@yielded/auth-persistence 0.1.0-beta.7

package/dist/drizzle/phone-target.mjs

@@ -0,0 +1,170 @@
+import { requiredProofConstraints } from "./proof-model.mjs";
+import { CurrentProofSql } from "../internal/proof-kernel.mjs";
+import { CurrentPhoneTransaction } from "../internal/phone-kernel.mjs";
+import { completeProofPlanIn } from "./proof-sql.mjs";
+import { coordinateTransactionOwner, makeTransactionExecution, sqlClientTransactionStandaloneGuard } from "./transaction-execution.mjs";
+import { phoneProofs, requiredPhoneConstraints } from "./phone-model.mjs";
+import { CurrentD1PlanningDatabase } from "./d1-planning.mjs";
+import { compileD1ProofCompletionPlan } from "./d1-proofs.mjs";
+import { admitPhone, capturePhone, cleanupPhoneAdmission, equal, invariant, lookupPhone, preparePhoneMutation, unavailable } from "./phone-state.mjs";
+import { Context, Effect, Schema } from "effect";
+import { randomId } from "@yielded/auth/Persistence";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { PhoneActionAuthorization, PhoneAdmission, PhoneAdmissionPolicy, PhoneConfigurationError, PhoneLifecyclePolicy, PhoneLifecycleTarget, PhonePersistence, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
+import { ProofBinding } from "@yielded/auth/Proofs";
+import { sql } from "drizzle-orm";
+//#region src/drizzle/phone-target.ts
+const sqlClientPhoneStandaloneGuard = (database) => sqlClientTransactionStandaloneGuard(unavailable, database);
+const validateMapping = (original, configuration) => {
+	const mapping = original;
+	invariant(mapping.moduleId.length > 0);
+	Schema.decodeSync(PhoneLifecyclePolicy)(mapping.policy);
+	Schema.decodeSync(PhoneAdmissionPolicy)(mapping.admission);
+	invariant(mapping.admission.requestRetentionMillis >= mapping.admission.windowMillis);
+	const proofs = phoneProofs(mapping.proofs);
+	invariant(proofs !== void 0);
+	for (const [key, value] of Object.entries(requiredProofConstraints)) invariant(proofs.constraints?.[key] === value);
+	if (configuration.mode === "synchronous") invariant(proofs.allocateVersionSync !== void 0);
+	if (configuration.mode === "batch") invariant(proofs.d1 !== void 0 && proofs.authority.identifier.d1CurrentCondition !== void 0);
+	for (const [key, value] of Object.entries(requiredPhoneConstraints)) invariant(mapping.constraints?.[key] === value);
+	if (configuration.mode === "batch") invariant(mapping.d1?.primary === true);
+	return Object.freeze({
+		...mapping,
+		policy: Object.freeze({ ...mapping.policy }),
+		subject: Object.freeze({ ...mapping.subject }),
+		state: Object.freeze({ ...mapping.state }),
+		identifier: Object.freeze({ ...mapping.identifier }),
+		admission: Object.freeze({ ...mapping.admission }),
+		credential: Object.freeze({ ...mapping.credential }),
+		subjectIds: Object.freeze({ ...mapping.subjectIds })
+	});
+};
+const services = (mapping, execution, hooks, configuration) => {
+	const run = (effect, mutation = true) => execution.admit.pipe(Effect.andThen(execution.run(effect, mutation)), Effect.provideService(LifecycleHooks, hooks));
+	return {
+		phoneAdmission: PhoneAdmission.of({
+			admit: (input) => run(admitPhone(mapping, { ...input })),
+			cleanup: (input) => run(cleanupPhoneAdmission(mapping, { ...input }))
+		}),
+		phoneSignInTargets: PhoneSignInTargets.of({ lookup: (input) => run(lookupPhone(mapping, { ...input }), false) }),
+		phonePersistence: PhonePersistence.of({
+			target: (input) => run(Effect.gen(function* () {
+				invariant(input.moduleId === mapping.moduleId);
+				return (yield* capturePhone(mapping, { ...input })).target;
+			}), false),
+			mutate: (original, prepare) => Effect.suspend(() => {
+				const input = {
+					...original,
+					target: Schema.decodeSync(Schema.toCodecIso(PhoneLifecycleTarget))(Schema.encodeSync(Schema.toCodecIso(PhoneLifecycleTarget))(original.target)),
+					policy: { ...original.policy },
+					...original.authorization === void 0 ? {} : { authorization: Schema.decodeSync(Schema.toCodecIso(PhoneActionAuthorization))(Schema.encodeSync(Schema.toCodecIso(PhoneActionAuthorization))(original.authorization)) },
+					completion: {
+						input: {
+							...original.completion.input,
+							binding: Schema.decodeSync(Schema.toCodecIso(ProofBinding))(Schema.encodeSync(Schema.toCodecIso(ProofBinding))(original.completion.input.binding))
+						},
+						prepare: original.completion.prepare
+					}
+				};
+				return run(Effect.gen(function* () {
+					const owner = yield* CurrentPhoneTransaction, candidate = yield* preparePhoneMutation(mapping, input);
+					if (candidate.mutate === void 0) {
+						const receipt = prepare(candidate.decision, owner.journal);
+						owner.guards.push(receipt);
+						return receipt;
+					}
+					const cn = phoneProofs(mapping.proofs).continuation;
+					const observed = yield* owner.read(cn.table, equal(cn.table, {
+						[cn.moduleId]: input.completion.input.moduleId,
+						[cn.continuationId]: input.completion.input.continuationId
+					}), { limit: 1 });
+					let completed = false;
+					const plan = {
+						...input.completion,
+						prepare: (decision, journal) => {
+							completed = decision === "completed";
+							const proofReceipt = input.completion.prepare(decision, journal, () => void 0);
+							owner.guards.push(proofReceipt);
+							return prepare(decision === "completed" ? candidate.decision : { _tag: "Rejected" }, journal);
+						}
+					};
+					let receipt;
+					if (owner.batch) {
+						const offset = owner.statements.length;
+						yield* candidate.mutate;
+						const statements = owner.statements.splice(offset);
+						const compiled = yield* compileD1ProofCompletionPlan(phoneProofs(mapping.proofs), plan, {
+							statements,
+							appliedCondition: candidate.appliedCondition
+						}, (x) => x).pipe(Effect.provideService(CurrentD1PlanningDatabase, owner.database));
+						invariant(compiled.statements.length !== 0);
+						owner.statements.push(...compiled.statements, ...compiled.postconditions ?? []);
+						receipt = compiled.receipt;
+					} else receipt = yield* completeProofPlanIn(phoneProofs(mapping.proofs), {
+						mode: configuration.mode === "synchronous" ? "synchronous" : "interactive",
+						locking: configuration.locking,
+						standaloneGuard: Effect.void,
+						coordinated: true,
+						insertIfAbsent: (query, key, value) => configuration.dialect === "mysql" ? query.onDuplicateKeyUpdate({ set: { [key]: value } }) : query.onConflictDoNothing()
+					}, plan, candidate.mutate, (x) => x).pipe(Effect.provideService(CurrentProofSql, owner.database));
+					if (completed) {
+						invariant(observed.rows.length === 1);
+						const record = yield* cn.decode(observed.rows[0]);
+						observed.rows = observed.rows.map((row) => ({
+							...row,
+							[cn.consumed]: true
+						}));
+						const command = phoneProofs(mapping.proofs).command;
+						owner.postconditions.push(sql`${mapping.engineNowMillis} < ${record.expiresAtMillis}`, sql`exists(select 1 from ${command.table} where ${equal(command.table, {
+							[command.moduleId]: input.completion.input.moduleId,
+							[command.commandId]: input.completion.input.continuationDigest,
+							[command.kind]: "complete",
+							[command.decision]: "completed",
+							[command.retentionUntil]: phoneProofs(mapping.proofs).encodeInstant(record.expiresAtMillis)
+						})})`);
+					}
+					invariant(receipt?._tag === "PreparedCommit");
+					owner.guards.push(receipt);
+					return receipt;
+				}));
+			}).pipe(Effect.catchDefect(() => Effect.fail(unavailable())))
+		})
+	};
+};
+const makeTargetPhonePersistence = (database, source, configuration) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);
+	const mapping = yield* Effect.try({
+		try: () => validateMapping(original, configuration),
+		catch: () => PhoneConfigurationError.make({})
+	});
+	const execution = makeTransactionExecution(CurrentPhoneTransaction, database, configuration, unavailable, randomId);
+	return services(mapping, execution, hooks, configuration);
+});
+const coordinateTargetPhone = (database, source, configuration, body) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);
+	const mapping = yield* Effect.try({
+		try: () => validateMapping(original, configuration),
+		catch: () => PhoneConfigurationError.make({})
+	});
+	return yield* coordinateTransactionOwner(database, CurrentPhoneTransaction, configuration, Effect.void, unavailable, randomId, (execution) => services(mapping, execution, hooks, configuration), body);
+});
+/** Concrete driver wrappers select transaction mode; cryptography always precedes these owners. */
+const makePhoneTarget = (configuration) => {
+	function coordinatePhonePersistence(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetPhone(database, options.mapping, configuration, (transaction, services) => {
+			const provided = Context.make(PhonePersistence, services.phonePersistence).pipe(Context.add(PhoneAdmission, services.phoneAdmission), Context.add(PhoneSignInTargets, services.phoneSignInTargets));
+			const work = Effect.provideContext(body, provided);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	return {
+		makePhonePersistenceServices: (database, mapping) => makeTargetPhonePersistence(database, mapping, configuration),
+		coordinatePhonePersistence
+	};
+};
+//#endregion
+export { coordinateTargetPhone, makePhoneTarget, makeTargetPhonePersistence, sqlClientPhoneStandaloneGuard };
+
+//# sourceMappingURL=phone-target.mjs.map

package/dist/drizzle/phone-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone-target.mjs","names":[],"sources":["../../src/drizzle/phone-target.ts"],"sourcesContent":["import { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport { randomId } from \"@yielded/auth/Persistence\";\nimport {\n  PhoneConfigurationError,\n  PhoneLifecyclePolicy,\n  PhoneAdmissionPolicy,\n  PhoneLifecycleTarget,\n  PhoneActionAuthorization,\n  PhoneAdmission,\n  type PhoneMutation,\n  PhonePersistence,\n  PhoneSignInTargets,\n  type PhoneOtpUnavailable as PhoneUnavailable,\n} from \"@yielded/auth/PhoneOtp\";\nimport { ProofBinding } from \"@yielded/auth/Proofs\";\nimport { sql, type Table } from \"drizzle-orm\";\n/* oxlint-disable no-explicit-any -- shared native implementation; driver entrypoints retain exact database and table types. */\nimport { Context, Effect, Schema } from \"effect\";\nimport type { Statement } from \"effect/unstable/sql/Statement\";\n\nimport { CurrentD1PlanningDatabase } from \"./d1-planning\";\nimport { compileD1ProofCompletionPlan } from \"./d1-proofs\";\nimport type { PersistenceMappingError } from \"./model\";\nimport {\n  phoneProofs,\n  type PhoneMapping,\n  type PhoneMappingSource,\n  type PhonePersistenceServices,\n  requiredPhoneConstraints,\n} from \"./phone-model\";\nimport {\n  capturePhone,\n  lookupPhone,\n  admitPhone,\n  cleanupPhoneAdmission,\n  CurrentPhoneTransaction,\n  invariant,\n  equal,\n  preparePhoneMutation,\n  unavailable,\n} from \"./phone-state\";\nimport { requiredProofConstraints } from \"./proof-model\";\nimport { completeProofPlanIn, CurrentProofSql } from \"./proof-sql\";\nimport type { SuppliedService } from \"./SuppliedService\";\nimport {\n  coordinateTransactionOwner,\n  makeTransactionExecution,\n  sqlClientTransactionStandaloneGuard,\n  type TransactionExecution,\n  type TransactionTargetConfiguration,\n  type TransactionCoordinatorError,\n} from \"./transaction-execution\";\nimport type { TransactionNativeDatabase } from \"./transaction-owner\";\nexport type PhoneTargetConfiguration = TransactionTargetConfiguration<PhoneUnavailable>;\n\nexport type PhoneCoordinatorError<E> =\n  | TransactionCoordinatorError<E, PhoneUnavailable>\n  | PhoneConfigurationError\n  | PersistenceMappingError;\n\nexport const sqlClientPhoneStandaloneGuard = (\n  database: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n) => sqlClientTransactionStandaloneGuard(unavailable, database);\n\nconst validateMapping = <M>(original: M, configuration: PhoneTargetConfiguration): M => {\n  const mapping = original as any;\n\n  invariant(mapping.moduleId.length > 0);\n  Schema.decodeSync(PhoneLifecyclePolicy)(mapping.policy);\n  Schema.decodeSync(PhoneAdmissionPolicy)(mapping.admission);\n  invariant(mapping.admission.requestRetentionMillis >= mapping.admission.windowMillis);\n  const proofs = phoneProofs(mapping.proofs);\n\n  invariant(proofs !== undefined);\n  for (const [key, value] of Object.entries(requiredProofConstraints))\n    invariant((proofs.constraints as any)?.[key] === value);\n  if (configuration.mode === \"synchronous\") invariant(proofs.allocateVersionSync !== undefined);\n  if (configuration.mode === \"batch\")\n    invariant(\n      proofs.d1 !== undefined && proofs.authority.identifier.d1CurrentCondition !== undefined,\n    );\n  for (const [key, value] of Object.entries(requiredPhoneConstraints))\n    invariant(mapping.constraints?.[key] === value);\n  if (configuration.mode === \"batch\") invariant(mapping.d1?.primary === true);\n\n  return Object.freeze({\n    ...mapping,\n    policy: Object.freeze({ ...mapping.policy }),\n    subject: Object.freeze({ ...mapping.subject }),\n    state: Object.freeze({ ...mapping.state }),\n    identifier: Object.freeze({ ...mapping.identifier }),\n    admission: Object.freeze({ ...mapping.admission }),\n    credential: Object.freeze({ ...mapping.credential }),\n    subjectIds: Object.freeze({ ...mapping.subjectIds }),\n  });\n};\n\nconst services = (\n  mapping: any,\n  execution: TransactionExecution<PhoneUnavailable, CurrentPhoneTransaction>,\n  hooks: LifecycleHooks[\"Service\"],\n  configuration: PhoneTargetConfiguration,\n): PhonePersistenceServices => {\n  const run = <A, E, R>(effect: Effect.Effect<A, E, R>, mutation = true) =>\n    execution.admit.pipe(\n      Effect.andThen(execution.run(effect, mutation)),\n      Effect.provideService(LifecycleHooks, hooks),\n    );\n\n  return {\n    phoneAdmission: PhoneAdmission.of({\n      admit: (input) => run(admitPhone(mapping, { ...input })),\n      cleanup: (input) => run(cleanupPhoneAdmission(mapping, { ...input })),\n    }),\n    phoneSignInTargets: PhoneSignInTargets.of({\n      lookup: (input) => run(lookupPhone(mapping, { ...input }), false),\n    }),\n    phonePersistence: PhonePersistence.of({\n      target: (input) =>\n        run(\n          Effect.gen(function* () {\n            invariant(input.moduleId === mapping.moduleId);\n\n            return (yield* capturePhone(mapping, { ...input })).target;\n          }),\n          false,\n        ),\n      mutate: (original, prepare) =>\n        Effect.suspend(() => {\n          const input: PhoneMutation = {\n            ...original,\n            target: Schema.decodeSync(Schema.toCodecIso(PhoneLifecycleTarget))(\n              Schema.encodeSync(Schema.toCodecIso(PhoneLifecycleTarget))(original.target),\n            ),\n            policy: { ...original.policy },\n            ...(original.authorization === undefined\n              ? {}\n              : {\n                  authorization: Schema.decodeSync(Schema.toCodecIso(PhoneActionAuthorization))(\n                    Schema.encodeSync(Schema.toCodecIso(PhoneActionAuthorization))(\n                      original.authorization,\n                    ),\n                  ),\n                }),\n            completion: {\n              input: {\n                ...original.completion.input,\n                binding: Schema.decodeSync(Schema.toCodecIso(ProofBinding))(\n                  Schema.encodeSync(Schema.toCodecIso(ProofBinding))(\n                    original.completion.input.binding,\n                  ),\n                ),\n              },\n              prepare: original.completion.prepare,\n            },\n          };\n\n          return run(\n            Effect.gen(function* () {\n              const owner = yield* CurrentPhoneTransaction,\n                candidate = yield* preparePhoneMutation(mapping, input);\n\n              if (candidate.mutate === undefined) {\n                const receipt = prepare(candidate.decision, owner.journal);\n\n                owner.guards.push(receipt as any);\n\n                return receipt;\n              }\n              const cn = phoneProofs(mapping.proofs).continuation;\n\n              const observed = yield* owner.read(\n                cn.table,\n                equal(cn.table, {\n                  [cn.moduleId]: input.completion.input.moduleId,\n                  [cn.continuationId]: input.completion.input.continuationId,\n                }),\n                { limit: 1 },\n              );\n\n              let completed = false;\n\n              const plan = {\n                ...input.completion,\n                prepare: (decision: any, journal: any) => {\n                  completed = decision === \"completed\";\n                  const proofReceipt = input.completion.prepare(decision, journal, () => undefined);\n\n                  owner.guards.push(proofReceipt);\n\n                  return prepare(\n                    decision === \"completed\" ? candidate.decision : { _tag: \"Rejected\" },\n                    journal,\n                  );\n                },\n              };\n\n              let receipt;\n\n              if (owner.batch) {\n                const offset = owner.statements.length;\n\n                yield* candidate.mutate;\n                const statements = owner.statements.splice(offset);\n\n                const compiled = yield* compileD1ProofCompletionPlan(\n                  phoneProofs(mapping.proofs) as any,\n                  plan as any,\n                  { statements, appliedCondition: candidate.appliedCondition! },\n                  (x) => x,\n                ).pipe(Effect.provideService(CurrentD1PlanningDatabase, owner.database));\n\n                // Mutation observations describe an accepted plan. A stale proof aborts this owner.\n                invariant(compiled.statements.length !== 0);\n                owner.statements.push(...compiled.statements, ...(compiled.postconditions ?? []));\n                receipt = compiled.receipt;\n              } else {\n                receipt = yield* completeProofPlanIn(\n                  phoneProofs(mapping.proofs),\n                  {\n                    mode: configuration.mode === \"synchronous\" ? \"synchronous\" : \"interactive\",\n                    locking: configuration.locking,\n                    standaloneGuard: Effect.void,\n                    coordinated: true,\n                    insertIfAbsent: (query: any, key, value) =>\n                      configuration.dialect === \"mysql\"\n                        ? query.onDuplicateKeyUpdate({ set: { [key]: value } })\n                        : query.onConflictDoNothing(),\n                  },\n                  plan as any,\n                  candidate.mutate,\n                  (x) => x,\n                ).pipe(Effect.provideService(CurrentProofSql, owner.database));\n              }\n              if (completed) {\n                invariant(observed.rows.length === 1);\n                const record = yield* cn.decode(observed.rows[0]!);\n\n                observed.rows = observed.rows.map((row) => ({ ...row, [cn.consumed]: true }));\n                const command = phoneProofs(mapping.proofs).command;\n\n                owner.postconditions.push(\n                  sql`${mapping.engineNowMillis} < ${record.expiresAtMillis}`,\n                  sql`exists(select 1 from ${command.table} where ${equal(command.table, { [command.moduleId]: input.completion.input.moduleId, [command.commandId]: input.completion.input.continuationDigest, [command.kind]: \"complete\", [command.decision]: \"completed\", [command.retentionUntil]: phoneProofs(mapping.proofs).encodeInstant(record.expiresAtMillis) })})`,\n                );\n              }\n              invariant(receipt?._tag === \"PreparedCommit\");\n              owner.guards.push(receipt as any);\n\n              return receipt as ReturnType<typeof prepare>;\n            }),\n          );\n        }).pipe(Effect.catchDefect(() => Effect.fail(unavailable()))),\n    }),\n  };\n};\n\nexport const makeTargetPhonePersistence = <\n  S extends Table,\n  I extends Table,\n  F extends Table,\n  C extends Table,\n  N,\n  RSetup = never,\n>(\n  database: TransactionNativeDatabase,\n  source: PhoneMappingSource<PhoneMapping<S, I, C, F, N>, RSetup>,\n  configuration: PhoneTargetConfiguration,\n) =>\n  Effect.gen(function* () {\n    const hooks = yield* LifecycleHooks;\n    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);\n\n    const mapping = yield* Effect.try({\n      try: () => validateMapping(original, configuration),\n      catch: () => PhoneConfigurationError.make({}),\n    });\n\n    const execution = makeTransactionExecution(\n      CurrentPhoneTransaction,\n      database,\n      configuration,\n      unavailable,\n      randomId,\n    );\n\n    return services(mapping, execution, hooks, configuration);\n  });\n\nexport const coordinateTargetPhone = <M, A, E, R, RSetup = never>(\n  database: TransactionNativeDatabase,\n  source: PhoneMappingSource<M, RSetup>,\n  configuration: PhoneTargetConfiguration,\n  body: (\n    transaction: any,\n    services: PhonePersistenceServices,\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, PhoneCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n  Effect.gen(function* () {\n    const hooks = yield* LifecycleHooks;\n    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);\n\n    const mapping = yield* Effect.try({\n      try: () => validateMapping(original, configuration),\n      catch: () => PhoneConfigurationError.make({}),\n    });\n\n    return yield* coordinateTransactionOwner(\n      database,\n      CurrentPhoneTransaction,\n      configuration,\n      Effect.void,\n      unavailable,\n      randomId,\n      (execution) => services(mapping, execution, hooks, configuration),\n      body,\n    );\n  });\n\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\n\n/** Concrete driver wrappers select transaction mode; cryptography always precedes these owners. */\nexport const makePhoneTarget = <\n  D extends { readonly transaction: any },\n  T extends Table,\n  Extra = unknown,\n  Synchronous extends boolean = false,\n>(\n  configuration: PhoneTargetConfiguration,\n) => {\n  function coordinatePhonePersistence<\n    Database extends D,\n    S extends T,\n    I extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & Extra, RSetup>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<PhonePersistence | PhoneAdmission | PhoneSignInTargets> : R\n    >,\n  ): Effect.Effect<\n    A,\n    PhoneCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true\n        ? never\n        : Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinatePhonePersistence<\n    Database extends D,\n    S extends T,\n    I extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & Extra, RSetup>;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true\n        ? NoInfer<PhonePersistence | PhoneAdmission | PhoneSignInTargets | TxId>\n        : R\n    >,\n  ): Effect.Effect<\n    A,\n    PhoneCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true\n        ? never\n        : Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets | TxId>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinatePhonePersistence<\n    Database extends D,\n    S extends T,\n    I extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & Extra, RSetup>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PhoneCoordinatorError<E> | DatabaseError,\n    | Exclude<R, PhonePersistence | PhoneAdmission | PhoneSignInTargets>\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetPhone(\n        database as any,\n        options.mapping,\n        configuration,\n        (transaction: TransactionOf<Database>, services) => {\n          const provided = Context.make(PhonePersistence, services.phonePersistence).pipe(\n            Context.add(PhoneAdmission, services.phoneAdmission),\n            Context.add(PhoneSignInTargets, services.phoneSignInTargets),\n          );\n\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  return {\n    makePhonePersistenceServices: <\n      Database extends D,\n      S extends T,\n      I extends T,\n      F extends T,\n      C extends T,\n      N,\n      RSetup = never,\n    >(\n      database: Database,\n      mapping: PhoneMappingSource<PhoneMapping<S, I, C, F, N> & Extra, RSetup>,\n    ) => makeTargetPhonePersistence(database as any, mapping, configuration),\n    coordinatePhonePersistence,\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;;AA4DA,MAAa,iCACX,aACG,oCAAoC,aAAa,QAAQ;AAE9D,MAAM,mBAAsB,UAAa,kBAA+C;CACtF,MAAM,UAAU;CAEhB,UAAU,QAAQ,SAAS,SAAS,CAAC;CACrC,OAAO,WAAW,oBAAoB,CAAC,CAAC,QAAQ,MAAM;CACtD,OAAO,WAAW,oBAAoB,CAAC,CAAC,QAAQ,SAAS;CACzD,UAAU,QAAQ,UAAU,0BAA0B,QAAQ,UAAU,YAAY;CACpF,MAAM,SAAS,YAAY,QAAQ,MAAM;CAEzC,UAAU,WAAW,KAAA,CAAS;CAC9B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,wBAAwB,GAChE,UAAW,OAAO,cAAsB,SAAS,KAAK;CACxD,IAAI,cAAc,SAAS,eAAe,UAAU,OAAO,wBAAwB,KAAA,CAAS;CAC5F,IAAI,cAAc,SAAS,SACzB,UACE,OAAO,OAAO,KAAA,KAAa,OAAO,UAAU,WAAW,uBAAuB,KAAA,CAChF;CACF,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,wBAAwB,GAChE,UAAU,QAAQ,cAAc,SAAS,KAAK;CAChD,IAAI,cAAc,SAAS,SAAS,UAAU,QAAQ,IAAI,YAAY,IAAI;CAE1E,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;EAC3C,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;EAC7C,OAAO,OAAO,OAAO,EAAE,GAAG,QAAQ,MAAM,CAAC;EACzC,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;EACnD,WAAW,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,CAAC;EACjD,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;EACnD,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACrD,CAAC;AACH;AAEA,MAAM,YACJ,SACA,WACA,OACA,kBAC6B;CAC7B,MAAM,OAAgB,QAAgC,WAAW,SAC/D,UAAU,MAAM,KACd,OAAO,QAAQ,UAAU,IAAI,QAAQ,QAAQ,CAAC,GAC9C,OAAO,eAAe,gBAAgB,KAAK,CAC7C;CAEF,OAAO;EACL,gBAAgB,eAAe,GAAG;GAChC,QAAQ,UAAU,IAAI,WAAW,SAAS,EAAE,GAAG,MAAM,CAAC,CAAC;GACvD,UAAU,UAAU,IAAI,sBAAsB,SAAS,EAAE,GAAG,MAAM,CAAC,CAAC;EACtE,CAAC;EACD,oBAAoB,mBAAmB,GAAG,EACxC,SAAS,UAAU,IAAI,YAAY,SAAS,EAAE,GAAG,MAAM,CAAC,GAAG,KAAK,EAClE,CAAC;EACD,kBAAkB,iBAAiB,GAAG;GACpC,SAAS,UACP,IACE,OAAO,IAAI,aAAa;IACtB,UAAU,MAAM,aAAa,QAAQ,QAAQ;IAE7C,QAAQ,OAAO,aAAa,SAAS,EAAE,GAAG,MAAM,CAAC,EAAA,CAAG;GACtD,CAAC,GACD,KACF;GACF,SAAS,UAAU,YACjB,OAAO,cAAc;IACnB,MAAM,QAAuB;KAC3B,GAAG;KACH,QAAQ,OAAO,WAAW,OAAO,WAAW,oBAAoB,CAAC,CAAC,CAChE,OAAO,WAAW,OAAO,WAAW,oBAAoB,CAAC,CAAC,CAAC,SAAS,MAAM,CAC5E;KACA,QAAQ,EAAE,GAAG,SAAS,OAAO;KAC7B,GAAI,SAAS,kBAAkB,KAAA,IAC3B,CAAC,IACD,EACE,eAAe,OAAO,WAAW,OAAO,WAAW,wBAAwB,CAAC,CAAC,CAC3E,OAAO,WAAW,OAAO,WAAW,wBAAwB,CAAC,CAAC,CAC5D,SAAS,aACX,CACF,EACF;KACJ,YAAY;MACV,OAAO;OACL,GAAG,SAAS,WAAW;OACvB,SAAS,OAAO,WAAW,OAAO,WAAW,YAAY,CAAC,CAAC,CACzD,OAAO,WAAW,OAAO,WAAW,YAAY,CAAC,CAAC,CAChD,SAAS,WAAW,MAAM,OAC5B,CACF;MACF;MACA,SAAS,SAAS,WAAW;KAC/B;IACF;IAEA,OAAO,IACL,OAAO,IAAI,aAAa;KACtB,MAAM,QAAQ,OAAO,yBACnB,YAAY,OAAO,qBAAqB,SAAS,KAAK;KAExD,IAAI,UAAU,WAAW,KAAA,GAAW;MAClC,MAAM,UAAU,QAAQ,UAAU,UAAU,MAAM,OAAO;MAEzD,MAAM,OAAO,KAAK,OAAc;MAEhC,OAAO;KACT;KACA,MAAM,KAAK,YAAY,QAAQ,MAAM,CAAC,CAAC;KAEvC,MAAM,WAAW,OAAO,MAAM,KAC5B,GAAG,OACH,MAAM,GAAG,OAAO;OACb,GAAG,WAAW,MAAM,WAAW,MAAM;OACrC,GAAG,iBAAiB,MAAM,WAAW,MAAM;KAC9C,CAAC,GACD,EAAE,OAAO,EAAE,CACb;KAEA,IAAI,YAAY;KAEhB,MAAM,OAAO;MACX,GAAG,MAAM;MACT,UAAU,UAAe,YAAiB;OACxC,YAAY,aAAa;OACzB,MAAM,eAAe,MAAM,WAAW,QAAQ,UAAU,eAAe,KAAA,CAAS;OAEhF,MAAM,OAAO,KAAK,YAAY;OAE9B,OAAO,QACL,aAAa,cAAc,UAAU,WAAW,EAAE,MAAM,WAAW,GACnE,OACF;MACF;KACF;KAEA,IAAI;KAEJ,IAAI,MAAM,OAAO;MACf,MAAM,SAAS,MAAM,WAAW;MAEhC,OAAO,UAAU;MACjB,MAAM,aAAa,MAAM,WAAW,OAAO,MAAM;MAEjD,MAAM,WAAW,OAAO,6BACtB,YAAY,QAAQ,MAAM,GAC1B,MACA;OAAE;OAAY,kBAAkB,UAAU;MAAkB,IAC3D,MAAM,CACT,CAAC,CAAC,KAAK,OAAO,eAAe,2BAA2B,MAAM,QAAQ,CAAC;MAGvE,UAAU,SAAS,WAAW,WAAW,CAAC;MAC1C,MAAM,WAAW,KAAK,GAAG,SAAS,YAAY,GAAI,SAAS,kBAAkB,CAAC,CAAE;MAChF,UAAU,SAAS;KACrB,OACE,UAAU,OAAO,oBACf,YAAY,QAAQ,MAAM,GAC1B;MACE,MAAM,cAAc,SAAS,gBAAgB,gBAAgB;MAC7D,SAAS,cAAc;MACvB,iBAAiB,OAAO;MACxB,aAAa;MACb,iBAAiB,OAAY,KAAK,UAChC,cAAc,YAAY,UACtB,MAAM,qBAAqB,EAAE,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC,IACpD,MAAM,oBAAoB;KAClC,GACA,MACA,UAAU,SACT,MAAM,CACT,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,MAAM,QAAQ,CAAC;KAE/D,IAAI,WAAW;MACb,UAAU,SAAS,KAAK,WAAW,CAAC;MACpC,MAAM,SAAS,OAAO,GAAG,OAAO,SAAS,KAAK,EAAG;MAEjD,SAAS,OAAO,SAAS,KAAK,KAAK,SAAS;OAAE,GAAG;QAAM,GAAG,WAAW;MAAK,EAAE;MAC5E,MAAM,UAAU,YAAY,QAAQ,MAAM,CAAC,CAAC;MAE5C,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,gBAAgB,KAAK,OAAO,mBAC1C,GAAG,wBAAwB,QAAQ,MAAM,SAAS,MAAM,QAAQ,OAAO;QAAG,QAAQ,WAAW,MAAM,WAAW,MAAM;QAAW,QAAQ,YAAY,MAAM,WAAW,MAAM;QAAqB,QAAQ,OAAO;QAAa,QAAQ,WAAW;QAAc,QAAQ,iBAAiB,YAAY,QAAQ,MAAM,CAAC,CAAC,cAAc,OAAO,eAAe;MAAE,CAAC,EAAE,EAC5V;KACF;KACA,UAAU,SAAS,SAAS,gBAAgB;KAC5C,MAAM,OAAO,KAAK,OAAc;KAEhC,OAAO;IACT,CAAC,CACH;GACF,CAAC,CAAC,CAAC,KAAK,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC;EAChE,CAAC;CACH;AACF;AAEA,MAAa,8BAQX,UACA,QACA,kBAEA,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO;CACrB,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM;CAEhF,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAAW,gBAAgB,UAAU,aAAa;EAClD,aAAa,wBAAwB,KAAK,CAAC,CAAC;CAC9C,CAAC;CAED,MAAM,YAAY,yBAChB,yBACA,UACA,eACA,aACA,QACF;CAEA,OAAO,SAAS,SAAS,WAAW,OAAO,aAAa;AAC1D,CAAC;AAEH,MAAa,yBACX,UACA,QACA,eACA,SAMA,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO;CACrB,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM;CAEhF,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAAW,gBAAgB,UAAU,aAAa;EAClD,aAAa,wBAAwB,KAAK,CAAC,CAAC;CAC9C,CAAC;CAED,OAAO,OAAO,2BACZ,UACA,yBACA,eACA,OAAO,MACP,aACA,WACC,cAAc,SAAS,SAAS,WAAW,OAAO,aAAa,GAChE,IACF;AACF,CAAC;;AAOH,MAAa,mBAMX,kBACG;CAyEH,SAAS,2BAgBP,SACA,SAIA,MAQA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,sBACE,UACA,QAAQ,SACR,gBACC,aAAsC,aAAa;GAClD,MAAM,WAAW,QAAQ,KAAK,kBAAkB,SAAS,gBAAgB,CAAC,CAAC,KACzE,QAAQ,IAAI,gBAAgB,SAAS,cAAc,GACnD,QAAQ,IAAI,oBAAoB,SAAS,kBAAkB,CAC7D;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,OAAO;EACL,+BASE,UACA,YACG,2BAA2B,UAAiB,SAAS,aAAa;EACvE;CACF;AACF"}

package/dist/drizzle/proof-model.d.mts

@@ -0,0 +1,286 @@
+import { PersistenceMappingError } from "../internal/mapping-error.mjs";
+import { SubjectIdCodec } from "./model.mjs";
+import { Effect } from "effect";
+import { TokenDigest } from "@yielded/auth/Schema";
+import { ProofBinding, ProofContinuationId, ProofId, ProofPolicy, ProofPurpose, ProofRecord, ProofRequestReceipt, ProofVersion } from "@yielded/auth/Proofs";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/proof-model.d.ts
+type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+type ProofAction = "issue" | "attempt";
+type ProofScopeKind = "action" | "identifier" | "subject";
+type ProofGenerationState = "active" | "consumed" | "cancelled" | "superseded";
+type ProofDeliveryState = "new" | "claimed" | "accepted" | "failed" | "ambiguous";
+type ProofCommandKind = "attempt" | "complete";
+type ProofCommandDecision = "accepted" | "rejected" | "completed";
+interface ProofScopeKeys {
+  /** Stable across flow/context/request changes and bounded by the consumer codec. */
+  readonly series: string;
+  readonly identifier: string;
+  /** A tagged non-null value; use a stable sentinel when the binding has no subject. */
+  readonly subject: string;
+}
+interface ProofAuthorityInput<NativeSubjectId> {
+  readonly moduleId: string;
+  readonly purpose: ProofPurpose;
+  readonly binding: ProofBinding;
+  /** Resolved by Effect preplanning before an interactive check or D1 predicate compile. */
+  readonly nativeSubjectId?: NativeSubjectId;
+}
+interface ProofAuthorityTables<Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> {
+  readonly identifier: {
+    readonly table: Identifier;
+    readonly namespace: ColumnKey<Identifier>;
+    readonly value: ColumnKey<Identifier>;
+    /** Evaluate the consumer's explicit current-ownership/availability semantics. */
+    readonly isCurrent: (input: ProofAuthorityInput<NativeSubjectId>, rows: ReadonlyArray<InferSelectModel<Identifier>>) => boolean;
+    /** Optional outside D1. Never infer this semantic predicate from eligibility. */
+    readonly d1CurrentCondition?: (input: ProofAuthorityInput<NativeSubjectId>) => SQL;
+  };
+  readonly subject?: {
+    readonly table: Subject;
+    readonly id: ColumnKey<Subject>;
+    readonly status: ColumnKey<Subject>;
+    readonly securityRevision: ColumnKey<Subject>;
+    readonly isActiveStatus: (value: unknown) => boolean;
+    readonly d1ActiveStatusValue: unknown;
+  };
+  readonly credential?: {
+    readonly table: Credential;
+    readonly subjectId: ColumnKey<Credential>;
+    readonly credentialId: ColumnKey<Credential>;
+    readonly revision: ColumnKey<Credential>;
+    readonly status?: ColumnKey<Credential>;
+    readonly isActiveStatus?: (value: unknown) => boolean;
+    readonly d1ActiveStatusValue?: unknown;
+  };
+  readonly subjectId?: SubjectIdCodec<NativeSubjectId>;
+}
+interface ProofRequestTable<Request extends Table> {
+  readonly table: Request;
+  readonly moduleId: ColumnKey<Request>;
+  readonly requestId: ColumnKey<Request>;
+  readonly fingerprint: ColumnKey<Request>;
+  readonly proofId: ColumnKey<Request>;
+  readonly purpose: ColumnKey<Request>;
+  readonly keyId: ColumnKey<Request>;
+  readonly createdAt: ColumnKey<Request>;
+  readonly retentionUntil: ColumnKey<Request>;
+  readonly encodeInsert: (input: {
+    readonly record: ProofRecord;
+    readonly createdAtMillis: number;
+    readonly retentionUntilMillis: number;
+  }) => InferInsertModel<Request>;
+  readonly decodeReceipt: (row: InferSelectModel<Request>) => Effect.Effect<ProofRequestReceipt, PersistenceMappingError>;
+}
+interface ProofSeriesTable<Series extends Table> {
+  readonly table: Series;
+  readonly moduleId: ColumnKey<Series>;
+  readonly purpose: ColumnKey<Series>;
+  readonly scopeKey: ColumnKey<Series>;
+  readonly activeProofId: ColumnKey<Series>;
+  readonly lastIssueAt: ColumnKey<Series>;
+  readonly version: ColumnKey<Series>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly purpose: ProofPurpose;
+    readonly scopeKey: string;
+    readonly version: ProofVersion;
+  }) => InferInsertModel<Series>;
+}
+interface ProofGenerationTable<Generation extends Table> {
+  readonly table: Generation;
+  readonly moduleId: ColumnKey<Generation>;
+  readonly purpose: ColumnKey<Generation>;
+  readonly proofId: ColumnKey<Generation>;
+  readonly requestId: ColumnKey<Generation>;
+  readonly seriesKey: ColumnKey<Generation>;
+  readonly deliveryId: ColumnKey<Generation>;
+  readonly binding: ColumnKey<Generation>;
+  readonly verifierKeyId: ColumnKey<Generation>;
+  readonly verifierDigest: ColumnKey<Generation>;
+  readonly issuedAt: ColumnKey<Generation>;
+  readonly expiresAt: ColumnKey<Generation>;
+  readonly version: ColumnKey<Generation>;
+  readonly state: ColumnKey<Generation>;
+  readonly sendCount: ColumnKey<Generation>;
+  readonly deliveryState: ColumnKey<Generation>;
+  readonly claimVersion: ColumnKey<Generation>;
+  readonly claimDeadline: ColumnKey<Generation>;
+  readonly retryAt: ColumnKey<Generation>;
+  readonly deliveryRetryMillis: ColumnKey<Generation>;
+  readonly retentionUntil: ColumnKey<Generation>;
+  readonly encodeInsert: (input: {
+    readonly record: ProofRecord;
+    readonly seriesKey: string;
+    readonly retentionUntilMillis: number;
+    readonly state: ProofGenerationState;
+    readonly deliveryState: ProofDeliveryState;
+    readonly policy: ProofPolicy;
+  }) => InferInsertModel<Generation>;
+  readonly decodeRecord: (row: InferSelectModel<Generation>) => Effect.Effect<ProofRecord, PersistenceMappingError>;
+  readonly decodeBinding: (row: InferSelectModel<Generation>) => Effect.Effect<ProofBinding, PersistenceMappingError>;
+}
+interface ProofContinuationRecord {
+  readonly moduleId: string;
+  readonly purpose: ProofPurpose;
+  readonly continuationId: ProofContinuationId;
+  readonly digest: TokenDigest;
+  readonly proofId: ProofId;
+  readonly seriesKey: string;
+  readonly binding: ProofBinding;
+  readonly expiresAtMillis: number;
+  readonly version: ProofVersion;
+}
+interface ProofContinuationTable<Continuation extends Table> {
+  readonly table: Continuation;
+  readonly moduleId: ColumnKey<Continuation>;
+  readonly purpose: ColumnKey<Continuation>;
+  readonly continuationId: ColumnKey<Continuation>;
+  readonly digest: ColumnKey<Continuation>;
+  readonly proofId: ColumnKey<Continuation>;
+  readonly seriesKey: ColumnKey<Continuation>;
+  readonly binding: ColumnKey<Continuation>;
+  readonly expiresAt: ColumnKey<Continuation>;
+  readonly consumed: ColumnKey<Continuation>;
+  readonly version: ColumnKey<Continuation>;
+  readonly retentionUntil: ColumnKey<Continuation>;
+  readonly encodeInsert: (record: ProofContinuationRecord & {
+    readonly retentionUntilMillis: number;
+  }) => InferInsertModel<Continuation>;
+  readonly decode: (row: InferSelectModel<Continuation>) => Effect.Effect<ProofContinuationRecord, PersistenceMappingError>;
+}
+interface ProofRateScopeTable<RateScope extends Table> {
+  readonly table: RateScope;
+  readonly moduleId: ColumnKey<RateScope>;
+  readonly purpose: ColumnKey<RateScope>;
+  readonly action: ColumnKey<RateScope>;
+  readonly scopeKind: ColumnKey<RateScope>;
+  readonly scopeKey: ColumnKey<RateScope>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly purpose: ProofPurpose;
+    readonly action: ProofAction;
+    readonly scopeKind: ProofScopeKind;
+    readonly scopeKey: string;
+  }) => InferInsertModel<RateScope>;
+}
+interface ProofAbuseEventTable<AbuseEvent extends Table> {
+  readonly table: AbuseEvent;
+  readonly moduleId: ColumnKey<AbuseEvent>;
+  readonly purpose: ColumnKey<AbuseEvent>;
+  readonly action: ColumnKey<AbuseEvent>;
+  readonly scopeKind: ColumnKey<AbuseEvent>;
+  readonly scopeKey: ColumnKey<AbuseEvent>;
+  readonly commandId: ColumnKey<AbuseEvent>;
+  readonly occurredAt: ColumnKey<AbuseEvent>;
+  readonly retentionUntil: ColumnKey<AbuseEvent>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly purpose: ProofPurpose;
+    readonly action: ProofAction;
+    readonly scopeKind: ProofScopeKind;
+    readonly scopeKey: string;
+    readonly commandId: string;
+    readonly occurredAtMillis: number;
+    readonly retentionUntilMillis: number;
+  }) => InferInsertModel<AbuseEvent>;
+}
+interface ProofFailureEventTable<FailureEvent extends Table> {
+  readonly table: FailureEvent;
+  readonly moduleId: ColumnKey<FailureEvent>;
+  readonly purpose: ColumnKey<FailureEvent>;
+  readonly seriesKey: ColumnKey<FailureEvent>;
+  readonly commandId: ColumnKey<FailureEvent>;
+  readonly occurredAt: ColumnKey<FailureEvent>;
+  readonly retentionUntil: ColumnKey<FailureEvent>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly purpose: ProofPurpose;
+    readonly seriesKey: string;
+    readonly commandId: string;
+    readonly occurredAtMillis: number;
+    readonly retentionUntilMillis: number;
+  }) => InferInsertModel<FailureEvent>;
+}
+interface ProofCommandTable<Command extends Table> {
+  readonly table: Command;
+  readonly moduleId: ColumnKey<Command>;
+  readonly commandId: ColumnKey<Command>;
+  readonly kind: ColumnKey<Command>;
+  readonly decision: ColumnKey<Command>;
+  readonly retentionUntil: ColumnKey<Command>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly commandId: string;
+    readonly kind: ProofCommandKind;
+    readonly decision: ProofCommandDecision;
+    readonly retentionUntilMillis: number;
+  }) => InferInsertModel<Command>;
+}
+interface RequiredProofConstraints {
+  readonly request: "unique(request.moduleId,request.requestId)";
+  readonly series: "unique(series.moduleId,series.purpose,series.scopeKey)";
+  readonly proof: "unique(generation.moduleId,generation.proofId)";
+  readonly delivery: "unique(generation.moduleId,generation.deliveryId)";
+  readonly continuationId: "unique(continuation.moduleId,continuation.continuationId)";
+  readonly continuationDigest: "unique(continuation.moduleId,continuation.digest)";
+  readonly rateScope: "unique(rateScope.moduleId,rateScope.purpose,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)";
+  readonly abuseEvent: "unique(abuseEvent.moduleId,abuseEvent.action,abuseEvent.scopeKind,abuseEvent.scopeKey,abuseEvent.commandId)";
+  readonly failureEvent: "unique(failureEvent.moduleId,failureEvent.seriesKey,failureEvent.commandId)";
+  readonly command: "unique(command.moduleId,command.commandId)";
+}
+declare const requiredProofConstraints: RequiredProofConstraints;
+interface ProofConstraintClassifier {
+  /** Match only the declared request uniqueness constraint, including wrapped driver errors. */
+  readonly isRequestConflict: (cause: unknown) => boolean;
+  /** Match only the declared series uniqueness constraint, including wrapped driver errors. */
+  readonly isSeriesConflict: (cause: unknown) => boolean;
+  /** Match only the declared command uniqueness constraint, including wrapped driver errors. */
+  readonly isCommandConflict: (cause: unknown) => boolean;
+}
+interface ProofD1Clock {
+  /** Native instant expression evaluated by SQLite inside the submitted batch. */
+  readonly engineNow: SQL;
+  /** Integer Unix milliseconds expression evaluated inside the submitted batch. */
+  readonly engineNowMillis: SQL;
+  /** Native instant expression for an engine-time rolling-window cutoff. */
+  readonly engineInstantMinus: (millis: number) => SQL;
+  /** Native instant expression for a retention/lease deadline from engine time. */
+  readonly engineInstantPlus: (millis: number) => SQL;
+}
+interface ProofPersistenceMapping<Request extends Table, Series extends Table, Generation extends Table, Continuation extends Table, RateScope extends Table, AbuseEvent extends Table, FailureEvent extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> extends ProofConstraintClassifier {
+  readonly request: ProofRequestTable<Request>;
+  readonly series: ProofSeriesTable<Series>;
+  readonly generation: ProofGenerationTable<Generation>;
+  readonly continuation: ProofContinuationTable<Continuation>;
+  readonly rateScope: ProofRateScopeTable<RateScope>;
+  readonly abuseEvent: ProofAbuseEventTable<AbuseEvent>;
+  readonly failureEvent: ProofFailureEventTable<FailureEvent>;
+  readonly command: ProofCommandTable<Command>;
+  readonly authority: ProofAuthorityTables<Subject, Identifier, Credential, NativeSubjectId>;
+  readonly constraints: RequiredProofConstraints;
+  readonly scopeKeys: (input: {
+    readonly moduleId: string;
+    readonly purpose: ProofPurpose;
+    readonly binding: ProofBinding;
+  }) => ProofScopeKeys;
+  readonly encodeInstant: (epochMillis: number) => unknown;
+  readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;
+  readonly allocateVersion?: Effect.Effect<ProofVersion, PersistenceMappingError>;
+  readonly allocateVersionSync?: () => ProofVersion;
+  /** Required by D1 mappings and ignored by interactive targets. */
+  readonly d1?: ProofD1Clock;
+}
+type D1ProofPersistenceMapping<Request extends Table, Series extends Table, Generation extends Table, Continuation extends Table, RateScope extends Table, AbuseEvent extends Table, FailureEvent extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = ProofPersistenceMapping<Request, Series, Generation, Continuation, RateScope, AbuseEvent, FailureEvent, Command, Subject, Identifier, Credential, NativeSubjectId> & {
+  readonly d1: ProofD1Clock;
+  readonly authority: ProofAuthorityTables<Subject, Identifier, Credential, NativeSubjectId> & {
+    readonly identifier: ProofAuthorityTables<Subject, Identifier, Credential, NativeSubjectId>["identifier"] & {
+      /** Synchronous SQL compiler; Effect-based ID conversion has already completed. */
+      readonly d1CurrentCondition: (input: ProofAuthorityInput<NativeSubjectId>) => SQL;
+    };
+  };
+};
+type AnyProofPersistenceMapping = ProofPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
+//#endregion
+export { AnyProofPersistenceMapping, D1ProofPersistenceMapping, ProofAbuseEventTable, ProofAction, ProofAuthorityInput, ProofAuthorityTables, ProofCommandDecision, ProofCommandKind, ProofCommandTable, ProofConstraintClassifier, ProofContinuationRecord, ProofContinuationTable, ProofD1Clock, ProofDeliveryState, ProofFailureEventTable, ProofGenerationState, ProofGenerationTable, ProofPersistenceMapping, ProofRateScopeTable, ProofRequestTable, ProofScopeKeys, ProofScopeKind, ProofSeriesTable, RequiredProofConstraints, requiredProofConstraints };
+//# sourceMappingURL=proof-model.d.mts.map

package/dist/drizzle/proof-model.mjs

@@ -0,0 +1,17 @@
+//#region src/drizzle/proof-model.ts
+const requiredProofConstraints = {
+	request: "unique(request.moduleId,request.requestId)",
+	series: "unique(series.moduleId,series.purpose,series.scopeKey)",
+	proof: "unique(generation.moduleId,generation.proofId)",
+	delivery: "unique(generation.moduleId,generation.deliveryId)",
+	continuationId: "unique(continuation.moduleId,continuation.continuationId)",
+	continuationDigest: "unique(continuation.moduleId,continuation.digest)",
+	rateScope: "unique(rateScope.moduleId,rateScope.purpose,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)",
+	abuseEvent: "unique(abuseEvent.moduleId,abuseEvent.action,abuseEvent.scopeKind,abuseEvent.scopeKey,abuseEvent.commandId)",
+	failureEvent: "unique(failureEvent.moduleId,failureEvent.seriesKey,failureEvent.commandId)",
+	command: "unique(command.moduleId,command.commandId)"
+};
+//#endregion
+export { requiredProofConstraints };
+
+//# sourceMappingURL=proof-model.mjs.map

package/dist/drizzle/proof-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-model.mjs","names":[],"sources":["../../src/drizzle/proof-model.ts"],"sourcesContent":["import type {\n  ProofBinding,\n  ProofContinuationId,\n  ProofId,\n  ProofPurpose,\n  ProofRequestReceipt,\n  ProofVersion,\n  ProofPolicy,\n  ProofRecord,\n} from \"@yielded/auth/Proofs\";\nimport type { TokenDigest } from \"@yielded/auth/Schema\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { Effect } from \"effect\";\n\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./model\";\n\ntype ColumnKey<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\n\nexport type ProofAction = \"issue\" | \"attempt\";\nexport type ProofScopeKind = \"action\" | \"identifier\" | \"subject\";\nexport type ProofGenerationState = \"active\" | \"consumed\" | \"cancelled\" | \"superseded\";\nexport type ProofDeliveryState = \"new\" | \"claimed\" | \"accepted\" | \"failed\" | \"ambiguous\";\nexport type ProofCommandKind = \"attempt\" | \"complete\";\nexport type ProofCommandDecision = \"accepted\" | \"rejected\" | \"completed\";\n\nexport interface ProofScopeKeys {\n  /** Stable across flow/context/request changes and bounded by the consumer codec. */\n  readonly series: string;\n  readonly identifier: string;\n  /** A tagged non-null value; use a stable sentinel when the binding has no subject. */\n  readonly subject: string;\n}\n\nexport interface ProofAuthorityInput<NativeSubjectId> {\n  readonly moduleId: string;\n  readonly purpose: ProofPurpose;\n  readonly binding: ProofBinding;\n  /** Resolved by Effect preplanning before an interactive check or D1 predicate compile. */\n  readonly nativeSubjectId?: NativeSubjectId;\n}\n\nexport interface ProofAuthorityTables<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> {\n  readonly identifier: {\n    readonly table: Identifier;\n    readonly namespace: ColumnKey<Identifier>;\n    readonly value: ColumnKey<Identifier>;\n    /** Evaluate the consumer's explicit current-ownership/availability semantics. */\n    readonly isCurrent: (\n      input: ProofAuthorityInput<NativeSubjectId>,\n      rows: ReadonlyArray<InferSelectModel<Identifier>>,\n    ) => boolean;\n    /** Optional outside D1. Never infer this semantic predicate from eligibility. */\n    readonly d1CurrentCondition?: (input: ProofAuthorityInput<NativeSubjectId>) => SQL;\n  };\n  readonly subject?: {\n    readonly table: Subject;\n    readonly id: ColumnKey<Subject>;\n    readonly status: ColumnKey<Subject>;\n    readonly securityRevision: ColumnKey<Subject>;\n    readonly isActiveStatus: (value: unknown) => boolean;\n    readonly d1ActiveStatusValue: unknown;\n  };\n  readonly credential?: {\n    readonly table: Credential;\n    readonly subjectId: ColumnKey<Credential>;\n    readonly credentialId: ColumnKey<Credential>;\n    readonly revision: ColumnKey<Credential>;\n    readonly status?: ColumnKey<Credential>;\n    readonly isActiveStatus?: (value: unknown) => boolean;\n    readonly d1ActiveStatusValue?: unknown;\n  };\n  readonly subjectId?: SubjectIdCodec<NativeSubjectId>;\n}\n\nexport interface ProofRequestTable<Request extends Table> {\n  readonly table: Request;\n  readonly moduleId: ColumnKey<Request>;\n  readonly requestId: ColumnKey<Request>;\n  readonly fingerprint: ColumnKey<Request>;\n  readonly proofId: ColumnKey<Request>;\n  readonly purpose: ColumnKey<Request>;\n  readonly keyId: ColumnKey<Request>;\n  readonly createdAt: ColumnKey<Request>;\n  readonly retentionUntil: ColumnKey<Request>;\n  readonly encodeInsert: (input: {\n    readonly record: ProofRecord;\n    readonly createdAtMillis: number;\n    readonly retentionUntilMillis: number;\n  }) => InferInsertModel<Request>;\n  readonly decodeReceipt: (\n    row: InferSelectModel<Request>,\n  ) => Effect.Effect<ProofRequestReceipt, PersistenceMappingError>;\n}\n\nexport interface ProofSeriesTable<Series extends Table> {\n  readonly table: Series;\n  readonly moduleId: ColumnKey<Series>;\n  readonly purpose: ColumnKey<Series>;\n  readonly scopeKey: ColumnKey<Series>;\n  readonly activeProofId: ColumnKey<Series>;\n  readonly lastIssueAt: ColumnKey<Series>;\n  readonly version: ColumnKey<Series>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly purpose: ProofPurpose;\n    readonly scopeKey: string;\n    readonly version: ProofVersion;\n  }) => InferInsertModel<Series>;\n}\n\nexport interface ProofGenerationTable<Generation extends Table> {\n  readonly table: Generation;\n  readonly moduleId: ColumnKey<Generation>;\n  readonly purpose: ColumnKey<Generation>;\n  readonly proofId: ColumnKey<Generation>;\n  readonly requestId: ColumnKey<Generation>;\n  readonly seriesKey: ColumnKey<Generation>;\n  readonly deliveryId: ColumnKey<Generation>;\n  readonly binding: ColumnKey<Generation>;\n  readonly verifierKeyId: ColumnKey<Generation>;\n  readonly verifierDigest: ColumnKey<Generation>;\n  readonly issuedAt: ColumnKey<Generation>;\n  readonly expiresAt: ColumnKey<Generation>;\n  readonly version: ColumnKey<Generation>;\n  readonly state: ColumnKey<Generation>;\n  readonly sendCount: ColumnKey<Generation>;\n  readonly deliveryState: ColumnKey<Generation>;\n  readonly claimVersion: ColumnKey<Generation>;\n  readonly claimDeadline: ColumnKey<Generation>;\n  readonly retryAt: ColumnKey<Generation>;\n  readonly deliveryRetryMillis: ColumnKey<Generation>;\n  readonly retentionUntil: ColumnKey<Generation>;\n  readonly encodeInsert: (input: {\n    readonly record: ProofRecord;\n    readonly seriesKey: string;\n    readonly retentionUntilMillis: number;\n    readonly state: ProofGenerationState;\n    readonly deliveryState: ProofDeliveryState;\n    readonly policy: ProofPolicy;\n  }) => InferInsertModel<Generation>;\n  readonly decodeRecord: (\n    row: InferSelectModel<Generation>,\n  ) => Effect.Effect<ProofRecord, PersistenceMappingError>;\n  readonly decodeBinding: (\n    row: InferSelectModel<Generation>,\n  ) => Effect.Effect<ProofBinding, PersistenceMappingError>;\n}\n\nexport interface ProofContinuationRecord {\n  readonly moduleId: string;\n  readonly purpose: ProofPurpose;\n  readonly continuationId: ProofContinuationId;\n  readonly digest: TokenDigest;\n  readonly proofId: ProofId;\n  readonly seriesKey: string;\n  readonly binding: ProofBinding;\n  readonly expiresAtMillis: number;\n  readonly version: ProofVersion;\n}\n\nexport interface ProofContinuationTable<Continuation extends Table> {\n  readonly table: Continuation;\n  readonly moduleId: ColumnKey<Continuation>;\n  readonly purpose: ColumnKey<Continuation>;\n  readonly continuationId: ColumnKey<Continuation>;\n  readonly digest: ColumnKey<Continuation>;\n  readonly proofId: ColumnKey<Continuation>;\n  readonly seriesKey: ColumnKey<Continuation>;\n  readonly binding: ColumnKey<Continuation>;\n  readonly expiresAt: ColumnKey<Continuation>;\n  readonly consumed: ColumnKey<Continuation>;\n  readonly version: ColumnKey<Continuation>;\n  readonly retentionUntil: ColumnKey<Continuation>;\n  readonly encodeInsert: (\n    record: ProofContinuationRecord & { readonly retentionUntilMillis: number },\n  ) => InferInsertModel<Continuation>;\n  readonly decode: (\n    row: InferSelectModel<Continuation>,\n  ) => Effect.Effect<ProofContinuationRecord, PersistenceMappingError>;\n}\n\nexport interface ProofRateScopeTable<RateScope extends Table> {\n  readonly table: RateScope;\n  readonly moduleId: ColumnKey<RateScope>;\n  readonly purpose: ColumnKey<RateScope>;\n  readonly action: ColumnKey<RateScope>;\n  readonly scopeKind: ColumnKey<RateScope>;\n  readonly scopeKey: ColumnKey<RateScope>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly purpose: ProofPurpose;\n    readonly action: ProofAction;\n    readonly scopeKind: ProofScopeKind;\n    readonly scopeKey: string;\n  }) => InferInsertModel<RateScope>;\n}\n\nexport interface ProofAbuseEventTable<AbuseEvent extends Table> {\n  readonly table: AbuseEvent;\n  readonly moduleId: ColumnKey<AbuseEvent>;\n  readonly purpose: ColumnKey<AbuseEvent>;\n  readonly action: ColumnKey<AbuseEvent>;\n  readonly scopeKind: ColumnKey<AbuseEvent>;\n  readonly scopeKey: ColumnKey<AbuseEvent>;\n  readonly commandId: ColumnKey<AbuseEvent>;\n  readonly occurredAt: ColumnKey<AbuseEvent>;\n  readonly retentionUntil: ColumnKey<AbuseEvent>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly purpose: ProofPurpose;\n    readonly action: ProofAction;\n    readonly scopeKind: ProofScopeKind;\n    readonly scopeKey: string;\n    readonly commandId: string;\n    readonly occurredAtMillis: number;\n    readonly retentionUntilMillis: number;\n  }) => InferInsertModel<AbuseEvent>;\n}\n\nexport interface ProofFailureEventTable<FailureEvent extends Table> {\n  readonly table: FailureEvent;\n  readonly moduleId: ColumnKey<FailureEvent>;\n  readonly purpose: ColumnKey<FailureEvent>;\n  readonly seriesKey: ColumnKey<FailureEvent>;\n  readonly commandId: ColumnKey<FailureEvent>;\n  readonly occurredAt: ColumnKey<FailureEvent>;\n  readonly retentionUntil: ColumnKey<FailureEvent>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly purpose: ProofPurpose;\n    readonly seriesKey: string;\n    readonly commandId: string;\n    readonly occurredAtMillis: number;\n    readonly retentionUntilMillis: number;\n  }) => InferInsertModel<FailureEvent>;\n}\n\nexport interface ProofCommandTable<Command extends Table> {\n  readonly table: Command;\n  readonly moduleId: ColumnKey<Command>;\n  readonly commandId: ColumnKey<Command>;\n  readonly kind: ColumnKey<Command>;\n  readonly decision: ColumnKey<Command>;\n  readonly retentionUntil: ColumnKey<Command>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly kind: ProofCommandKind;\n    readonly decision: ProofCommandDecision;\n    readonly retentionUntilMillis: number;\n  }) => InferInsertModel<Command>;\n}\n\nexport interface RequiredProofConstraints {\n  readonly request: \"unique(request.moduleId,request.requestId)\";\n  readonly series: \"unique(series.moduleId,series.purpose,series.scopeKey)\";\n  readonly proof: \"unique(generation.moduleId,generation.proofId)\";\n  readonly delivery: \"unique(generation.moduleId,generation.deliveryId)\";\n  readonly continuationId: \"unique(continuation.moduleId,continuation.continuationId)\";\n  readonly continuationDigest: \"unique(continuation.moduleId,continuation.digest)\";\n  readonly rateScope: \"unique(rateScope.moduleId,rateScope.purpose,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)\";\n  readonly abuseEvent: \"unique(abuseEvent.moduleId,abuseEvent.action,abuseEvent.scopeKind,abuseEvent.scopeKey,abuseEvent.commandId)\";\n  readonly failureEvent: \"unique(failureEvent.moduleId,failureEvent.seriesKey,failureEvent.commandId)\";\n  readonly command: \"unique(command.moduleId,command.commandId)\";\n}\n\nexport const requiredProofConstraints: RequiredProofConstraints = {\n  request: \"unique(request.moduleId,request.requestId)\",\n  series: \"unique(series.moduleId,series.purpose,series.scopeKey)\",\n  proof: \"unique(generation.moduleId,generation.proofId)\",\n  delivery: \"unique(generation.moduleId,generation.deliveryId)\",\n  continuationId: \"unique(continuation.moduleId,continuation.continuationId)\",\n  continuationDigest: \"unique(continuation.moduleId,continuation.digest)\",\n  rateScope:\n    \"unique(rateScope.moduleId,rateScope.purpose,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)\",\n  abuseEvent:\n    \"unique(abuseEvent.moduleId,abuseEvent.action,abuseEvent.scopeKind,abuseEvent.scopeKey,abuseEvent.commandId)\",\n  failureEvent: \"unique(failureEvent.moduleId,failureEvent.seriesKey,failureEvent.commandId)\",\n  command: \"unique(command.moduleId,command.commandId)\",\n};\n\nexport interface ProofConstraintClassifier {\n  /** Match only the declared request uniqueness constraint, including wrapped driver errors. */\n  readonly isRequestConflict: (cause: unknown) => boolean;\n  /** Match only the declared series uniqueness constraint, including wrapped driver errors. */\n  readonly isSeriesConflict: (cause: unknown) => boolean;\n  /** Match only the declared command uniqueness constraint, including wrapped driver errors. */\n  readonly isCommandConflict: (cause: unknown) => boolean;\n}\n\nexport interface ProofD1Clock {\n  /** Native instant expression evaluated by SQLite inside the submitted batch. */\n  readonly engineNow: SQL;\n  /** Integer Unix milliseconds expression evaluated inside the submitted batch. */\n  readonly engineNowMillis: SQL;\n  /** Native instant expression for an engine-time rolling-window cutoff. */\n  readonly engineInstantMinus: (millis: number) => SQL;\n  /** Native instant expression for a retention/lease deadline from engine time. */\n  readonly engineInstantPlus: (millis: number) => SQL;\n}\n\nexport interface ProofPersistenceMapping<\n  Request extends Table,\n  Series extends Table,\n  Generation extends Table,\n  Continuation extends Table,\n  RateScope extends Table,\n  AbuseEvent extends Table,\n  FailureEvent extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> extends ProofConstraintClassifier {\n  readonly request: ProofRequestTable<Request>;\n  readonly series: ProofSeriesTable<Series>;\n  readonly generation: ProofGenerationTable<Generation>;\n  readonly continuation: ProofContinuationTable<Continuation>;\n  readonly rateScope: ProofRateScopeTable<RateScope>;\n  readonly abuseEvent: ProofAbuseEventTable<AbuseEvent>;\n  readonly failureEvent: ProofFailureEventTable<FailureEvent>;\n  readonly command: ProofCommandTable<Command>;\n  readonly authority: ProofAuthorityTables<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly constraints: RequiredProofConstraints;\n  readonly scopeKeys: (input: {\n    readonly moduleId: string;\n    readonly purpose: ProofPurpose;\n    readonly binding: ProofBinding;\n  }) => ProofScopeKeys;\n  readonly encodeInstant: (epochMillis: number) => unknown;\n  readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly allocateVersion?: Effect.Effect<ProofVersion, PersistenceMappingError>;\n  readonly allocateVersionSync?: () => ProofVersion;\n  /** Required by D1 mappings and ignored by interactive targets. */\n  readonly d1?: ProofD1Clock;\n}\n\nexport type D1ProofPersistenceMapping<\n  Request extends Table,\n  Series extends Table,\n  Generation extends Table,\n  Continuation extends Table,\n  RateScope extends Table,\n  AbuseEvent extends Table,\n  FailureEvent extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = ProofPersistenceMapping<\n  Request,\n  Series,\n  Generation,\n  Continuation,\n  RateScope,\n  AbuseEvent,\n  FailureEvent,\n  Command,\n  Subject,\n  Identifier,\n  Credential,\n  NativeSubjectId\n> & {\n  readonly d1: ProofD1Clock;\n  readonly authority: ProofAuthorityTables<Subject, Identifier, Credential, NativeSubjectId> & {\n    readonly identifier: ProofAuthorityTables<\n      Subject,\n      Identifier,\n      Credential,\n      NativeSubjectId\n    >[\"identifier\"] & {\n      /** Synchronous SQL compiler; Effect-based ID conversion has already completed. */\n      readonly d1CurrentCondition: (input: ProofAuthorityInput<NativeSubjectId>) => SQL;\n    };\n  };\n};\n\nexport type AnyProofPersistenceMapping = ProofPersistenceMapping<\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\n"],"mappings":";AA+QA,MAAa,2BAAqD;CAChE,SAAS;CACT,QAAQ;CACR,OAAO;CACP,UAAU;CACV,gBAAgB;CAChB,oBAAoB;CACpB,WACE;CACF,YACE;CACF,cAAc;CACd,SAAS;AACX"}

package/dist/drizzle/proof-sql.d.mts

@@ -0,0 +1,4 @@
+import "./model.mjs";
+import "./proof-model.mjs";
+import "../internal/proof-kernel.mjs";
+import "./proof-sql.mjs";

package/dist/drizzle/proof-sql.mjs

@@ -0,0 +1,8 @@
+import { CurrentProofSql, makeProofKernel } from "../internal/proof-kernel.mjs";
+import { drizzleQueryOperations } from "./query-operations.mjs";
+//#region src/drizzle/proof-sql.ts
+const { makeSqlProofPersistence, checkProofCompletionIn, completeProofPlanIn } = makeProofKernel(drizzleQueryOperations);
+//#endregion
+export { CurrentProofSql, checkProofCompletionIn, completeProofPlanIn, makeSqlProofPersistence };
+
+//# sourceMappingURL=proof-sql.mjs.map

package/dist/drizzle/proof-sql.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-sql.mjs","names":[],"sources":["../../src/drizzle/proof-sql.ts"],"sourcesContent":["import { makeProofKernel } from \"../internal/proof-kernel\";\nimport { drizzleQueryOperations } from \"./query-operations\";\nexport type { ProofSqlQuery } from \"../internal/proof-kernel\";\nexport type { ProofSqlDatabase } from \"../internal/proof-kernel\";\nexport { CurrentProofSql } from \"../internal/proof-kernel\";\nexport type { ProofSqlConfiguration } from \"../internal/proof-kernel\";\n\nexport const { makeSqlProofPersistence, checkProofCompletionIn, completeProofPlanIn } =\n  makeProofKernel(drizzleQueryOperations);\n"],"mappings":";;;AAOA,MAAa,EAAE,yBAAyB,wBAAwB,wBAC9D,gBAAgB,sBAAsB"}

package/dist/drizzle/proof-target.d.mts

@@ -0,0 +1,12 @@
+import "./proof-sql.mjs";
+import { Effect, Layer } from "effect";
+import { HookConfigurationError, LifecycleHooks } from "@yielded/auth/Hooks";
+import { ProofPersistence, ProofUnavailable } from "@yielded/auth/Proofs";
+import "effect/unstable/sql/SqlError";
+//#region src/drizzle/proof-target.d.ts
+declare const proofPersistenceLayer: (services: Effect.Effect<{
+  readonly proofPersistence: ProofPersistence["Service"];
+}, never, LifecycleHooks>) => Layer.Layer<ProofPersistence, never, LifecycleHooks>;
+//#endregion
+export { proofPersistenceLayer };
+//# sourceMappingURL=proof-target.d.mts.map

package/dist/drizzle/proof-target.mjs

@@ -0,0 +1,36 @@
+import { sqlClientStandaloneGuard } from "./standalone-guard.mjs";
+import { makeSqlProofPersistence } from "./proof-sql.mjs";
+import { Effect, Layer } from "effect";
+import { LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
+import { ProofPersistence, ProofUnavailable } from "@yielded/auth/Proofs";
+//#region src/drizzle/proof-target.ts
+const sqlClientProofStandaloneGuard = (database) => sqlClientStandaloneGuard(database, () => ProofUnavailable.make({}));
+const options = (configuration, coordinated = false) => ({
+	mode: configuration.mode,
+	locking: configuration.locking,
+	standaloneGuard: !coordinated ? configuration.standaloneGuard : Effect.void,
+	insertIfAbsent: configuration.insertIfAbsent,
+	coordinated
+});
+const makeTargetProofPersistenceServices = (database, mapping, configuration) => Effect.gen(function* () {
+	return { proofPersistence: yield* makeSqlProofPersistence(database, mapping, options(configuration)) };
+});
+/**
+* The native transaction is the root commit owner. Interruption or owner failure
+* rolls it back and discards the journal. No owner effect is retried. Native
+* transaction-acquisition `SqlError`s are exposed; caller errors, including
+* Drizzle query wrappers, propagate unchanged.
+*/
+const coordinateTargetProofPersistence = (database, mapping, configuration, owner) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	if (yield* hasCommitScope) return yield* ProofUnavailable.make({});
+	yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
+	return (yield* coordinateCommit(() => database.transaction((transaction) => Effect.gen(function* () {
+		return yield* owner(transaction, { proofPersistence: yield* makeSqlProofPersistence(transaction, mapping, options(configuration, true)) });
+	})), { mode: configuration.mode }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
+});
+const proofPersistenceLayer = (services) => Layer.effect(ProofPersistence, Effect.map(services, (value) => value.proofPersistence));
+//#endregion
+export { coordinateTargetProofPersistence, makeTargetProofPersistenceServices, proofPersistenceLayer, sqlClientProofStandaloneGuard };
+
+//# sourceMappingURL=proof-target.mjs.map