly moduleId: string;\n    readonly subject: InferSelectModel<Subject>;\n    readonly identifier: InferSelectModel<Identifier>;\n    readonly credential: InferSelectModel<Credential>;\n  }) => Effect.Effect<PasswordCredentialSnapshot, PersistenceMappingError>;\n}\n\nexport interface PasswordAttemptRecord {\n  readonly moduleId: string;\n  readonly action: PasswordAttemptAction;\n  readonly attemptId: PasswordAttemptId;\n  readonly identifier: LoginIdentifier;\n  readonly subjectId?: string;\n  readonly credentialId?: string;\n  readonly securityRevision?: SecurityRevision;\n  readonly credentialRevision?: SecurityRevision;\n  readonly verifierVersion?: SecurityRevision;\n  readonly identifierBindingRevision?: SecurityRevision;\n  readonly admittedAtMillis: number;\n  readonly deadlineMillis: number;\n  readonly retentionUntilMillis: number;\n}\n\nexport interface PasswordAttemptTable<Attempt extends Table, NativeSubjectId> {\n  readonly table: Attempt;\n  readonly moduleId: ColumnKey<Attempt>;\n  readonly action: ColumnKey<Attempt>;\n  readonly attemptId: ColumnKey<Attempt>;\n  readonly identifierNamespace: ColumnKey<Attempt>;\n  readonly identifierValue: ColumnKey<Attempt>;\n  readonly subjectId: ColumnKey<Attempt>;\n  readonly credentialId: ColumnKey<Attempt>;\n  readonly securityRevision: ColumnKey<Attempt>;\n  readonly credentialRevision: ColumnKey<Attempt>;\n  readonly verifierVersion: ColumnKey<Attempt>;\n  readonly identifierBindingRevision: ColumnKey<Attempt>;\n  readonly admittedAt: ColumnKey<Attempt>;\n  readonly deadline: ColumnKey<Attempt>;\n  readonly retentionUntil: ColumnKey<Attempt>;\n  readonly state: ColumnKey<Attempt>;\n  readonly encodeInsert: (\n    record: PasswordAttemptRecord,\n    input: { readonly nativeSubjectId?: NativeSubjectId; readonly state: \"pending\" },\n  ) => InferInsertModel<Attempt>;\n}\n\nexport interface PasswordRateScopeTable<RateScope extends Table> {\n  readonly table: RateScope;\n  readonly moduleId: ColumnKey<RateScope>;\n  readonly action: ColumnKey<RateScope>;\n  readonly scopeKind: ColumnKey<RateScope>;\n  readonly scopeKey: ColumnKey<RateScope>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly action: PasswordAttemptAction;\n    readonly scopeKind: PasswordRateScopeKind;\n    readonly scopeKey: string;\n  }) => InferInsertModel<RateScope>;\n}\n\nexport interface PasswordChargeTable<Charge extends Table> {\n  readonly table: Charge;\n  readonly moduleId: ColumnKey<Charge>;\n  readonly action: ColumnKey<Charge>;\n  readonly scopeKind: ColumnKey<Charge>;\n  readonly scopeKey: ColumnKey<Charge>;\n  readonly attemptId: ColumnKey<Charge>;\n  readonly occurredAt: ColumnKey<Charge>;\n  readonly retentionUntil: ColumnKey<Charge>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly action: PasswordAttemptAction;\n    readonly scopeKind: PasswordRateScopeKind;\n    readonly scopeKey: string;\n    readonly attemptId: PasswordAttemptId;\n    readonly occurredAtMillis: number;\n    readonly retentionUntilMillis: number;\n  }) => InferInsertModel<Charge>;\n}\n\nexport interface PasswordCommandTable<Command extends Table> {\n  readonly table: Command;\n  readonly moduleId: ColumnKey<Command>;\n  readonly commandId: ColumnKey<Command>;\n  readonly action: ColumnKey<Command>;\n  readonly bindingDigest: ColumnKey<Command>;\n  readonly decision: ColumnKey<Command>;\n  readonly retentionUntil: ColumnKey<Command>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly action: string;\n    readonly bindingDigest: string;\n    readonly decision: \"changed\";\n    readonly retentionUntilMillis: number;\n  }) => InferInsertModel<Command>;\n}\n\nexport interface RequiredPasswordConstraints {\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n  readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n  readonly credentialId: \"unique(credential.moduleId,credential.credentialId)\";\n  readonly attempt: \"unique(attempt.moduleId,attempt.attemptId)\";\n  readonly rateScope: \"unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)\";\n  readonly charge: \"unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)\";\n  readonly command: \"unique(command.moduleId,command.commandId)\";\n}\n\nexport const requiredPasswordConstraints: RequiredPasswordConstraints = {\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n  credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n  credentialId: \"unique(credential.moduleId,credential.credentialId)\",\n  attempt: \"unique(attempt.moduleId,attempt.attemptId)\",\n  rateScope: \"unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)\",\n  charge: \"unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)\",\n  command: \"unique(command.moduleId,command.commandId)\",\n};\n\nexport interface PasswordConstraintClassifier {\n  /** Match only the mapped command uniqueness constraint. */\n  readonly isCommandConflict: (cause: unknown) => boolean;\n  /** Match only the mapped rate-scope uniqueness constraint. */\n  readonly isRateScopeConflict: (cause: unknown) => boolean;\n}\n\nexport interface PasswordD1Clock {\n  readonly engineNow: SQL;\n  readonly engineNowMillis: SQL;\n  readonly engineInstantMinus: (millis: number) => SQL;\n  readonly engineInstantPlus: (millis: number) => SQL;\n}\n\nexport interface PasswordPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  RateScope extends Table,\n  Charge extends Table,\n  Command extends Table,\n  NativeSubjectId,\n> extends PasswordConstraintClassifier {\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId>;\n  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  /** Every factor revision named by action evidence, including non-password factors. */\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly attempt: PasswordAttemptTable<Attempt, NativeSubjectId>;\n  readonly rateScope: PasswordRateScopeTable<RateScope>;\n  readonly charge: PasswordChargeTable<Charge>;\n  readonly command: PasswordCommandTable<Command>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredPasswordConstraints;\n  readonly scopeKeys: (input: {\n    readonly moduleId: string;\n    readonly action: PasswordAttemptAction;\n    readonly identifier: LoginIdentifier;\n    readonly subjectId?: string;\n  }) => PasswordScopeKeys;\n  readonly encodeInstant: (epochMillis: number) => unknown;\n  readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly allocateAttemptId?: Effect.Effect<PasswordAttemptId, PersistenceMappingError>;\n  readonly allocateAttemptIdSync?: () => PasswordAttemptId;\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n  readonly commandRetentionMillis: number;\n  /** All semantic replacements still bump subject revision. This flag only declares bearer invalidation latency. */\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n  readonly d1?: PasswordD1Clock;\n}\n\nexport type D1PasswordPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  RateScope extends Table,\n  Charge extends Table,\n  Command extends Table,\n  NativeSubjectId,\n> = PasswordPersistenceMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Attempt,\n  RateScope,\n  Charge,\n  Command,\n  NativeSubjectId\n> & {\n  readonly d1: PasswordD1Clock;\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId> & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId> & {\n    readonly d1CurrentCondition: (input: {\n      readonly identifier: LoginIdentifier;\n      readonly nativeSubjectId: NativeSubjectId;\n    }) => SQL;\n  };\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  > & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n};\n\nexport type PasswordRegistrationState = \"pending\" | \"created\";\n\nexport interface PasswordRegistrationIntent<Registration> {\n  readonly moduleId: string;\n  readonly requestId: string;\n  readonly identifier: LoginIdentifier;\n  readonly registration: Registration;\n  readonly replacement: PasswordReplacement;\n}\n\nexport interface PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> {\n  readonly table: Request;\n  readonly moduleId: ColumnKey<Request>;\n  readonly requestId: ColumnKey<Request>;\n  readonly state: ColumnKey<Request>;\n  readonly subjectId: ColumnKey<Request>;\n  readonly recoveryReference: ColumnKey<Request>;\n  readonly encodeInsert: (\n    input: PasswordRegistrationIntent<Registration>,\n    state: {\n      readonly state: PasswordRegistrationState;\n      readonly nativeSubjectId?: NativeSubjectId;\n      readonly recoveryReference?: typeof RecoveryReference.Type;\n    },\n  ) => InferInsertModel<Request>;\n  /** Replay projection must never expose a stored subject or decode protected intent. */\n  readonly decodeReplay: (\n    row: InferSelectModel<Request>,\n  ) => Effect.Effect<\n    Exclude<PasswordRegistrationDecision, { readonly _tag: \"Created\" }>,\n    PersistenceMappingError\n  >;\n}\n\nexport interface PasswordRegistrationProvisioning<\n  Registration,\n  Subject extends Table,\n  NativeSubjectId,\n> {\n  readonly encodeSubjectInsert: (\n    input: PasswordRegistrationIntent<Registration>,\n    values: {\n      readonly nativeSubjectId: NativeSubjectId | undefined;\n      readonly securityRevision: SecurityRevision;\n    },\n  ) => InferInsertModel<Subject>;\n  readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n  readonly allocateSubjectIdSync?: () => NativeSubjectId;\n  /** Interactive targets use this for database-generated/autoincrement keys. */\n  readonly decodeGeneratedId?: (\n    rows: ReadonlyArray<unknown>,\n  ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n}\n\nexport interface RequiredPasswordRegistrationConstraints {\n  readonly request: \"unique(registration.moduleId,registration.requestId)\";\n  readonly recoveryReference: \"unique(registration.recoveryReference)\";\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n}\n\nexport const requiredPasswordRegistrationConstraints: RequiredPasswordRegistrationConstraints = {\n  request: \"unique(registration.moduleId,registration.requestId)\",\n  recoveryReference: \"unique(registration.recoveryReference)\",\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n};\n\nexport interface PasswordRegistrationConstraintClassifier {\n  readonly isRequestConflict: (cause: unknown) => boolean;\n  readonly isIdentifierConflict: (cause: unknown) => boolean;\n  readonly isCredentialConflict: (cause: unknown) => boolean;\n}\n\nexport type PasswordRegistrationMapping<\n  Registration,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Request extends Table,\n  NativeSubjectId,\n> = PasswordRegistrationConstraintClassifier & {\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId>;\n  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly registration: PasswordRegistrationTable<Registration, Request, NativeSubjectId>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredPasswordRegistrationConstraints;\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n} & (\n    | {\n        readonly mode: \"atomic\";\n        readonly provisioning: PasswordRegistrationProvisioning<\n          Registration,\n          Subject,\n          NativeSubjectId\n        > &\n          (\n            | {\n                readonly idMode: \"allocated\";\n                readonly allocateSubjectId: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n              }\n            | {\n                readonly idMode: \"synchronous\";\n                readonly allocateSubjectIdSync: () => NativeSubjectId;\n              }\n            | {\n                readonly idMode: \"generated\";\n                readonly decodeGeneratedId: (\n                  rows: ReadonlyArray<unknown>,\n                ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n              }\n          );\n      }\n    | {\n        readonly mode: \"pending\";\n        readonly allocateRecoveryReference?: Effect.Effect<\n          typeof RecoveryReference.Type,\n          PersistenceMappingError\n        >;\n        readonly allocateRecoveryReferenceSync?: () => typeof RecoveryReference.Type;\n      }\n  );\n\nexport type AnyPasswordPersistenceMapping = PasswordPersistenceMapping<\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\n\nexport type AnyPasswordRegistrationMapping<Registration = unknown> = PasswordRegistrationMapping<\n  Registration,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\n"],"mappings":";;AAmOA,MAAa,8BAA2D;CACtE,YAAY;CACZ,qBAAqB;CACrB,mBAAmB;CACnB,cAAc;CACd,SAAS;CACT,WAAW;CACX,QAAQ;CACR,SAAS;AACX;AAkKA,MAAa,0CAAmF;CAC9F,SAAS;CACT,mBAAmB;CACnB,YAAY;CACZ,mBAAmB;CACnB,qBAAqB;AACvB"}

package/dist/drizzle/password-prepared-model.d.mts

@@ -0,0 +1,94 @@
+import { PersistenceMappingError } from "../internal/mapping-error.mjs";
+import "./model.mjs";
+import { D1PasswordPersistenceMapping, PasswordPersistenceMapping } from "./password-model.mjs";
+import { D1ProofPersistenceMapping, ProofPersistenceMapping, RequiredProofConstraints } from "./proof-model.mjs";
+import { Effect } from "effect";
+import { PasswordPreparedReady, PasswordPreparedReservation, PasswordPreparedVersion } from "@yielded/auth/Password";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/password-prepared-model.d.ts
+type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+type PasswordPreparedState = "Preparing" | "Ready" | "Consumed" | "Cancelled" | "Expired";
+/** The retained intent is also its nonrefundable admission charge. Scalar identity,
+ * scope and timing columns survive sensitive snapshot/digest erasure. */
+interface PasswordPreparedIntentTable<Intent extends Table, NativeSubjectId> {
+  readonly table: Intent;
+  readonly moduleId: ColumnKey<Intent>;
+  readonly intentId: ColumnKey<Intent>;
+  readonly commandId: ColumnKey<Intent>;
+  readonly subjectId: ColumnKey<Intent>;
+  readonly action: ColumnKey<Intent>;
+  readonly generation: ColumnKey<Intent>;
+  readonly version: ColumnKey<Intent>;
+  readonly state: ColumnKey<Intent>;
+  readonly digest: ColumnKey<Intent>;
+  readonly snapshot: ColumnKey<Intent>;
+  readonly identifierScope: ColumnKey<Intent>;
+  readonly createdAt: ColumnKey<Intent>;
+  readonly admittedAt: ColumnKey<Intent>;
+  readonly admissionRetainUntil: ColumnKey<Intent>;
+  readonly preparationExpiresAt: ColumnKey<Intent>;
+  readonly expiresAt: ColumnKey<Intent>;
+  readonly retainUntil: ColumnKey<Intent>;
+  readonly states: Readonly<Record<PasswordPreparedState, InferSelectModel<Intent>[ColumnKey<Intent>]>>;
+  readonly encodeInsert: (input: {
+    readonly reservation: PasswordPreparedReservation;
+    readonly nativeSubjectId: NativeSubjectId;
+    readonly identifierScope: string;
+    readonly admittedAtMillis: number;
+    readonly admissionRetainUntilMillis: number;
+    /** Bounded private core codec output; contains a salted verifier for Change/Reset. */
+    readonly snapshot: string;
+  }) => InferInsertModel<Intent>;
+  readonly encodeReady: (input: {
+    readonly ready: PasswordPreparedReady;
+    readonly snapshot: string;
+  }) => Partial<InferInsertModel<Intent>>;
+  /** Erase snapshot and digest, preserving every identity/scope/time column. */
+  readonly encodeTerminal: (state: Exclude<PasswordPreparedState, "Preparing" | "Ready">) => Partial<InferInsertModel<Intent>>;
+}
+/** One permanent row per configured module; never one row per attacker input.
+ * Native owners lock this before subject → identifier → sorted credentials → intent.
+ * It serializes admission and maintenance without process-local locks. */
+interface PasswordPreparedAdmissionTable<Admission extends Table> {
+  readonly table: Admission;
+  readonly moduleId: ColumnKey<Admission>;
+  readonly intentId: ColumnKey<Admission>;
+  readonly admittedAt: ColumnKey<Admission>;
+  readonly admissionRetainUntil: ColumnKey<Admission>;
+  readonly encodeInsert: (moduleId: string) => InferInsertModel<Admission>;
+}
+declare const requiredPasswordPreparedConstraints: {
+  readonly admission: "unique(admission.moduleId)";
+  readonly intent: "unique(intent.moduleId,intent.intentId)";
+  readonly command: "unique(intent.moduleId,intent.commandId)";
+  readonly digest: "unique(intent.digest)";
+};
+type RequiredPasswordPreparedConstraints = typeof requiredPasswordPreparedConstraints;
+interface PasswordPreparedPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, Intent extends Table, Admission extends Table, NativeSubjectId> {
+  readonly password: PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, NativeSubjectId>;
+  readonly intent: PasswordPreparedIntentTable<Intent, NativeSubjectId>;
+  readonly admission: PasswordPreparedAdmissionTable<Admission>;
+  readonly constraints: RequiredPasswordPreparedConstraints;
+  readonly allocateVersion?: Effect.Effect<PasswordPreparedVersion, PersistenceMappingError>;
+  /** Required by synchronous owners, invoked inside their actual transactionSync. */
+  readonly allocateVersionSync?: () => PasswordPreparedVersion;
+}
+type D1PasswordPreparedPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, Intent extends Table, Admission extends Table, NativeSubjectId> = PasswordPreparedPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, Intent, Admission, NativeSubjectId> & {
+  /** Convert a stored native instant to epoch milliseconds in the same SQL engine. */
+  readonly admissionClock: {
+    readonly toMillis: (instant: SQL) => SQL;
+  };
+  readonly password: D1PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, NativeSubjectId>;
+};
+/** Optional real proof completion authority. Request/delivery/abuse capabilities
+ * are not required to complete the original continuation. */
+type PasswordPreparedProofMapping<Series extends Table, Continuation extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = Pick<ProofPersistenceMapping<Table, Series, Table, Continuation, Table, Table, Table, Command, Subject, Identifier, Credential, NativeSubjectId>, "series" | "continuation" | "command" | "authority" | "scopeKeys" | "encodeInstant" | "decodeInstant" | "allocateVersion" | "allocateVersionSync" | "isSeriesConflict" | "isCommandConflict" | "d1"> & {
+  readonly constraints: Pick<RequiredProofConstraints, "series" | "continuationId" | "continuationDigest" | "command">;
+};
+type D1PasswordPreparedProofMapping<Series extends Table, Continuation extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = Pick<D1ProofPersistenceMapping<Table, Series, Table, Continuation, Table, Table, Table, Command, Subject, Identifier, Credential, NativeSubjectId>, Exclude<keyof PasswordPreparedProofMapping<Series, Continuation, Command, Subject, Identifier, Credential, NativeSubjectId>, "constraints">> & {
+  readonly constraints: PasswordPreparedProofMapping<Series, Continuation, Command, Subject, Identifier, Credential, NativeSubjectId>["constraints"];
+};
+type AnyPasswordPreparedPersistenceMapping = PasswordPreparedPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
+//#endregion
+export { AnyPasswordPreparedPersistenceMapping, D1PasswordPreparedPersistenceMapping, D1PasswordPreparedProofMapping, PasswordPreparedAdmissionTable, PasswordPreparedIntentTable, PasswordPreparedPersistenceMapping, PasswordPreparedProofMapping, PasswordPreparedState, RequiredPasswordPreparedConstraints, requiredPasswordPreparedConstraints };
+//# sourceMappingURL=password-prepared-model.d.mts.map

package/dist/drizzle/password-prepared-model.mjs

@@ -0,0 +1,11 @@
+//#region src/drizzle/password-prepared-model.ts
+const requiredPasswordPreparedConstraints = {
+	admission: "unique(admission.moduleId)",
+	intent: "unique(intent.moduleId,intent.intentId)",
+	command: "unique(intent.moduleId,intent.commandId)",
+	digest: "unique(intent.digest)"
+};
+//#endregion
+export { requiredPasswordPreparedConstraints };
+
+//# sourceMappingURL=password-prepared-model.mjs.map

package/dist/drizzle/password-prepared-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-prepared-model.mjs","names":[],"sources":["../../src/drizzle/password-prepared-model.ts"],"sourcesContent":["import type {\n  PasswordPreparedReady,\n  PasswordPreparedReservation,\n  PasswordPreparedVersion,\n} from \"@yielded/auth/Password\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { Effect } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport type { D1PasswordPersistenceMapping, PasswordPersistenceMapping } from \"./password-model\";\nimport type {\n  D1ProofPersistenceMapping,\n  ProofPersistenceMapping,\n  RequiredProofConstraints,\n} from \"./proof-model\";\n\ntype ColumnKey<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type PasswordPreparedState = \"Preparing\" | \"Ready\" | \"Consumed\" | \"Cancelled\" | \"Expired\";\n\n/** The retained intent is also its nonrefundable admission charge. Scalar identity,\n * scope and timing columns survive sensitive snapshot/digest erasure. */\nexport interface PasswordPreparedIntentTable<Intent extends Table, NativeSubjectId> {\n  readonly table: Intent;\n  readonly moduleId: ColumnKey<Intent>;\n  readonly intentId: ColumnKey<Intent>;\n  readonly commandId: ColumnKey<Intent>;\n  readonly subjectId: ColumnKey<Intent>;\n  readonly action: ColumnKey<Intent>;\n  readonly generation: ColumnKey<Intent>;\n  readonly version: ColumnKey<Intent>;\n  readonly state: ColumnKey<Intent>;\n  readonly digest: ColumnKey<Intent>;\n  readonly snapshot: ColumnKey<Intent>;\n  readonly identifierScope: ColumnKey<Intent>;\n  readonly createdAt: ColumnKey<Intent>;\n  readonly admittedAt: ColumnKey<Intent>;\n  readonly admissionRetainUntil: ColumnKey<Intent>;\n  readonly preparationExpiresAt: ColumnKey<Intent>;\n  readonly expiresAt: ColumnKey<Intent>;\n  readonly retainUntil: ColumnKey<Intent>;\n  readonly states: Readonly<\n    Record<PasswordPreparedState, InferSelectModel<Intent>[ColumnKey<Intent>]>\n  >;\n  readonly encodeInsert: (input: {\n    readonly reservation: PasswordPreparedReservation;\n    readonly nativeSubjectId: NativeSubjectId;\n    readonly identifierScope: string;\n    readonly admittedAtMillis: number;\n    readonly admissionRetainUntilMillis: number;\n    /** Bounded private core codec output; contains a salted verifier for Change/Reset. */\n    readonly snapshot: string;\n  }) => InferInsertModel<Intent>;\n  readonly encodeReady: (input: {\n    readonly ready: PasswordPreparedReady;\n    readonly snapshot: string;\n  }) => Partial<InferInsertModel<Intent>>;\n  /** Erase snapshot and digest, preserving every identity/scope/time column. */\n  readonly encodeTerminal: (\n    state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n  ) => Partial<InferInsertModel<Intent>>;\n}\n\n/** One permanent row per configured module; never one row per attacker input.\n * Native owners lock this before subject → identifier → sorted credentials → intent.\n * It serializes admission and maintenance without process-local locks. */\nexport interface PasswordPreparedAdmissionTable<Admission extends Table> {\n  readonly table: Admission;\n  readonly moduleId: ColumnKey<Admission>;\n  readonly intentId: ColumnKey<Admission>;\n  readonly admittedAt: ColumnKey<Admission>;\n  readonly admissionRetainUntil: ColumnKey<Admission>;\n  readonly encodeInsert: (moduleId: string) => InferInsertModel<Admission>;\n}\n\nexport const requiredPasswordPreparedConstraints = {\n  admission: \"unique(admission.moduleId)\",\n  intent: \"unique(intent.moduleId,intent.intentId)\",\n  command: \"unique(intent.moduleId,intent.commandId)\",\n  digest: \"unique(intent.digest)\",\n} as const;\n\nexport type RequiredPasswordPreparedConstraints = typeof requiredPasswordPreparedConstraints;\n\nexport interface PasswordPreparedPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  RateScope extends Table,\n  Charge extends Table,\n  Command extends Table,\n  Intent extends Table,\n  Admission extends Table,\n  NativeSubjectId,\n> {\n  readonly password: PasswordPersistenceMapping<\n    Subject,\n    Identifier,\n    Credential,\n    AuthorityCredential,\n    Attempt,\n    RateScope,\n    Charge,\n    Command,\n    NativeSubjectId\n  >;\n  readonly intent: PasswordPreparedIntentTable<Intent, NativeSubjectId>;\n  readonly admission: PasswordPreparedAdmissionTable<Admission>;\n  readonly constraints: RequiredPasswordPreparedConstraints;\n  readonly allocateVersion?: Effect.Effect<PasswordPreparedVersion, PersistenceMappingError>;\n  /** Required by synchronous owners, invoked inside their actual transactionSync. */\n  readonly allocateVersionSync?: () => PasswordPreparedVersion;\n}\n\nexport type D1PasswordPreparedPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  RateScope extends Table,\n  Charge extends Table,\n  Command extends Table,\n  Intent extends Table,\n  Admission extends Table,\n  NativeSubjectId,\n> = PasswordPreparedPersistenceMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Attempt,\n  RateScope,\n  Charge,\n  Command,\n  Intent,\n  Admission,\n  NativeSubjectId\n> & {\n  /** Convert a stored native instant to epoch milliseconds in the same SQL engine. */\n  readonly admissionClock: { readonly toMillis: (instant: SQL) => SQL };\n  readonly password: D1PasswordPersistenceMapping<\n    Subject,\n    Identifier,\n    Credential,\n    AuthorityCredential,\n    Attempt,\n    RateScope,\n    Charge,\n    Command,\n    NativeSubjectId\n  >;\n};\n\n/** Optional real proof completion authority. Request/delivery/abuse capabilities\n * are not required to complete the original continuation. */\nexport type PasswordPreparedProofMapping<\n  Series extends Table,\n  Continuation extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = Pick<\n  ProofPersistenceMapping<\n    Table,\n    Series,\n    Table,\n    Continuation,\n    Table,\n    Table,\n    Table,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >,\n  | \"series\"\n  | \"continuation\"\n  | \"command\"\n  | \"authority\"\n  | \"scopeKeys\"\n  | \"encodeInstant\"\n  | \"decodeInstant\"\n  | \"allocateVersion\"\n  | \"allocateVersionSync\"\n  | \"isSeriesConflict\"\n  | \"isCommandConflict\"\n  | \"d1\"\n> & {\n  readonly constraints: Pick<\n    RequiredProofConstraints,\n    \"series\" | \"continuationId\" | \"continuationDigest\" | \"command\"\n  >;\n};\n\nexport type D1PasswordPreparedProofMapping<\n  Series extends Table,\n  Continuation extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = Pick<\n  D1ProofPersistenceMapping<\n    Table,\n    Series,\n    Table,\n    Continuation,\n    Table,\n    Table,\n    Table,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >,\n  Exclude<\n    keyof PasswordPreparedProofMapping<\n      Series,\n      Continuation,\n      Command,\n      Subject,\n      Identifier,\n      Credential,\n      NativeSubjectId\n    >,\n    \"constraints\"\n  >\n> & {\n  readonly constraints: PasswordPreparedProofMapping<\n    Series,\n    Continuation,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >[\"constraints\"];\n};\n\nexport type AnyPasswordPreparedPersistenceMapping = PasswordPreparedPersistenceMapping<\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\n"],"mappings":";AA0EA,MAAa,sCAAsC;CACjD,WAAW;CACX,QAAQ;CACR,SAAS;CACT,QAAQ;AACV"}

package/dist/drizzle/password-prepared-sql.mjs

@@ -0,0 +1,390 @@
+import { CurrentPasswordPreparedTransaction, PasswordPreparedJournalGuards, PasswordPreparedPostconditions } from "./PasswordPreparedPostconditions.mjs";
+import { CurrentPasswordSql } from "../internal/password-kernel.mjs";
+import { requiredPasswordPreparedConstraints } from "./password-prepared-model.mjs";
+import { column } from "./model.mjs";
+import { checkProofCompletionIn, completeProofPlanIn } from "./proof-sql.mjs";
+import { passwordSqlKernel } from "./password-sql.mjs";
+import { CompletionInput, ContextInput, encodeReservation, evidenceCurrent, identifierScope, reservationOf, sameRevision, snapshotMutation, snapshotReserve, unavailable } from "./password-prepared-state.mjs";
+import { Cause, DateTime, Effect, Option, Predicate, Redacted, Schema } from "effect";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks } from "@yielded/auth/Hooks";
+import { AuthenticationRevision } from "@yielded/auth/Sessions";
+import { PasswordPreparedVersion, PasswordRejected, PasswordUnavailable, decodePasswordPreparedReady, encodePasswordPreparedReady, snapshotPasswordCredential, snapshotPasswordPreparedReady, snapshotPasswordPreparedReservation, snapshotPasswordRequirement } from "@yielded/auth/Password";
+import { ProofBinding, ProofUnavailable } from "@yielded/auth/Proofs";
+import { and, count, eq, gt, isNotNull, isNull, lte, or } from "drizzle-orm";
+//#region src/drizzle/password-prepared-sql.ts
+const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+const translateContextFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(PasswordRejected)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => Schema.is(PasswordRejected)(error) ? error : unavailable()))));
+const nowMillis = DateTime.now.pipe(Effect.map(DateTime.toEpochMillis));
+const read = (query, locking) => locking && typeof query.for === "function" ? query.for("update") : query;
+const columns = (mapping) => {
+	const table = mapping.intent;
+	return {
+		moduleId: column(table.table, table.moduleId),
+		intentId: column(table.table, table.intentId),
+		commandId: column(table.table, table.commandId),
+		subjectId: column(table.table, table.subjectId),
+		action: column(table.table, table.action),
+		generation: column(table.table, table.generation),
+		version: column(table.table, table.version),
+		state: column(table.table, table.state),
+		digest: column(table.table, table.digest),
+		snapshot: column(table.table, table.snapshot),
+		identifierScope: column(table.table, table.identifierScope),
+		createdAt: column(table.table, table.createdAt),
+		admittedAt: column(table.table, table.admittedAt),
+		admissionRetainUntil: column(table.table, table.admissionRetainUntil),
+		preparationExpiresAt: column(table.table, table.preparationExpiresAt),
+		expiresAt: column(table.table, table.expiresAt),
+		retainUntil: column(table.table, table.retainUntil)
+	};
+};
+const valid = (mapping) => Object.entries(requiredPasswordPreparedConstraints).every(([key, value]) => mapping.constraints[key] === value);
+const lockAnchor = Effect.fn("DrizzlePasswordPrepared.lockAnchor")(function* (mapping, configuration, moduleId, create = true) {
+	const database = yield* CurrentPasswordSql;
+	const a = mapping.admission, key = column(a.table, a.moduleId);
+	if (create) yield* configuration.insertIfAbsent(database.insert(a.table).values(a.encodeInsert(moduleId)), a.moduleId, moduleId);
+	const rows = yield* read(database.select().from(a.table).where(eq(key, moduleId)).limit(2), configuration.locking);
+	if (rows.length > 1 || create && rows.length !== 1) return yield* unavailable();
+	return rows.length === 1;
+});
+const bindingJson = Schema.encodeSync(Schema.fromJsonString(ProofBinding));
+const captureAuthority = Effect.fn("DrizzlePasswordPrepared.captureAuthority")(function* (mapping, configuration, input) {
+	const database = yield* CurrentPasswordSql;
+	const p = mapping.password;
+	const locked = yield* passwordSqlKernel.lockSubject(p, input.subjectId, configuration.locking);
+	if (locked.row === void 0 || !p.subject.isActiveStatus(locked.row[p.subject.status])) return void 0;
+	const ic = passwordSqlKernel.identifierColumns(p), ac = passwordSqlKernel.authorityCredentialColumns(p);
+	let identifier;
+	if (input.action !== "add-password") {
+		if (input.reset !== void 0) identifier = (yield* passwordSqlKernel.lockIdentifier(p, input.reset.binding.identifier, configuration.locking))[0];
+		else {
+			const discovered = (yield* read(database.select().from(p.identifier.table).where(eq(ic.subjectId, locked.nativeSubjectId)).orderBy(ic.namespace, ic.value), false)).find((row) => p.identifier.isCurrent(row));
+			if (discovered !== void 0) identifier = (yield* passwordSqlKernel.lockIdentifier(p, {
+				namespace: discovered[p.identifier.namespace],
+				value: discovered[p.identifier.value]
+			}, configuration.locking))[0];
+		}
+		if (identifier === void 0 || !p.identifier.isCurrent(identifier) || !p.subjectId.equals(identifier[p.identifier.subjectId], locked.nativeSubjectId)) return void 0;
+	}
+	const credential = (yield* passwordSqlKernel.readPasswordCredential(p, input.moduleId, locked.nativeSubjectId, configuration.locking))[0];
+	if (input.action === "add-password" !== (credential === void 0)) return void 0;
+	const snapshot = credential === void 0 ? void 0 : yield* p.credential.decode({
+		moduleId: input.moduleId,
+		subject: locked.row,
+		identifier,
+		credential
+	}).pipe(Effect.flatMap(snapshotPasswordCredential));
+	if (snapshot !== void 0 && (snapshot.moduleId !== input.moduleId || snapshot.revision.subjectId !== input.subjectId || snapshot.revision.securityRevision !== locked.row[p.subject.securityRevision] || snapshot.credentialId !== credential[p.credential.credentialId] || snapshot.credentialRevision !== credential[p.credential.credentialRevision] || snapshot.verifierVersion !== credential[p.credential.verifierVersion] || Redacted.value(snapshot.verifier) !== credential[p.credential.verifier] || snapshot.normalization !== credential[p.credential.normalization] || snapshot.identifier.namespace !== identifier[p.identifier.namespace] || snapshot.identifier.value !== identifier[p.identifier.value] || snapshot.identifierBindingRevision !== identifier[p.identifier.bindingRevision])) return void 0;
+	const active = (yield* read(database.select().from(p.authorityCredential.table).where(eq(ac.subjectId, locked.nativeSubjectId)).orderBy(ac.credentialId), configuration.locking)).filter((row) => p.authorityCredential.status === void 0 || p.authorityCredential.isActiveStatus?.(row[p.authorityCredential.status]) === true);
+	if (active.length > 64) return yield* unavailable();
+	const revision = snapshot?.revision ?? AuthenticationRevision.make({
+		subjectId: input.subjectId,
+		securityRevision: locked.row[p.subject.securityRevision],
+		credentials: active.map((row) => ({
+			credentialId: row[p.authorityCredential.credentialId],
+			revision: row[p.authorityCredential.revision]
+		}))
+	});
+	if (revision.credentials.some((expected) => !active.some((row) => row[p.authorityCredential.credentialId] === expected.credentialId && row[p.authorityCredential.revision] === expected.revision))) return void 0;
+	const requirement = yield* p.subject.decodeActionRequirement(locked.row, input.action).pipe(Effect.flatMap(snapshotPasswordRequirement));
+	return {
+		...locked,
+		identifier,
+		snapshot,
+		revision,
+		requirement
+	};
+});
+const currentAuthority = Effect.fn("DrizzlePasswordPrepared.currentAuthority")(function* (mapping, configuration, record) {
+	const current = yield* captureAuthority(mapping, configuration, {
+		moduleId: record.moduleId,
+		action: record.action,
+		subjectId: record.revision.subjectId,
+		...record.reset === void 0 ? {} : { reset: record.reset }
+	});
+	if (current === void 0 || !sameRevision(current.revision, record.revision) || (current.snapshot === void 0 ? record.credential !== void 0 : record.credential === void 0 || !passwordSqlKernel.sameCredentialSnapshot(current.snapshot, record.credential))) return void 0;
+	return current;
+});
+const rowCondition = (mapping, row) => {
+	const c = columns(mapping);
+	return and(...Object.entries(c).map(([key, value]) => {
+		const item = row[mapping.intent[key]];
+		return Predicate.isNullish(item) ? isNull(value) : eq(value, item);
+	}));
+};
+const readIntent = Effect.fn("Drizzle.readIntent")(function* (mapping, condition, locking) {
+	const database = yield* CurrentPasswordSql;
+	return yield* read(database.select().from(mapping.intent.table).where(condition).limit(2), locking);
+});
+const recordMatches = Effect.fn("DrizzlePasswordPrepared.recordMatches")(function* (mapping, row, record, nativeSubjectId, snapshot) {
+	const t = mapping.intent, p = mapping.password;
+	if (row === void 0 || row[t.moduleId] !== record.moduleId || row[t.intentId] !== record.intentId || row[t.commandId] !== record.commandId || !p.subjectId.equals(row[t.subjectId], nativeSubjectId) || row[t.action] !== record.action || row[t.generation] !== record.generation || row[t.version] !== record.version || row[t.state] !== t.states[record._tag] || row[t.snapshot] !== snapshot || row[t.identifierScope] !== identifierScope(record) || (record._tag === "Ready" ? row[t.digest] !== record.digest : !Predicate.isNullish(row[t.digest]))) return false;
+	for (const [key, instant] of [
+		[t.createdAt, record.createdAtMillis],
+		[t.preparationExpiresAt, record.preparationExpiresAtMillis],
+		[t.retainUntil, record.retainUntilMillis]
+	]) if ((yield* p.decodeInstant(row[key])) !== instant) return false;
+	return record._tag === "Ready" ? (yield* p.decodeInstant(row[t.expiresAt])) === record.expiresAtMillis : Predicate.isNullish(row[t.expiresAt]);
+});
+const terminal = Effect.fn("DrizzlePasswordPrepared.terminal")(function* (mapping, row, state) {
+	yield* (yield* CurrentPasswordSql).update(mapping.intent.table).set(mapping.intent.encodeTerminal(state)).where(rowCondition(mapping, row));
+	const c = columns(mapping), t = mapping.intent;
+	const rows = yield* readIntent(mapping, and(eq(c.moduleId, row[t.moduleId]), eq(c.intentId, row[t.intentId])), false);
+	const expected = {
+		...row,
+		[t.state]: t.states[state],
+		[t.snapshot]: null,
+		[t.digest]: null
+	};
+	if (rows.length !== 1 || (yield* readIntent(mapping, rowCondition(mapping, expected), false)).length !== 1) return yield* unavailable();
+});
+const makeSqlPasswordPreparedPersistence = Effect.fn("makeSqlPasswordPreparedPersistence")(function* (database, mapping, configuration) {
+	const hooks = yield* LifecycleHooks;
+	const p = mapping.password, c = columns(mapping), t = mapping.intent;
+	const owned = (body) => valid(mapping) ? passwordSqlKernel.owned(database, p, configuration, Effect.gen(function* () {
+		const journal = yield* CurrentCommitJournal;
+		const guards = yield* Effect.serviceOption(PasswordPreparedJournalGuards);
+		if (Option.isSome(guards) && !guards.value.register(journal.prepare(void 0))) return yield* unavailable();
+		return yield* body;
+	})) : Effect.fail(unavailable());
+	const complete = (uncaptured, prepare) => Effect.gen(function* () {
+		const input = yield* snapshotMutation(uncaptured);
+		const completion = uncaptured.completion === void 0 ? void 0 : {
+			prepare: uncaptured.completion.prepare,
+			input: yield* Schema.encodeEffect(Schema.fromJsonString(CompletionInput))(uncaptured.completion.input).pipe(Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(CompletionInput))), Effect.mapError(unavailable))
+		};
+		if (input.intent.action === "reset-password" !== (completion !== void 0) || completion !== void 0 && configuration.proof === void 0) return yield* unavailable();
+		return yield* owned(Effect.gen(function* () {
+			const transaction = yield* CurrentPasswordSql;
+			const journal = yield* CurrentCommitJournal;
+			yield* lockAnchor(mapping, configuration, input.intent.moduleId);
+			if ((yield* passwordSqlKernel.validateMutationAuthority(p, configuration, input.mutation, input.intent.action)) === void 0) return prepare("rejected", journal);
+			const current = yield* currentAuthority(mapping, configuration, input.intent);
+			if (current === void 0) return prepare("rejected", journal);
+			const rows = yield* readIntent(mapping, and(eq(c.moduleId, input.intent.moduleId), eq(c.intentId, input.intent.intentId)), configuration.locking);
+			const row = rows[0], encoded = yield* encodePasswordPreparedReady(input.intent);
+			if (rows.length !== 1 || !(yield* recordMatches(mapping, row, input.intent, current.nativeSubjectId, encoded)) || !evidenceCurrent(input, current.requirement, yield* nowMillis) || (yield* passwordSqlKernel.commandExists(p, input.intent.moduleId, input.intent.commandId, configuration.locking)).length !== 0) return prepare("rejected", journal);
+			if (completion !== void 0 && (input.intent.reset === void 0 || completion.input.continuationId !== input.intent.reset.continuationId || bindingJson(completion.input.binding) !== bindingJson(input.intent.reset.binding) || !passwordSqlKernel.proofCompletionMatchesPassword({
+				...input.mutation,
+				completion
+			}))) return prepare("rejected", journal);
+			const credentialRevision = yield* passwordSqlKernel.allocate(configuration.mode, p.allocateRevision, p.allocateRevisionSync);
+			const verifierVersion = yield* passwordSqlKernel.allocate(configuration.mode, p.allocateRevision, p.allocateRevisionSync);
+			const nextSecurityRevision = yield* passwordSqlKernel.allocateNextSecurityRevision(p, configuration.mode, input.intent.revision.securityRevision);
+			if (nextSecurityRevision === input.intent.revision.securityRevision || credentialRevision === input.intent.credential?.credentialRevision || verifierVersion === input.intent.credential?.verifierVersion) return yield* unavailable();
+			const credentialId = input.intent.action === "add-password" ? yield* passwordSqlKernel.allocate(configuration.mode, p.allocateCredentialId, p.allocateCredentialIdSync) : void 0;
+			let appliedAt;
+			const assertApplied = Effect.fn("DrizzlePasswordPrepared.assertApplied")(() => Effect.flatMap(CurrentPasswordPreparedTransaction, (currentTransaction) => Effect.gen(function* () {
+				if (appliedAt === void 0) return;
+				if (!(yield* passwordSqlKernel.checkMutationApplied(p, input.mutation, current.nativeSubjectId, {
+					credentialId: credentialId ?? input.intent.credential.credentialId,
+					credentialRevision,
+					verifierVersion,
+					nextSecurityRevision
+				}, appliedAt)) || (yield* readIntent(mapping, rowCondition(mapping, {
+					...row,
+					[t.state]: t.states.Consumed,
+					[t.snapshot]: null,
+					[t.digest]: null
+				}), false)).length !== 1 || !evidenceCurrent(input, current.requirement, yield* nowMillis)) return yield* unavailable();
+			}).pipe(Effect.provideService(CurrentPasswordSql, currentTransaction))));
+			const validateApplied = Effect.gen(function* () {
+				yield* assertApplied().pipe(Effect.provideService(CurrentPasswordPreparedTransaction, transaction));
+				if (appliedAt === void 0) return;
+				const postconditions = yield* Effect.serviceOption(PasswordPreparedPostconditions);
+				if (Option.isSome(postconditions) && !postconditions.value.register(assertApplied().pipe(translateFailure))) return yield* unavailable();
+			});
+			const apply = Effect.fn("DrizzlePasswordPrepared.apply")(function* () {
+				const finalNow = yield* nowMillis;
+				if (!evidenceCurrent(input, current.requirement, finalNow)) return false;
+				if (!(input.intent.action === "add-password" ? yield* passwordSqlKernel.addPasswordIn(p, configuration, input.mutation, {
+					credentialId,
+					credentialRevision,
+					verifierVersion,
+					nextSecurityRevision
+				}, finalNow) : yield* passwordSqlKernel.writeReplacement(p, input.mutation, current.nativeSubjectId, {
+					credentialRevision,
+					verifierVersion,
+					nextSecurityRevision
+				}, finalNow))) return yield* unavailable();
+				appliedAt = finalNow;
+				yield* terminal(mapping, row, "Consumed");
+				if (!evidenceCurrent(input, current.requirement, yield* nowMillis)) return yield* unavailable();
+				return true;
+			});
+			if (completion !== void 0) {
+				let receipt;
+				yield* completeProofPlanIn(configuration.proof.mapping, configuration.proof.configuration, completion, Effect.gen(function* () {
+					return yield* apply();
+				}), (decision) => {
+					receipt = prepare(decision === "completed" ? "changed" : "rejected", journal);
+					return decision;
+				});
+				yield* validateApplied;
+				return receipt ?? prepare("rejected", journal);
+			}
+			const changed = yield* apply();
+			yield* validateApplied;
+			return prepare(changed ? "changed" : "rejected", journal);
+		}));
+	});
+	return {
+		reserve: (uncaptured, prepare) => Effect.gen(function* () {
+			const input = yield* snapshotReserve(uncaptured);
+			if (input.action === "reset-password" !== (input.reset !== void 0 && input.completion !== void 0) || input.action === "reset-password" && configuration.proof === void 0 || input.generation !== input.policy.generation || input.policy.retentionMillis < Math.max(input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis, input.policy.admission.action.windowMillis, input.policy.admission.identifier.windowMillis, input.policy.admission.subject.windowMillis) || input.invalidation.existingSessions === "immediate" && p.sessionInvalidation !== "same-authority-immediate") return yield* unavailable();
+			return yield* owned(Effect.gen(function* () {
+				const transaction = yield* CurrentPasswordSql;
+				const journal = yield* CurrentCommitJournal;
+				yield* lockAnchor(mapping, configuration, input.moduleId);
+				const version = PasswordPreparedVersion.make(yield* passwordSqlKernel.allocate(configuration.mode, mapping.allocateVersion, mapping.allocateVersionSync));
+				const authority = yield* captureAuthority(mapping, configuration, input);
+				if (authority === void 0) return yield* unavailable();
+				if (input.reset !== void 0) {
+					if (input.completion === void 0 || input.completion.moduleId !== `${input.moduleId}/reset` || input.completion.purpose !== "password-reset" || input.reset.continuationId !== input.completion.continuationId || bindingJson(input.reset.binding) !== bindingJson(input.completion.binding) || input.reset.binding._tag !== "Subject" || !sameRevision(input.reset.binding.revision, authority.revision) || authority.snapshot?.identifierVerifiedAtMillis === void 0 || !(yield* checkProofCompletionIn(configuration.proof.mapping, configuration.proof.configuration, input.completion))) return yield* unavailable();
+				}
+				if ((yield* readIntent(mapping, and(eq(c.moduleId, input.moduleId), eq(c.commandId, input.commandId)), configuration.locking)).length) return prepare({ _tag: "Existing" }, journal);
+				const now = yield* nowMillis, nativeNow = p.encodeInstant(now);
+				const scope = identifierScope({
+					credential: authority.snapshot,
+					revision: authority.revision
+				});
+				if (((yield* read(transaction.select({ total: count() }).from(t.table).where(and(eq(c.moduleId, input.moduleId), eq(c.subjectId, authority.nativeSubjectId), or(and(eq(c.state, t.states.Preparing), gt(c.preparationExpiresAt, nativeNow)), and(eq(c.state, t.states.Ready), gt(c.expiresAt, nativeNow))))), false))[0]?.total ?? 0) >= input.policy.maximumPendingPerSubject) return yield* unavailable();
+				for (const [condition, budget] of [
+					[eq(c.action, input.action), input.policy.admission.action],
+					[eq(c.identifierScope, scope), input.policy.admission.identifier],
+					[eq(c.subjectId, authority.nativeSubjectId), input.policy.admission.subject]
+				]) if (((yield* read(transaction.select({ total: count() }).from(t.table).where(and(eq(c.moduleId, input.moduleId), condition, gt(c.admittedAt, p.encodeInstant(now - budget.windowMillis)))), false))[0]?.total ?? 0) >= budget.limit) return yield* unavailable();
+				const reservation = yield* snapshotPasswordPreparedReservation({
+					_tag: "Preparing",
+					moduleId: input.moduleId,
+					generation: input.generation,
+					intentId: input.intentId,
+					version,
+					commandId: input.commandId,
+					action: input.action,
+					revision: authority.revision,
+					...authority.snapshot === void 0 ? {} : { credential: authority.snapshot },
+					capturedRequirement: authority.requirement,
+					...input.reset === void 0 ? {} : { reset: input.reset },
+					invalidation: input.invalidation,
+					createdAtMillis: now,
+					preparationExpiresAtMillis: now + input.policy.preparationLifetimeMillis,
+					retainUntilMillis: now + input.policy.retentionMillis
+				});
+				const snapshot = yield* encodeReservation(reservation);
+				yield* transaction.insert(t.table).values(t.encodeInsert({
+					reservation,
+					nativeSubjectId: authority.nativeSubjectId,
+					identifierScope: scope,
+					snapshot,
+					admittedAtMillis: now,
+					admissionRetainUntilMillis: now + Math.max(input.policy.admission.action.windowMillis, input.policy.admission.identifier.windowMillis, input.policy.admission.subject.windowMillis)
+				}));
+				const rows = yield* readIntent(mapping, and(eq(c.moduleId, input.moduleId), eq(c.intentId, input.intentId)), false);
+				if (rows.length !== 1 || !(yield* recordMatches(mapping, rows[0], reservation, authority.nativeSubjectId, snapshot))) return yield* unavailable();
+				const admittedUntil = now + Math.max(input.policy.admission.action.windowMillis, input.policy.admission.identifier.windowMillis, input.policy.admission.subject.windowMillis);
+				if ((yield* p.decodeInstant(rows[0][t.admittedAt])) !== now || (yield* p.decodeInstant(rows[0][t.admissionRetainUntil])) !== admittedUntil || (yield* nowMillis) >= reservation.preparationExpiresAtMillis || input.completion !== void 0 && !(yield* checkProofCompletionIn(configuration.proof.mapping, configuration.proof.configuration, input.completion))) return yield* unavailable();
+				return prepare({
+					_tag: "Reserved",
+					reservation
+				}, journal);
+			}));
+		}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		publishReady: (uncaptured, prepare) => Effect.gen(function* () {
+			const reservation = yield* snapshotPasswordPreparedReservation(uncaptured.reservation), ready = yield* snapshotPasswordPreparedReady(uncaptured.ready);
+			const snapshot = yield* encodeReservation(reservation), readySnapshot = yield* encodePasswordPreparedReady(ready);
+			if ((yield* encodeReservation(reservationOf(ready))) !== snapshot) return yield* unavailable();
+			return yield* owned(Effect.gen(function* () {
+				const transaction = yield* CurrentPasswordSql;
+				const journal = yield* CurrentCommitJournal;
+				yield* lockAnchor(mapping, configuration, reservation.moduleId);
+				const authority = yield* currentAuthority(mapping, configuration, reservation);
+				if (authority === void 0) return prepare("rejected", journal);
+				const rows = yield* readIntent(mapping, and(eq(c.moduleId, reservation.moduleId), eq(c.intentId, reservation.intentId)), configuration.locking), row = rows[0];
+				const now = yield* nowMillis;
+				if (rows.length !== 1 || !(yield* recordMatches(mapping, row, reservation, authority.nativeSubjectId, snapshot)) || now < ready.issuedAtMillis || now >= reservation.preparationExpiresAtMillis || now >= ready.expiresAtMillis) return prepare("rejected", journal);
+				yield* transaction.update(t.table).set(t.encodeReady({
+					ready,
+					snapshot: readySnapshot
+				})).where(rowCondition(mapping, row));
+				const saved = yield* readIntent(mapping, and(eq(c.moduleId, ready.moduleId), eq(c.intentId, ready.intentId)), false);
+				if (saved.length !== 1 || !(yield* recordMatches(mapping, saved[0], ready, authority.nativeSubjectId, readySnapshot)) || (yield* readIntent(mapping, and(eq(c.moduleId, ready.moduleId), eq(c.intentId, ready.intentId), eq(c.admittedAt, row[t.admittedAt]), eq(c.admissionRetainUntil, row[t.admissionRetainUntil])), false)).length !== 1) return yield* unavailable();
+				if ((yield* nowMillis) >= reservation.preparationExpiresAtMillis || (yield* nowMillis) >= ready.expiresAtMillis) return yield* unavailable();
+				return prepare("published", journal);
+			}));
+		}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		context: (uncaptured) => Effect.gen(function* () {
+			const input = yield* Schema.decodeEffect(ContextInput)({ ...uncaptured }).pipe(Effect.mapError(unavailable));
+			return (yield* passwordSqlKernel.safeRead(database, configuration, Effect.gen(function* () {
+				if (!valid(mapping) || !(yield* lockAnchor(mapping, configuration, input.moduleId, false))) return void 0;
+				const rows = yield* readIntent(mapping, and(eq(c.moduleId, input.moduleId), eq(c.generation, input.generation), eq(c.digest, input.digest), eq(c.state, t.states.Ready)), false);
+				if (rows.length !== 1) return void 0;
+				const selected = yield* decodePasswordPreparedReady(rows[0][t.snapshot]);
+				const authority = yield* currentAuthority(mapping, configuration, selected);
+				if (authority === void 0) return void 0;
+				const locked = yield* readIntent(mapping, rowCondition(mapping, rows[0]), configuration.locking);
+				const now = yield* nowMillis;
+				if (locked.length !== 1 || now < selected.issuedAtMillis || now >= selected.expiresAtMillis || selected.moduleId !== input.moduleId || selected.generation !== input.generation || selected.digest !== input.digest || !(yield* recordMatches(mapping, locked[0], selected, authority.nativeSubjectId, yield* encodePasswordPreparedReady(selected)))) return void 0;
+				return {
+					record: selected,
+					currentRequirement: authority.requirement
+				};
+			}))) ?? (yield* PasswordRejected.make({}));
+		}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateContextFailure),
+		complete: (input, prepare) => complete(input, prepare).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		resetWithProof: (input, prepare) => complete(input, prepare).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		cancel: (uncaptured, prepare) => Effect.gen(function* () {
+			const record = yield* snapshotPasswordPreparedReady(uncaptured.record), snapshot = yield* encodePasswordPreparedReady(record);
+			return yield* owned(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				yield* lockAnchor(mapping, configuration, record.moduleId);
+				const authority = yield* currentAuthority(mapping, configuration, record);
+				if (authority === void 0) return prepare(false, journal);
+				const rows = yield* readIntent(mapping, and(eq(c.moduleId, record.moduleId), eq(c.intentId, record.intentId)), configuration.locking);
+				const now = yield* nowMillis;
+				if (rows.length !== 1 || now < record.issuedAtMillis || now >= record.expiresAtMillis || !(yield* recordMatches(mapping, rows[0], record, authority.nativeSubjectId, snapshot))) return prepare(false, journal);
+				yield* terminal(mapping, rows[0], "Cancelled");
+				return prepare(true, journal);
+			}));
+		}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure),
+		cleanup: (uncaptured, prepare) => Effect.gen(function* () {
+			const input = { ...uncaptured };
+			if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) return yield* unavailable();
+			return yield* owned(Effect.gen(function* () {
+				const transaction = yield* CurrentPasswordSql;
+				const journal = yield* CurrentCommitJournal;
+				if (!(yield* lockAnchor(mapping, configuration, input.moduleId, false))) return prepare({
+					removed: 0,
+					hasMore: false
+				}, journal);
+				const now = p.encodeInstant(yield* nowMillis);
+				const due = and(eq(c.moduleId, input.moduleId), or(and(lte(c.retainUntil, now), lte(c.admissionRetainUntil, now)), and(isNotNull(c.snapshot), or(and(eq(c.state, t.states.Preparing), lte(c.preparationExpiresAt, now)), and(eq(c.state, t.states.Ready), lte(c.expiresAt, now))))));
+				const rows = yield* read(transaction.select().from(t.table).where(due).orderBy(c.createdAt, c.intentId).limit(input.limit + 1), configuration.locking);
+				let removed = 0;
+				for (const row of rows.slice(0, input.limit)) if ((yield* readIntent(mapping, and(rowCondition(mapping, row), lte(c.retainUntil, now), lte(c.admissionRetainUntil, now)), false)).length === 1) {
+					yield* transaction.delete(t.table).where(rowCondition(mapping, row));
+					if ((yield* readIntent(mapping, and(eq(c.moduleId, input.moduleId), eq(c.intentId, row[t.intentId])), false)).length) return yield* unavailable();
+					removed++;
+				} else yield* terminal(mapping, row, "Expired");
+				return prepare({
+					removed,
+					hasMore: (yield* read(transaction.select().from(t.table).where(due).limit(1), false)).length > 0
+				}, journal);
+			}));
+		}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure)
+	};
+});
+const passwordPreparedSqlKernel = {
+	columns,
+	recordMatches,
+	captureAuthority,
+	currentAuthority,
+	rowCondition,
+	valid,
+	identifierScope
+};
+//#endregion
+export { makeSqlPasswordPreparedPersistence, passwordPreparedSqlKernel };
+
+//# sourceMappingURL=password-prepared-sql.mjs.map