@yielded/auth-persistence 0.1.0-beta.7

package/dist/drizzle/totp-state.mjs

@@ -0,0 +1,287 @@
+import { both, makeTransactionRows } from "./transaction-owner.mjs";
+import { Context, Effect, Schema } from "effect";
+import { digest, randomId } from "@yielded/auth/Persistence";
+import { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
+import { sql } from "drizzle-orm";
+import { TotpPolicy, TotpRecord, TotpUnavailable } from "@yielded/auth/Totp";
+//#region src/drizzle/totp-state.ts
+const unavailable = () => TotpUnavailable.make({});
+const invariant = (condition) => {
+	if (!condition) throw unavailable();
+};
+var CurrentTotpTransaction = class extends Context.Service()("effect-auth/drizzle/CurrentTotpTransaction") {};
+const { equal, col, copiedRow } = makeTransactionRows(unavailable);
+const codec = Schema.fromJsonString(TotpRecord);
+const encodeTotpRecord = (record) => Schema.encodeSync(codec)(record);
+const decodeTotpRecord = (state) => Schema.decodeSync(codec)(state);
+const scopeFor = (moduleId, subjectId) => digest(`effect-auth/totp/scope/v1/${moduleId.length}:${moduleId}/${subjectId}`);
+const captureTotp = Effect.fn("TotpNative.capture")(function* (mapping, subjectId) {
+	const owner = yield* CurrentTotpTransaction, subject = mapping.subject, factor = mapping.factor, nativeId = mapping.subjectIds.toNative(subjectId);
+	invariant(mapping.subjectIds.toSubject(nativeId) === subjectId);
+	const subjectRow = (yield* owner.read(subject.table, equal(subject.table, { [subject.id]: nativeId }), { limit: 1 })).rows[0];
+	if (subjectRow === void 0 || !(yield* owner.check(sql`exists(select 1 from ${subject.table} where ${both(owner.exact(subject.table, subjectRow), subject.activeCondition)})`))) return void 0;
+	const scope = scopeFor(mapping.moduleId, subjectId), found = yield* owner.read(factor.table, equal(factor.table, { [factor.scope]: scope }), { limit: 1 }), row = found.rows[0];
+	const record = row === void 0 ? null : decodeTotpRecord(row[factor.state]);
+	invariant(record === null || (record.secret === null || record.secret.revision === record.revision) && (record.pending === null || record.pending.secret.revision === record.pending.revision));
+	invariant(record === null || record.moduleId === mapping.moduleId && record.subjectId === subjectId && record.version === row[factor.version]);
+	return {
+		nativeId,
+		subjectRow,
+		factorRow: row,
+		factorObservation: found,
+		scope,
+		snapshot: {
+			revision: {
+				subjectId,
+				securityRevision: SecurityRevision.make(subjectRow[subject.securityRevision]),
+				credentials: record === null || record.secret === null ? [] : [{
+					credentialId: record.credentialId,
+					revision: SecurityRevision.make(record.revision)
+				}]
+			},
+			record
+		}
+	};
+});
+const reject = { _tag: "Rejected" };
+const mutateTotp = Effect.fn("TotpNative.mutate")(function* (mapping, input) {
+	const owner = yield* CurrentTotpTransaction;
+	invariant(input.moduleId === mapping.moduleId && Schema.encodeSync(Schema.fromJsonString(TotpPolicy))(input.policy) === Schema.encodeSync(Schema.fromJsonString(TotpPolicy))(mapping.policy));
+	const captured = yield* captureTotp(mapping, input.subjectId);
+	if (captured === void 0) return reject;
+	const { snapshot, subjectRow, factorRow, factorObservation, scope, nativeId } = captured, current = snapshot.record, policy = input.policy, action = input.action;
+	if (snapshot.revision.securityRevision !== input.snapshot.revision.securityRevision || (current?.version ?? null) !== (input.snapshot.record?.version ?? null)) return reject;
+	if (current === null !== (input.snapshot.record === null) || current !== null && encodeTotpRecord(current) !== encodeTotpRecord(input.snapshot.record)) return reject;
+	const now = yield* owner.now({ engineNowMillis: mapping.engineNowMillis });
+	const guards = [];
+	const credentialGuards = [];
+	const commandScope = digest(`effect-auth/totp/command/v1/${mapping.moduleId.length}:${mapping.moduleId}/${input.subjectId.length}:${input.subjectId}/${input.commandId}`);
+	const commandObservation = [
+		"Enroll",
+		"Confirm",
+		"Disable",
+		"Regenerate"
+	].includes(action._tag) ? yield* owner.read(mapping.factor.table, equal(mapping.factor.table, { [mapping.factor.scope]: commandScope }), { limit: 1 }) : void 0;
+	if (commandObservation !== void 0 && commandObservation.rows.length !== 0) return reject;
+	const timeGuards = [];
+	const timeBound = (start, end) => {
+		timeGuards.push(sql`${mapping.engineNowMillis} >= ${start} and ${mapping.engineNowMillis} < ${end}`);
+	};
+	if (action._tag === "Enroll" || action._tag === "Confirm" || action._tag === "Disable" || action._tag === "Regenerate") {
+		const authorization = input.authorization;
+		if (authorization === void 0) return reject;
+		const { challenge, evidence } = authorization;
+		const expectedAction = {
+			Enroll: "enroll",
+			Confirm: "confirm",
+			Disable: "disable",
+			Regenerate: "regenerate"
+		}[action._tag];
+		if (challenge.action !== expectedAction || challenge.moduleId !== mapping.moduleId || challenge.commandId !== input.commandId || challenge.revision.subjectId !== input.subjectId || challenge.revision.securityRevision !== snapshot.revision.securityRevision || evidence.flowId !== challenge.flowId || evidence.bindingDigest !== challenge.bindingDigest || evidence.revision.subjectId !== input.subjectId || evidence.revision.securityRevision !== snapshot.revision.securityRevision) return reject;
+		const auth = mapping.credential;
+		for (const revision of [...evidence.revision.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId))) {
+			const row = (yield* owner.read(auth.table, equal(auth.table, {
+				[auth.id]: revision.credentialId,
+				[auth.subjectId]: nativeId
+			}), { limit: 1 })).rows[0];
+			if (row === void 0 || row[auth.revision] !== revision.revision) return reject;
+			const condition = sql`exists(select 1 from ${auth.table} where ${both(owner.exact(auth.table, row), auth.activeCondition)})`;
+			if (!(yield* owner.check(condition))) return reject;
+			credentialGuards.push({
+				credentialId: revision.credentialId,
+				condition
+			});
+		}
+		const eligible = evidence.proofs.filter((proof) => evidence.revision.credentials.some((revision) => revision.credentialId === proof.credentialId));
+		if (eligible.length !== evidence.proofs.length || eligible.length === 0) return reject;
+		const requirements = [authorization.requirement, Schema.decodeSync(AuthenticationRequirement)(mapping.subject.decodeRequirement(copiedRow(subjectRow)))];
+		const maximumAge = Math.min(policy.maximumEvidenceAgeMillis, ...requirements.map((requirement) => requirement.maximumAgeMillis));
+		const evidenceFactors = new Set(eligible.flatMap((proof) => proof.factors));
+		const evidenceCredentials = new Set(eligible.map((proof) => proof.credentialId));
+		for (const requirement of requirements) if (!requirement.alternatives.some((alternative) => alternative.factors.every((factor) => evidenceFactors.has(factor)) && evidenceCredentials.size >= alternative.minimumCredentials && eligible.some((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)))) return reject;
+		for (const proof of eligible) {
+			const verifiedAt = proof.verifiedAt.epochMilliseconds;
+			if (verifiedAt > now || now - verifiedAt >= maximumAge) return reject;
+			timeBound(verifiedAt, verifiedAt + maximumAge);
+		}
+		if (current !== null && current.secret !== null || action._tag === "Disable" || action._tag === "Regenerate") {
+			const factors = new Set(eligible.flatMap((proof) => proof.factors));
+			if (!(eligible.some((proof) => proof.userVerified && proof.phishingResistant && proof.factors.includes("possession")) || factors.has("knowledge") && factors.has("possession") && new Set(eligible.map((proof) => proof.credentialId)).size >= 2)) return reject;
+		}
+	}
+	if (action._tag === "Recovery" && action.reset) {
+		const target = action.pending;
+		if (target === void 0 || mapping.pendingCondition === void 0 || target.revision.subjectId !== input.subjectId || target.revision.securityRevision !== snapshot.revision.securityRevision || target.expiresAtMillis <= now) return reject;
+		const condition = mapping.pendingCondition(target, nativeId);
+		if (!(yield* owner.check(condition))) return reject;
+		guards.push(condition);
+		timeBound(0, target.expiresAtMillis);
+	}
+	let next, semantic = false, accepted = true;
+	if (action._tag === "Enroll") {
+		const candidate = action.record;
+		if (candidate.subjectId !== input.subjectId || candidate.moduleId !== input.moduleId || candidate.pending === null || candidate.pending.expiresAtMillis <= now || candidate.pending.expiresAtMillis > now + policy.enrollmentLifetimeMillis || candidate.pending.failedAttempts !== 0 || candidate.pending.secret.revision !== candidate.pending.revision) return reject;
+		if (current !== null && current.pending !== null && current.pending.expiresAtMillis > now) return reject;
+		if (current !== null && (candidate.credentialId !== current.credentialId || encodeTotpRecord({
+			...candidate,
+			pending: current.pending
+		}) !== encodeTotpRecord(current))) return reject;
+		if (current === null && (candidate.secret !== null || candidate.recoveryDigests.length !== 0 || candidate.acceptedStep !== -1 || candidate.failedAttempts !== 0)) return reject;
+		next = candidate;
+		timeBound(0, candidate.pending.expiresAtMillis);
+	} else {
+		if (current === null) return reject;
+		next = { ...current };
+		if (action._tag === "Confirm") {
+			const pending = current.pending;
+			if (pending === null || pending.enrollmentId !== action.enrollmentId || pending.expiresAtMillis <= now || pending.failedAttempts >= policy.attemptLimit) return reject;
+			timeBound(0, pending.expiresAtMillis);
+			if (action.matchedStep === null || Math.abs(Math.floor(now / 3e4) - action.matchedStep) > policy.clockSkewSteps) {
+				next = {
+					...current,
+					pending: {
+						...pending,
+						failedAttempts: pending.failedAttempts + 1
+					}
+				};
+				accepted = false;
+			} else {
+				if (new Set(action.recoveryDigests).size !== 10) return reject;
+				next = {
+					...current,
+					secret: pending.secret,
+					revision: pending.secret.revision,
+					pending: null,
+					recoveryDigests: action.recoveryDigests,
+					acceptedStep: action.matchedStep,
+					attemptWindow: now,
+					failedAttempts: 0
+				};
+				semantic = true;
+				timeBound(Math.max(0, (action.matchedStep - policy.clockSkewSteps) * 3e4), (action.matchedStep + policy.clockSkewSteps + 1) * 3e4);
+			}
+		} else if (action._tag === "Verify" || action._tag === "Recovery") {
+			if (current.secret === null) return reject;
+			const expired = now >= current.attemptWindow + policy.attemptWindowMillis, attempts = expired ? 0 : current.failedAttempts, start = expired ? now : current.attemptWindow;
+			if (attempts >= policy.attemptLimit) return reject;
+			next = {
+				...current,
+				attemptWindow: start,
+				failedAttempts: attempts + 1
+			};
+			if (action._tag === "Verify") {
+				if (action.matchedStep === null || action.matchedStep <= current.acceptedStep || Math.abs(Math.floor(now / 3e4) - action.matchedStep) > policy.clockSkewSteps) accepted = false;
+				else {
+					next = {
+						...next,
+						acceptedStep: action.matchedStep,
+						failedAttempts: 0
+					};
+					timeBound(Math.max(0, (action.matchedStep - policy.clockSkewSteps) * 3e4), (action.matchedStep + policy.clockSkewSteps + 1) * 3e4);
+				}
+			} else if ((action.reset ? policy.lostFactorRecovery !== "reset-with-recovery-code" : !policy.allowRecoveryCodeForPending) || !current.recoveryDigests.includes(action.digest)) accepted = false;
+			else {
+				next = {
+					...next,
+					recoveryDigests: current.recoveryDigests.filter((value) => value !== action.digest),
+					failedAttempts: 0
+				};
+				if (action.reset) {
+					next = {
+						...next,
+						secret: null,
+						pending: null,
+						recoveryDigests: [],
+						revision: randomId()
+					};
+					semantic = true;
+				}
+			}
+		} else {
+			if (current.secret === null) return reject;
+			semantic = true;
+			if (action._tag === "Disable") next = {
+				...current,
+				secret: null,
+				pending: null,
+				recoveryDigests: [],
+				revision: randomId()
+			};
+			else {
+				if (new Set(action.recoveryDigests).size !== 10) return reject;
+				next = {
+					...current,
+					recoveryDigests: action.recoveryDigests
+				};
+			}
+		}
+	}
+	next = {
+		...next,
+		version: randomId()
+	};
+	const subject = mapping.subject, factor = mapping.factor, auth = mapping.credential;
+	const subjectKey = { [subject.id]: nativeId };
+	if (semantic) {
+		const revision = randomId(), updates = {
+			[subject.securityRevision]: revision,
+			[subject.factorEnabled]: subject.encodeEnabled(next.secret !== null)
+		};
+		yield* owner.update(subject.table, subjectKey, updates);
+		const idKey = {
+			[auth.id]: next.credentialId,
+			[auth.subjectId]: nativeId
+		};
+		const existing = yield* owner.read(auth.table, equal(auth.table, idKey), { limit: 1 });
+		if (existing.rows.length === 0) {
+			const values = {
+				...auth.encodeInsert({
+					credentialId: next.credentialId,
+					subjectId: nativeId,
+					revision: next.revision,
+					active: next.secret !== null
+				}),
+				[auth.id]: next.credentialId,
+				[auth.subjectId]: nativeId,
+				[auth.revision]: next.revision,
+				[auth.status]: auth.encodeStatus(next.secret !== null)
+			};
+			existing.rows = (yield* owner.insert(auth.table, values, { [auth.id]: next.credentialId })).rows;
+		} else yield* owner.update(auth.table, idKey, {
+			[auth.revision]: next.revision,
+			[auth.status]: auth.encodeStatus(next.secret !== null)
+		});
+	}
+	const state = encodeTotpRecord(next), values = {
+		[factor.state]: state,
+		[factor.version]: next.version
+	};
+	if (factorRow === void 0) {
+		const insert = factor.encodeInsert({
+			scope,
+			state,
+			version: next.version
+		});
+		invariant(insert[factor.scope] === scope && insert[factor.state] === state && insert[factor.version] === next.version);
+		factorObservation.rows = (yield* owner.insert(factor.table, insert, { [factor.scope]: scope })).rows;
+	} else yield* owner.update(factor.table, { [factor.scope]: scope }, values);
+	if (commandObservation !== void 0) {
+		const values = factor.encodeInsert({
+			scope: commandScope,
+			state: "totp-command/v1",
+			version: randomId()
+		});
+		invariant(values[factor.scope] === commandScope && values[factor.state] === "totp-command/v1");
+		commandObservation.rows = (yield* owner.insert(factor.table, values, { [factor.scope]: commandScope })).rows;
+	}
+	guards.push(sql`exists(select 1 from ${subject.table} where ${both(equal(subject.table, subjectKey), subject.activeCondition)})`);
+	owner.postconditions.push(...guards, ...timeGuards, ...credentialGuards.filter((guard) => !semantic || guard.credentialId !== next.credentialId).map((guard) => guard.condition));
+	return accepted ? {
+		_tag: "Accepted",
+		record: next
+	} : reject;
+});
+//#endregion
+export { CurrentTotpTransaction, captureTotp, copiedRow, decodeTotpRecord, encodeTotpRecord, equal, invariant, mutateTotp, unavailable };
+
+//# sourceMappingURL=totp-state.mjs.map

package/dist/drizzle/totp-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp-state.mjs","names":[],"sources":["../../src/drizzle/totp-state.ts"],"sourcesContent":["import { randomId, digest } from \"@yielded/auth/Persistence\";\nimport { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport {\n  TotpUnavailable,\n  type TotpMutation,\n  TotpPolicy,\n  TotpRecord,\n  type TotpDecision,\n} from \"@yielded/auth/Totp\";\n/* oxlint-disable no-explicit-any -- private native driver bridge; public makers preserve table and ID types. */\nimport { sql, type SQL } from \"drizzle-orm\";\nimport { Context, Effect, Schema } from \"effect\";\n\nimport { both, makeTransactionRows, type TransactionOwner } from \"./transaction-owner\";\nexport const unavailable = () => TotpUnavailable.make({});\n\nexport const invariant: (condition: unknown) => asserts condition = (condition) => {\n  if (!condition) throw unavailable();\n};\n\nexport class CurrentTotpTransaction extends Context.Service<\n  CurrentTotpTransaction,\n  TransactionOwner<TotpUnavailable>\n>()(\"effect-auth/drizzle/CurrentTotpTransaction\") {}\n\nexport const { equal, col, copiedRow } = makeTransactionRows(unavailable);\nconst codec = Schema.fromJsonString(TotpRecord);\n\nexport const encodeTotpRecord = (record: TotpRecord) => Schema.encodeSync(codec)(record);\nexport const decodeTotpRecord = (state: string) => Schema.decodeSync(codec)(state);\n\nconst scopeFor = (moduleId: string, subjectId: string) =>\n  digest(`effect-auth/totp/scope/v1/${moduleId.length}:${moduleId}/${subjectId}`);\n\nexport const captureTotp = Effect.fn(\"TotpNative.capture\")(function* (\n  mapping: any,\n  subjectId: typeof TotpRecord.Type.subjectId,\n) {\n  const owner = yield* CurrentTotpTransaction,\n    subject = mapping.subject,\n    factor = mapping.factor,\n    nativeId = mapping.subjectIds.toNative(subjectId);\n\n  invariant(mapping.subjectIds.toSubject(nativeId) === subjectId);\n\n  const selected = yield* owner.read(\n    subject.table,\n    equal(subject.table, { [subject.id]: nativeId }),\n    { limit: 1 },\n  );\n\n  const subjectRow = selected.rows[0];\n\n  if (\n    subjectRow === undefined ||\n    !(yield* owner.check(\n      sql`exists(select 1 from ${subject.table} where ${both(owner.exact(subject.table, subjectRow), subject.activeCondition)})`,\n    ))\n  )\n    return undefined;\n\n  const scope = scopeFor(mapping.moduleId, subjectId),\n    found = yield* owner.read(factor.table, equal(factor.table, { [factor.scope]: scope }), {\n      limit: 1,\n    }),\n    row = found.rows[0];\n\n  const record = row === undefined ? null : decodeTotpRecord(row[factor.state] as string);\n\n  invariant(\n    record === null ||\n      ((record.secret === null || record.secret.revision === record.revision) &&\n        (record.pending === null || record.pending.secret.revision === record.pending.revision)),\n  );\n  invariant(\n    record === null ||\n      (record.moduleId === mapping.moduleId &&\n        record.subjectId === subjectId &&\n        record.version === row![factor.version]),\n  );\n\n  return {\n    nativeId,\n    subjectRow,\n    factorRow: row,\n    factorObservation: found,\n    scope,\n    snapshot: {\n      revision: {\n        subjectId,\n        securityRevision: SecurityRevision.make(subjectRow[subject.securityRevision] as string),\n        credentials:\n          record === null || record.secret === null\n            ? []\n            : [\n                {\n                  credentialId: record.credentialId,\n                  revision: SecurityRevision.make(record.revision),\n                },\n              ],\n      },\n      record,\n    },\n  };\n});\n\nconst reject: TotpDecision = { _tag: \"Rejected\" };\n\nexport const mutateTotp = Effect.fn(\"TotpNative.mutate\")(function* (\n  mapping: any,\n  input: TotpMutation,\n) {\n  const owner = yield* CurrentTotpTransaction;\n\n  invariant(\n    input.moduleId === mapping.moduleId &&\n      Schema.encodeSync(Schema.fromJsonString(TotpPolicy))(input.policy) ===\n        Schema.encodeSync(Schema.fromJsonString(TotpPolicy))(mapping.policy),\n  );\n  const captured = yield* captureTotp(mapping, input.subjectId);\n\n  if (captured === undefined) return reject;\n\n  const { snapshot, subjectRow, factorRow, factorObservation, scope, nativeId } = captured,\n    current = snapshot.record,\n    policy = input.policy,\n    action = input.action;\n\n  if (\n    snapshot.revision.securityRevision !== input.snapshot.revision.securityRevision ||\n    (current?.version ?? null) !== (input.snapshot.record?.version ?? null)\n  )\n    return reject;\n  if (\n    (current === null) !== (input.snapshot.record === null) ||\n    (current !== null && encodeTotpRecord(current) !== encodeTotpRecord(input.snapshot.record!))\n  )\n    return reject;\n  const now = yield* owner.now({ engineNowMillis: mapping.engineNowMillis });\n  const guards: SQL[] = [];\n  const credentialGuards: { credentialId: string; condition: SQL }[] = [];\n\n  const commandScope = digest(\n    `effect-auth/totp/command/v1/${mapping.moduleId.length}:${mapping.moduleId}/${input.subjectId.length}:${input.subjectId}/${input.commandId}`,\n  );\n\n  const management = [\"Enroll\", \"Confirm\", \"Disable\", \"Regenerate\"].includes(action._tag);\n\n  const commandObservation = management\n    ? yield* owner.read(\n        mapping.factor.table,\n        equal(mapping.factor.table, { [mapping.factor.scope]: commandScope }),\n        { limit: 1 },\n      )\n    : undefined;\n\n  if (commandObservation !== undefined && commandObservation.rows.length !== 0) return reject;\n  const timeGuards: SQL[] = [];\n\n  const timeBound = (start: number, end: number) => {\n    timeGuards.push(\n      sql`${mapping.engineNowMillis} >= ${start} and ${mapping.engineNowMillis} < ${end}`,\n    );\n  };\n\n  if (\n    action._tag === \"Enroll\" ||\n    action._tag === \"Confirm\" ||\n    action._tag === \"Disable\" ||\n    action._tag === \"Regenerate\"\n  ) {\n    const authorization = input.authorization;\n\n    if (authorization === undefined) return reject;\n    const { challenge, evidence } = authorization;\n\n    const expectedAction = {\n      Enroll: \"enroll\",\n      Confirm: \"confirm\",\n      Disable: \"disable\",\n      Regenerate: \"regenerate\",\n    }[action._tag];\n\n    if (\n      challenge.action !== expectedAction ||\n      challenge.moduleId !== mapping.moduleId ||\n      challenge.commandId !== input.commandId ||\n      challenge.revision.subjectId !== input.subjectId ||\n      challenge.revision.securityRevision !== snapshot.revision.securityRevision ||\n      evidence.flowId !== challenge.flowId ||\n      evidence.bindingDigest !== challenge.bindingDigest ||\n      evidence.revision.subjectId !== input.subjectId ||\n      evidence.revision.securityRevision !== snapshot.revision.securityRevision\n    )\n      return reject;\n    const auth = mapping.credential;\n\n    for (const revision of [...evidence.revision.credentials].sort((a, b) =>\n      a.credentialId.localeCompare(b.credentialId),\n    )) {\n      const found = yield* owner.read(\n        auth.table,\n        equal(auth.table, { [auth.id]: revision.credentialId, [auth.subjectId]: nativeId }),\n        { limit: 1 },\n      );\n\n      const row = found.rows[0];\n\n      if (row === undefined || row[auth.revision] !== revision.revision) return reject;\n      const condition = sql`exists(select 1 from ${auth.table} where ${both(owner.exact(auth.table, row), auth.activeCondition)})`;\n\n      if (!(yield* owner.check(condition))) return reject;\n      credentialGuards.push({ credentialId: revision.credentialId, condition });\n    }\n\n    const eligible = evidence.proofs.filter((proof) =>\n      evidence.revision.credentials.some(\n        (revision) => revision.credentialId === proof.credentialId,\n      ),\n    );\n\n    if (eligible.length !== evidence.proofs.length || eligible.length === 0) return reject;\n\n    const requirements = [\n      authorization.requirement,\n      Schema.decodeSync(AuthenticationRequirement)(\n        mapping.subject.decodeRequirement(copiedRow(subjectRow)),\n      ),\n    ];\n\n    const maximumAge = Math.min(\n      policy.maximumEvidenceAgeMillis,\n      ...requirements.map((requirement) => requirement.maximumAgeMillis),\n    );\n\n    const evidenceFactors = new Set(eligible.flatMap((proof) => proof.factors));\n    const evidenceCredentials = new Set(eligible.map((proof) => proof.credentialId));\n\n    for (const requirement of requirements) {\n      if (\n        !requirement.alternatives.some(\n          (alternative) =>\n            alternative.factors.every((factor) => evidenceFactors.has(factor)) &&\n            evidenceCredentials.size >= alternative.minimumCredentials &&\n            eligible.some(\n              (proof) =>\n                (!alternative.userVerified || proof.userVerified) &&\n                (!alternative.phishingResistant || proof.phishingResistant),\n            ),\n        )\n      )\n        return reject;\n    }\n    for (const proof of eligible) {\n      const verifiedAt = proof.verifiedAt.epochMilliseconds;\n\n      if (verifiedAt > now || now - verifiedAt >= maximumAge) return reject;\n      timeBound(verifiedAt, verifiedAt + maximumAge);\n    }\n    if (\n      (current !== null && current.secret !== null) ||\n      action._tag === \"Disable\" ||\n      action._tag === \"Regenerate\"\n    ) {\n      const factors = new Set(eligible.flatMap((proof) => proof.factors));\n\n      if (\n        !(\n          eligible.some(\n            (proof) =>\n              proof.userVerified && proof.phishingResistant && proof.factors.includes(\"possession\"),\n          ) ||\n          (factors.has(\"knowledge\") &&\n            factors.has(\"possession\") &&\n            new Set(eligible.map((proof) => proof.credentialId)).size >= 2)\n        )\n      )\n        return reject;\n    }\n  }\n  if (action._tag === \"Recovery\" && action.reset) {\n    const target = action.pending;\n\n    if (\n      target === undefined ||\n      mapping.pendingCondition === undefined ||\n      target.revision.subjectId !== input.subjectId ||\n      target.revision.securityRevision !== snapshot.revision.securityRevision ||\n      target.expiresAtMillis <= now\n    )\n      return reject;\n    const condition = mapping.pendingCondition(target, nativeId);\n\n    if (!(yield* owner.check(condition))) return reject;\n    guards.push(condition);\n    timeBound(0, target.expiresAtMillis);\n  }\n\n  let next: TotpRecord,\n    semantic = false,\n    accepted = true;\n\n  if (action._tag === \"Enroll\") {\n    const candidate = action.record;\n\n    if (\n      candidate.subjectId !== input.subjectId ||\n      candidate.moduleId !== input.moduleId ||\n      candidate.pending === null ||\n      candidate.pending.expiresAtMillis <= now ||\n      candidate.pending.expiresAtMillis > now + policy.enrollmentLifetimeMillis ||\n      candidate.pending.failedAttempts !== 0 ||\n      candidate.pending.secret.revision !== candidate.pending.revision\n    )\n      return reject;\n    // Reissuing cannot erase the confirmation budget during its current enrollment lifetime.\n    if (current !== null && current.pending !== null && current.pending.expiresAtMillis > now)\n      return reject;\n    if (\n      current !== null &&\n      (candidate.credentialId !== current.credentialId ||\n        encodeTotpRecord({ ...candidate, pending: current.pending }) !== encodeTotpRecord(current))\n    )\n      return reject;\n    if (\n      current === null &&\n      (candidate.secret !== null ||\n        candidate.recoveryDigests.length !== 0 ||\n        candidate.acceptedStep !== -1 ||\n        candidate.failedAttempts !== 0)\n    )\n      return reject;\n    next = candidate;\n    timeBound(0, candidate.pending.expiresAtMillis);\n  } else {\n    if (current === null) return reject;\n    next = { ...current };\n    if (action._tag === \"Confirm\") {\n      const pending = current.pending;\n\n      if (\n        pending === null ||\n        pending.enrollmentId !== action.enrollmentId ||\n        pending.expiresAtMillis <= now ||\n        pending.failedAttempts >= policy.attemptLimit\n      )\n        return reject;\n      timeBound(0, pending.expiresAtMillis);\n      if (\n        action.matchedStep === null ||\n        Math.abs(Math.floor(now / 30000) - action.matchedStep) > policy.clockSkewSteps\n      ) {\n        next = { ...current, pending: { ...pending, failedAttempts: pending.failedAttempts + 1 } };\n        accepted = false;\n      } else {\n        if (new Set(action.recoveryDigests).size !== 10) return reject;\n        next = {\n          ...current,\n          secret: pending.secret,\n          revision: pending.secret.revision,\n          pending: null,\n          recoveryDigests: action.recoveryDigests,\n          acceptedStep: action.matchedStep,\n          attemptWindow: now,\n          failedAttempts: 0,\n        };\n        semantic = true;\n        timeBound(\n          Math.max(0, (action.matchedStep - policy.clockSkewSteps) * 30000),\n          (action.matchedStep + policy.clockSkewSteps + 1) * 30000,\n        );\n      }\n    } else if (action._tag === \"Verify\" || action._tag === \"Recovery\") {\n      if (current.secret === null) return reject;\n\n      const expired = now >= current.attemptWindow + policy.attemptWindowMillis,\n        attempts = expired ? 0 : current.failedAttempts,\n        start = expired ? now : current.attemptWindow;\n\n      if (attempts >= policy.attemptLimit) return reject;\n      next = { ...current, attemptWindow: start, failedAttempts: attempts + 1 };\n      if (action._tag === \"Verify\") {\n        if (\n          action.matchedStep === null ||\n          action.matchedStep <= current.acceptedStep ||\n          Math.abs(Math.floor(now / 30000) - action.matchedStep) > policy.clockSkewSteps\n        )\n          accepted = false;\n        else {\n          next = { ...next, acceptedStep: action.matchedStep, failedAttempts: 0 };\n          timeBound(\n            Math.max(0, (action.matchedStep - policy.clockSkewSteps) * 30000),\n            (action.matchedStep + policy.clockSkewSteps + 1) * 30000,\n          );\n        }\n      } else {\n        if (\n          (action.reset\n            ? policy.lostFactorRecovery !== \"reset-with-recovery-code\"\n            : !policy.allowRecoveryCodeForPending) ||\n          !current.recoveryDigests.includes(action.digest)\n        )\n          accepted = false;\n        else {\n          next = {\n            ...next,\n            recoveryDigests: current.recoveryDigests.filter((value) => value !== action.digest),\n            failedAttempts: 0,\n          };\n          if (action.reset) {\n            next = {\n              ...next,\n              secret: null,\n              pending: null,\n              recoveryDigests: [],\n              revision: randomId(),\n            };\n            semantic = true;\n          }\n        }\n      }\n    } else {\n      if (current.secret === null) return reject;\n      semantic = true;\n      if (action._tag === \"Disable\")\n        next = {\n          ...current,\n          secret: null,\n          pending: null,\n          recoveryDigests: [],\n          revision: randomId(),\n        };\n      else {\n        if (new Set(action.recoveryDigests).size !== 10) return reject;\n        next = { ...current, recoveryDigests: action.recoveryDigests };\n      }\n    }\n  }\n  next = { ...next, version: randomId() };\n\n  const subject = mapping.subject,\n    factor = mapping.factor,\n    auth = mapping.credential;\n\n  const subjectKey = { [subject.id]: nativeId };\n\n  if (semantic) {\n    const revision = randomId(),\n      updates = {\n        [subject.securityRevision]: revision,\n        [subject.factorEnabled]: subject.encodeEnabled(next.secret !== null),\n      };\n\n    yield* owner.update(subject.table, subjectKey, updates);\n    const idKey = { [auth.id]: next.credentialId, [auth.subjectId]: nativeId };\n    const existing = yield* owner.read(auth.table, equal(auth.table, idKey), { limit: 1 });\n\n    if (existing.rows.length === 0) {\n      const values = {\n        ...auth.encodeInsert({\n          credentialId: next.credentialId,\n          subjectId: nativeId,\n          revision: next.revision,\n          active: next.secret !== null,\n        }),\n        [auth.id]: next.credentialId,\n        [auth.subjectId]: nativeId,\n        [auth.revision]: next.revision,\n        [auth.status]: auth.encodeStatus(next.secret !== null),\n      };\n\n      existing.rows = (yield* owner.insert(auth.table, values, {\n        [auth.id]: next.credentialId,\n      })).rows;\n    } else\n      yield* owner.update(auth.table, idKey, {\n        [auth.revision]: next.revision,\n        [auth.status]: auth.encodeStatus(next.secret !== null),\n      });\n    // Management proof observations precede its own credential/revision mutation.\n    // Retain all unrelated credential authority checks at final commit.\n  }\n\n  const state = encodeTotpRecord(next),\n    values = { [factor.state]: state, [factor.version]: next.version };\n\n  if (factorRow === undefined) {\n    const insert = factor.encodeInsert({ scope, state, version: next.version });\n\n    invariant(\n      insert[factor.scope] === scope &&\n        insert[factor.state] === state &&\n        insert[factor.version] === next.version,\n    );\n    factorObservation.rows = (yield* owner.insert(factor.table, insert, {\n      [factor.scope]: scope,\n    })).rows;\n  } else yield* owner.update(factor.table, { [factor.scope]: scope }, values);\n  if (commandObservation !== undefined) {\n    const values = factor.encodeInsert({\n      scope: commandScope,\n      state: \"totp-command/v1\",\n      version: randomId(),\n    });\n\n    invariant(values[factor.scope] === commandScope && values[factor.state] === \"totp-command/v1\");\n    commandObservation.rows = (yield* owner.insert(factor.table, values, {\n      [factor.scope]: commandScope,\n    })).rows;\n  }\n  // Exact pre-write observations plus final readback are asserted by the common owner.\n  // Include active subject and native time at finalization, including on rejection commits.\n  guards.push(\n    sql`exists(select 1 from ${subject.table} where ${both(equal(subject.table, subjectKey), subject.activeCondition)})`,\n  );\n  owner.postconditions.push(\n    ...guards,\n    ...timeGuards,\n    ...credentialGuards\n      .filter((guard) => !semantic || guard.credentialId !== next.credentialId)\n      .map((guard) => guard.condition),\n  );\n\n  return accepted ? { _tag: \"Accepted\" as const, record: next } : reject;\n});\n"],"mappings":";;;;;;;AAcA,MAAa,oBAAoB,gBAAgB,KAAK,CAAC,CAAC;AAExD,MAAa,aAAwD,cAAc;CACjF,IAAI,CAAC,WAAW,MAAM,YAAY;AACpC;AAEA,IAAa,yBAAb,cAA4C,QAAQ,QAGlD,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC;AAEnD,MAAa,EAAE,OAAO,KAAK,cAAc,oBAAoB,WAAW;AACxE,MAAM,QAAQ,OAAO,eAAe,UAAU;AAE9C,MAAa,oBAAoB,WAAuB,OAAO,WAAW,KAAK,CAAC,CAAC,MAAM;AACvF,MAAa,oBAAoB,UAAkB,OAAO,WAAW,KAAK,CAAC,CAAC,KAAK;AAEjF,MAAM,YAAY,UAAkB,cAClC,OAAO,6BAA6B,SAAS,OAAO,GAAG,SAAS,GAAG,WAAW;AAEhF,MAAa,cAAc,OAAO,GAAG,oBAAoB,CAAC,CAAC,WACzD,SACA,WACA;CACA,MAAM,QAAQ,OAAO,wBACnB,UAAU,QAAQ,SAClB,SAAS,QAAQ,QACjB,WAAW,QAAQ,WAAW,SAAS,SAAS;CAElD,UAAU,QAAQ,WAAW,UAAU,QAAQ,MAAM,SAAS;CAQ9D,MAAM,cAAa,OANK,MAAM,KAC5B,QAAQ,OACR,MAAM,QAAQ,OAAO,GAAG,QAAQ,KAAK,SAAS,CAAC,GAC/C,EAAE,OAAO,EAAE,CACb,EAAA,CAE4B,KAAK;CAEjC,IACE,eAAe,KAAA,KACf,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,QAAQ,MAAM,SAAS,KAAK,MAAM,MAAM,QAAQ,OAAO,UAAU,GAAG,QAAQ,eAAe,EAAE,EAC1H,IAEA,OAAO,KAAA;CAET,MAAM,QAAQ,SAAS,QAAQ,UAAU,SAAS,GAChD,QAAQ,OAAO,MAAM,KAAK,OAAO,OAAO,MAAM,OAAO,OAAO,GAAG,OAAO,QAAQ,MAAM,CAAC,GAAG,EACtF,OAAO,EACT,CAAC,GACD,MAAM,MAAM,KAAK;CAEnB,MAAM,SAAS,QAAQ,KAAA,IAAY,OAAO,iBAAiB,IAAI,OAAO,MAAgB;CAEtF,UACE,WAAW,SACP,OAAO,WAAW,QAAQ,OAAO,OAAO,aAAa,OAAO,cAC3D,OAAO,YAAY,QAAQ,OAAO,QAAQ,OAAO,aAAa,OAAO,QAAQ,SACpF;CACA,UACE,WAAW,QACR,OAAO,aAAa,QAAQ,YAC3B,OAAO,cAAc,aACrB,OAAO,YAAY,IAAK,OAAO,QACrC;CAEA,OAAO;EACL;EACA;EACA,WAAW;EACX,mBAAmB;EACnB;EACA,UAAU;GACR,UAAU;IACR;IACA,kBAAkB,iBAAiB,KAAK,WAAW,QAAQ,iBAA2B;IACtF,aACE,WAAW,QAAQ,OAAO,WAAW,OACjC,CAAC,IACD,CACE;KACE,cAAc,OAAO;KACrB,UAAU,iBAAiB,KAAK,OAAO,QAAQ;IACjD,CACF;GACR;GACA;EACF;CACF;AACF,CAAC;AAED,MAAM,SAAuB,EAAE,MAAM,WAAW;AAEhD,MAAa,aAAa,OAAO,GAAG,mBAAmB,CAAC,CAAC,WACvD,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,UACE,MAAM,aAAa,QAAQ,YACzB,OAAO,WAAW,OAAO,eAAe,UAAU,CAAC,CAAC,CAAC,MAAM,MAAM,MAC/D,OAAO,WAAW,OAAO,eAAe,UAAU,CAAC,CAAC,CAAC,QAAQ,MAAM,CACzE;CACA,MAAM,WAAW,OAAO,YAAY,SAAS,MAAM,SAAS;CAE5D,IAAI,aAAa,KAAA,GAAW,OAAO;CAEnC,MAAM,EAAE,UAAU,YAAY,WAAW,mBAAmB,OAAO,aAAa,UAC9E,UAAU,SAAS,QACnB,SAAS,MAAM,QACf,SAAS,MAAM;CAEjB,IACE,SAAS,SAAS,qBAAqB,MAAM,SAAS,SAAS,qBAC9D,SAAS,WAAW,WAAW,MAAM,SAAS,QAAQ,WAAW,OAElE,OAAO;CACT,IACG,YAAY,UAAW,MAAM,SAAS,WAAW,SACjD,YAAY,QAAQ,iBAAiB,OAAO,MAAM,iBAAiB,MAAM,SAAS,MAAO,GAE1F,OAAO;CACT,MAAM,MAAM,OAAO,MAAM,IAAI,EAAE,iBAAiB,QAAQ,gBAAgB,CAAC;CACzE,MAAM,SAAgB,CAAC;CACvB,MAAM,mBAA+D,CAAC;CAEtE,MAAM,eAAe,OACnB,+BAA+B,QAAQ,SAAS,OAAO,GAAG,QAAQ,SAAS,GAAG,MAAM,UAAU,OAAO,GAAG,MAAM,UAAU,GAAG,MAAM,WACnI;CAIA,MAAM,qBAFa;EAAC;EAAU;EAAW;EAAW;CAAY,CAAC,CAAC,SAAS,OAAO,IAE9C,IAChC,OAAO,MAAM,KACX,QAAQ,OAAO,OACf,MAAM,QAAQ,OAAO,OAAO,GAAG,QAAQ,OAAO,QAAQ,aAAa,CAAC,GACpE,EAAE,OAAO,EAAE,CACb,IACA,KAAA;CAEJ,IAAI,uBAAuB,KAAA,KAAa,mBAAmB,KAAK,WAAW,GAAG,OAAO;CACrF,MAAM,aAAoB,CAAC;CAE3B,MAAM,aAAa,OAAe,QAAgB;EAChD,WAAW,KACT,GAAG,GAAG,QAAQ,gBAAgB,MAAM,MAAM,OAAO,QAAQ,gBAAgB,KAAK,KAChF;CACF;CAEA,IACE,OAAO,SAAS,YAChB,OAAO,SAAS,aAChB,OAAO,SAAS,aAChB,OAAO,SAAS,cAChB;EACA,MAAM,gBAAgB,MAAM;EAE5B,IAAI,kBAAkB,KAAA,GAAW,OAAO;EACxC,MAAM,EAAE,WAAW,aAAa;EAEhC,MAAM,iBAAiB;GACrB,QAAQ;GACR,SAAS;GACT,SAAS;GACT,YAAY;EACd,EAAE,OAAO;EAET,IACE,UAAU,WAAW,kBACrB,UAAU,aAAa,QAAQ,YAC/B,UAAU,cAAc,MAAM,aAC9B,UAAU,SAAS,cAAc,MAAM,aACvC,UAAU,SAAS,qBAAqB,SAAS,SAAS,oBAC1D,SAAS,WAAW,UAAU,UAC9B,SAAS,kBAAkB,UAAU,iBACrC,SAAS,SAAS,cAAc,MAAM,aACtC,SAAS,SAAS,qBAAqB,SAAS,SAAS,kBAEzD,OAAO;EACT,MAAM,OAAO,QAAQ;EAErB,KAAK,MAAM,YAAY,CAAC,GAAG,SAAS,SAAS,WAAW,CAAC,CAAC,MAAM,GAAG,MACjE,EAAE,aAAa,cAAc,EAAE,YAAY,CAC7C,GAAG;GAOD,MAAM,OAAM,OANS,MAAM,KACzB,KAAK,OACL,MAAM,KAAK,OAAO;KAAG,KAAK,KAAK,SAAS;KAAe,KAAK,YAAY;GAAS,CAAC,GAClF,EAAE,OAAO,EAAE,CACb,EAAA,CAEkB,KAAK;GAEvB,IAAI,QAAQ,KAAA,KAAa,IAAI,KAAK,cAAc,SAAS,UAAU,OAAO;GAC1E,MAAM,YAAY,GAAG,wBAAwB,KAAK,MAAM,SAAS,KAAK,MAAM,MAAM,KAAK,OAAO,GAAG,GAAG,KAAK,eAAe,EAAE;GAE1H,IAAI,EAAE,OAAO,MAAM,MAAM,SAAS,IAAI,OAAO;GAC7C,iBAAiB,KAAK;IAAE,cAAc,SAAS;IAAc;GAAU,CAAC;EAC1E;EAEA,MAAM,WAAW,SAAS,OAAO,QAAQ,UACvC,SAAS,SAAS,YAAY,MAC3B,aAAa,SAAS,iBAAiB,MAAM,YAChD,CACF;EAEA,IAAI,SAAS,WAAW,SAAS,OAAO,UAAU,SAAS,WAAW,GAAG,OAAO;EAEhF,MAAM,eAAe,CACnB,cAAc,aACd,OAAO,WAAW,yBAAyB,CAAC,CAC1C,QAAQ,QAAQ,kBAAkB,UAAU,UAAU,CAAC,CACzD,CACF;EAEA,MAAM,aAAa,KAAK,IACtB,OAAO,0BACP,GAAG,aAAa,KAAK,gBAAgB,YAAY,gBAAgB,CACnE;EAEA,MAAM,kBAAkB,IAAI,IAAI,SAAS,SAAS,UAAU,MAAM,OAAO,CAAC;EAC1E,MAAM,sBAAsB,IAAI,IAAI,SAAS,KAAK,UAAU,MAAM,YAAY,CAAC;EAE/E,KAAK,MAAM,eAAe,cACxB,IACE,CAAC,YAAY,aAAa,MACvB,gBACC,YAAY,QAAQ,OAAO,WAAW,gBAAgB,IAAI,MAAM,CAAC,KACjE,oBAAoB,QAAQ,YAAY,sBACxC,SAAS,MACN,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ,GAEA,OAAO;EAEX,KAAK,MAAM,SAAS,UAAU;GAC5B,MAAM,aAAa,MAAM,WAAW;GAEpC,IAAI,aAAa,OAAO,MAAM,cAAc,YAAY,OAAO;GAC/D,UAAU,YAAY,aAAa,UAAU;EAC/C;EACA,IACG,YAAY,QAAQ,QAAQ,WAAW,QACxC,OAAO,SAAS,aAChB,OAAO,SAAS,cAChB;GACA,MAAM,UAAU,IAAI,IAAI,SAAS,SAAS,UAAU,MAAM,OAAO,CAAC;GAElE,IACE,EACE,SAAS,MACN,UACC,MAAM,gBAAgB,MAAM,qBAAqB,MAAM,QAAQ,SAAS,YAAY,CACxF,KACC,QAAQ,IAAI,WAAW,KACtB,QAAQ,IAAI,YAAY,KACxB,IAAI,IAAI,SAAS,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,QAAQ,IAGjE,OAAO;EACX;CACF;CACA,IAAI,OAAO,SAAS,cAAc,OAAO,OAAO;EAC9C,MAAM,SAAS,OAAO;EAEtB,IACE,WAAW,KAAA,KACX,QAAQ,qBAAqB,KAAA,KAC7B,OAAO,SAAS,cAAc,MAAM,aACpC,OAAO,SAAS,qBAAqB,SAAS,SAAS,oBACvD,OAAO,mBAAmB,KAE1B,OAAO;EACT,MAAM,YAAY,QAAQ,iBAAiB,QAAQ,QAAQ;EAE3D,IAAI,EAAE,OAAO,MAAM,MAAM,SAAS,IAAI,OAAO;EAC7C,OAAO,KAAK,SAAS;EACrB,UAAU,GAAG,OAAO,eAAe;CACrC;CAEA,IAAI,MACF,WAAW,OACX,WAAW;CAEb,IAAI,OAAO,SAAS,UAAU;EAC5B,MAAM,YAAY,OAAO;EAEzB,IACE,UAAU,cAAc,MAAM,aAC9B,UAAU,aAAa,MAAM,YAC7B,UAAU,YAAY,QACtB,UAAU,QAAQ,mBAAmB,OACrC,UAAU,QAAQ,kBAAkB,MAAM,OAAO,4BACjD,UAAU,QAAQ,mBAAmB,KACrC,UAAU,QAAQ,OAAO,aAAa,UAAU,QAAQ,UAExD,OAAO;EAET,IAAI,YAAY,QAAQ,QAAQ,YAAY,QAAQ,QAAQ,QAAQ,kBAAkB,KACpF,OAAO;EACT,IACE,YAAY,SACX,UAAU,iBAAiB,QAAQ,gBAClC,iBAAiB;GAAE,GAAG;GAAW,SAAS,QAAQ;EAAQ,CAAC,MAAM,iBAAiB,OAAO,IAE3F,OAAO;EACT,IACE,YAAY,SACX,UAAU,WAAW,QACpB,UAAU,gBAAgB,WAAW,KACrC,UAAU,iBAAiB,MAC3B,UAAU,mBAAmB,IAE/B,OAAO;EACT,OAAO;EACP,UAAU,GAAG,UAAU,QAAQ,eAAe;CAChD,OAAO;EACL,IAAI,YAAY,MAAM,OAAO;EAC7B,OAAO,EAAE,GAAG,QAAQ;EACpB,IAAI,OAAO,SAAS,WAAW;GAC7B,MAAM,UAAU,QAAQ;GAExB,IACE,YAAY,QACZ,QAAQ,iBAAiB,OAAO,gBAChC,QAAQ,mBAAmB,OAC3B,QAAQ,kBAAkB,OAAO,cAEjC,OAAO;GACT,UAAU,GAAG,QAAQ,eAAe;GACpC,IACE,OAAO,gBAAgB,QACvB,KAAK,IAAI,KAAK,MAAM,MAAM,GAAK,IAAI,OAAO,WAAW,IAAI,OAAO,gBAChE;IACA,OAAO;KAAE,GAAG;KAAS,SAAS;MAAE,GAAG;MAAS,gBAAgB,QAAQ,iBAAiB;KAAE;IAAE;IACzF,WAAW;GACb,OAAO;IACL,IAAI,IAAI,IAAI,OAAO,eAAe,CAAC,CAAC,SAAS,IAAI,OAAO;IACxD,OAAO;KACL,GAAG;KACH,QAAQ,QAAQ;KAChB,UAAU,QAAQ,OAAO;KACzB,SAAS;KACT,iBAAiB,OAAO;KACxB,cAAc,OAAO;KACrB,eAAe;KACf,gBAAgB;IAClB;IACA,WAAW;IACX,UACE,KAAK,IAAI,IAAI,OAAO,cAAc,OAAO,kBAAkB,GAAK,IAC/D,OAAO,cAAc,OAAO,iBAAiB,KAAK,GACrD;GACF;EACF,OAAO,IAAI,OAAO,SAAS,YAAY,OAAO,SAAS,YAAY;GACjE,IAAI,QAAQ,WAAW,MAAM,OAAO;GAEpC,MAAM,UAAU,OAAO,QAAQ,gBAAgB,OAAO,qBACpD,WAAW,UAAU,IAAI,QAAQ,gBACjC,QAAQ,UAAU,MAAM,QAAQ;GAElC,IAAI,YAAY,OAAO,cAAc,OAAO;GAC5C,OAAO;IAAE,GAAG;IAAS,eAAe;IAAO,gBAAgB,WAAW;GAAE;GACxE,IAAI,OAAO,SAAS,UAAU;IAC5B,IACE,OAAO,gBAAgB,QACvB,OAAO,eAAe,QAAQ,gBAC9B,KAAK,IAAI,KAAK,MAAM,MAAM,GAAK,IAAI,OAAO,WAAW,IAAI,OAAO,gBAEhE,WAAW;SACR;KACH,OAAO;MAAE,GAAG;MAAM,cAAc,OAAO;MAAa,gBAAgB;KAAE;KACtE,UACE,KAAK,IAAI,IAAI,OAAO,cAAc,OAAO,kBAAkB,GAAK,IAC/D,OAAO,cAAc,OAAO,iBAAiB,KAAK,GACrD;IACF;GACF,OACE,KACG,OAAO,QACJ,OAAO,uBAAuB,6BAC9B,CAAC,OAAO,gCACZ,CAAC,QAAQ,gBAAgB,SAAS,OAAO,MAAM,GAE/C,WAAW;QACR;IACH,OAAO;KACL,GAAG;KACH,iBAAiB,QAAQ,gBAAgB,QAAQ,UAAU,UAAU,OAAO,MAAM;KAClF,gBAAgB;IAClB;IACA,IAAI,OAAO,OAAO;KAChB,OAAO;MACL,GAAG;MACH,QAAQ;MACR,SAAS;MACT,iBAAiB,CAAC;MAClB,UAAU,SAAS;KACrB;KACA,WAAW;IACb;GACF;EAEJ,OAAO;GACL,IAAI,QAAQ,WAAW,MAAM,OAAO;GACpC,WAAW;GACX,IAAI,OAAO,SAAS,WAClB,OAAO;IACL,GAAG;IACH,QAAQ;IACR,SAAS;IACT,iBAAiB,CAAC;IAClB,UAAU,SAAS;GACrB;QACG;IACH,IAAI,IAAI,IAAI,OAAO,eAAe,CAAC,CAAC,SAAS,IAAI,OAAO;IACxD,OAAO;KAAE,GAAG;KAAS,iBAAiB,OAAO;IAAgB;GAC/D;EACF;CACF;CACA,OAAO;EAAE,GAAG;EAAM,SAAS,SAAS;CAAE;CAEtC,MAAM,UAAU,QAAQ,SACtB,SAAS,QAAQ,QACjB,OAAO,QAAQ;CAEjB,MAAM,aAAa,GAAG,QAAQ,KAAK,SAAS;CAE5C,IAAI,UAAU;EACZ,MAAM,WAAW,SAAS,GACxB,UAAU;IACP,QAAQ,mBAAmB;IAC3B,QAAQ,gBAAgB,QAAQ,cAAc,KAAK,WAAW,IAAI;EACrE;EAEF,OAAO,MAAM,OAAO,QAAQ,OAAO,YAAY,OAAO;EACtD,MAAM,QAAQ;IAAG,KAAK,KAAK,KAAK;IAAe,KAAK,YAAY;EAAS;EACzE,MAAM,WAAW,OAAO,MAAM,KAAK,KAAK,OAAO,MAAM,KAAK,OAAO,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC;EAErF,IAAI,SAAS,KAAK,WAAW,GAAG;GAC9B,MAAM,SAAS;IACb,GAAG,KAAK,aAAa;KACnB,cAAc,KAAK;KACnB,WAAW;KACX,UAAU,KAAK;KACf,QAAQ,KAAK,WAAW;IAC1B,CAAC;KACA,KAAK,KAAK,KAAK;KACf,KAAK,YAAY;KACjB,KAAK,WAAW,KAAK;KACrB,KAAK,SAAS,KAAK,aAAa,KAAK,WAAW,IAAI;GACvD;GAEA,SAAS,QAAQ,OAAO,MAAM,OAAO,KAAK,OAAO,QAAQ,GACtD,KAAK,KAAK,KAAK,aAClB,CAAC,EAAA,CAAG;EACN,OACE,OAAO,MAAM,OAAO,KAAK,OAAO,OAAO;IACpC,KAAK,WAAW,KAAK;IACrB,KAAK,SAAS,KAAK,aAAa,KAAK,WAAW,IAAI;EACvD,CAAC;CAGL;CAEA,MAAM,QAAQ,iBAAiB,IAAI,GACjC,SAAS;GAAG,OAAO,QAAQ;GAAQ,OAAO,UAAU,KAAK;CAAQ;CAEnE,IAAI,cAAc,KAAA,GAAW;EAC3B,MAAM,SAAS,OAAO,aAAa;GAAE;GAAO;GAAO,SAAS,KAAK;EAAQ,CAAC;EAE1E,UACE,OAAO,OAAO,WAAW,SACvB,OAAO,OAAO,WAAW,SACzB,OAAO,OAAO,aAAa,KAAK,OACpC;EACA,kBAAkB,QAAQ,OAAO,MAAM,OAAO,OAAO,OAAO,QAAQ,GACjE,OAAO,QAAQ,MAClB,CAAC,EAAA,CAAG;CACN,OAAO,OAAO,MAAM,OAAO,OAAO,OAAO,GAAG,OAAO,QAAQ,MAAM,GAAG,MAAM;CAC1E,IAAI,uBAAuB,KAAA,GAAW;EACpC,MAAM,SAAS,OAAO,aAAa;GACjC,OAAO;GACP,OAAO;GACP,SAAS,SAAS;EACpB,CAAC;EAED,UAAU,OAAO,OAAO,WAAW,gBAAgB,OAAO,OAAO,WAAW,iBAAiB;EAC7F,mBAAmB,QAAQ,OAAO,MAAM,OAAO,OAAO,OAAO,QAAQ,GAClE,OAAO,QAAQ,aAClB,CAAC,EAAA,CAAG;CACN;CAGA,OAAO,KACL,GAAG,wBAAwB,QAAQ,MAAM,SAAS,KAAK,MAAM,QAAQ,OAAO,UAAU,GAAG,QAAQ,eAAe,EAAE,EACpH;CACA,MAAM,eAAe,KACnB,GAAG,QACH,GAAG,YACH,GAAG,iBACA,QAAQ,UAAU,CAAC,YAAY,MAAM,iBAAiB,KAAK,YAAY,CAAC,CACxE,KAAK,UAAU,MAAM,SAAS,CACnC;CAEA,OAAO,WAAW;EAAE,MAAM;EAAqB,QAAQ;CAAK,IAAI;AAClE,CAAC"}

package/dist/drizzle/totp-target.d.mts

@@ -0,0 +1,17 @@
+import { PersistenceMappingError } from "../internal/mapping-error.mjs";
+import "./model.mjs";
+import "./transaction-owner.mjs";
+import { TransactionCoordinatorError } from "../internal/transaction-execution-kernel.mjs";
+import "./transaction-execution.mjs";
+import "./totp-model.mjs";
+import "./SuppliedService.mjs";
+import { Effect } from "effect";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { Table } from "drizzle-orm";
+import { TotpConfigurationError, TotpPersistence, TotpUnavailable } from "@yielded/auth/Totp";
+import { Statement } from "effect/unstable/sql/Statement";
+//#region src/drizzle/totp-target.d.ts
+type TotpCoordinatorError<E> = TransactionCoordinatorError<E, TotpUnavailable> | TotpConfigurationError | PersistenceMappingError;
+//#endregion
+export { TotpCoordinatorError };
+//# sourceMappingURL=totp-target.d.mts.map

package/dist/drizzle/totp-target.mjs

@@ -0,0 +1,81 @@
+import { coordinateTransactionOwner, makeTransactionExecution, sqlClientTransactionStandaloneGuard } from "./transaction-execution.mjs";
+import { requiredTotpConstraints } from "./totp-model.mjs";
+import { CurrentTotpTransaction, captureTotp, invariant, mutateTotp, unavailable } from "./totp-state.mjs";
+import { Context, Effect, Schema } from "effect";
+import { randomId } from "@yielded/auth/Persistence";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import { TotpConfigurationError, TotpMutation, TotpPersistence, TotpPolicy } from "@yielded/auth/Totp";
+//#region src/drizzle/totp-target.ts
+const sqlClientTotpStandaloneGuard = (database) => sqlClientTransactionStandaloneGuard(unavailable, database);
+const validateMapping = (original, configuration) => {
+	const mapping = original;
+	invariant(mapping.moduleId.length > 0);
+	Schema.decodeSync(TotpPolicy)(mapping.policy);
+	for (const [key, value] of Object.entries(requiredTotpConstraints)) invariant(mapping.constraints?.[key] === value);
+	if (configuration.mode === "batch") invariant(mapping.d1?.primary === true);
+	return Object.freeze({
+		...mapping,
+		policy: Object.freeze({ ...mapping.policy }),
+		subject: Object.freeze({ ...mapping.subject }),
+		factor: Object.freeze({ ...mapping.factor }),
+		credential: Object.freeze({ ...mapping.credential }),
+		subjectIds: Object.freeze({ ...mapping.subjectIds })
+	});
+};
+const services = (mapping, execution, hooks) => ({ totpPersistence: TotpPersistence.of({
+	snapshot: Effect.fn("TotpNative.snapshot")(function* (input) {
+		const captured = { ...input };
+		invariant(captured.moduleId === mapping.moduleId);
+		yield* execution.admit;
+		return yield* execution.run(Effect.map(captureTotp(mapping, captured.subjectId), (value) => value?.snapshot), false).pipe(Effect.provideService(LifecycleHooks, hooks));
+	}, Effect.catchDefect(() => Effect.fail(unavailable()))),
+	mutate: (original, prepare) => Effect.suspend(() => {
+		const codec = Schema.toCodecIso(TotpMutation);
+		const input = Schema.decodeSync(codec)(Schema.encodeSync(codec)(original));
+		return execution.admit.pipe(Effect.andThen(execution.run(Effect.gen(function* () {
+			const decision = yield* mutateTotp(mapping, input), owner = yield* CurrentTotpTransaction;
+			owner.guards.push(owner.journal.prepare(void 0));
+			const receipt = prepare(decision, owner.journal);
+			invariant(receipt?._tag === "PreparedCommit" && Effect.isEffect(receipt.read));
+			owner.guards.push(receipt);
+			return receipt;
+		}))), Effect.provideService(LifecycleHooks, hooks));
+	}).pipe(Effect.catchDefect(() => Effect.fail(unavailable())))
+}) });
+const makeTargetTotpPersistence = (database, source, configuration) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);
+	const mapping = yield* Effect.try({
+		try: () => validateMapping(original, configuration),
+		catch: () => TotpConfigurationError.make({})
+	});
+	const execution = makeTransactionExecution(CurrentTotpTransaction, database, configuration, unavailable, randomId);
+	return services(mapping, execution, hooks);
+});
+const coordinateTargetTotp = (database, source, configuration, body) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);
+	const mapping = yield* Effect.try({
+		try: () => validateMapping(original, configuration),
+		catch: () => TotpConfigurationError.make({})
+	});
+	return yield* coordinateTransactionOwner(database, CurrentTotpTransaction, configuration, Effect.void, unavailable, randomId, (execution) => services(mapping, execution, hooks), body);
+});
+/** Concrete driver wrappers select transaction mode; cryptography always precedes these owners. */
+const makeTotpTarget = (configuration) => {
+	function coordinateTotpPersistence(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetTotp(database, options.mapping, configuration, (transaction, services) => {
+			const provided = Context.make(TotpPersistence, services.totpPersistence);
+			const work = Effect.provideContext(body, provided);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	return {
+		makeTotpPersistenceServices: (database, mapping) => makeTargetTotpPersistence(database, mapping, configuration),
+		coordinateTotpPersistence
+	};
+};
+//#endregion
+export { coordinateTargetTotp, makeTargetTotpPersistence, makeTotpTarget, sqlClientTotpStandaloneGuard };
+
+//# sourceMappingURL=totp-target.mjs.map

package/dist/drizzle/totp-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp-target.mjs","names":[],"sources":["../../src/drizzle/totp-target.ts"],"sourcesContent":["import { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport { randomId } from \"@yielded/auth/Persistence\";\nimport {\n  TotpConfigurationError,\n  type TotpUnavailable,\n  TotpMutation,\n  TotpPolicy,\n  TotpPersistence,\n} from \"@yielded/auth/Totp\";\nimport type { Table } from \"drizzle-orm\";\n/* oxlint-disable no-explicit-any -- shared native implementation; driver entrypoints retain exact database and table types. */\nimport { Context, Effect, Schema } from \"effect\";\nimport type { Statement } from \"effect/unstable/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"./model\";\nimport type { SuppliedService } from \"./SuppliedService\";\nimport {\n  type TotpMapping,\n  type TotpMappingSource,\n  type TotpPersistenceServices,\n  requiredTotpConstraints,\n} from \"./totp-model\";\nimport {\n  captureTotp,\n  CurrentTotpTransaction,\n  invariant,\n  mutateTotp,\n  unavailable,\n} from \"./totp-state\";\nimport {\n  coordinateTransactionOwner,\n  makeTransactionExecution,\n  sqlClientTransactionStandaloneGuard,\n  type TransactionExecution,\n  type TransactionTargetConfiguration,\n  type TransactionCoordinatorError,\n} from \"./transaction-execution\";\nimport type { TransactionNativeDatabase } from \"./transaction-owner\";\nexport type TotpTargetConfiguration = TransactionTargetConfiguration<TotpUnavailable>;\n\nexport type TotpCoordinatorError<E> =\n  | TransactionCoordinatorError<E, TotpUnavailable>\n  | TotpConfigurationError\n  | PersistenceMappingError;\n\nexport const sqlClientTotpStandaloneGuard = (\n  database: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n) => sqlClientTransactionStandaloneGuard(unavailable, database);\n\nconst validateMapping = <M>(original: M, configuration: TotpTargetConfiguration): M => {\n  const mapping = original as any;\n\n  invariant(mapping.moduleId.length > 0);\n  Schema.decodeSync(TotpPolicy)(mapping.policy);\n  for (const [key, value] of Object.entries(requiredTotpConstraints))\n    invariant(mapping.constraints?.[key] === value);\n  if (configuration.mode === \"batch\") invariant(mapping.d1?.primary === true);\n\n  return Object.freeze({\n    ...mapping,\n    policy: Object.freeze({ ...mapping.policy }),\n    subject: Object.freeze({ ...mapping.subject }),\n    factor: Object.freeze({ ...mapping.factor }),\n    credential: Object.freeze({ ...mapping.credential }),\n    subjectIds: Object.freeze({ ...mapping.subjectIds }),\n  });\n};\n\nconst services = (\n  mapping: any,\n  execution: TransactionExecution<TotpUnavailable, CurrentTotpTransaction>,\n  hooks: LifecycleHooks[\"Service\"],\n): TotpPersistenceServices => ({\n  totpPersistence: TotpPersistence.of({\n    snapshot: Effect.fn(\"TotpNative.snapshot\")(\n      function* (input) {\n        const captured = { ...input };\n\n        invariant(captured.moduleId === mapping.moduleId);\n        yield* execution.admit;\n\n        return yield* execution\n          .run(\n            Effect.map(captureTotp(mapping, captured.subjectId), (value) => value?.snapshot),\n            false,\n          )\n          .pipe(Effect.provideService(LifecycleHooks, hooks));\n      },\n      Effect.catchDefect(() => Effect.fail(unavailable())),\n    ),\n    mutate: (original, prepare) =>\n      Effect.suspend(() => {\n        // Detach caller-owned payloads before any driver or hook can suspend.\n        const codec = Schema.toCodecIso(TotpMutation);\n        const input = Schema.decodeSync(codec)(Schema.encodeSync(codec)(original));\n\n        return execution.admit.pipe(\n          Effect.andThen(\n            execution.run(\n              Effect.gen(function* () {\n                const decision = yield* mutateTotp(mapping, input),\n                  owner = yield* CurrentTotpTransaction;\n\n                owner.guards.push(owner.journal.prepare(undefined));\n                const receipt = prepare(decision, owner.journal);\n\n                invariant(receipt?._tag === \"PreparedCommit\" && Effect.isEffect(receipt.read));\n                owner.guards.push(receipt as any);\n\n                return receipt;\n              }),\n            ),\n          ),\n          Effect.provideService(LifecycleHooks, hooks),\n        );\n      }).pipe(Effect.catchDefect(() => Effect.fail(unavailable()))),\n  }),\n});\n\nexport const makeTargetTotpPersistence = <\n  S extends Table,\n  F extends Table,\n  C extends Table,\n  N,\n  RSetup = never,\n>(\n  database: TransactionNativeDatabase,\n  source: TotpMappingSource<TotpMapping<S, F, C, N>, RSetup>,\n  configuration: TotpTargetConfiguration,\n) =>\n  Effect.gen(function* () {\n    const hooks = yield* LifecycleHooks;\n    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);\n\n    const mapping = yield* Effect.try({\n      try: () => validateMapping(original, configuration),\n      catch: () => TotpConfigurationError.make({}),\n    });\n\n    const execution = makeTransactionExecution(\n      CurrentTotpTransaction,\n      database,\n      configuration,\n      unavailable,\n      randomId,\n    );\n\n    return services(mapping, execution, hooks);\n  });\n\nexport const coordinateTargetTotp = <M, A, E, R, RSetup = never>(\n  database: TransactionNativeDatabase,\n  source: TotpMappingSource<M, RSetup>,\n  configuration: TotpTargetConfiguration,\n  body: (\n    transaction: any,\n    services: TotpPersistenceServices,\n    append: (statement: Statement<any>) => void,\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, TotpCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n  Effect.gen(function* () {\n    const hooks = yield* LifecycleHooks;\n    const original = yield* Effect.isEffect(source) ? source : Effect.succeed(source);\n\n    const mapping = yield* Effect.try({\n      try: () => validateMapping(original, configuration),\n      catch: () => TotpConfigurationError.make({}),\n    });\n\n    return yield* coordinateTransactionOwner(\n      database,\n      CurrentTotpTransaction,\n      configuration,\n      Effect.void,\n      unavailable,\n      randomId,\n      (execution) => services(mapping, execution, hooks),\n      body,\n    );\n  });\n\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\n\n/** Concrete driver wrappers select transaction mode; cryptography always precedes these owners. */\nexport const makeTotpTarget = <\n  D extends { readonly transaction: any },\n  T extends Table,\n  Extra = unknown,\n  Synchronous extends boolean = false,\n>(\n  configuration: TotpTargetConfiguration,\n) => {\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<TotpPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TotpPersistence>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<TotpPersistence | TxId> : R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, TotpPersistence | TxId>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinateTotpPersistence<\n    Database extends D,\n    S extends T,\n    F extends T,\n    C extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    TotpCoordinatorError<E> | DatabaseError,\n    Exclude<R, TotpPersistence> | LifecycleHooks | RSetup | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetTotp(\n        database as any,\n        options.mapping,\n        configuration,\n        (transaction: TransactionOf<Database>, services) => {\n          const provided = Context.make(TotpPersistence, services.totpPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  return {\n    makeTotpPersistenceServices: <\n      Database extends D,\n      S extends T,\n      F extends T,\n      C extends T,\n      N,\n      RSetup = never,\n    >(\n      database: Database,\n      mapping: TotpMappingSource<TotpMapping<S, F, C, N> & Extra, RSetup>,\n    ) => makeTargetTotpPersistence(database as any, mapping, configuration),\n    coordinateTotpPersistence,\n  };\n};\n"],"mappings":";;;;;;;;AA6CA,MAAa,gCACX,aACG,oCAAoC,aAAa,QAAQ;AAE9D,MAAM,mBAAsB,UAAa,kBAA8C;CACrF,MAAM,UAAU;CAEhB,UAAU,QAAQ,SAAS,SAAS,CAAC;CACrC,OAAO,WAAW,UAAU,CAAC,CAAC,QAAQ,MAAM;CAC5C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,uBAAuB,GAC/D,UAAU,QAAQ,cAAc,SAAS,KAAK;CAChD,IAAI,cAAc,SAAS,SAAS,UAAU,QAAQ,IAAI,YAAY,IAAI;CAE1E,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;EAC3C,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;EAC7C,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;EAC3C,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;EACnD,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACrD,CAAC;AACH;AAEA,MAAM,YACJ,SACA,WACA,WAC6B,EAC7B,iBAAiB,gBAAgB,GAAG;CAClC,UAAU,OAAO,GAAG,qBAAqB,CAAC,CACxC,WAAW,OAAO;EAChB,MAAM,WAAW,EAAE,GAAG,MAAM;EAE5B,UAAU,SAAS,aAAa,QAAQ,QAAQ;EAChD,OAAO,UAAU;EAEjB,OAAO,OAAO,UACX,IACC,OAAO,IAAI,YAAY,SAAS,SAAS,SAAS,IAAI,UAAU,OAAO,QAAQ,GAC/E,KACF,CAAC,CACA,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACtD,GACA,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD;CACA,SAAS,UAAU,YACjB,OAAO,cAAc;EAEnB,MAAM,QAAQ,OAAO,WAAW,YAAY;EAC5C,MAAM,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,OAAO,WAAW,KAAK,CAAC,CAAC,QAAQ,CAAC;EAEzE,OAAO,UAAU,MAAM,KACrB,OAAO,QACL,UAAU,IACR,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,WAAW,SAAS,KAAK,GAC/C,QAAQ,OAAO;GAEjB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;GAClD,MAAM,UAAU,QAAQ,UAAU,MAAM,OAAO;GAE/C,UAAU,SAAS,SAAS,oBAAoB,OAAO,SAAS,QAAQ,IAAI,CAAC;GAC7E,MAAM,OAAO,KAAK,OAAc;GAEhC,OAAO;EACT,CAAC,CACH,CACF,GACA,OAAO,eAAe,gBAAgB,KAAK,CAC7C;CACF,CAAC,CAAC,CAAC,KAAK,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC;AAChE,CAAC,EACH;AAEA,MAAa,6BAOX,UACA,QACA,kBAEA,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO;CACrB,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM;CAEhF,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAAW,gBAAgB,UAAU,aAAa;EAClD,aAAa,uBAAuB,KAAK,CAAC,CAAC;CAC7C,CAAC;CAED,MAAM,YAAY,yBAChB,wBACA,UACA,eACA,aACA,QACF;CAEA,OAAO,SAAS,SAAS,WAAW,KAAK;AAC3C,CAAC;AAEH,MAAa,wBACX,UACA,QACA,eACA,SAMA,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO;CACrB,MAAM,WAAW,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM;CAEhF,MAAM,UAAU,OAAO,OAAO,IAAI;EAChC,WAAW,gBAAgB,UAAU,aAAa;EAClD,aAAa,uBAAuB,KAAK,CAAC,CAAC;CAC7C,CAAC;CAED,OAAO,OAAO,2BACZ,UACA,wBACA,eACA,OAAO,MACP,aACA,WACC,cAAc,SAAS,SAAS,WAAW,KAAK,GACjD,IACF;AACF,CAAC;;AAOH,MAAa,kBAMX,kBACG;CAyDH,SAAS,0BAeP,SACA,SAIA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,qBACE,UACA,QAAQ,SACR,gBACC,aAAsC,aAAa;GAClD,MAAM,WAAW,QAAQ,KAAK,iBAAiB,SAAS,eAAe;GACvE,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,OAAO;EACL,8BAQE,UACA,YACG,0BAA0B,UAAiB,SAAS,aAAa;EACtE;CACF;AACF"}

package/dist/drizzle/transaction-execution.d.mts

@@ -0,0 +1,4 @@
+import "./transaction-owner.mjs";
+import { TransactionCoordinatorError, TransactionTargetConfiguration } from "../internal/transaction-execution-kernel.mjs";
+import "./transaction-execution.mjs";
+export type { TransactionCoordinatorError, TransactionTargetConfiguration };

package/dist/drizzle/transaction-execution.mjs

@@ -0,0 +1,11 @@
+import { makeTransactionExecutionKernel } from "../internal/transaction-execution-kernel.mjs";
+import { makeTransactionOwner, reportTransactionFailure } from "./transaction-owner.mjs";
+//#region src/drizzle/transaction-execution.ts
+const { sqlClientTransactionStandaloneGuard, makeTransactionExecution, coordinateTransactionOwner } = makeTransactionExecutionKernel({
+	makeTransactionOwner,
+	reportTransactionFailure
+});
+//#endregion
+export { coordinateTransactionOwner, makeTransactionExecution, sqlClientTransactionStandaloneGuard };
+
+//# sourceMappingURL=transaction-execution.mjs.map

package/dist/drizzle/transaction-execution.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction-execution.mjs","names":[],"sources":["../../src/drizzle/transaction-execution.ts"],"sourcesContent":["import { makeTransactionExecutionKernel } from \"../internal/transaction-execution-kernel\";\nimport { makeTransactionOwner, reportTransactionFailure } from \"./transaction-owner\";\nexport type { TransactionTargetConfiguration } from \"../internal/transaction-execution-kernel\";\nexport type { TransactionCoordinatorError } from \"../internal/transaction-execution-kernel\";\nexport type { TransactionBound } from \"../internal/transaction-execution-kernel\";\nexport type { TransactionExecution } from \"../internal/transaction-execution-kernel\";\n\nexport const {\n  sqlClientTransactionStandaloneGuard,\n  makeTransactionExecution,\n  coordinateTransactionOwner,\n} = makeTransactionExecutionKernel({ makeTransactionOwner, reportTransactionFailure });\n"],"mappings":";;;AAOA,MAAa,EACX,qCACA,0BACA,+BACE,+BAA+B;CAAE;CAAsB;AAAyB,CAAC"}

package/dist/drizzle/transaction-mysql.mjs

@@ -0,0 +1,46 @@
+import { Effect } from "effect";
+import { EffectMysql2Transaction } from "drizzle-orm/effect-mysql2";
+import { makeWithTransaction } from "effect/unstable/sql/SqlClient";
+//#region src/drizzle/transaction-mysql.ts
+/** Locking discovery and later SQL policy predicates must see the same current
+* authority. MySQL's default repeatable-read snapshot is unsuitable after a
+* contended authority lock. Own one connection and one-shot transaction mode;
+* the pooled connection's session default is never changed. */
+const mysqlTransaction = (unavailable, database, body) => Effect.scoped(Effect.gen(function* () {
+	const client = database.$client;
+	const connection = yield* client.reserve;
+	const nativeConnection = connection.conn;
+	if (typeof nativeConnection?.destroy !== "function" || typeof nativeConnection.release !== "function") return yield* Effect.fail(unavailable());
+	const destroy = nativeConnection.destroy.bind(nativeConnection);
+	const defaults = yield* connection.executeUnprepared("select @@session.transaction_isolation as isolation", [], void 0);
+	const isolation = String(defaults[0]?.isolation).replaceAll("-", " ").toUpperCase();
+	if (![
+		"READ UNCOMMITTED",
+		"READ COMMITTED",
+		"REPEATABLE READ",
+		"SERIALIZABLE"
+	].includes(isolation)) return yield* Effect.fail(unavailable());
+	const statement = (source) => Effect.asVoid(connection.executeUnprepared(source, [], void 0));
+	const transaction = makeWithTransaction({
+		transactionService: client.transactionService,
+		spanAttributes: [["db.system", "mysql"], ["effect_auth.owner", "oauth"]],
+		acquireConnection: Effect.succeed([void 0, connection]),
+		begin: () => statement("SET TRANSACTION ISOLATION LEVEL READ COMMITTED").pipe(Effect.andThen(statement("BEGIN"))),
+		commit: () => statement("COMMIT"),
+		rollback: () => statement("ROLLBACK"),
+		savepoint: (_connection, id) => statement(`SAVEPOINT effect_auth_oauth_${id}`),
+		rollbackSavepoint: (_connection, id) => statement(`ROLLBACK TO SAVEPOINT effect_auth_oauth_${id}`)
+	});
+	class NativeTransaction extends EffectMysql2Transaction {
+		transaction(nested) {
+			return transaction(Effect.suspend(() => nested(new NativeTransaction(database.dialect, database._.session, database._.relations))));
+		}
+	}
+	const native = new NativeTransaction(database.dialect, database._.session, database._.relations);
+	const cleanup = statement("ROLLBACK").pipe(Effect.andThen(statement(`SET TRANSACTION ISOLATION LEVEL ${isolation}`)), Effect.onExit((exit) => exit._tag === "Failure" ? Effect.sync(destroy) : Effect.void), Effect.orDie);
+	return yield* transaction(Effect.suspend(() => body(native))).pipe(Effect.ensuring(cleanup));
+}));
+//#endregion
+export { mysqlTransaction };
+
+//# sourceMappingURL=transaction-mysql.mjs.map

package/dist/drizzle/transaction-mysql.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction-mysql.mjs","names":[],"sources":["../../src/drizzle/transaction-mysql.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- this private acquisition preserves the installed native transaction; public wrappers retain its exact type. */\nimport { EffectMysql2Transaction } from \"drizzle-orm/effect-mysql2\";\nimport { Effect } from \"effect\";\nimport { makeWithTransaction, type SqlClient } from \"effect/unstable/sql/SqlClient\";\n\n/** Locking discovery and later SQL policy predicates must see the same current\n * authority. MySQL's default repeatable-read snapshot is unsuitable after a\n * contended authority lock. Own one connection and one-shot transaction mode;\n * the pooled connection's session default is never changed. */\nexport const mysqlTransaction = <A, E, R, Failure>(\n  unavailable: () => Failure,\n  database: any,\n  body: (transaction: any) => Effect.Effect<A, E, R>,\n) =>\n  Effect.scoped(\n    Effect.gen(function* () {\n      const client: SqlClient = database.$client;\n      const connection = yield* client.reserve;\n\n      // Installed @effect/sql-mysql2 ConnectionImpl exposes its reserved native\n      // PoolConnection as `conn`. Capture only its public disposal method; fail\n      // before transaction work if an installed driver no longer provides it.\n      const nativeConnection = (\n        connection as {\n          readonly conn?: { readonly destroy?: () => void; readonly release?: () => void };\n        }\n      ).conn;\n\n      if (\n        typeof nativeConnection?.destroy !== \"function\" ||\n        typeof nativeConnection.release !== \"function\"\n      )\n        return yield* Effect.fail(unavailable());\n      const destroy = nativeConnection.destroy.bind(nativeConnection);\n\n      const defaults = yield* connection.executeUnprepared(\n        \"select @@session.transaction_isolation as isolation\",\n        [],\n        undefined,\n      );\n\n      const isolation = String(defaults[0]?.isolation).replaceAll(\"-\", \" \").toUpperCase();\n\n      if (\n        ![\"READ UNCOMMITTED\", \"READ COMMITTED\", \"REPEATABLE READ\", \"SERIALIZABLE\"].includes(\n          isolation,\n        )\n      )\n        return yield* Effect.fail(unavailable());\n\n      const statement = (source: string) =>\n        Effect.asVoid(connection.executeUnprepared(source, [], undefined));\n\n      const transaction = makeWithTransaction({\n        transactionService: client.transactionService,\n        spanAttributes: [\n          [\"db.system\", \"mysql\"],\n          [\"effect_auth.owner\", \"oauth\"],\n        ],\n        acquireConnection: Effect.succeed([undefined, connection] as const),\n        begin: () =>\n          statement(\"SET TRANSACTION ISOLATION LEVEL READ COMMITTED\").pipe(\n            Effect.andThen(statement(\"BEGIN\")),\n          ),\n        commit: () => statement(\"COMMIT\"),\n        rollback: () => statement(\"ROLLBACK\"),\n        savepoint: (_connection, id) => statement(`SAVEPOINT effect_auth_oauth_${id}`),\n        rollbackSavepoint: (_connection, id) =>\n          statement(`ROLLBACK TO SAVEPOINT effect_auth_oauth_${id}`),\n      });\n\n      class NativeTransaction extends EffectMysql2Transaction<any, any> {\n        override transaction<A2, E2, R2>(nested: (tx: any) => Effect.Effect<A2, E2, R2>) {\n          return transaction(\n            Effect.suspend(() =>\n              nested(\n                new NativeTransaction(database.dialect, database._.session, database._.relations),\n              ),\n            ),\n          );\n        }\n      }\n\n      const native = new NativeTransaction(\n        database.dialect,\n        database._.session,\n        database._.relations,\n      );\n\n      const cleanup = statement(\"ROLLBACK\").pipe(\n        Effect.andThen(statement(`SET TRANSACTION ISOLATION LEVEL ${isolation}`)),\n        Effect.onExit((exit) => (exit._tag === \"Failure\" ? Effect.sync(destroy) : Effect.void)),\n        Effect.orDie,\n      );\n\n      return yield* transaction(Effect.suspend(() => body(native))).pipe(\n        // BEGIN/COMMIT acknowledgments can be lost after the server acted.\n        // Roll back any surviving transaction before resetting one-shot mode.\n        // Failed cleanup destroys the connection before its reserve is released;\n        // the unknown owner result cannot release a prepared receipt.\n        Effect.ensuring(cleanup),\n      );\n    }),\n  );\n"],"mappings":";;;;;;;;AASA,MAAa,oBACX,aACA,UACA,SAEA,OAAO,OACL,OAAO,IAAI,aAAa;CACtB,MAAM,SAAoB,SAAS;CACnC,MAAM,aAAa,OAAO,OAAO;CAKjC,MAAM,mBACJ,WAGA;CAEF,IACE,OAAO,kBAAkB,YAAY,cACrC,OAAO,iBAAiB,YAAY,YAEpC,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;CACzC,MAAM,UAAU,iBAAiB,QAAQ,KAAK,gBAAgB;CAE9D,MAAM,WAAW,OAAO,WAAW,kBACjC,uDACA,CAAC,GACD,KAAA,CACF;CAEA,MAAM,YAAY,OAAO,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,YAAY;CAElF,IACE,CAAC;EAAC;EAAoB;EAAkB;EAAmB;CAAc,CAAC,CAAC,SACzE,SACF,GAEA,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC;CAEzC,MAAM,aAAa,WACjB,OAAO,OAAO,WAAW,kBAAkB,QAAQ,CAAC,GAAG,KAAA,CAAS,CAAC;CAEnE,MAAM,cAAc,oBAAoB;EACtC,oBAAoB,OAAO;EAC3B,gBAAgB,CACd,CAAC,aAAa,OAAO,GACrB,CAAC,qBAAqB,OAAO,CAC/B;EACA,mBAAmB,OAAO,QAAQ,CAAC,KAAA,GAAW,UAAU,CAAU;EAClE,aACE,UAAU,gDAAgD,CAAC,CAAC,KAC1D,OAAO,QAAQ,UAAU,OAAO,CAAC,CACnC;EACF,cAAc,UAAU,QAAQ;EAChC,gBAAgB,UAAU,UAAU;EACpC,YAAY,aAAa,OAAO,UAAU,+BAA+B,IAAI;EAC7E,oBAAoB,aAAa,OAC/B,UAAU,2CAA2C,IAAI;CAC7D,CAAC;CAED,MAAM,0BAA0B,wBAAkC;EAChE,YAAiC,QAAgD;GAC/E,OAAO,YACL,OAAO,cACL,OACE,IAAI,kBAAkB,SAAS,SAAS,SAAS,EAAE,SAAS,SAAS,EAAE,SAAS,CAClF,CACF,CACF;EACF;CACF;CAEA,MAAM,SAAS,IAAI,kBACjB,SAAS,SACT,SAAS,EAAE,SACX,SAAS,EAAE,SACb;CAEA,MAAM,UAAU,UAAU,UAAU,CAAC,CAAC,KACpC,OAAO,QAAQ,UAAU,mCAAmC,WAAW,CAAC,GACxE,OAAO,QAAQ,SAAU,KAAK,SAAS,YAAY,OAAO,KAAK,OAAO,IAAI,OAAO,IAAK,GACtF,OAAO,KACT;CAEA,OAAO,OAAO,YAAY,OAAO,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAK5D,OAAO,SAAS,OAAO,CACzB;AACF,CAAC,CACH"}

package/dist/drizzle/transaction-owner.d.mts

@@ -0,0 +1,2 @@
+import "../internal/transaction-kernel.mjs";
+import "./transaction-owner.mjs";

package/dist/drizzle/transaction-owner.mjs

@@ -0,0 +1,8 @@
+import { makeTransactionKernel } from "../internal/transaction-kernel.mjs";
+import { drizzleQueryOperations } from "./query-operations.mjs";
+//#region src/drizzle/transaction-owner.ts
+const { reportTransactionFailure, both, makeTransactionRows, makeTransactionOwner } = makeTransactionKernel(drizzleQueryOperations);
+//#endregion
+export { both, makeTransactionOwner, makeTransactionRows, reportTransactionFailure };
+
+//# sourceMappingURL=transaction-owner.mjs.map

package/dist/drizzle/transaction-owner.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction-owner.mjs","names":[],"sources":["../../src/drizzle/transaction-owner.ts"],"sourcesContent":["import { makeTransactionKernel } from \"../internal/transaction-kernel\";\nimport { drizzleQueryOperations } from \"./query-operations\";\nexport type { Row } from \"../internal/transaction-kernel\";\nexport type { TransactionNativeDatabase } from \"../internal/transaction-kernel\";\nexport type { Observation } from \"../internal/transaction-kernel\";\nexport type { GuardedUpdate } from \"../internal/transaction-kernel\";\nexport type { TransactionOwner } from \"../internal/transaction-kernel\";\n\nexport const { reportTransactionFailure, both, makeTransactionRows, makeTransactionOwner } =\n  makeTransactionKernel(drizzleQueryOperations);\n"],"mappings":";;;AAQA,MAAa,EAAE,0BAA0B,MAAM,qBAAqB,yBAClE,sBAAsB,sBAAsB"}

package/dist/index.d.mts

@@ -0,0 +1,5 @@
+import { PersistenceMappingError } from "./internal/mapping-error.mjs";
+import { StorageColumn, StorageTable } from "./internal/storage-tables.mjs";
+import { PersistenceConfigurationError } from "./internal/configuration.mjs";
+import { AuthPersistence } from "./internal/sql-persistence.mjs";
+export { AuthPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };

package/dist/index.mjs

@@ -0,0 +1,5 @@
+import { PersistenceConfigurationError } from "./internal/configuration.mjs";
+import { PersistenceMappingError } from "./internal/mapping-error.mjs";
+import { StorageColumn, StorageTable } from "./internal/storage-tables.mjs";
+import { AuthPersistence } from "./internal/sql-persistence.mjs";
+export { AuthPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };