@yielded/auth-persistence 0.1.0-beta.7

package/dist/drizzle/proof-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-target.mjs","names":[],"sources":["../../src/drizzle/proof-target.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  hasCommitScope,\n  LifecycleHooks,\n  type HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport { ProofUnavailable, ProofPersistence } from \"@yielded/auth/Proofs\";\n/* oxlint-disable no-explicit-any -- public driver entrypoints restore concrete Drizzle types. */\nimport { Effect, Layer } from \"effect\";\nimport type * as SqlError from \"effect/unstable/sql/SqlError\";\n\nimport {\n  makeSqlProofPersistence,\n  type ProofSqlConfiguration,\n  type ProofSqlDatabase,\n  type ProofSqlQuery,\n} from \"./proof-sql\";\nimport { sqlClientStandaloneGuard } from \"./standalone-guard\";\n\nexport interface ProofTargetConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, ProofUnavailable>;\n  readonly coordinatorGuard?: Effect.Effect<void, ProofUnavailable>;\n  readonly insertIfAbsent: (\n    query: ProofSqlQuery,\n    selfKey: string,\n    selfValue: unknown,\n  ) => ProofSqlQuery;\n}\n\ninterface TransactionOwner<Transaction> {\n  readonly transaction: <A, E, R>(\n    body: (transaction: Transaction) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\nexport type ProofCoordinatorError<E> =\n  | E\n  | ProofUnavailable\n  | HookConfigurationError\n  | SqlError.SqlError;\n\nexport const sqlClientProofStandaloneGuard = (\n  database: unknown,\n): Effect.Effect<void, ProofUnavailable> =>\n  sqlClientStandaloneGuard(database, () => ProofUnavailable.make({}));\n\nconst options = (\n  configuration: ProofTargetConfiguration,\n  coordinated = false,\n): ProofSqlConfiguration => ({\n  mode: configuration.mode,\n  locking: configuration.locking,\n\n  standaloneGuard: !coordinated ? configuration.standaloneGuard : Effect.void,\n  insertIfAbsent: configuration.insertIfAbsent,\n  coordinated,\n});\n\nexport const makeTargetProofPersistenceServices = (\n  database: any,\n  mapping: any,\n  configuration: ProofTargetConfiguration,\n) =>\n  Effect.gen(function* () {\n    return {\n      proofPersistence: yield* makeSqlProofPersistence(database, mapping, options(configuration)),\n    };\n  });\n\n/**\n * The native transaction is the root commit owner. Interruption or owner failure\n * rolls it back and discards the journal. No owner effect is retried. Native\n * transaction-acquisition `SqlError`s are exposed; caller errors, including\n * Drizzle query wrappers, propagate unchanged.\n */\nexport const coordinateTargetProofPersistence = <Transaction, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  mapping: any,\n  configuration: ProofTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly proofPersistence: ProofPersistence[\"Service\"] },\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, ProofCoordinatorError<E>, R | LifecycleHooks> =>\n  Effect.gen(function* (): Effect.fn.Return<A, ProofCoordinatorError<E>, R | LifecycleHooks> {\n    const hooks = yield* LifecycleHooks;\n\n    if (yield* hasCommitScope) return yield* ProofUnavailable.make({});\n    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;\n\n    const result = yield* coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          Effect.gen(function* () {\n            return yield* owner(transaction, {\n              proofPersistence: yield* makeSqlProofPersistence(\n                transaction as unknown as ProofSqlDatabase,\n                mapping,\n                options(configuration, true),\n              ),\n            });\n          }),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.provideService(LifecycleHooks, hooks));\n\n    return result.value;\n  });\n\nexport const proofPersistenceLayer = (\n  services: Effect.Effect<\n    { readonly proofPersistence: ProofPersistence[\"Service\"] },\n    never,\n    LifecycleHooks\n  >,\n) =>\n  Layer.effect(\n    ProofPersistence,\n    Effect.map(services, (value) => value.proofPersistence),\n  );\n"],"mappings":";;;;;;AA2CA,MAAa,iCACX,aAEA,yBAAyB,gBAAgB,iBAAiB,KAAK,CAAC,CAAC,CAAC;AAEpE,MAAM,WACJ,eACA,cAAc,WACa;CAC3B,MAAM,cAAc;CACpB,SAAS,cAAc;CAEvB,iBAAiB,CAAC,cAAc,cAAc,kBAAkB,OAAO;CACvE,gBAAgB,cAAc;CAC9B;AACF;AAEA,MAAa,sCACX,UACA,SACA,kBAEA,OAAO,IAAI,aAAa;CACtB,OAAO,EACL,kBAAkB,OAAO,wBAAwB,UAAU,SAAS,QAAQ,aAAa,CAAC,EAC5F;AACF,CAAC;;;;;;;AAQH,MAAa,oCACX,UACA,SACA,eACA,UAKA,OAAO,IAAI,aAAgF;CACzF,MAAM,QAAQ,OAAO;CAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;CACjE,OAAO,cAAc,oBAAoB,cAAc;CAkBvD,QAAO,OAhBe,uBAElB,SAAS,aAAa,gBACpB,OAAO,IAAI,aAAa;EACtB,OAAO,OAAO,MAAM,aAAa,EAC/B,kBAAkB,OAAO,wBACvB,aACA,SACA,QAAQ,eAAe,IAAI,CAC7B,EACF,CAAC;CACH,CAAC,CACH,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CAErC;AAChB,CAAC;AAEH,MAAa,yBACX,aAMA,MAAM,OACJ,kBACA,OAAO,IAAI,WAAW,UAAU,MAAM,gBAAgB,CACxD"}

package/dist/drizzle/query-operations.mjs

@@ -0,0 +1,26 @@
+import { column, updateValues } from "./model.mjs";
+import { balancedD1And, compactD1GeneratedStatement } from "./d1-generated-statement.mjs";
+import { and, asc, eq, getTableColumns, gt, gte, inArray, isNull, lte, notExists, or, sql } from "drizzle-orm";
+//#region src/drizzle/query-operations.ts
+const drizzleQueryOperations = {
+	and,
+	asc,
+	or,
+	eq,
+	gt,
+	gte,
+	lte,
+	inArray,
+	isNull,
+	notExists,
+	sql,
+	getTableColumns,
+	column,
+	updateValues,
+	balancedD1And,
+	compactD1GeneratedStatement
+};
+//#endregion
+export { drizzleQueryOperations };
+
+//# sourceMappingURL=query-operations.mjs.map

package/dist/drizzle/query-operations.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-operations.mjs","names":[],"sources":["../../src/drizzle/query-operations.ts"],"sourcesContent":["import {\n  and,\n  asc,\n  or,\n  eq,\n  gt,\n  gte,\n  lte,\n  inArray,\n  isNull,\n  notExists,\n  sql,\n  getTableColumns,\n} from \"drizzle-orm\";\n\nimport type { QueryOperations } from \"../internal/query-operations\";\nimport { balancedD1And, compactD1GeneratedStatement } from \"./d1-generated-statement\";\nimport { column, updateValues } from \"./model\";\n\nexport const drizzleQueryOperations: QueryOperations = {\n  and,\n  asc,\n  or,\n  eq,\n  gt,\n  gte,\n  lte,\n  inArray,\n  isNull,\n  notExists,\n  sql,\n  getTableColumns,\n  column,\n  updateValues,\n  balancedD1And,\n  compactD1GeneratedStatement,\n};\n"],"mappings":";;;;AAmBA,MAAa,yBAA0C;CACrD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}

package/dist/drizzle/session-model.d.mts

@@ -0,0 +1,200 @@
+import { PersistenceMappingError } from "../internal/mapping-error.mjs";
+import { SubjectIdCodec } from "./model.mjs";
+import { DateTime, Effect } from "effect";
+import { TokenDigest } from "@yielded/auth/Schema";
+import { AuthenticationEvidence, AuthenticationRequirement, PendingAuthenticationRecord, PendingAuthenticationState, SecurityRevision, SessionId, StatefulSessionRecord } from "@yielded/auth/Sessions";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/session-model.d.ts
+type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+interface SessionIdCodec<NativeId> {
+  readonly toNative: (id: SessionId) => Effect.Effect<NativeId, PersistenceMappingError>;
+  readonly toSession: (id: NativeId) => Effect.Effect<SessionId, PersistenceMappingError>;
+  readonly equals: (left: NativeId, right: NativeId) => boolean;
+}
+interface SessionSubjectTables<Subject extends Table, NativeId> {
+  readonly subject: {
+    readonly table: Subject;
+    readonly id: ColumnKey<Subject>;
+    readonly status: ColumnKey<Subject>;
+    readonly securityRevision: ColumnKey<Subject>;
+    readonly isActiveStatus: (value: unknown) => boolean;
+    readonly decodeRequirement: (row: InferSelectModel<Subject>) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
+    readonly nextSecurityRevision?: (current: SecurityRevision) => Effect.Effect<SecurityRevision, PersistenceMappingError>;
+    readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;
+  };
+  readonly subjectId: SubjectIdCodec<NativeId>;
+}
+interface SessionAuthorityTables<Subject extends Table, Credential extends Table, NativeId> extends SessionSubjectTables<Subject, NativeId> {
+  readonly credential: {
+    readonly table: Credential;
+    readonly subjectId: ColumnKey<Credential>;
+    readonly credentialId: ColumnKey<Credential>;
+    readonly revision: ColumnKey<Credential>;
+    /** Optional consumer status predicate; omitted means every stored credential row is active. */
+    readonly status?: ColumnKey<Credential>;
+    readonly isActiveStatus?: (value: unknown) => boolean;
+  };
+}
+interface SessionFlowTables<Flow extends Table, NativeSubjectId> {
+  readonly flow: {
+    readonly table: Flow;
+    readonly flowId: ColumnKey<Flow>;
+    readonly subjectId: ColumnKey<Flow>;
+    readonly state: ColumnKey<Flow>;
+    readonly pendingDigest: ColumnKey<Flow>;
+    readonly dedupUntil: ColumnKey<Flow>;
+    readonly pendingStateValue: unknown;
+    readonly establishedStateValue: unknown;
+    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+    readonly decodeInstant: (native: unknown) => Effect.Effect<DateTime.Utc, PersistenceMappingError>;
+    readonly encodePendingInsert: (input: {
+      readonly evidence: AuthenticationEvidence;
+      readonly subjectId: NativeSubjectId;
+      readonly pendingDigest: TokenDigest;
+      readonly dedupUntil: DateTime.Utc;
+    }) => InferInsertModel<Flow>;
+    readonly encodeEstablishedInsert: (input: {
+      readonly evidence: AuthenticationEvidence;
+      readonly subjectId: NativeSubjectId;
+      readonly dedupUntil: DateTime.Utc;
+    }) => InferInsertModel<Flow>;
+  };
+}
+interface StatefulSessionTables<Claims, Session extends Table, Flow extends Table, NativeSubjectId, NativeSessionId> extends SessionFlowTables<Flow, NativeSubjectId> {
+  readonly session: {
+    readonly table: Session;
+    readonly sessionId: ColumnKey<Session>;
+    readonly subjectId: ColumnKey<Session>;
+    readonly digest: ColumnKey<Session>;
+    readonly version: ColumnKey<Session>;
+    readonly securityRevision: ColumnKey<Session>;
+    readonly issuedAt: ColumnKey<Session>;
+    readonly expiresAt: ColumnKey<Session>;
+    readonly absoluteExpiresAt: ColumnKey<Session>;
+    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+    readonly encodeInsert: (record: StatefulSessionRecord<Claims>, ids: {
+      readonly subjectId: NativeSubjectId;
+      readonly sessionId: NativeSessionId;
+    }) => InferInsertModel<Session>;
+    /** Persist the prepared credentialVersion and retain exact private provenance. */
+    readonly encodeRotation: (record: StatefulSessionRecord<Claims>) => Partial<InferInsertModel<Session>>;
+    readonly decode: (row: InferSelectModel<Session>) => Effect.Effect<StatefulSessionRecord<Claims>, PersistenceMappingError>;
+    readonly allocateId?: Effect.Effect<NativeSessionId, PersistenceMappingError>;
+    readonly allocateIdSync?: () => NativeSessionId;
+    readonly allocateVersion?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
+    readonly allocateVersionSync?: () => SecurityRevision;
+  };
+  readonly sessionId: SessionIdCodec<NativeSessionId>;
+}
+interface PendingAuthenticationTables<Claims, Pending extends Table, Flow extends Table, NativeSubjectId> extends SessionFlowTables<Flow, NativeSubjectId> {
+  readonly pending: {
+    readonly table: Pending;
+    readonly digest: ColumnKey<Pending>;
+    readonly version: ColumnKey<Pending>;
+    readonly flowId: ColumnKey<Pending>;
+    readonly subjectId: ColumnKey<Pending>;
+    readonly bindingDigest: ColumnKey<Pending>;
+    readonly expiresAt: ColumnKey<Pending>;
+    readonly attemptLimit: ColumnKey<Pending>;
+    readonly failedAttempts: ColumnKey<Pending>;
+    readonly consumed: ColumnKey<Pending>;
+    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+    readonly encodeInsert: (record: PendingAuthenticationRecord<Claims>, input: {
+      readonly subjectId: NativeSubjectId;
+      readonly failedAttempts: 0;
+      readonly consumed: false;
+    }) => InferInsertModel<Pending>;
+    readonly decode: (row: InferSelectModel<Pending>) => Effect.Effect<PendingAuthenticationRecord<Claims>, PersistenceMappingError>;
+    /** Decodes original evidence and storage guards only. The internal pending
+     * context lookup must not execute unrelated consumer Claims transforms. */
+    readonly decodeContext: (row: InferSelectModel<Pending>) => Effect.Effect<PendingAuthenticationState, PersistenceMappingError>;
+    readonly allocateVersion?: Effect.Effect<SecurityRevision, PersistenceMappingError>;
+    readonly allocateVersionSync?: () => SecurityRevision;
+  };
+}
+interface SignedSessionValidityTables<Tombstone extends Table, NativeSubjectId, NativeSessionId> {
+  readonly tombstone: {
+    readonly table: Tombstone;
+    readonly subjectId: ColumnKey<Tombstone>;
+    readonly sessionId: ColumnKey<Tombstone>;
+    readonly absoluteExpiresAt: ColumnKey<Tombstone>;
+    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+    readonly decodeInstant: (native: unknown) => Effect.Effect<DateTime.Utc, PersistenceMappingError>;
+    readonly encodeInsert: (input: {
+      readonly subjectId: NativeSubjectId;
+      readonly sessionId: NativeSessionId;
+      readonly absoluteExpiresAt: DateTime.Utc;
+    }) => InferInsertModel<Tombstone>;
+  };
+  readonly sessionId: SessionIdCodec<NativeSessionId>;
+}
+interface RequiredSessionConstraints {
+  readonly sessionDigest: "unique(session.digest)";
+  readonly flowId: "unique(flow.flowId)";
+}
+interface RequiredPendingAuthenticationConstraints {
+  readonly pendingDigest: "unique(pending.digest)";
+  readonly pendingFlow: "unique(pending.flowId)";
+  readonly flowId: "unique(flow.flowId)";
+}
+interface RequiredStatefulPendingConstraints extends RequiredSessionConstraints, RequiredPendingAuthenticationConstraints {}
+interface RequiredSignedValidityConstraints {
+  readonly tombstoneOwner: "unique(tombstone.subjectId,tombstone.sessionId)";
+}
+declare const requiredSessionConstraints: RequiredSessionConstraints;
+declare const requiredPendingAuthenticationConstraints: RequiredPendingAuthenticationConstraints;
+declare const requiredStatefulPendingConstraints: RequiredStatefulPendingConstraints;
+declare const requiredSignedValidityConstraints: RequiredSignedValidityConstraints;
+interface SessionConstraintClassifier {
+  /**
+   * Match only the named unique constraints declared by this mapping. Broad
+   * SQL/constraint classifiers can relabel application or NOT NULL failures as
+   * a domain conflict.
+   */
+  readonly isConstraintConflict: (cause: unknown) => boolean;
+}
+type AuthenticationAuthorityMapping<Claims, Subject extends Table, Credential extends Table, Flow extends Table, Pending extends Table, NativeSubjectId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & SessionConstraintClassifier & ({
+  /** Omit for single-factor authority installations. Pending input then fails closed. */
+  readonly pending?: undefined;
+} | {
+  readonly pending: PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId>;
+  readonly constraints: RequiredPendingAuthenticationConstraints;
+});
+type StatefulSessionMapping<Claims, Subject extends Table, Credential extends Table, Session extends Table, Flow extends Table, Pending extends Table, NativeSubjectId, NativeSessionId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & StatefulSessionTables<Claims, Session, Flow, NativeSubjectId, NativeSessionId> & SessionConstraintClassifier & ({
+  /** Omit when this session module does not support pending MFA completion. */
+  readonly pending?: undefined;
+  readonly constraints: RequiredSessionConstraints;
+} | {
+  readonly pending: PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId>["pending"];
+  readonly constraints: RequiredStatefulPendingConstraints;
+});
+type PendingAuthenticationMapping<Claims, Subject extends Table, Credential extends Table, Pending extends Table, Flow extends Table, NativeSubjectId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId> & SessionConstraintClassifier & {
+  readonly constraints: RequiredPendingAuthenticationConstraints;
+};
+type SignedSessionValidityMapping<Subject extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = SessionSubjectTables<Subject, NativeSubjectId> & SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId> & SessionConstraintClassifier & {
+  readonly constraints: RequiredSignedValidityConstraints;
+};
+/** D1 evaluates these expressions inside the atomic batch, after queueing delay.
+ * `engineNow` must use the exact native representation of every mapped instant
+ * column. `engineNowMillis` is Unix epoch milliseconds for proof freshness.
+ * Changes to the consumer's factor policy MUST bump subject.securityRevision.
+ * Supply the authoritative primary D1 database, never a replica-affined
+ * `withSession` handle, because verification and security revision reads must
+ * observe completed revocation writes across clients.
+ */
+interface D1SessionClockMapping {
+  readonly d1: {
+    readonly engineNow: SQL;
+    readonly engineNowMillis: SQL;
+    readonly activeSubjectStatusValue: unknown;
+    /** Required when `credential.status` is mapped. */
+    readonly activeCredentialStatusValue?: unknown;
+  };
+}
+type D1AuthenticationAuthorityMapping<Claims, Subject extends Table, Credential extends Table, Flow extends Table, Pending extends Table, NativeSubjectId> = AuthenticationAuthorityMapping<Claims, Subject, Credential, Flow, Pending, NativeSubjectId> & D1SessionClockMapping;
+type D1PendingAuthenticationMapping<Claims, Subject extends Table, Credential extends Table, Pending extends Table, Flow extends Table, NativeSubjectId> = PendingAuthenticationMapping<Claims, Subject, Credential, Pending, Flow, NativeSubjectId> & D1SessionClockMapping;
+type D1StatefulSessionMapping<Claims, Subject extends Table, Credential extends Table, Session extends Table, Flow extends Table, Pending extends Table, NativeSubjectId, NativeSessionId> = StatefulSessionMapping<Claims, Subject, Credential, Session, Flow, Pending, NativeSubjectId, NativeSessionId> & D1SessionClockMapping;
+type D1SignedSessionValidityMapping<Subject extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = SignedSessionValidityMapping<Subject, Tombstone, NativeSubjectId, NativeSessionId> & D1SessionClockMapping;
+//#endregion
+export { AuthenticationAuthorityMapping, D1AuthenticationAuthorityMapping, D1PendingAuthenticationMapping, D1SessionClockMapping, D1SignedSessionValidityMapping, D1StatefulSessionMapping, PendingAuthenticationMapping, PendingAuthenticationTables, RequiredPendingAuthenticationConstraints, RequiredSessionConstraints, RequiredSignedValidityConstraints, RequiredStatefulPendingConstraints, SessionAuthorityTables, SessionConstraintClassifier, SessionFlowTables, SessionIdCodec, SessionSubjectTables, SignedSessionValidityMapping, SignedSessionValidityTables, StatefulSessionMapping, StatefulSessionTables, requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints };
+//# sourceMappingURL=session-model.d.mts.map

package/dist/drizzle/session-model.mjs

@@ -0,0 +1,20 @@
+import "@yielded/auth/Sessions";
+//#region src/drizzle/session-model.ts
+const requiredSessionConstraints = {
+	sessionDigest: "unique(session.digest)",
+	flowId: "unique(flow.flowId)"
+};
+const requiredPendingAuthenticationConstraints = {
+	pendingDigest: "unique(pending.digest)",
+	pendingFlow: "unique(pending.flowId)",
+	flowId: "unique(flow.flowId)"
+};
+const requiredStatefulPendingConstraints = {
+	...requiredSessionConstraints,
+	...requiredPendingAuthenticationConstraints
+};
+const requiredSignedValidityConstraints = { tombstoneOwner: "unique(tombstone.subjectId,tombstone.sessionId)" };
+//#endregion
+export { requiredPendingAuthenticationConstraints, requiredSessionConstraints, requiredSignedValidityConstraints, requiredStatefulPendingConstraints };
+
+//# sourceMappingURL=session-model.mjs.map

package/dist/drizzle/session-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-model.mjs","names":[],"sources":["../../src/drizzle/session-model.ts"],"sourcesContent":["import type { TokenDigest } from \"@yielded/auth/Schema\";\nimport {\n  type AuthenticationRequirement,\n  type AuthenticationEvidence,\n  type SecurityRevision,\n  type SessionId,\n  type PendingAuthenticationRecord,\n  type PendingAuthenticationState,\n  type StatefulSessionRecord,\n} from \"@yielded/auth/Sessions\";\nimport type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { DateTime, Effect } from \"effect\";\n\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./model\";\n\ntype ColumnKey<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\n\nexport interface SessionIdCodec<NativeId> {\n  readonly toNative: (id: SessionId) => Effect.Effect<NativeId, PersistenceMappingError>;\n  readonly toSession: (id: NativeId) => Effect.Effect<SessionId, PersistenceMappingError>;\n  readonly equals: (left: NativeId, right: NativeId) => boolean;\n}\n\nexport interface SessionSubjectTables<Subject extends Table, NativeId> {\n  readonly subject: {\n    readonly table: Subject;\n    readonly id: ColumnKey<Subject>;\n    readonly status: ColumnKey<Subject>;\n    readonly securityRevision: ColumnKey<Subject>;\n    readonly isActiveStatus: (value: unknown) => boolean;\n    readonly decodeRequirement: (\n      row: InferSelectModel<Subject>,\n    ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n    readonly nextSecurityRevision?: (\n      current: SecurityRevision,\n    ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;\n    readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  };\n  readonly subjectId: SubjectIdCodec<NativeId>;\n}\n\nexport interface SessionAuthorityTables<\n  Subject extends Table,\n  Credential extends Table,\n  NativeId,\n> extends SessionSubjectTables<Subject, NativeId> {\n  readonly credential: {\n    readonly table: Credential;\n    readonly subjectId: ColumnKey<Credential>;\n    readonly credentialId: ColumnKey<Credential>;\n    readonly revision: ColumnKey<Credential>;\n    /** Optional consumer status predicate; omitted means every stored credential row is active. */\n    readonly status?: ColumnKey<Credential>;\n    readonly isActiveStatus?: (value: unknown) => boolean;\n  };\n}\n\nexport interface SessionFlowTables<Flow extends Table, NativeSubjectId> {\n  readonly flow: {\n    readonly table: Flow;\n    readonly flowId: ColumnKey<Flow>;\n    readonly subjectId: ColumnKey<Flow>;\n    readonly state: ColumnKey<Flow>;\n    readonly pendingDigest: ColumnKey<Flow>;\n    readonly dedupUntil: ColumnKey<Flow>;\n    readonly pendingStateValue: unknown;\n    readonly establishedStateValue: unknown;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    readonly decodeInstant: (\n      native: unknown,\n    ) => Effect.Effect<DateTime.Utc, PersistenceMappingError>;\n    readonly encodePendingInsert: (input: {\n      readonly evidence: AuthenticationEvidence;\n      readonly subjectId: NativeSubjectId;\n      readonly pendingDigest: TokenDigest;\n      readonly dedupUntil: DateTime.Utc;\n    }) => InferInsertModel<Flow>;\n    readonly encodeEstablishedInsert: (input: {\n      readonly evidence: AuthenticationEvidence;\n      readonly subjectId: NativeSubjectId;\n      readonly dedupUntil: DateTime.Utc;\n    }) => InferInsertModel<Flow>;\n  };\n}\n\nexport interface StatefulSessionTables<\n  Claims,\n  Session extends Table,\n  Flow extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> extends SessionFlowTables<Flow, NativeSubjectId> {\n  readonly session: {\n    readonly table: Session;\n    readonly sessionId: ColumnKey<Session>;\n    readonly subjectId: ColumnKey<Session>;\n    readonly digest: ColumnKey<Session>;\n    readonly version: ColumnKey<Session>;\n    readonly securityRevision: ColumnKey<Session>;\n    readonly issuedAt: ColumnKey<Session>;\n    readonly expiresAt: ColumnKey<Session>;\n    readonly absoluteExpiresAt: ColumnKey<Session>;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    readonly encodeInsert: (\n      record: StatefulSessionRecord<Claims>,\n      ids: { readonly subjectId: NativeSubjectId; readonly sessionId: NativeSessionId },\n    ) => InferInsertModel<Session>;\n    /** Persist the prepared credentialVersion and retain exact private provenance. */\n    readonly encodeRotation: (\n      record: StatefulSessionRecord<Claims>,\n    ) => Partial<InferInsertModel<Session>>;\n    readonly decode: (\n      row: InferSelectModel<Session>,\n    ) => Effect.Effect<StatefulSessionRecord<Claims>, PersistenceMappingError>;\n    readonly allocateId?: Effect.Effect<NativeSessionId, PersistenceMappingError>;\n    readonly allocateIdSync?: () => NativeSessionId;\n    readonly allocateVersion?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n    readonly allocateVersionSync?: () => SecurityRevision;\n  };\n  readonly sessionId: SessionIdCodec<NativeSessionId>;\n}\n\nexport interface PendingAuthenticationTables<\n  Claims,\n  Pending extends Table,\n  Flow extends Table,\n  NativeSubjectId,\n> extends SessionFlowTables<Flow, NativeSubjectId> {\n  readonly pending: {\n    readonly table: Pending;\n    readonly digest: ColumnKey<Pending>;\n    readonly version: ColumnKey<Pending>;\n    readonly flowId: ColumnKey<Pending>;\n    readonly subjectId: ColumnKey<Pending>;\n    readonly bindingDigest: ColumnKey<Pending>;\n    readonly expiresAt: ColumnKey<Pending>;\n    readonly attemptLimit: ColumnKey<Pending>;\n    readonly failedAttempts: ColumnKey<Pending>;\n    readonly consumed: ColumnKey<Pending>;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    readonly encodeInsert: (\n      record: PendingAuthenticationRecord<Claims>,\n      input: {\n        readonly subjectId: NativeSubjectId;\n        readonly failedAttempts: 0;\n        readonly consumed: false;\n      },\n    ) => InferInsertModel<Pending>;\n    readonly decode: (\n      row: InferSelectModel<Pending>,\n    ) => Effect.Effect<PendingAuthenticationRecord<Claims>, PersistenceMappingError>;\n    /** Decodes original evidence and storage guards only. The internal pending\n     * context lookup must not execute unrelated consumer Claims transforms. */\n    readonly decodeContext: (\n      row: InferSelectModel<Pending>,\n    ) => Effect.Effect<PendingAuthenticationState, PersistenceMappingError>;\n    readonly allocateVersion?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n    readonly allocateVersionSync?: () => SecurityRevision;\n  };\n}\n\nexport interface SignedSessionValidityTables<\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> {\n  readonly tombstone: {\n    readonly table: Tombstone;\n    readonly subjectId: ColumnKey<Tombstone>;\n    readonly sessionId: ColumnKey<Tombstone>;\n    readonly absoluteExpiresAt: ColumnKey<Tombstone>;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    readonly decodeInstant: (\n      native: unknown,\n    ) => Effect.Effect<DateTime.Utc, PersistenceMappingError>;\n    readonly encodeInsert: (input: {\n      readonly subjectId: NativeSubjectId;\n      readonly sessionId: NativeSessionId;\n      readonly absoluteExpiresAt: DateTime.Utc;\n    }) => InferInsertModel<Tombstone>;\n  };\n  readonly sessionId: SessionIdCodec<NativeSessionId>;\n}\n\nexport interface RequiredSessionConstraints {\n  readonly sessionDigest: \"unique(session.digest)\";\n  readonly flowId: \"unique(flow.flowId)\";\n}\n\nexport interface RequiredPendingAuthenticationConstraints {\n  readonly pendingDigest: \"unique(pending.digest)\";\n  readonly pendingFlow: \"unique(pending.flowId)\";\n  readonly flowId: \"unique(flow.flowId)\";\n}\n\nexport interface RequiredStatefulPendingConstraints\n  extends RequiredSessionConstraints, RequiredPendingAuthenticationConstraints {}\n\nexport interface RequiredSignedValidityConstraints {\n  readonly tombstoneOwner: \"unique(tombstone.subjectId,tombstone.sessionId)\";\n}\n\nexport const requiredSessionConstraints: RequiredSessionConstraints = {\n  sessionDigest: \"unique(session.digest)\",\n  flowId: \"unique(flow.flowId)\",\n};\n\nexport const requiredPendingAuthenticationConstraints: RequiredPendingAuthenticationConstraints = {\n  pendingDigest: \"unique(pending.digest)\",\n  pendingFlow: \"unique(pending.flowId)\",\n  flowId: \"unique(flow.flowId)\",\n};\n\nexport const requiredStatefulPendingConstraints: RequiredStatefulPendingConstraints = {\n  ...requiredSessionConstraints,\n  ...requiredPendingAuthenticationConstraints,\n};\n\nexport const requiredSignedValidityConstraints: RequiredSignedValidityConstraints = {\n  tombstoneOwner: \"unique(tombstone.subjectId,tombstone.sessionId)\",\n};\n\nexport interface SessionConstraintClassifier {\n  /**\n   * Match only the named unique constraints declared by this mapping. Broad\n   * SQL/constraint classifiers can relabel application or NOT NULL failures as\n   * a domain conflict.\n   */\n  readonly isConstraintConflict: (cause: unknown) => boolean;\n}\n\nexport type AuthenticationAuthorityMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Flow extends Table,\n  Pending extends Table,\n  NativeSubjectId,\n> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &\n  SessionConstraintClassifier &\n  (\n    | {\n        /** Omit for single-factor authority installations. Pending input then fails closed. */\n        readonly pending?: undefined;\n      }\n    | {\n        readonly pending: PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId>;\n        readonly constraints: RequiredPendingAuthenticationConstraints;\n      }\n  );\n\nexport type StatefulSessionMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Session extends Table,\n  Flow extends Table,\n  Pending extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &\n  StatefulSessionTables<Claims, Session, Flow, NativeSubjectId, NativeSessionId> &\n  SessionConstraintClassifier &\n  (\n    | {\n        /** Omit when this session module does not support pending MFA completion. */\n        readonly pending?: undefined;\n        readonly constraints: RequiredSessionConstraints;\n      }\n    | {\n        readonly pending: PendingAuthenticationTables<\n          Claims,\n          Pending,\n          Flow,\n          NativeSubjectId\n        >[\"pending\"];\n        readonly constraints: RequiredStatefulPendingConstraints;\n      }\n  );\n\nexport type PendingAuthenticationMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Pending extends Table,\n  Flow extends Table,\n  NativeSubjectId,\n> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &\n  PendingAuthenticationTables<Claims, Pending, Flow, NativeSubjectId> &\n  SessionConstraintClassifier & {\n    readonly constraints: RequiredPendingAuthenticationConstraints;\n  };\n\nexport type SignedSessionValidityMapping<\n  Subject extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> = SessionSubjectTables<Subject, NativeSubjectId> &\n  SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId> &\n  SessionConstraintClassifier & {\n    readonly constraints: RequiredSignedValidityConstraints;\n  };\n\n/** D1 evaluates these expressions inside the atomic batch, after queueing delay.\n * `engineNow` must use the exact native representation of every mapped instant\n * column. `engineNowMillis` is Unix epoch milliseconds for proof freshness.\n * Changes to the consumer's factor policy MUST bump subject.securityRevision.\n * Supply the authoritative primary D1 database, never a replica-affined\n * `withSession` handle, because verification and security revision reads must\n * observe completed revocation writes across clients.\n */\nexport interface D1SessionClockMapping {\n  readonly d1: {\n    readonly engineNow: SQL;\n    readonly engineNowMillis: SQL;\n    readonly activeSubjectStatusValue: unknown;\n    /** Required when `credential.status` is mapped. */\n    readonly activeCredentialStatusValue?: unknown;\n  };\n}\n\nexport type D1AuthenticationAuthorityMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Flow extends Table,\n  Pending extends Table,\n  NativeSubjectId,\n> = AuthenticationAuthorityMapping<Claims, Subject, Credential, Flow, Pending, NativeSubjectId> &\n  D1SessionClockMapping;\n\nexport type D1PendingAuthenticationMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Pending extends Table,\n  Flow extends Table,\n  NativeSubjectId,\n> = PendingAuthenticationMapping<Claims, Subject, Credential, Pending, Flow, NativeSubjectId> &\n  D1SessionClockMapping;\n\nexport type D1StatefulSessionMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Session extends Table,\n  Flow extends Table,\n  Pending extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> = StatefulSessionMapping<\n  Claims,\n  Subject,\n  Credential,\n  Session,\n  Flow,\n  Pending,\n  NativeSubjectId,\n  NativeSessionId\n> &\n  D1SessionClockMapping;\n\nexport type D1SignedSessionValidityMapping<\n  Subject extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> = SignedSessionValidityMapping<Subject, Tombstone, NativeSubjectId, NativeSessionId> &\n  D1SessionClockMapping;\n"],"mappings":";;AA0MA,MAAa,6BAAyD;CACpE,eAAe;CACf,QAAQ;AACV;AAEA,MAAa,2CAAqF;CAChG,eAAe;CACf,aAAa;CACb,QAAQ;AACV;AAEA,MAAa,qCAAyE;CACpF,GAAG;CACH,GAAG;AACL;AAEA,MAAa,oCAAuE,EAClF,gBAAgB,kDAClB"}

package/dist/drizzle/session-sql.mjs

@@ -0,0 +1,8 @@
+import { CurrentSessionSql, makeSessionKernel } from "../internal/session-kernel.mjs";
+import { drizzleQueryOperations } from "./query-operations.mjs";
+//#region src/drizzle/session-sql.ts
+const { makeSqlAuthenticationAuthority, makeSqlPendingAuthentication, makeSqlStatefulSessions, makeSqlSignedValidity, makeSqlSessionStepUp } = makeSessionKernel(drizzleQueryOperations);
+//#endregion
+export { CurrentSessionSql, makeSqlAuthenticationAuthority, makeSqlPendingAuthentication, makeSqlSessionStepUp, makeSqlSignedValidity, makeSqlStatefulSessions };
+
+//# sourceMappingURL=session-sql.mjs.map

package/dist/drizzle/session-sql.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-sql.mjs","names":[],"sources":["../../src/drizzle/session-sql.ts"],"sourcesContent":["import { makeSessionKernel } from \"../internal/session-kernel\";\nimport { drizzleQueryOperations } from \"./query-operations\";\nexport type { SessionSqlDatabase } from \"../internal/session-kernel\";\nexport { CurrentSessionSql } from \"../internal/session-kernel\";\nexport type { SessionSqlOptions } from \"../internal/session-kernel\";\n\nexport const {\n  makeSqlAuthenticationAuthority,\n  makeSqlPendingAuthentication,\n  makeSqlStatefulSessions,\n  makeSqlSignedValidity,\n  makeSqlSessionStepUp,\n} = makeSessionKernel(drizzleQueryOperations);\n"],"mappings":";;;AAMA,MAAa,EACX,gCACA,8BACA,yBACA,uBACA,yBACE,kBAAkB,sBAAsB"}

package/dist/drizzle/session-target.d.mts

@@ -0,0 +1,28 @@
+import { Context, Effect, Layer } from "effect";
+import { HookConfigurationError, LifecycleHooks } from "@yielded/auth/Hooks";
+import { AuthenticationAuthority, PendingAuthentication, SessionRepository, SessionStepUpPersistence, SessionUnavailable, SignedSessionValidity, StatefulSessionPersistence } from "@yielded/auth/Sessions";
+import "effect/unstable/sql/SqlError";
+//#region src/drizzle/session-target.d.ts
+declare const authenticationAuthorityLayer: (services: Effect.Effect<{
+  readonly authenticationAuthority: AuthenticationAuthority["Service"];
+}, never, LifecycleHooks>) => Layer.Layer<AuthenticationAuthority, never, LifecycleHooks>;
+declare const statefulSessionLayers: <Claims>(module: {
+  readonly StatefulSessionPersistence: any;
+  readonly SessionRepository: any;
+}, services: Effect.Effect<{
+  readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;
+  readonly sessionRepository: SessionRepository;
+}, never, LifecycleHooks>) => Layer.Layer<unknown, never, LifecycleHooks>;
+declare const pendingAuthenticationLayer: <Claims>(module: {
+  readonly PendingAuthentication: any;
+}, services: Effect.Effect<{
+  readonly pendingAuthentication: PendingAuthentication<Claims>;
+}, never, LifecycleHooks>) => Layer.Layer<unknown, never, LifecycleHooks>;
+declare const signedSessionValidityLayer: (module: {
+  readonly SignedSessionValidity: any;
+}, services: Effect.Effect<{
+  readonly signedSessionValidity: SignedSessionValidity;
+}, never, LifecycleHooks>) => Layer.Layer<unknown, never, LifecycleHooks>;
+//#endregion
+export { authenticationAuthorityLayer, pendingAuthenticationLayer, signedSessionValidityLayer, statefulSessionLayers };
+//# sourceMappingURL=session-target.d.mts.map

package/dist/drizzle/session-target.mjs

@@ -0,0 +1,47 @@
+import { CurrentSessionSql } from "../internal/session-kernel.mjs";
+import { makeSqlAuthenticationAuthority, makeSqlPendingAuthentication, makeSqlSessionStepUp, makeSqlSignedValidity, makeSqlStatefulSessions } from "./session-sql.mjs";
+import { sqlClientStandaloneGuard } from "./standalone-guard.mjs";
+import { Effect, Layer } from "effect";
+import { coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
+import { AuthenticationAuthority, SessionUnavailable } from "@yielded/auth/Sessions";
+//#region src/drizzle/session-target.ts
+const sqlClientSessionStandaloneGuard = (database) => sqlClientStandaloneGuard(database, () => SessionUnavailable.make({}));
+const options = (configuration, transactionBound = false) => ({
+	mode: configuration.mode,
+	locking: configuration.locking,
+	standaloneGuard: transactionBound ? Effect.void : configuration.standaloneGuard
+});
+const makeTargetAuthenticationAuthorityServices = (database, mapping, configuration) => Effect.map(makeSqlAuthenticationAuthority(database, mapping, options(configuration)), (authenticationAuthority) => ({ authenticationAuthority }));
+const makeTargetPendingAuthenticationServices = (database, mapping, configuration) => Effect.map(makeSqlPendingAuthentication(database, mapping, options(configuration)), (pendingAuthentication) => ({ pendingAuthentication }));
+const makeTargetStatefulSessionServices = (database, mapping, configuration) => makeSqlStatefulSessions(database, mapping, options(configuration));
+const makeTargetSignedSessionValidityServices = (database, mapping, configuration) => Effect.map(makeSqlSignedValidity(database, mapping, options(configuration)), (signedSessionValidity) => ({ signedSessionValidity }));
+/**
+* The native transaction is the root commit owner. Interruption or owner
+* failure rolls it back and discards the child journal; this adapter performs
+* no hidden retry. A caller that can safely retry must rerun the complete owner
+* operation and prepare fresh bearer material. The low-level coordinator keeps
+* caller failures intact, including Drizzle query wrappers, and exposes a
+* native `SqlError` when transaction acquisition fails. Captured service
+* operations normalize their own driver failures to `SessionUnavailable`.
+*/
+const coordinate = (database, configuration, make, owner) => Effect.gen(function* () {
+	if (yield* hasCommitScope) return yield* SessionUnavailable.make({});
+	yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
+	return (yield* coordinateCommit(() => database.transaction((transaction) => Effect.gen(function* () {
+		return yield* owner(transaction, yield* make(transaction));
+	}).pipe(Effect.provideService(CurrentSessionSql, transaction))), { mode: configuration.mode })).value;
+});
+const coordinateTargetAuthenticationAuthority = (database, mapping, configuration, owner) => coordinate(database, configuration, (transaction) => Effect.map(makeSqlAuthenticationAuthority(transaction, mapping, options(configuration, true)), (authenticationAuthority) => ({ authenticationAuthority })), owner);
+const coordinateTargetPendingAuthentication = (database, mapping, configuration, owner) => coordinate(database, configuration, (transaction) => Effect.map(makeSqlPendingAuthentication(transaction, mapping, options(configuration, true)), (pendingAuthentication) => ({ pendingAuthentication })), owner);
+const coordinateTargetStatefulSessions = (database, mapping, configuration, owner) => coordinate(database, configuration, (transaction) => makeSqlStatefulSessions(transaction, mapping, options(configuration, true)), owner);
+const coordinateTargetSignedSessionValidity = (database, mapping, configuration, owner) => coordinate(database, configuration, (transaction) => Effect.map(makeSqlSignedValidity(transaction, mapping, options(configuration, true)), (signedSessionValidity) => ({ signedSessionValidity })), owner);
+const authenticationAuthorityLayer = (services) => Layer.effect(AuthenticationAuthority, Effect.map(services, (value) => value.authenticationAuthority));
+const statefulSessionLayers = (module, services) => Layer.merge(Layer.effect(module.StatefulSessionPersistence, Effect.map(services, (value) => value.statefulSessionPersistence)), Layer.effect(module.SessionRepository, Effect.map(services, (value) => value.sessionRepository)));
+const pendingAuthenticationLayer = (module, services) => Layer.effect(module.PendingAuthentication, Effect.map(services, (value) => value.pendingAuthentication));
+const signedSessionValidityLayer = (module, services) => Layer.effect(module.SignedSessionValidity, Effect.map(services, (value) => value.signedSessionValidity));
+const makeTargetSessionStepUpServices = (database, mapping, target, configuration) => Effect.map(makeSqlSessionStepUp(database, mapping, options(configuration)), (sessionStepUpPersistence) => ({ sessionStepUpPersistence: target.of(sessionStepUpPersistence) }));
+const coordinateTargetSessionStepUp = (database, mapping, target, configuration, owner) => coordinate(database, configuration, (transaction) => Effect.map(makeSqlSessionStepUp(transaction, mapping, options(configuration, true)), (sessionStepUpPersistence) => ({ sessionStepUpPersistence: target.of(sessionStepUpPersistence) })), owner);
+//#endregion
+export { authenticationAuthorityLayer, coordinateTargetAuthenticationAuthority, coordinateTargetPendingAuthentication, coordinateTargetSessionStepUp, coordinateTargetSignedSessionValidity, coordinateTargetStatefulSessions, makeTargetAuthenticationAuthorityServices, makeTargetPendingAuthenticationServices, makeTargetSessionStepUpServices, makeTargetSignedSessionValidityServices, makeTargetStatefulSessionServices, pendingAuthenticationLayer, signedSessionValidityLayer, sqlClientSessionStandaloneGuard, statefulSessionLayers };
+
+//# sourceMappingURL=session-target.mjs.map

package/dist/drizzle/session-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-target.mjs","names":[],"sources":["../../src/drizzle/session-target.ts"],"sourcesContent":["import {\n  coordinateCommit,\n  hasCommitScope,\n  type LifecycleHooks,\n  type HookConfigurationError,\n} from \"@yielded/auth/Hooks\";\nimport {\n  AuthenticationAuthority,\n  SessionUnavailable,\n  type PendingAuthentication,\n  type SessionRepository,\n  type SignedSessionValidity,\n  type StatefulSessionPersistence,\n  type SessionStepUpPersistence,\n} from \"@yielded/auth/Sessions\";\n/* oxlint-disable no-explicit-any -- target entrypoints restore each concrete Drizzle database/table type. */\nimport { type Context, Effect, Layer } from \"effect\";\nimport type * as SqlError from \"effect/unstable/sql/SqlError\";\n\nimport {\n  makeSqlAuthenticationAuthority,\n  makeSqlPendingAuthentication,\n  makeSqlSignedValidity,\n  makeSqlStatefulSessions,\n  makeSqlSessionStepUp,\n  CurrentSessionSql,\n  type SessionSqlDatabase,\n  type SessionSqlOptions,\n} from \"./session-sql\";\nimport { sqlClientStandaloneGuard } from \"./standalone-guard\";\n\nexport interface SessionTargetConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, SessionUnavailable>;\n  readonly coordinatorGuard?: Effect.Effect<void, SessionUnavailable>;\n}\n\ninterface TransactionOwner<Transaction> {\n  readonly transaction: <A, E, R>(\n    body: (transaction: Transaction) => Effect.Effect<A, E, R>,\n  ) => Effect.Effect<A, E | SqlError.SqlError, R>;\n}\n\ntype CoordinatorError<E> = E | SessionUnavailable | HookConfigurationError | SqlError.SqlError;\n\nexport const sqlClientSessionStandaloneGuard = (\n  database: unknown,\n): Effect.Effect<void, SessionUnavailable> =>\n  sqlClientStandaloneGuard(database, () => SessionUnavailable.make({}));\n\nconst options = (\n  configuration: SessionTargetConfiguration,\n  transactionBound = false,\n): SessionSqlOptions => ({\n  mode: configuration.mode,\n  locking: configuration.locking,\n  standaloneGuard: transactionBound ? Effect.void : configuration.standaloneGuard,\n});\n\nexport const makeTargetAuthenticationAuthorityServices = <Claims>(\n  database: any,\n  mapping: any,\n  configuration: SessionTargetConfiguration,\n) =>\n  Effect.map(\n    makeSqlAuthenticationAuthority<Claims>(database, mapping, options(configuration)),\n    (authenticationAuthority) => ({ authenticationAuthority }),\n  );\n\nexport const makeTargetPendingAuthenticationServices = <Claims>(\n  database: any,\n  mapping: any,\n  configuration: SessionTargetConfiguration,\n) =>\n  Effect.map(\n    makeSqlPendingAuthentication<Claims>(database, mapping, options(configuration)),\n    (pendingAuthentication) => ({ pendingAuthentication }),\n  );\n\nexport const makeTargetStatefulSessionServices = <Claims>(\n  database: any,\n  mapping: any,\n  configuration: SessionTargetConfiguration,\n) => makeSqlStatefulSessions<Claims>(database, mapping, options(configuration));\n\nexport const makeTargetSignedSessionValidityServices = (\n  database: any,\n  mapping: any,\n  configuration: SessionTargetConfiguration,\n) =>\n  Effect.map(\n    makeSqlSignedValidity(database, mapping, options(configuration)),\n    (signedSessionValidity) => ({\n      signedSessionValidity,\n    }),\n  );\n\n/**\n * The native transaction is the root commit owner. Interruption or owner\n * failure rolls it back and discards the child journal; this adapter performs\n * no hidden retry. A caller that can safely retry must rerun the complete owner\n * operation and prepare fresh bearer material. The low-level coordinator keeps\n * caller failures intact, including Drizzle query wrappers, and exposes a\n * native `SqlError` when transaction acquisition fails. Captured service\n * operations normalize their own driver failures to `SessionUnavailable`.\n */\nconst coordinate = <Transaction, Services, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  configuration: SessionTargetConfiguration,\n  make: (transaction: Transaction) => Effect.Effect<Services, never, LifecycleHooks>,\n  owner: (transaction: Transaction, services: Services) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, CoordinatorError<E>, R | LifecycleHooks> =>\n  Effect.gen(function* (): Effect.fn.Return<A, CoordinatorError<E>, R | LifecycleHooks> {\n    if (yield* hasCommitScope) return yield* SessionUnavailable.make({});\n    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;\n\n    const result = yield* coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          Effect.gen(function* () {\n            const services = yield* make(transaction);\n\n            return yield* owner(transaction, services);\n          }).pipe(\n            Effect.provideService(CurrentSessionSql, transaction as unknown as SessionSqlDatabase),\n          ),\n        ),\n      { mode: configuration.mode },\n    );\n\n    return result.value;\n  });\n\nexport const coordinateTargetAuthenticationAuthority = <Claims, Transaction, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  mapping: any,\n  configuration: SessionTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly authenticationAuthority: AuthenticationAuthority[\"Service\"] },\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinate(\n    database,\n    configuration,\n    (transaction) =>\n      Effect.map(\n        makeSqlAuthenticationAuthority<Claims>(\n          transaction as unknown as SessionSqlDatabase,\n          mapping,\n          options(configuration, true),\n        ),\n        (authenticationAuthority) => ({ authenticationAuthority }),\n      ),\n    owner,\n  );\n\nexport const coordinateTargetPendingAuthentication = <Claims, Transaction, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  mapping: any,\n  configuration: SessionTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly pendingAuthentication: PendingAuthentication<Claims> },\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinate(\n    database,\n    configuration,\n    (transaction) =>\n      Effect.map(\n        makeSqlPendingAuthentication<Claims>(\n          transaction as unknown as SessionSqlDatabase,\n          mapping,\n          options(configuration, true),\n        ),\n        (pendingAuthentication) => ({ pendingAuthentication }),\n      ),\n    owner,\n  );\n\nexport const coordinateTargetStatefulSessions = <Claims, Transaction, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  mapping: any,\n  configuration: SessionTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: {\n      readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;\n      readonly sessionRepository: SessionRepository;\n    },\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinate(\n    database,\n    configuration,\n    (transaction) =>\n      makeSqlStatefulSessions<Claims>(\n        transaction as unknown as SessionSqlDatabase,\n        mapping,\n        options(configuration, true),\n      ),\n    owner,\n  );\n\nexport const coordinateTargetSignedSessionValidity = <Transaction, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  mapping: any,\n  configuration: SessionTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly signedSessionValidity: SignedSessionValidity },\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinate(\n    database,\n    configuration,\n    (transaction) =>\n      Effect.map(\n        makeSqlSignedValidity(\n          transaction as unknown as SessionSqlDatabase,\n          mapping,\n          options(configuration, true),\n        ),\n        (signedSessionValidity) => ({ signedSessionValidity }),\n      ),\n    owner,\n  );\n\nexport const authenticationAuthorityLayer = (\n  services: Effect.Effect<\n    {\n      readonly authenticationAuthority: AuthenticationAuthority[\"Service\"];\n    },\n    never,\n    LifecycleHooks\n  >,\n) =>\n  Layer.effect(\n    AuthenticationAuthority,\n    Effect.map(services, (value) => value.authenticationAuthority),\n  );\n\nexport const statefulSessionLayers = <Claims>(\n  module: {\n    readonly StatefulSessionPersistence: any;\n    readonly SessionRepository: any;\n  },\n  services: Effect.Effect<\n    {\n      readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;\n      readonly sessionRepository: SessionRepository;\n    },\n    never,\n    LifecycleHooks\n  >,\n) =>\n  Layer.merge(\n    Layer.effect(\n      module.StatefulSessionPersistence,\n      Effect.map(services, (value) => value.statefulSessionPersistence),\n    ),\n    Layer.effect(\n      module.SessionRepository,\n      Effect.map(services, (value) => value.sessionRepository),\n    ),\n  );\n\nexport const pendingAuthenticationLayer = <Claims>(\n  module: { readonly PendingAuthentication: any },\n  services: Effect.Effect<\n    {\n      readonly pendingAuthentication: PendingAuthentication<Claims>;\n    },\n    never,\n    LifecycleHooks\n  >,\n) =>\n  Layer.effect(\n    module.PendingAuthentication,\n    Effect.map(services, (value) => value.pendingAuthentication),\n  );\n\nexport const signedSessionValidityLayer = (\n  module: { readonly SignedSessionValidity: any },\n  services: Effect.Effect<\n    {\n      readonly signedSessionValidity: SignedSessionValidity;\n    },\n    never,\n    LifecycleHooks\n  >,\n) =>\n  Layer.effect(\n    module.SignedSessionValidity,\n    Effect.map(services, (value) => value.signedSessionValidity),\n  );\n\nexport const makeTargetSessionStepUpServices = <Claims, Id>(\n  database: any,\n  mapping: any,\n  target: Context.Service<Id, SessionStepUpPersistence<Claims>>,\n  configuration: SessionTargetConfiguration,\n) =>\n  Effect.map(\n    makeSqlSessionStepUp<Claims>(database, mapping, options(configuration)),\n    (sessionStepUpPersistence) => ({\n      sessionStepUpPersistence: target.of(sessionStepUpPersistence),\n    }),\n  );\n\nexport const coordinateTargetSessionStepUp = <Claims, Id, Transaction, A, E, R>(\n  database: TransactionOwner<Transaction>,\n  mapping: any,\n  target: Context.Service<Id, SessionStepUpPersistence<Claims>>,\n  configuration: SessionTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: { readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims> },\n  ) => Effect.Effect<A, E, R>,\n) =>\n  coordinate(\n    database,\n    configuration,\n    (transaction) =>\n      Effect.map(\n        makeSqlSessionStepUp<Claims>(\n          transaction as unknown as SessionSqlDatabase,\n          mapping,\n          options(configuration, true),\n        ),\n        (sessionStepUpPersistence) => ({\n          sessionStepUpPersistence: target.of(sessionStepUpPersistence),\n        }),\n      ),\n    owner,\n  );\n"],"mappings":";;;;;;;AA8CA,MAAa,mCACX,aAEA,yBAAyB,gBAAgB,mBAAmB,KAAK,CAAC,CAAC,CAAC;AAEtE,MAAM,WACJ,eACA,mBAAmB,WACI;CACvB,MAAM,cAAc;CACpB,SAAS,cAAc;CACvB,iBAAiB,mBAAmB,OAAO,OAAO,cAAc;AAClE;AAEA,MAAa,6CACX,UACA,SACA,kBAEA,OAAO,IACL,+BAAuC,UAAU,SAAS,QAAQ,aAAa,CAAC,IAC/E,6BAA6B,EAAE,wBAAwB,EAC1D;AAEF,MAAa,2CACX,UACA,SACA,kBAEA,OAAO,IACL,6BAAqC,UAAU,SAAS,QAAQ,aAAa,CAAC,IAC7E,2BAA2B,EAAE,sBAAsB,EACtD;AAEF,MAAa,qCACX,UACA,SACA,kBACG,wBAAgC,UAAU,SAAS,QAAQ,aAAa,CAAC;AAE9E,MAAa,2CACX,UACA,SACA,kBAEA,OAAO,IACL,sBAAsB,UAAU,SAAS,QAAQ,aAAa,CAAC,IAC9D,2BAA2B,EAC1B,sBACF,EACF;;;;;;;;;;AAWF,MAAM,cACJ,UACA,eACA,MACA,UAEA,OAAO,IAAI,aAA2E;CACpF,IAAI,OAAO,gBAAgB,OAAO,OAAO,mBAAmB,KAAK,CAAC,CAAC;CACnE,OAAO,cAAc,oBAAoB,cAAc;CAgBvD,QAAO,OAde,uBAElB,SAAS,aAAa,gBACpB,OAAO,IAAI,aAAa;EAGtB,OAAO,OAAO,MAAM,aAAa,OAFT,KAAK,WAAW,CAEC;CAC3C,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,mBAAmB,WAA4C,CACvF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,EAAA,CAEc;AAChB,CAAC;AAEH,MAAa,2CACX,UACA,SACA,eACA,UAKA,WACE,UACA,gBACC,gBACC,OAAO,IACL,+BACE,aACA,SACA,QAAQ,eAAe,IAAI,CAC7B,IACC,6BAA6B,EAAE,wBAAwB,EAC1D,GACF,KACF;AAEF,MAAa,yCACX,UACA,SACA,eACA,UAKA,WACE,UACA,gBACC,gBACC,OAAO,IACL,6BACE,aACA,SACA,QAAQ,eAAe,IAAI,CAC7B,IACC,2BAA2B,EAAE,sBAAsB,EACtD,GACF,KACF;AAEF,MAAa,oCACX,UACA,SACA,eACA,UAQA,WACE,UACA,gBACC,gBACC,wBACE,aACA,SACA,QAAQ,eAAe,IAAI,CAC7B,GACF,KACF;AAEF,MAAa,yCACX,UACA,SACA,eACA,UAKA,WACE,UACA,gBACC,gBACC,OAAO,IACL,sBACE,aACA,SACA,QAAQ,eAAe,IAAI,CAC7B,IACC,2BAA2B,EAAE,sBAAsB,EACtD,GACF,KACF;AAEF,MAAa,gCACX,aAQA,MAAM,OACJ,yBACA,OAAO,IAAI,WAAW,UAAU,MAAM,uBAAuB,CAC/D;AAEF,MAAa,yBACX,QAIA,aASA,MAAM,MACJ,MAAM,OACJ,OAAO,4BACP,OAAO,IAAI,WAAW,UAAU,MAAM,0BAA0B,CAClE,GACA,MAAM,OACJ,OAAO,mBACP,OAAO,IAAI,WAAW,UAAU,MAAM,iBAAiB,CACzD,CACF;AAEF,MAAa,8BACX,QACA,aAQA,MAAM,OACJ,OAAO,uBACP,OAAO,IAAI,WAAW,UAAU,MAAM,qBAAqB,CAC7D;AAEF,MAAa,8BACX,QACA,aAQA,MAAM,OACJ,OAAO,uBACP,OAAO,IAAI,WAAW,UAAU,MAAM,qBAAqB,CAC7D;AAEF,MAAa,mCACX,UACA,SACA,QACA,kBAEA,OAAO,IACL,qBAA6B,UAAU,SAAS,QAAQ,aAAa,CAAC,IACrE,8BAA8B,EAC7B,0BAA0B,OAAO,GAAG,wBAAwB,EAC9D,EACF;AAEF,MAAa,iCACX,UACA,SACA,QACA,eACA,UAKA,WACE,UACA,gBACC,gBACC,OAAO,IACL,qBACE,aACA,SACA,QAAQ,eAAe,IAAI,CAC7B,IACC,8BAA8B,EAC7B,0BAA0B,OAAO,GAAG,wBAAwB,EAC9D,EACF,GACF,KACF"}

package/dist/drizzle/sqlite-emails.mjs

@@ -0,0 +1,45 @@
+import { coordinateTargetEmailAddress, coordinateTargetEmailRegistration, makeTargetEmailAddressServices, makeTargetEmailRegistrationServices, makeTargetEmailSignInServices } from "./email-target.mjs";
+import { Context, Effect } from "effect";
+import { EmailAddressPersistence } from "@yielded/auth/Email";
+//#region src/drizzle/sqlite-emails.ts
+const sqliteEmailConfiguration = (mode, standaloneGuard, proofStandaloneGuard, coordinatorGuard) => ({
+	mode,
+	locking: false,
+	standaloneGuard,
+	...coordinatorGuard === void 0 ? {} : { coordinatorGuard },
+	generatedSubjectRows: (query) => query.returning(),
+	proof: {
+		mode,
+		locking: false,
+		standaloneGuard: proofStandaloneGuard,
+		insertIfAbsent: (query) => query.onConflictDoNothing()
+	}
+});
+const makeSqliteEmailTarget = (configuration) => {
+	const configurationFor = (database) => typeof configuration === "function" ? configuration(database) : configuration;
+	function coordinateEmailAddress(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetEmailAddress(database, options.mapping, options.proofMapping, configurationFor(database), (transaction, services) => {
+			const provided = Context.make(EmailAddressPersistence, services.emailAddressPersistence);
+			const work = Effect.provideContext(body, provided);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	function coordinateEmailRegistration(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetEmailRegistration(database, options.mapping, options.proofMapping, configurationFor(database), (transaction, services) => {
+			const provided = Context.make(options.target, services.registrationAuthority);
+			const work = Effect.provideContext(body, provided);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	return {
+		makeEmailSignInServices: (database, mapping) => makeTargetEmailSignInServices(database, mapping, configurationFor(database)),
+		makeEmailAddressServices: (database, mapping, proofMapping) => makeTargetEmailAddressServices(database, mapping, proofMapping, configurationFor(database)),
+		coordinateEmailAddress,
+		makeEmailRegistrationServices: (database, mapping, proofMapping) => makeTargetEmailRegistrationServices(database, mapping, proofMapping, configurationFor(database)),
+		coordinateEmailRegistration
+	};
+};
+//#endregion
+export { makeSqliteEmailTarget, sqliteEmailConfiguration };
+
+//# sourceMappingURL=sqlite-emails.mjs.map

package/dist/drizzle/sqlite-emails.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-emails.mjs","names":[],"sources":["../../src/drizzle/sqlite-emails.ts"],"sourcesContent":["import { EmailAddressPersistence, type EmailUnavailable } from \"@yielded/auth/Email\";\nimport type { LifecycleHooks, HookConfigurationError } from \"@yielded/auth/Hooks\";\n/* oxlint-disable no-explicit-any -- proof mapping tables are independently typed by the proof owner; this driver forwards them unchanged to the shared target. */\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectLibsqlDatabase } from \"drizzle-orm/effect-libsql\";\nimport type { EffectSQLiteBunDatabase } from \"drizzle-orm/effect-sqlite-bun\";\nimport type { EffectSQLiteDoDatabase as DODatabase } from \"drizzle-orm/effect-sqlite-do\";\nimport type { EffectSQLiteNodeDatabase as NodeDatabase } from \"drizzle-orm/effect-sqlite-node\";\nimport type { EffectSQLiteWasmDatabase as WasmDatabase } from \"drizzle-orm/effect-sqlite-wasm\";\nimport type { AnySQLiteTable } from \"drizzle-orm/sqlite-core\";\nimport { Effect, Context } from \"effect\";\nimport type { SqlError } from \"effect/unstable/sql/SqlError\";\n\nimport type {\n  EmailAddressMapping,\n  EmailRegistrationMapping,\n  EmailSignInMapping,\n} from \"./email-model\";\nimport type { EmailRegistrationAuthority } from \"./email-registration\";\nimport type { EmailSqlQuery } from \"./email-sql\";\nimport {\n  coordinateTargetEmailAddress,\n  coordinateTargetEmailRegistration,\n  makeTargetEmailAddressServices,\n  makeTargetEmailRegistrationServices,\n  makeTargetEmailSignInServices,\n  type EmailTargetConfiguration,\n} from \"./email-target\";\nimport type { ProofPersistenceMapping } from \"./proof-model\";\nimport type { ProofSqlQuery } from \"./proof-sql\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\nexport type SqliteEmailDatabase =\n  | NodeDatabase<AnyRelations>\n  | EffectSQLiteBunDatabase<AnyRelations>\n  | EffectLibsqlDatabase<AnyRelations>\n  | WasmDatabase<AnyRelations>\n  | DODatabase<AnyRelations>;\n\ntype TransactionOf<D extends SqliteEmailDatabase> = Parameters<Parameters<D[\"transaction\"]>[0]>[0];\ntype ProofMapping = ProofPersistenceMapping<\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any,\n  any\n>;\n\nexport const sqliteEmailConfiguration = (\n  mode: \"interactive\" | \"synchronous\",\n  standaloneGuard: EmailTargetConfiguration[\"standaloneGuard\"],\n  proofStandaloneGuard: EmailTargetConfiguration[\"proof\"][\"standaloneGuard\"],\n  coordinatorGuard?: EmailTargetConfiguration[\"coordinatorGuard\"],\n): EmailTargetConfiguration => ({\n  mode,\n  locking: false,\n  standaloneGuard,\n  ...(coordinatorGuard === undefined ? {} : { coordinatorGuard }),\n  generatedSubjectRows: (query: EmailSqlQuery) => query.returning(),\n  proof: {\n    mode,\n    locking: false,\n    standaloneGuard: proofStandaloneGuard,\n    insertIfAbsent: (query: ProofSqlQuery) => query.onConflictDoNothing(),\n  },\n});\n\nexport const makeSqliteEmailTarget = <\n  D extends SqliteEmailDatabase,\n  Synchronous extends boolean = false,\n>(\n  configuration: EmailTargetConfiguration | ((database: D) => EmailTargetConfiguration),\n) => {\n  const configurationFor = (database: D) =>\n    typeof configuration === \"function\" ? configuration(database) : configuration;\n\n  function coordinateEmailAddress<\n    Database extends D,\n    S extends AnySQLiteTable,\n    I extends AnySQLiteTable,\n    C extends AnySQLiteTable,\n    AC extends AnySQLiteTable,\n    M extends AnySQLiteTable,\n    NativeId,\n    Out,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;\n      readonly proofMapping: ProofMapping;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<Out, E, Synchronous extends true ? NoInfer<EmailAddressPersistence> : R>,\n  ): Effect.Effect<\n    Out,\n    E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, EmailAddressPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateEmailAddress<\n    Database extends D,\n    S extends AnySQLiteTable,\n    I extends AnySQLiteTable,\n    C extends AnySQLiteTable,\n    AC extends AnySQLiteTable,\n    M extends AnySQLiteTable,\n    NativeId,\n    Out,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;\n      readonly proofMapping: ProofMapping;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<\n      Out,\n      E,\n      Synchronous extends true ? NoInfer<EmailAddressPersistence | TxId> : R\n    >,\n  ): Effect.Effect<\n    Out,\n    E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, EmailAddressPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateEmailAddress<\n    Database extends D,\n    S extends AnySQLiteTable,\n    I extends AnySQLiteTable,\n    C extends AnySQLiteTable,\n    AC extends AnySQLiteTable,\n    M extends AnySQLiteTable,\n    NativeId,\n    Out,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>;\n      readonly proofMapping: ProofMapping;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<Out, E, R>,\n  ): Effect.Effect<\n    Out,\n    E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n    Exclude<R, EmailAddressPersistence> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetEmailAddress<\n        TransactionOf<Database>,\n        Out,\n        E,\n        Exclude<R, EmailAddressPersistence>\n      >(\n        database,\n        options.mapping,\n        options.proofMapping,\n        configurationFor(database),\n        (\n          transaction: TransactionOf<Database>,\n          services: { readonly emailAddressPersistence: EmailAddressPersistence[\"Service\"] },\n        ) => {\n          const provided = Context.make(EmailAddressPersistence, services.emailAddressPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n  function coordinateEmailRegistration<\n    Database extends D,\n    TargetId,\n    Registration,\n    S extends AnySQLiteTable,\n    I extends AnySQLiteTable,\n    C extends AnySQLiteTable,\n    AC extends AnySQLiteTable,\n    Rq extends AnySQLiteTable,\n    NativeId,\n    Out,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n      readonly proofMapping: ProofMapping;\n      readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<Out, E, Synchronous extends true ? NoInfer<TargetId> : R>,\n  ): Effect.Effect<\n    Out,\n    E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TargetId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateEmailRegistration<\n    Database extends D,\n    TargetId,\n    Registration,\n    S extends AnySQLiteTable,\n    I extends AnySQLiteTable,\n    C extends AnySQLiteTable,\n    AC extends AnySQLiteTable,\n    Rq extends AnySQLiteTable,\n    NativeId,\n    Out,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n      readonly proofMapping: ProofMapping;\n      readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<Out, E, Synchronous extends true ? NoInfer<TargetId | TxId> : R>,\n  ): Effect.Effect<\n    Out,\n    E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TargetId | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n  >;\n  function coordinateEmailRegistration<\n    Database extends D,\n    TargetId,\n    Registration,\n    S extends AnySQLiteTable,\n    I extends AnySQLiteTable,\n    C extends AnySQLiteTable,\n    AC extends AnySQLiteTable,\n    Rq extends AnySQLiteTable,\n    NativeId,\n    Out,\n    E,\n    R,\n    DatabaseError,\n    DatabaseRequirements,\n    TxId,\n    TxShape,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: EmailRegistrationMapping<NoInfer<Registration>, S, I, C, AC, Rq, NativeId>;\n      readonly proofMapping: ProofMapping;\n      readonly target: SuppliedService<TargetId, EmailRegistrationAuthority<Registration>>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<Out, E, R>,\n  ): Effect.Effect<\n    Out,\n    E | EmailUnavailable | HookConfigurationError | SqlError | DatabaseError,\n    Exclude<R, TargetId> | LifecycleHooks | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetEmailRegistration<\n        Registration,\n        TransactionOf<Database>,\n        Out,\n        E,\n        Exclude<R, TargetId>\n      >(\n        database,\n        options.mapping,\n        options.proofMapping,\n        configurationFor(database),\n        (\n          transaction: TransactionOf<Database>,\n          services: { readonly registrationAuthority: EmailRegistrationAuthority<Registration> },\n        ) => {\n          const provided = Context.make(options.target, services.registrationAuthority);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  return {\n    makeEmailSignInServices: <\n      S extends AnySQLiteTable,\n      I extends AnySQLiteTable,\n      C extends AnySQLiteTable,\n      NativeId,\n    >(\n      database: D,\n      mapping: EmailSignInMapping<S, I, C, NativeId>,\n    ) => makeTargetEmailSignInServices(database, mapping, configurationFor(database)),\n    makeEmailAddressServices: <\n      S extends AnySQLiteTable,\n      I extends AnySQLiteTable,\n      C extends AnySQLiteTable,\n      AC extends AnySQLiteTable,\n      M extends AnySQLiteTable,\n      NativeId,\n    >(\n      database: D,\n      mapping: EmailAddressMapping<S, I, C, AC, M, NativeId>,\n      proofMapping: ProofMapping,\n    ) =>\n      makeTargetEmailAddressServices(database, mapping, proofMapping, configurationFor(database)),\n    coordinateEmailAddress,\n    makeEmailRegistrationServices: <\n      Registration,\n      S extends AnySQLiteTable,\n      I extends AnySQLiteTable,\n      C extends AnySQLiteTable,\n      AC extends AnySQLiteTable,\n      Rq extends AnySQLiteTable,\n      NativeId,\n    >(\n      database: D,\n      mapping: EmailRegistrationMapping<Registration, S, I, C, AC, Rq, NativeId>,\n      proofMapping: ProofMapping,\n    ) =>\n      makeTargetEmailRegistrationServices<Registration>(\n        database,\n        mapping,\n        proofMapping,\n        configurationFor(database),\n      ),\n    coordinateEmailRegistration,\n  };\n};\n"],"mappings":";;;;AAuDA,MAAa,4BACX,MACA,iBACA,sBACA,sBAC8B;CAC9B;CACA,SAAS;CACT;CACA,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;CAC7D,uBAAuB,UAAyB,MAAM,UAAU;CAChE,OAAO;EACL;EACA,SAAS;EACT,iBAAiB;EACjB,iBAAiB,UAAyB,MAAM,oBAAoB;CACtE;AACF;AAEA,MAAa,yBAIX,kBACG;CACH,MAAM,oBAAoB,aACxB,OAAO,kBAAkB,aAAa,cAAc,QAAQ,IAAI;CAgElE,SAAS,uBAgBP,SACA,SAKA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,6BAME,UACA,QAAQ,SACR,QAAQ,cACR,iBAAiB,QAAQ,IAEvB,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KAAK,yBAAyB,SAAS,uBAAuB;GACvF,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAiEA,SAAS,4BAkBP,SACA,SAMA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,kCAOE,UACA,QAAQ,SACR,QAAQ,cACR,iBAAiB,QAAQ,IAEvB,aACA,aACG;GACH,MAAM,WAAW,QAAQ,KAAK,QAAQ,QAAQ,SAAS,qBAAqB;GAC5E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,OAAO;EACL,0BAME,UACA,YACG,8BAA8B,UAAU,SAAS,iBAAiB,QAAQ,CAAC;EAChF,2BAQE,UACA,SACA,iBAEA,+BAA+B,UAAU,SAAS,cAAc,iBAAiB,QAAQ,CAAC;EAC5F;EACA,gCASE,UACA,SACA,iBAEA,oCACE,UACA,SACA,cACA,iBAAiB,QAAQ,CAC3B;EACF;CACF;AACF"}

package/dist/drizzle/sqlite-identity.mjs

@@ -0,0 +1,91 @@
+import { PersistenceMappingError, isMappedConstraintConflict } from "../internal/mapping-error.mjs";
+import { column, provisioningFingerprint } from "./model.mjs";
+import { Cause, Effect, Schema } from "effect";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { ExternalIdentityMutation, IdentityConflict, IdentityUnavailable, SubjectProvisioned, SubjectProvisioner } from "@yielded/auth/Identity";
+import { and, eq } from "drizzle-orm";
+//#region src/drizzle/sqlite-identity.ts
+const unavailable = () => IdentityUnavailable.make();
+const isIdentityFailure = Schema.is(Schema.Union([IdentityConflict, IdentityUnavailable]));
+const mapUnavailable = (effect) => reportPersistenceFailure(effect, isIdentityFailure).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => isIdentityFailure(error) ? error : unavailable()))));
+const makeSqliteSubjectProvisioningServices = (database, mapping, mode) => {
+	const db = database;
+	const requestTable = mapping.provisioningRequest.table;
+	const requestIdColumn = column(requestTable, mapping.provisioningRequest.requestId);
+	const requestFingerprintColumn = column(requestTable, mapping.provisioningRequest.fingerprint);
+	const requestSubjectColumn = column(requestTable, mapping.provisioningRequest.subjectId);
+	const identifierTable = mapping.identifier.table;
+	const identifierNamespaceColumn = column(identifierTable, mapping.identifier.namespace);
+	const identifierValueColumn = column(identifierTable, mapping.identifier.value);
+	const subjectIdColumn = column(mapping.subject.table, mapping.subject.id);
+	const findReceipt = Effect.fn("DrizzleSqliteIdentity.findReceipt")(function* (requestId) {
+		return (yield* db.select({
+			fingerprint: requestFingerprintColumn,
+			subjectId: requestSubjectColumn
+		}).from(requestTable).where(eq(requestIdColumn, requestId)).limit(1))[0];
+	});
+	const provision = Effect.fn("DrizzleSqliteIdentity.provision")(function* (input) {
+		if (mode === "synchronous" && mapping.subject.allocateId !== void 0 && mapping.subject.allocateIdSync === void 0) return yield* unavailable();
+		const fingerprint = provisioningFingerprint(input);
+		const existing = yield* findReceipt(input.requestId);
+		if (existing !== void 0) {
+			if (existing.fingerprint !== fingerprint) return yield* IdentityConflict.make();
+			const subjectId = yield* mapping.subjectId.toSubject(existing.subjectId);
+			return SubjectProvisioned.make({ subjectId });
+		}
+		const nativeId = yield* db.transaction((tx) => Effect.gen(function* () {
+			const allocated = mode === "synchronous" ? mapping.subject.allocateIdSync?.() : mapping.subject.allocateId === void 0 ? mapping.subject.allocateIdSync?.() : yield* mapping.subject.allocateId;
+			const nativeId = (yield* tx.insert(mapping.subject.table).values(mapping.subject.encodeInsert(input, allocated)).returning({ id: subjectIdColumn }))[0]?.id ?? allocated;
+			if (nativeId === void 0) return yield* PersistenceMappingError.make({
+				operation: "provisionSubject.generatedId",
+				cause: /* @__PURE__ */ new Error("subject insert did not return its native id")
+			});
+			if (input.identifier !== void 0) yield* tx.insert(identifierTable).values(mapping.identifier.encodeInsert(input.identifier, nativeId, input.verifiedAt));
+			yield* tx.insert(requestTable).values(mapping.provisioningRequest.encodeInsert(input.requestId, fingerprint, nativeId));
+			return nativeId;
+		})).pipe(Effect.catchCause((cause) => {
+			if (cause.reasons.length === 0 || !cause.reasons.every((reason) => Cause.isFailReason(reason) && isMappedConstraintConflict(mapping.isConstraintConflict, reason.error))) return Effect.failCause(cause);
+			return findReceipt(input.requestId).pipe(Effect.flatMap((receipt) => {
+				if (receipt !== void 0 && receipt.fingerprint === fingerprint) return Effect.succeed(receipt.subjectId);
+				if (input.identifier === void 0) return IdentityConflict.make();
+				return db.select({ subjectId: column(identifierTable, mapping.identifier.subjectId) }).from(identifierTable).where(and(eq(identifierNamespaceColumn, input.identifier.namespace), eq(identifierValueColumn, input.identifier.value))).limit(1).pipe(Effect.flatMap(() => IdentityConflict.make()));
+			}));
+		}));
+		const subjectId = yield* mapping.subjectId.toSubject(nativeId);
+		return SubjectProvisioned.make({ subjectId });
+	}, mapUnavailable);
+	return { subjectProvisioner: SubjectProvisioner.of({ provision }) };
+};
+const makeSqliteExternalIdentityServices = (database, mapping) => {
+	const db = database;
+	const externalTable = mapping.externalIdentity.table;
+	const externalProviderColumn = column(externalTable, mapping.externalIdentity.provider);
+	const externalIssuerColumn = column(externalTable, mapping.externalIdentity.issuer);
+	const externalSubjectColumn = column(externalTable, mapping.externalIdentity.subject);
+	const externalSubjectIdColumn = column(externalTable, mapping.externalIdentity.subjectId);
+	const subjectIdColumn = column(mapping.subject.table, mapping.subject.id);
+	const subjectStatusColumn = column(mapping.subject.table, mapping.subject.status);
+	const bind = Effect.fn("DrizzleSqliteIdentity.bindExternalIdentity")(function* (subjectId, identity) {
+		const nativeId = yield* mapping.subjectId.toNative(subjectId);
+		if ((yield* db.transaction((tx) => Effect.gen(function* () {
+			const subjects = yield* tx.select({ status: subjectStatusColumn }).from(mapping.subject.table).where(eq(subjectIdColumn, nativeId)).limit(1);
+			if (subjects[0] === void 0 || !mapping.subject.isActiveStatus(subjects[0].status)) return { _tag: "conflict" };
+			const links = yield* tx.select({ subjectId: externalSubjectIdColumn }).from(externalTable).where(and(eq(externalProviderColumn, identity.provider), eq(externalIssuerColumn, identity.issuer), eq(externalSubjectColumn, identity.subject))).limit(1);
+			if (links[0] !== void 0) return mapping.subjectId.equals(links[0].subjectId, nativeId) ? { _tag: "bound" } : { _tag: "conflict" };
+			yield* tx.insert(externalTable).values(mapping.externalIdentity.encodeInsert(identity, nativeId));
+			return { _tag: "bound" };
+		})).pipe(Effect.catchCause((cause) => {
+			if (cause.reasons.length === 0 || !cause.reasons.every((reason) => Cause.isFailReason(reason) && isMappedConstraintConflict(mapping.isConstraintConflict, reason.error))) return Effect.failCause(cause);
+			return db.select({ subjectId: externalSubjectIdColumn }).from(externalTable).where(and(eq(externalProviderColumn, identity.provider), eq(externalIssuerColumn, identity.issuer), eq(externalSubjectColumn, identity.subject))).limit(1).pipe(Effect.map((rows) => rows[0] !== void 0 && mapping.subjectId.equals(rows[0].subjectId, nativeId) ? { _tag: "bound" } : { _tag: "conflict" }));
+		})))._tag === "conflict") return yield* IdentityConflict.make();
+	}, mapUnavailable);
+	return { externalIdentityMutation: ExternalIdentityMutation.of({ bind }) };
+};
+const makeSqliteIdentityServices = (database, mapping, mode) => ({
+	...makeSqliteSubjectProvisioningServices(database, mapping, mode),
+	...makeSqliteExternalIdentityServices(database, mapping)
+});
+//#endregion
+export { makeSqliteExternalIdentityServices, makeSqliteIdentityServices, makeSqliteSubjectProvisioningServices };
+
+//# sourceMappingURL=sqlite-identity.mjs.map