@yielded/auth 0.1.0-beta.1

package/dist/drizzle/d1-passkey.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1-passkey.mjs","names":[],"sources":["../../src/drizzle/d1-passkey.ts"],"sourcesContent":["import type { D1Client } from \"@effect/sql-d1/D1Client\";\nimport type { AnyRelations } from \"drizzle-orm\";\nimport type { EffectSQLiteD1Database } from \"drizzle-orm/effect-d1\";\nimport type { AnySQLiteTable } from \"drizzle-orm/sqlite-core\";\nimport { Effect, Context } from \"effect\";\n\nimport type { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { PasskeyUnavailable } from \"../passkey/errors\";\nimport { PasskeyPersistence } from \"../passkey/PasskeyPersistence\";\nimport { makeD1Owner } from \"./d1-planning\";\nimport { D1BatchStatements } from \"./D1BatchStatements\";\nimport { makePasskeyTarget } from \"./passkey-drivers\";\nimport type {\n  D1PasskeyMapping,\n  PasskeyCredentialMapping,\n  PasskeyMappingSource,\n  PasskeyPersistenceMapping,\n} from \"./passkey-model\";\nimport type { PasskeyRegistrationCeremonyMapping } from \"./passkey-registration-ceremony-model\";\nimport {\n  type PasskeyCoordinatorError,\n  coordinateTargetPasskey,\n  coordinateTargetPasskeyRegistration,\n} from \"./passkey-target\";\n\ntype Table = AnySQLiteTable<{ dialect: \"sqlite\" }>;\ntype Database = EffectSQLiteD1Database<AnyRelations> & { readonly $client: D1Client };\n\nconst unavailable = () => PasskeyUnavailable.make({});\n\nconst configuration = {\n  mode: \"batch\" as const,\n  dialect: \"sqlite\" as const,\n  locking: false,\n  standaloneGuard: () => Effect.void,\n};\n\nconst target = makePasskeyTarget<Database, Table, D1PasskeyMapping>(configuration);\n\nexport const {\n  makePasskeyCredentialServices,\n  makePasskeyEnrollmentContextServices,\n  makePasskeyPersistenceServices,\n  makePasskeyRegistrationCeremonyServices,\n  makePasskeyManagementServices,\n  makePasskeyRegistrationServices,\n} = target;\n\nexport function coordinatePasskeyPersistence<\n  D extends Database,\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  M extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  N,\n  A,\n  E,\n  R,\n  RSetup = never,\n  DatabaseError = never,\n  DatabaseRequirements = never,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasskeyMappingSource<\n      PasskeyPersistenceMapping<\n        PasskeyCredentialMapping<S, C, F, O, H, N>,\n        M,\n        Flow,\n        Admission,\n        Charge,\n        N\n      > &\n        D1PasskeyMapping,\n      RSetup\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  PasskeyCoordinatorError<E> | DatabaseError,\n  | Exclude<R, PasskeyPersistence | D1BatchStatements>\n  | LifecycleHooks\n  | DatabaseRequirements\n  | RSetup\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetPasskey(database, options.mapping, configuration, (_, services, append) =>\n      Effect.gen(function* () {\n        const original = services.passkeyPersistence;\n\n        const nativeCollector = D1BatchStatements.of({\n          append: (statement) => Effect.sync(() => append(statement)),\n        });\n\n        const owner = yield* makeD1Owner(unavailable()).pipe(\n          Effect.provideService(D1BatchStatements, nativeCollector),\n        );\n\n        const service: PasskeyPersistence[\"Service\"] = {\n          issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n          context: (input) => owner.run(original.context(input)),\n          claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n          settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n          cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n        };\n\n        const provided = Context.make(PasskeyPersistence, service).pipe(\n          Context.add(D1BatchStatements, owner.collector),\n        );\n\n        return yield* owner.close(Effect.provideContext(body, provided));\n      }),\n    ),\n  );\n}\n\nexport function coordinatePasskeyRegistrationCeremony<\n  D extends Database,\n  M extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  Intent extends Table,\n  H extends Table,\n  A,\n  E,\n  R,\n  RSetup = never,\n  DatabaseError = never,\n  DatabaseRequirements = never,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasskeyMappingSource<\n      PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & D1PasskeyMapping,\n      RSetup\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  PasskeyCoordinatorError<E> | DatabaseError,\n  | Exclude<R, PasskeyPersistence | D1BatchStatements>\n  | LifecycleHooks\n  | DatabaseRequirements\n  | RSetup\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetPasskeyRegistration(\n      database,\n      options.mapping,\n      configuration,\n      (_, services, append) =>\n        Effect.gen(function* () {\n          const original = services.passkeyPersistence;\n\n          const nativeCollector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, nativeCollector),\n          );\n\n          const service: PasskeyPersistence[\"Service\"] = {\n            issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n            context: (input) => owner.run(original.context(input)),\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n            cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n          };\n\n          const provided = Context.make(PasskeyPersistence, service).pipe(\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, provided));\n        }),\n    ),\n  );\n}\n\nimport { PasskeyManagementPersistence } from \"../passkey/PasskeyManagementPersistence\";\nimport type {\n  PasskeyManagementMapping,\n  PasskeyRegistrationMapping,\n  PasskeyRegistrationServices,\n  PasskeyRegistrationWriter,\n} from \"./passkey-write-model\";\nimport {\n  coordinateTargetPasskeyManagement,\n  coordinateTargetPasskeyRegistrationWriter,\n} from \"./passkey-write-target\";\n\nexport function coordinatePasskeyManagement<\n  D extends Database,\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  M extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  Command extends Table,\n  N,\n  A,\n  E,\n  R,\n  RSetup = never,\n  DatabaseError = never,\n  DatabaseRequirements = never,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasskeyMappingSource<\n      PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N> &\n        D1PasskeyMapping,\n      RSetup\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  PasskeyCoordinatorError<E> | DatabaseError,\n  | Exclude<R, PasskeyPersistence | PasskeyManagementPersistence | D1BatchStatements>\n  | LifecycleHooks\n  | DatabaseRequirements\n  | RSetup\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetPasskeyManagement(\n      database,\n      options.mapping,\n      configuration,\n      (_, services, append) =>\n        Effect.gen(function* () {\n          const collector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, collector),\n          );\n\n          const original = services.passkeyPersistence;\n\n          const persistence: PasskeyPersistence[\"Service\"] = {\n            issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n            context: (input) => owner.run(original.context(input)),\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n            cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n          };\n\n          const authority = services.passkeyManagementPersistence;\n\n          const service: PasskeyManagementPersistence[\"Service\"] = {\n            list: (input) => owner.run(authority.list(input)),\n            inspectRemove: (input) => owner.run(authority.inspectRemove(input)),\n            issueEnrollment: (input, prepare) =>\n              owner.run(authority.issueEnrollment(input, prepare)),\n            completeEnrollment: (input, prepare) =>\n              owner.run(authority.completeEnrollment(input, prepare)),\n            rename: (input, prepare) => owner.run(authority.rename(input, prepare)),\n            remove: (input, prepare) => owner.run(authority.remove(input, prepare)),\n          };\n\n          const context = Context.make(PasskeyPersistence, persistence).pipe(\n            Context.add(PasskeyManagementPersistence, service),\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, context));\n        }),\n    ),\n  );\n}\n\nexport function coordinatePasskeyRegistration<\n  D extends Database,\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  M extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  Intent extends Table,\n  N,\n  Value,\n  AuthorityId,\n  A,\n  E,\n  R,\n  RSetup = never,\n  DatabaseError = never,\n  DatabaseRequirements = never,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: PasskeyMappingSource<\n      PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &\n        D1PasskeyMapping,\n      RSetup\n    >;\n    readonly authority: Context.Key<AuthorityId, PasskeyRegistrationWriter<Value>>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  PasskeyCoordinatorError<E> | DatabaseError,\n  | Exclude<R, PasskeyPersistence | AuthorityId | D1BatchStatements>\n  | LifecycleHooks\n  | DatabaseRequirements\n  | RSetup\n> {\n  return Effect.flatMap(acquire, (database) =>\n    coordinateTargetPasskeyRegistrationWriter(\n      database,\n      options.mapping,\n      configuration,\n      (_, services: PasskeyRegistrationServices<Value>, append) =>\n        Effect.gen(function* () {\n          const collector = D1BatchStatements.of({\n            append: (statement) => Effect.sync(() => append(statement)),\n          });\n\n          const owner = yield* makeD1Owner(unavailable()).pipe(\n            Effect.provideService(D1BatchStatements, collector),\n          );\n\n          const original = services.passkeyPersistence;\n\n          const persistence: PasskeyPersistence[\"Service\"] = {\n            issue: (input, prepare) => owner.run(original.issue(input, prepare)),\n            context: (input) => owner.run(original.context(input)),\n            claim: (input, prepare) => owner.run(original.claim(input, prepare)),\n            settle: (input, prepare) => owner.run(original.settle(input, prepare)),\n            cleanup: (input, prepare) => owner.run(original.cleanup(input, prepare)),\n          };\n\n          const authority = services.passkeyRegistrationAuthority;\n\n          const service: PasskeyRegistrationWriter<Value> = {\n            inspect: (input) => owner.run(authority.inspect(input)),\n            issueRegistration: (input, prepare) =>\n              owner.run(authority.issueRegistration(input, prepare)),\n            completeRegistration: (input, prepare) =>\n              owner.run(authority.completeRegistration(input, prepare)),\n          };\n\n          const context = Context.make(PasskeyPersistence, persistence).pipe(\n            Context.add(options.authority, service),\n            Context.add(D1BatchStatements, owner.collector),\n          );\n\n          return yield* owner.close(Effect.provideContext(body, context));\n        }),\n    ),\n  );\n}\n"],"mappings":";;;;;;;;;;AA4BA,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;AAEpD,MAAM,gBAAgB;CACpB,MAAM;CACN,SAAS;CACT,SAAS;CACT,uBAAuB,OAAO;AAChC;AAIA,MAAa,EACX,+BACA,sCACA,gCACA,yCACA,+BACA,oCARa,kBAAqD,aAShE;AAEJ,SAAgB,6BAmBd,SACA,SAcA,MAQA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,wBAAwB,UAAU,QAAQ,SAAS,gBAAgB,GAAG,UAAU,WAC9E,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,SAAS;EAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;EAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;EAUA,MAAM,WAAW,QAAQ,KAAK,oBAAoB;GAPhD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;GACnE,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;GACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;GACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GACrE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;EAGjB,CAAC,CAAC,CAAC,KACzD,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;EAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;CACjE,CAAC,CACH,CACF;AACF;AAEA,SAAgB,sCAed,SACA,SAMA,MAQA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,oCACE,UACA,QAAQ,SACR,gBACC,GAAG,UAAU,WACZ,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,SAAS;EAE1B,MAAM,kBAAkB,kBAAkB,GAAG,EAC3C,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;EAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,eAAe,CAC1D;EAUA,MAAM,WAAW,QAAQ,KAAK,oBAAoB;GAPhD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;GACnE,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;GACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;GACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GACrE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;EAGjB,CAAC,CAAC,CAAC,KACzD,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;EAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,QAAQ,CAAC;CACjE,CAAC,CACL,CACF;AACF;AAcA,SAAgB,4BAoBd,SACA,SAOA,MAQA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,kCACE,UACA,QAAQ,SACR,gBACC,GAAG,UAAU,WACZ,OAAO,IAAI,aAAa;EACtB,MAAM,YAAY,kBAAkB,GAAG,EACrC,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;EAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,SAAS,CACpD;EAEA,MAAM,WAAW,SAAS;EAE1B,MAAM,cAA6C;GACjD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;GACnE,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;GACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;GACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GACrE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;EACzE;EAEA,MAAM,YAAY,SAAS;EAa3B,MAAM,UAAU,QAAQ,KAAK,oBAAoB,WAAW,CAAC,CAAC,KAC5D,QAAQ,IAAI,8BAA8B;GAX1C,OAAO,UAAU,MAAM,IAAI,UAAU,KAAK,KAAK,CAAC;GAChD,gBAAgB,UAAU,MAAM,IAAI,UAAU,cAAc,KAAK,CAAC;GAClE,kBAAkB,OAAO,YACvB,MAAM,IAAI,UAAU,gBAAgB,OAAO,OAAO,CAAC;GACrD,qBAAqB,OAAO,YAC1B,MAAM,IAAI,UAAU,mBAAmB,OAAO,OAAO,CAAC;GACxD,SAAS,OAAO,YAAY,MAAM,IAAI,UAAU,OAAO,OAAO,OAAO,CAAC;GACtE,SAAS,OAAO,YAAY,MAAM,IAAI,UAAU,OAAO,OAAO,OAAO,CAAC;EAItB,CAAC,GACjD,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;EAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,OAAO,CAAC;CAChE,CAAC,CACL,CACF;AACF;AAEA,SAAgB,8BAsBd,SACA,SAQA,MAQA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CACE,UACA,QAAQ,SACR,gBACC,GAAG,UAA8C,WAChD,OAAO,IAAI,aAAa;EACtB,MAAM,YAAY,kBAAkB,GAAG,EACrC,SAAS,cAAc,OAAO,WAAW,OAAO,SAAS,CAAC,EAC5D,CAAC;EAED,MAAM,QAAQ,OAAO,YAAY,YAAY,CAAC,CAAC,CAAC,KAC9C,OAAO,eAAe,mBAAmB,SAAS,CACpD;EAEA,MAAM,WAAW,SAAS;EAE1B,MAAM,cAA6C;GACjD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;GACnE,UAAU,UAAU,MAAM,IAAI,SAAS,QAAQ,KAAK,CAAC;GACrD,QAAQ,OAAO,YAAY,MAAM,IAAI,SAAS,MAAM,OAAO,OAAO,CAAC;GACnE,SAAS,OAAO,YAAY,MAAM,IAAI,SAAS,OAAO,OAAO,OAAO,CAAC;GACrE,UAAU,OAAO,YAAY,MAAM,IAAI,SAAS,QAAQ,OAAO,OAAO,CAAC;EACzE;EAEA,MAAM,YAAY,SAAS;EAU3B,MAAM,UAAU,QAAQ,KAAK,oBAAoB,WAAW,CAAC,CAAC,KAC5D,QAAQ,IAAI,QAAQ,WAAW;GAR/B,UAAU,UAAU,MAAM,IAAI,UAAU,QAAQ,KAAK,CAAC;GACtD,oBAAoB,OAAO,YACzB,MAAM,IAAI,UAAU,kBAAkB,OAAO,OAAO,CAAC;GACvD,uBAAuB,OAAO,YAC5B,MAAM,IAAI,UAAU,qBAAqB,OAAO,OAAO,CAAC;EAIrB,CAAC,GACtC,QAAQ,IAAI,mBAAmB,MAAM,SAAS,CAChD;EAEA,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,OAAO,CAAC;CAChE,CAAC,CACL,CACF;AACF"}

package/dist/drizzle/d1-password-prepared.d.mts

@@ -0,0 +1,27 @@
+import { HookConfigurationError } from "../hooks/models.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { PasswordUnavailable } from "../password/methods/errors.mjs";
+import { PasswordPreparedPersistence } from "../password/methods/PasswordPreparedPersistence.mjs";
+import { D1PasswordPreparedPersistenceMapping, D1PasswordPreparedProofMapping } from "./password-prepared-model.mjs";
+import { D1BatchStatements } from "./D1BatchStatements.mjs";
+import { SuppliedService } from "./SuppliedService.mjs";
+import { Effect } from "effect";
+import { AnyRelations } from "drizzle-orm";
+import { D1Client } from "@effect/sql-d1/D1Client";
+import { EffectSQLiteD1Database } from "drizzle-orm/effect-d1";
+import { AnySQLiteTable } from "drizzle-orm/sqlite-core";
+//#region src/drizzle/d1-password-prepared.d.ts
+type Database = EffectSQLiteD1Database<AnyRelations> & {
+  readonly $client: D1Client;
+};
+declare const makeD1PasswordPreparedPersistenceServices: <S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, At extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable = AnySQLiteTable, PC extends AnySQLiteTable = AnySQLiteTable, PM extends AnySQLiteTable = AnySQLiteTable, PSub extends AnySQLiteTable = AnySQLiteTable, PI extends AnySQLiteTable = AnySQLiteTable, PCr extends AnySQLiteTable = AnySQLiteTable, PNativeId = unknown>(database: Database, mapping: D1PasswordPreparedPersistenceMapping<S, I, C, AC, At, RS, CE, M, T, B, NativeId>, proofMapping?: D1PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId>) => Effect.Effect<{
+  passwordPreparedPersistence: PasswordPreparedPersistence;
+}, never, LifecycleHooks>;
+declare function coordinateD1PasswordPreparedPersistence<TargetId, S extends AnySQLiteTable, I extends AnySQLiteTable, C extends AnySQLiteTable, AC extends AnySQLiteTable, At extends AnySQLiteTable, RS extends AnySQLiteTable, CE extends AnySQLiteTable, M extends AnySQLiteTable, T extends AnySQLiteTable, B extends AnySQLiteTable, NativeId, PS extends AnySQLiteTable, PC extends AnySQLiteTable, PM extends AnySQLiteTable, PSub extends AnySQLiteTable, PI extends AnySQLiteTable, PCr extends AnySQLiteTable, PNativeId, A, E, R, DatabaseError, DatabaseRequirements>(acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>, options: {
+  readonly mapping: D1PasswordPreparedPersistenceMapping<S, I, C, AC, At, RS, CE, M, T, B, NativeId>;
+  readonly proofMapping?: D1PasswordPreparedProofMapping<PS, PC, PM, PSub, PI, PCr, PNativeId> | undefined;
+  readonly target: SuppliedService<TargetId, PasswordPreparedPersistence>;
+}, body: Effect.Effect<A, E, R>): Effect.Effect<A, E | PasswordUnavailable | HookConfigurationError | DatabaseError, Exclude<R, TargetId | D1BatchStatements> | LifecycleHooks | DatabaseRequirements>;
+//#endregion
+export { coordinateD1PasswordPreparedPersistence, makeD1PasswordPreparedPersistenceServices };
+//# sourceMappingURL=d1-password-prepared.d.mts.map

package/dist/drizzle/d1-password-prepared.mjs

@@ -0,0 +1,464 @@
+import { HookConfigurationError } from "../hooks/models.mjs";
+import { reportPersistenceFailure } from "../internal/diagnostics.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { CurrentCommitJournal, coordinateCommit, hasCommitScope } from "../hooks/commit.mjs";
+import { PasswordRejected, PasswordUnavailable } from "../password/methods/errors.mjs";
+import { DrizzleMappingError, column, updateValues } from "./model.mjs";
+import { ProofUnavailable } from "../proofs/errors.mjs";
+import { ProofBinding } from "../proofs/models.mjs";
+import { balancedD1And, compactD1GeneratedStatement } from "./d1-generated-statement.mjs";
+import { CurrentPasswordSql } from "./password-sql.mjs";
+import { PasswordPreparedVersion, decodePasswordPreparedReady, encodePasswordPreparedReady, snapshotPasswordPreparedReady, snapshotPasswordPreparedReservation } from "../password/methods/preparedModels.mjs";
+import { CompletionInput, ContextInput, encodeReservation, evidenceCurrent, identifierScope, reservationOf, sameRevision, snapshotMutation, snapshotReserve, unavailable } from "./password-prepared-state.mjs";
+import { passwordPreparedSqlKernel } from "./password-prepared-sql.mjs";
+import { D1BatchStatements } from "./D1BatchStatements.mjs";
+import { CurrentD1PlanningDatabase, makeD1Owner } from "./d1-planning.mjs";
+import { checkD1ProofCompletion, compileD1ProofCompletionPlan } from "./d1-proofs.mjs";
+import { passwordD1Kernel } from "./d1-passwords.mjs";
+import { Cause, Context, DateTime, Effect, Predicate, Redacted, Schema } from "effect";
+import { SQL, eq, is, isNotNull, lte, or, sql } from "drizzle-orm";
+//#region src/drizzle/d1-password-prepared.ts
+const everyFailureMatches = (cause, classify) => classify !== void 0 && cause.reasons.length > 0 && cause.reasons.every((reason) => Cause.isFailReason(reason) && classify(Cause.fail(reason.error)));
+const bindingJson = Schema.encodeSync(Schema.fromJsonString(ProofBinding));
+const authorityCondition = (mapping, current, moduleId) => {
+	const p = mapping.password, s = passwordD1Kernel.subjectColumns(p), i = passwordD1Kernel.identifierColumns(p), c = passwordD1Kernel.credentialColumns(p), ac = passwordD1Kernel.authorityColumns(p);
+	const snapshot = current.snapshot, native = current.nativeSubjectId;
+	const identifier = snapshot === void 0 ? sql`true` : balancedD1And(p.identifier.d1CurrentCondition({
+		identifier: snapshot.identifier,
+		nativeSubjectId: native
+	}), sql`exists(select 1 from ${p.identifier.table} where ${i.namespace} = ${sql.param(snapshot.identifier.namespace, i.namespace)} and ${i.value} = ${sql.param(snapshot.identifier.value, i.value)} and ${i.subjectId} = ${sql.param(native, i.subjectId)} and ${i.bindingRevision} = ${sql.param(snapshot.identifierBindingRevision, i.bindingRevision)} and ${Predicate.isNullish(current.identifier[p.identifier.verifiedAt]) ? sql`${i.verifiedAt} is null` : sql`${i.verifiedAt} = ${sql.param(current.identifier[p.identifier.verifiedAt], i.verifiedAt)}`})`);
+	return balancedD1And(sql`exists(select 1 from ${p.subject.table} where ${s.id} = ${sql.param(native, s.id)} and ${s.status} = ${sql.param(p.subject.d1ActiveStatusValue, s.status)} and ${s.securityRevision} = ${sql.param(current.revision.securityRevision, s.securityRevision)})`, identifier, snapshot === void 0 ? sql`not exists(select 1 from ${p.credential.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(native, c.subjectId)})` : sql`exists(select 1 from ${p.credential.table} where ${c.moduleId} = ${sql.param(moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(native, c.subjectId)} and ${c.credentialId} = ${sql.param(snapshot.credentialId, c.credentialId)} and ${c.credentialRevision} = ${sql.param(snapshot.credentialRevision, c.credentialRevision)} and ${c.verifierVersion} = ${sql.param(snapshot.verifierVersion, c.verifierVersion)} and ${c.verifier} = ${sql.param(Redacted.value(snapshot.verifier), c.verifier)} and ${c.normalization} = ${sql.param(snapshot.normalization, c.normalization)})`, ...current.revision.credentials.map((entry) => sql`exists(select 1 from ${p.authorityCredential.table} where ${ac.subjectId} = ${sql.param(native, ac.subjectId)} and ${ac.credentialId} = ${sql.param(entry.credentialId, ac.credentialId)} and ${ac.revision} = ${sql.param(entry.revision, ac.revision)}${ac.status === void 0 ? sql`` : sql` and ${ac.status} = ${sql.param(p.authorityCredential.d1ActiveStatusValue, ac.status)}`})`));
+};
+const existsRow = (mapping, row) => sql`exists(select 1 from ${mapping.intent.table} where ${passwordPreparedSqlKernel.rowCondition(mapping, row)})`;
+const terminalStatements = Effect.fn(function* (mapping, row, state, marker) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const t = mapping.intent;
+	return [yield* passwordD1Kernel.statement(database.update(t.table).set(t.encodeTerminal(state)).where(passwordPreparedSqlKernel.rowCondition(mapping, row))), yield* passwordD1Kernel.assertion(existsRow(mapping, {
+		...row,
+		[t.state]: t.states[state],
+		[t.snapshot]: null,
+		[t.digest]: null
+	}), marker)];
+});
+const selectInsert = Effect.fn(function* (table, values, condition) {
+	const database = yield* CurrentD1PlanningDatabase;
+	const selected = Object.fromEntries(Object.entries(values).filter(([, value]) => value !== void 0).map(([key, value]) => [key, (is(value, SQL) ? value : sql`${sql.param(value, column(table, key))}`).as(key)]));
+	return database.insert(table).select(database.select(selected).from(sql`(select 1)`).where(condition));
+});
+const makePreparedPlans = (mapping, proofMapping) => {
+	const p = mapping.password, t = mapping.intent, c = passwordPreparedSqlKernel.columns(mapping), config = { locking: false };
+	const readRows = Effect.fn(function* (condition) {
+		return yield* (yield* CurrentD1PlanningDatabase).select().from(t.table).where(condition).limit(2);
+	});
+	const run = (plan) => Effect.gen(function* () {
+		const database = yield* CurrentD1PlanningDatabase;
+		return yield* passwordPreparedSqlKernel.valid(mapping) ? plan.pipe(Effect.flatMap((planned) => Effect.try({
+			try: () => ({
+				...planned,
+				statements: planned.statements.map((statement) => compactD1GeneratedStatement(database.$client, statement, unavailable)),
+				postconditions: planned.postconditions?.map((statement) => compactD1GeneratedStatement(database.$client, statement, unavailable))
+			}),
+			catch: (cause) => Schema.is(PasswordUnavailable)(cause) ? cause : DrizzleMappingError.make({
+				operation: "mapping",
+				cause
+			})
+		}))) : Effect.fail(unavailable());
+	});
+	const current = (record) => passwordPreparedSqlKernel.currentAuthority(mapping, config, record);
+	const complete = (uncaptured, prepare) => Effect.gen(function* () {
+		const input = yield* snapshotMutation(uncaptured);
+		const completion = uncaptured.completion === void 0 ? void 0 : {
+			prepare: uncaptured.completion.prepare,
+			input: yield* Schema.encodeEffect(Schema.fromJsonString(CompletionInput))(uncaptured.completion.input).pipe(Effect.flatMap(Schema.decodeEffect(Schema.fromJsonString(CompletionInput))), Effect.mapError(unavailable))
+		};
+		if (input.intent.action === "reset-password" !== (completion !== void 0) || completion !== void 0 && proofMapping === void 0) return yield* unavailable();
+		const credentialRevision = yield* passwordD1Kernel.allocate(p.allocateRevision, p.allocateRevisionSync), verifierVersion = yield* passwordD1Kernel.allocate(p.allocateRevision, p.allocateRevisionSync), nextSecurityRevision = yield* passwordD1Kernel.allocateNextSecurityRevision(p, input.intent.revision.securityRevision);
+		if (nextSecurityRevision === input.intent.revision.securityRevision || credentialRevision === input.intent.credential?.credentialRevision || verifierVersion === input.intent.credential?.verifierVersion) return yield* unavailable();
+		const credentialId = input.intent.action === "add-password" ? yield* passwordD1Kernel.allocate(p.allocateCredentialId, p.allocateCredentialIdSync) : void 0;
+		return yield* run(Effect.gen(function* () {
+			const journal = yield* CurrentCommitJournal;
+			const authority = yield* current(input.intent), rows = yield* readRows(balancedD1And(eq(c.moduleId, input.intent.moduleId), eq(c.intentId, input.intent.intentId))), row = rows[0], now = yield* passwordD1Kernel.readEngineNowMillis(p);
+			if (authority === void 0 || rows.length !== 1 || !(yield* passwordPreparedSqlKernel.recordMatches(mapping, row, input.intent, authority.nativeSubjectId, yield* encodePasswordPreparedReady(input.intent))) || !evidenceCurrent(input, authority.requirement, now)) return {
+				receipt: prepare("rejected", journal),
+				statements: []
+			};
+			const marker = `effect-auth-password-prepared:complete:${input.intent.intentId}`;
+			const requirements = [
+				input.mutation.authorization.requirement,
+				input.intent.capturedRequirement,
+				input.capturedRequirement,
+				authority.requirement,
+				input.currentRequirement
+			];
+			const age = Math.min(...requirements.map((value) => value.maximumAgeMillis));
+			const live = balancedD1And(existsRow(mapping, row), authorityCondition(mapping, authority, input.intent.moduleId), sql`${p.d1.engineNowMillis} >= ${input.intent.issuedAtMillis} and ${p.d1.engineNowMillis} < ${input.intent.expiresAtMillis}`, ...requirements.map((requirement) => passwordD1Kernel.assuranceCondition(p, input.mutation.authorization.evidence, requirement)), ...(input.intent.baseEvidence?.proofs ?? []).map((proof) => sql`${p.d1.engineNowMillis} >= ${DateTime.toEpochMillis(proof.verifiedAt)} and ${p.d1.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`));
+			let mutation;
+			let passwordApplied;
+			let mutationGuard;
+			if (input.intent.action === "add-password") {
+				const compiled = yield* passwordD1Kernel.compileAddMutation(p, input.mutation, {
+					credentialId,
+					credentialRevision,
+					verifierVersion,
+					nextSecurityRevision
+				});
+				if (compiled === void 0) return {
+					receipt: prepare("rejected", journal),
+					statements: []
+				};
+				mutation = compiled.statements;
+				mutationGuard = compiled.retryable;
+				passwordApplied = compiled.appliedCondition;
+			} else {
+				const compiled = yield* passwordD1Kernel.compileReplacementMutation(p, input.mutation, input.intent.action, {
+					credentialRevision,
+					verifierVersion,
+					nextSecurityRevision
+				});
+				if (compiled === void 0) return {
+					receipt: prepare("rejected", journal),
+					statements: []
+				};
+				passwordApplied = compiled.protectedMutation.appliedCondition;
+				mutationGuard = (cause) => passwordD1Kernel.isGuardFailure(cause, compiled.marker);
+				mutation = [...compiled.protectedMutation.statements, yield* passwordD1Kernel.assertion(compiled.protectedMutation.appliedCondition, marker)];
+			}
+			const terminal = {
+				...row,
+				[t.state]: t.states.Consumed,
+				[t.snapshot]: null,
+				[t.digest]: null
+			};
+			const protectedMutation = {
+				statements: [
+					yield* passwordD1Kernel.assertion(live, marker),
+					...mutation,
+					...yield* terminalStatements(mapping, row, "Consumed", marker)
+				],
+				appliedCondition: balancedD1And(passwordApplied, existsRow(mapping, terminal), sql`${p.d1.engineNowMillis} >= ${input.intent.issuedAtMillis} and ${p.d1.engineNowMillis} < ${input.intent.expiresAtMillis}`, ...(input.intent.baseEvidence?.proofs ?? []).map((proof) => sql`${p.d1.engineNowMillis} >= ${DateTime.toEpochMillis(proof.verifiedAt)} and ${p.d1.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`), ...requirements.map((requirement) => passwordD1Kernel.assuranceCondition(p, input.mutation.authorization.evidence, requirement)))
+			};
+			if (completion !== void 0) {
+				if (input.intent.reset === void 0 || completion.input.continuationId !== input.intent.reset.continuationId || bindingJson(completion.input.binding) !== bindingJson(input.intent.reset.binding) || !passwordD1Kernel.completionMatchesPassword({
+					...input.mutation,
+					completion
+				})) return {
+					receipt: prepare("rejected", journal),
+					statements: []
+				};
+				let receipt;
+				const compiled = yield* compileD1ProofCompletionPlan(proofMapping, completion, protectedMutation, (decision) => {
+					receipt = prepare(decision === "completed" ? "changed" : "rejected", journal);
+					return decision;
+				});
+				return {
+					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker) || mutationGuard?.(cause) === true || completion !== void 0 && (passwordD1Kernel.isGuardFailure(cause, `effect-auth-proof-guard:complete:${completion.input.continuationId}`) || passwordD1Kernel.isGuardFailure(cause, `effect-auth-proof-guard:protected:${completion.input.continuationId}`)),
+					receipt: receipt ?? prepare("rejected", journal),
+					statements: compiled.statements,
+					postconditions: compiled.postconditions
+				};
+			}
+			const postconditions = [yield* passwordD1Kernel.assertion(protectedMutation.appliedCondition, marker)];
+			return {
+				retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker) || mutationGuard?.(cause) === true,
+				receipt: prepare("changed", journal),
+				statements: [...protectedMutation.statements, ...postconditions],
+				postconditions
+			};
+		}));
+	});
+	return {
+		reserve: (uncaptured, prepare) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			const input = yield* snapshotReserve(uncaptured);
+			if (input.action === "reset-password" !== (input.reset !== void 0 && input.completion !== void 0) || input.action === "reset-password" && proofMapping === void 0 || input.generation !== input.policy.generation || input.policy.retentionMillis < Math.max(input.policy.preparationLifetimeMillis + input.policy.lifetimeMillis, input.policy.admission.action.windowMillis, input.policy.admission.subject.windowMillis, input.policy.admission.identifier.windowMillis) || input.invalidation.existingSessions === "immediate" && p.sessionInvalidation !== "same-authority-immediate") return yield* unavailable();
+			const version = PasswordPreparedVersion.make(yield* passwordD1Kernel.allocate(mapping.allocateVersion, mapping.allocateVersionSync));
+			return yield* run(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const authority = yield* passwordPreparedSqlKernel.captureAuthority(mapping, config, input);
+				if (authority === void 0) return yield* unavailable();
+				let proofCondition = sql`true`;
+				if (input.reset !== void 0) {
+					if (input.completion === void 0 || input.completion.moduleId !== `${input.moduleId}/reset` || input.completion.purpose !== "password-reset" || input.reset.continuationId !== input.completion.continuationId || bindingJson(input.reset.binding) !== bindingJson(input.completion.binding) || input.reset.binding._tag !== "Subject" || !sameRevision(input.reset.binding.revision, authority.revision) || authority.snapshot?.identifierVerifiedAtMillis === void 0) return yield* unavailable();
+					const inspected = yield* checkD1ProofCompletion(proofMapping, input.completion);
+					if (!inspected.accepted) return yield* unavailable();
+					proofCondition = inspected.condition;
+				}
+				const ownerCurrent = balancedD1And(authorityCondition(mapping, authority, input.moduleId), proofCondition);
+				const marker = `effect-auth-password-prepared:reserve:${input.intentId}`;
+				const existing = yield* readRows(balancedD1And(eq(c.moduleId, input.moduleId), eq(c.commandId, input.commandId)));
+				if (existing.length) return {
+					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker),
+					receipt: prepare({ _tag: "Existing" }, journal),
+					statements: [yield* passwordD1Kernel.assertion(balancedD1And(ownerCurrent, existsRow(mapping, existing[0])), marker)]
+				};
+				const now = yield* passwordD1Kernel.readEngineNowMillis(p), scope = identifierScope({
+					credential: authority.snapshot,
+					revision: authority.revision
+				});
+				const reservation = yield* snapshotPasswordPreparedReservation({
+					_tag: "Preparing",
+					moduleId: input.moduleId,
+					generation: input.generation,
+					intentId: input.intentId,
+					version,
+					commandId: input.commandId,
+					action: input.action,
+					revision: authority.revision,
+					...authority.snapshot === void 0 ? {} : { credential: authority.snapshot },
+					capturedRequirement: authority.requirement,
+					...input.reset === void 0 ? {} : { reset: input.reset },
+					invalidation: input.invalidation,
+					createdAtMillis: now,
+					preparationExpiresAtMillis: now + input.policy.preparationLifetimeMillis,
+					retainUntilMillis: now + input.policy.retentionMillis
+				});
+				const snapshot = yield* encodeReservation(reservation), window = Math.max(input.policy.admission.action.windowMillis, input.policy.admission.identifier.windowMillis, input.policy.admission.subject.windowMillis);
+				const a = mapping.admission, am = column(a.table, a.moduleId), ai = column(a.table, a.intentId), at = column(a.table, a.admittedAt), ar = column(a.table, a.admissionRetainUntil);
+				const stamp = sql`(select ${at} from ${a.table} where ${am} = ${sql.param(input.moduleId, am)})`, retention = sql`(select ${ar} from ${a.table} where ${am} = ${sql.param(input.moduleId, am)})`;
+				const active = sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)} and ((${c.state} = ${sql.param(t.states.Preparing, c.state)} and ${c.preparationExpiresAt} > ${p.d1.engineNow}) or (${c.state} = ${sql.param(t.states.Ready, c.state)} and ${c.expiresAt} > ${p.d1.engineNow}))) < ${input.policy.maximumPendingPerSubject}`;
+				const budgets = [
+					[eq(c.action, input.action), input.policy.admission.action],
+					[eq(c.identifierScope, scope), input.policy.admission.identifier],
+					[eq(c.subjectId, authority.nativeSubjectId), input.policy.admission.subject]
+				];
+				const admissionDecision = balancedD1And(ownerCurrent, active, ...budgets.map(([condition, budget]) => sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${condition} and ${c.admittedAt} > ${p.d1.engineInstantMinus(budget.windowMillis)}) < ${budget.limit}`), sql`not exists(select 1 from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.commandId} = ${sql.param(input.commandId, c.commandId)})`, sql`${p.d1.engineNowMillis} >= ${now} and ${p.d1.engineNowMillis} < ${reservation.preparationExpiresAtMillis}`);
+				const admittedMillis = mapping.admissionClock.toMillis(stamp), retainedMillis = mapping.admissionClock.toMillis(retention);
+				const clockGuard = balancedD1And(sql`exists(select 1 from ${a.table} where ${am} = ${sql.param(input.moduleId, am)} and ${ai} = ${sql.param(input.intentId, ai)})`, sql`${admittedMillis} >= ${now} and ${admittedMillis} <= ${p.d1.engineNowMillis}`, sql`${retainedMillis} = ${admittedMillis} + ${window}`);
+				const guard = balancedD1And(sql`changes() = 1`, clockGuard);
+				const values = {
+					...t.encodeInsert({
+						reservation,
+						nativeSubjectId: authority.nativeSubjectId,
+						identifierScope: scope,
+						snapshot,
+						admittedAtMillis: now,
+						admissionRetainUntilMillis: now + window
+					}),
+					[t.admittedAt]: stamp,
+					[t.admissionRetainUntil]: retention
+				};
+				const expected = {
+					[t.moduleId]: input.moduleId,
+					[t.intentId]: input.intentId,
+					[t.commandId]: input.commandId,
+					[t.subjectId]: authority.nativeSubjectId,
+					[t.action]: input.action,
+					[t.generation]: input.generation,
+					[t.version]: version,
+					[t.state]: t.states.Preparing,
+					[t.digest]: null,
+					[t.snapshot]: snapshot,
+					[t.identifierScope]: scope,
+					[t.createdAt]: p.encodeInstant(now),
+					[t.preparationExpiresAt]: p.encodeInstant(reservation.preparationExpiresAtMillis),
+					[t.expiresAt]: null,
+					[t.retainUntil]: p.encodeInstant(reservation.retainUntilMillis),
+					[t.admittedAt]: stamp,
+					[t.admissionRetainUntil]: retention
+				};
+				return {
+					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker),
+					receipt: prepare({
+						_tag: "Reserved",
+						reservation
+					}, journal),
+					statements: [
+						yield* passwordD1Kernel.statement(database.insert(a.table).values(a.encodeInsert(input.moduleId)).onConflictDoNothing()),
+						yield* passwordD1Kernel.statement(database.update(a.table).set(updateValues([
+							[a.intentId, input.intentId],
+							[a.admittedAt, p.d1.engineNow],
+							[a.admissionRetainUntil, p.d1.engineInstantPlus(window)]
+						])).where(balancedD1And(eq(am, input.moduleId), admissionDecision))),
+						yield* passwordD1Kernel.statement(yield* selectInsert(t.table, values, guard)),
+						yield* passwordD1Kernel.assertion(existsRow(mapping, expected), marker),
+						yield* passwordD1Kernel.assertion(balancedD1And(ownerCurrent, clockGuard, sql`${p.d1.engineNowMillis} < ${reservation.preparationExpiresAtMillis}`, sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.subjectId} = ${sql.param(authority.nativeSubjectId, c.subjectId)} and ((${c.state} = ${sql.param(t.states.Preparing, c.state)} and ${c.preparationExpiresAt} > ${p.d1.engineNow}) or (${c.state} = ${sql.param(t.states.Ready, c.state)} and ${c.expiresAt} > ${p.d1.engineNow}))) <= ${input.policy.maximumPendingPerSubject}`, ...budgets.map(([condition, budget]) => sql`(select count(*) from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${condition} and ${c.admittedAt} > ${p.d1.engineInstantMinus(budget.windowMillis)}) <= ${budget.limit}`)), marker)
+					]
+				};
+			}));
+		}),
+		publishReady: (uncaptured, prepare) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			const reservation = yield* snapshotPasswordPreparedReservation(uncaptured.reservation), ready = yield* snapshotPasswordPreparedReady(uncaptured.ready), snapshot = yield* encodeReservation(reservation), readySnapshot = yield* encodePasswordPreparedReady(ready);
+			if ((yield* encodeReservation(reservationOf(ready))) !== snapshot) return yield* unavailable();
+			return yield* run(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const authority = yield* current(reservation), rows = yield* readRows(balancedD1And(eq(c.moduleId, reservation.moduleId), eq(c.intentId, reservation.intentId))), row = rows[0];
+				if (authority === void 0 || rows.length !== 1 || !(yield* passwordPreparedSqlKernel.recordMatches(mapping, row, reservation, authority.nativeSubjectId, snapshot))) return {
+					receipt: prepare("rejected", journal),
+					statements: []
+				};
+				const marker = `effect-auth-password-prepared:ready:${ready.intentId}`, live = balancedD1And(authorityCondition(mapping, authority, ready.moduleId), sql`${p.d1.engineNowMillis} >= ${ready.issuedAtMillis} and ${p.d1.engineNowMillis} < ${reservation.preparationExpiresAtMillis} and ${p.d1.engineNowMillis} < ${ready.expiresAtMillis}`);
+				const expected = {
+					...row,
+					[t.state]: t.states.Ready,
+					[t.snapshot]: readySnapshot,
+					[t.digest]: ready.digest,
+					[t.expiresAt]: p.encodeInstant(ready.expiresAtMillis)
+				};
+				return {
+					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker),
+					receipt: prepare("published", journal),
+					statements: [
+						yield* passwordD1Kernel.assertion(balancedD1And(live, existsRow(mapping, row)), marker),
+						yield* passwordD1Kernel.statement(database.update(t.table).set(t.encodeReady({
+							ready,
+							snapshot: readySnapshot
+						})).where(passwordPreparedSqlKernel.rowCondition(mapping, row))),
+						yield* passwordD1Kernel.assertion(balancedD1And(live, existsRow(mapping, expected)), marker)
+					]
+				};
+			}));
+		}),
+		context: (uncaptured) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			if (yield* hasCommitScope) return yield* unavailable();
+			const input = yield* Schema.decodeEffect(ContextInput)({ ...uncaptured }).pipe(Effect.mapError(unavailable)), rows = yield* readRows(balancedD1And(eq(c.moduleId, input.moduleId), eq(c.generation, input.generation), eq(c.digest, input.digest), eq(c.state, t.states.Ready)));
+			if (rows.length !== 1) return yield* PasswordRejected.make({});
+			const record = yield* decodePasswordPreparedReady(rows[0][t.snapshot]), authority = yield* current(record);
+			if (authority === void 0 || record.moduleId !== input.moduleId || record.generation !== input.generation || record.digest !== input.digest || !(yield* passwordPreparedSqlKernel.recordMatches(mapping, rows[0], record, authority.nativeSubjectId, yield* encodePasswordPreparedReady(record)))) return yield* PasswordRejected.make({});
+			const condition = balancedD1And(passwordPreparedSqlKernel.rowCondition(mapping, rows[0]), authorityCondition(mapping, authority, record.moduleId), sql`${p.d1.engineNowMillis} >= ${record.issuedAtMillis} and ${p.d1.engineNowMillis} < ${record.expiresAtMillis}`);
+			const guardStatement = yield* passwordD1Kernel.assertion(sql`exists(select 1 from ${t.table} where ${condition})`, `effect-auth-password-prepared:context:${record.intentId}`);
+			const guard = yield* Effect.try({
+				try: () => compactD1GeneratedStatement(database.$client, guardStatement, unavailable),
+				catch: (cause) => Schema.is(PasswordUnavailable)(cause) ? cause : DrizzleMappingError.make({
+					operation: "mapping",
+					cause
+				})
+			});
+			yield* database.$client.batch([guard]).pipe(Effect.catchCause((cause) => everyFailureMatches(cause, (failure) => passwordD1Kernel.isGuardFailure(failure, `effect-auth-password-prepared:context:${record.intentId}`)) ? Effect.fail(PasswordRejected.make({})) : Effect.failCause(cause)));
+			return {
+				record,
+				currentRequirement: authority.requirement
+			};
+		}),
+		complete,
+		resetWithProof: complete,
+		cancel: (uncaptured, prepare) => Effect.gen(function* () {
+			const record = yield* snapshotPasswordPreparedReady(uncaptured.record);
+			return yield* run(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const authority = yield* current(record), rows = yield* readRows(balancedD1And(eq(c.moduleId, record.moduleId), eq(c.intentId, record.intentId))), row = rows[0];
+				if (authority === void 0 || rows.length !== 1 || !(yield* passwordPreparedSqlKernel.recordMatches(mapping, row, record, authority.nativeSubjectId, yield* encodePasswordPreparedReady(record)))) return {
+					receipt: prepare(false, journal),
+					statements: []
+				};
+				const marker = `effect-auth-password-prepared:cancel:${record.intentId}`;
+				return {
+					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker),
+					receipt: prepare(true, journal),
+					statements: [yield* passwordD1Kernel.assertion(balancedD1And(existsRow(mapping, row), authorityCondition(mapping, authority, record.moduleId), sql`${p.d1.engineNowMillis} >= ${record.issuedAtMillis} and ${p.d1.engineNowMillis} < ${record.expiresAtMillis}`), marker), ...yield* terminalStatements(mapping, row, "Cancelled", marker)]
+				};
+			}));
+		}),
+		cleanup: (uncaptured, prepare) => Effect.gen(function* () {
+			const database = yield* CurrentD1PlanningDatabase;
+			const input = { ...uncaptured };
+			if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) return yield* unavailable();
+			return yield* run(Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const due = balancedD1And(eq(c.moduleId, input.moduleId), or(balancedD1And(lte(c.retainUntil, p.d1.engineNow), lte(c.admissionRetainUntil, p.d1.engineNow)), balancedD1And(isNotNull(c.snapshot), or(balancedD1And(eq(c.state, t.states.Preparing), lte(c.preparationExpiresAt, p.d1.engineNow)), balancedD1And(eq(c.state, t.states.Ready), lte(c.expiresAt, p.d1.engineNow))))));
+				const rows = yield* database.select().from(t.table).where(due).orderBy(c.createdAt, c.intentId).limit(input.limit + 1);
+				const now = yield* passwordD1Kernel.readEngineNowMillis(p), statements = [], marker = `effect-auth-password-prepared:cleanup:${input.moduleId}`;
+				let removed = 0;
+				for (const row of rows.slice(0, input.limit)) {
+					const retained = yield* p.decodeInstant(row[t.retainUntil]), charge = yield* p.decodeInstant(row[t.admissionRetainUntil]);
+					statements.push(yield* passwordD1Kernel.assertion(balancedD1And(existsRow(mapping, row), sql`exists(select 1 from ${t.table} where ${passwordPreparedSqlKernel.rowCondition(mapping, row)} and ${due})`), marker));
+					if (retained <= now && charge <= now) {
+						statements.push(yield* passwordD1Kernel.statement(database.delete(t.table).where(balancedD1And(passwordPreparedSqlKernel.rowCondition(mapping, row), lte(c.retainUntil, p.d1.engineNow), lte(c.admissionRetainUntil, p.d1.engineNow)))), yield* passwordD1Kernel.assertion(sql`not exists(select 1 from ${t.table} where ${c.moduleId} = ${sql.param(input.moduleId, c.moduleId)} and ${c.intentId} = ${sql.param(row[t.intentId], c.intentId)})`, marker));
+						removed++;
+					} else statements.push(...yield* terminalStatements(mapping, row, "Expired", marker));
+				}
+				const hasMore = rows.length > input.limit;
+				statements.push(yield* passwordD1Kernel.assertion(hasMore ? sql`exists(select 1 from ${t.table} where ${due})` : sql`not exists(select 1 from ${t.table} where ${due})`, marker));
+				return {
+					retryable: (cause) => passwordD1Kernel.isGuardFailure(cause, marker),
+					receipt: prepare({
+						removed,
+						hasMore
+					}, journal),
+					statements
+				};
+			}));
+		})
+	};
+};
+const makeD1PasswordPreparedPersistenceServices = (database, mapping, proofMapping) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	const plans = makePreparedPlans(mapping, proofMapping);
+	const run = (plan) => Effect.gen(function* () {
+		if (yield* hasCommitScope) return yield* unavailable();
+		return yield* executeStandalone(plan);
+	}).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks));
+	return { passwordPreparedPersistence: {
+		reserve: (input, prepare) => run(plans.reserve(input, prepare)).pipe(translateFailure),
+		publishReady: (input, prepare) => run(plans.publishReady(input, prepare)).pipe(translateFailure),
+		context: (input) => plans.context(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateContextFailure),
+		complete: (input, prepare) => run(plans.complete(input, prepare)).pipe(translateFailure),
+		resetWithProof: (input, prepare) => run(plans.resetWithProof(input, prepare)).pipe(translateFailure),
+		cancel: (input, prepare) => run(plans.cancel(input, prepare)).pipe(translateFailure),
+		cleanup: (input, prepare) => run(plans.cleanup(input, prepare)).pipe(translateFailure)
+	} };
+});
+function coordinateD1PasswordPreparedPersistence(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => Effect.gen(function* () {
+		const hooks = yield* LifecycleHooks;
+		if (yield* hasCommitScope) return yield* unavailable();
+		return (yield* coordinateCommit(() => Effect.gen(function* () {
+			const statements = [];
+			let mutation;
+			let poisoned = false;
+			const nativeCollector = D1BatchStatements.of({ append: (statement) => Effect.sync(() => statements.push(statement)) });
+			const owner = yield* makeD1Owner(unavailable()).pipe(Effect.provideService(D1BatchStatements, nativeCollector));
+			const protect = (effect) => effect.pipe(Effect.onError(() => Effect.sync(() => {
+				poisoned = true;
+			})));
+			const plans = makePreparedPlans(options.mapping, options.proofMapping);
+			const run = (plan) => coordinateCommit(() => Effect.gen(function* () {
+				const journal = yield* CurrentCommitJournal;
+				const planned = yield* plan;
+				yield* owner.check;
+				if (mutation !== void 0) return yield* unavailable();
+				const guarded = {
+					...planned,
+					journalGuard: journal.prepare(void 0)
+				};
+				mutation = guarded;
+				statements.push(...guarded.statements);
+				return guarded.receipt;
+			}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks));
+			const provided = Context.make(options.target, {
+				reserve: (input, prepare) => owner.run(protect(run(plans.reserve(input, prepare)).pipe(translateFailure))),
+				publishReady: (input, prepare) => owner.run(protect(run(plans.publishReady(input, prepare)).pipe(translateFailure))),
+				context: (input) => owner.run(protect(plans.context(input).pipe(Effect.provideService(CurrentD1PlanningDatabase, database), Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateContextFailure))),
+				complete: (input, prepare) => owner.run(protect(run(plans.complete(input, prepare)).pipe(translateFailure))),
+				resetWithProof: (input, prepare) => owner.run(protect(run(plans.resetWithProof(input, prepare)).pipe(translateFailure))),
+				cancel: (input, prepare) => owner.run(protect(run(plans.cancel(input, prepare)).pipe(translateFailure))),
+				cleanup: (input, prepare) => owner.run(protect(run(plans.cleanup(input, prepare)).pipe(translateFailure)))
+			}).pipe(Context.add(D1BatchStatements, owner.collector));
+			const value = yield* owner.close(Effect.provideContext(body, provided));
+			if (poisoned) return yield* unavailable();
+			if (mutation?.journalGuard !== void 0) {
+				const status = yield* Effect.result(mutation.journalGuard.read);
+				if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* unavailable();
+			}
+			yield* database.$client.batch([...statements, ...mutation?.postconditions ?? []]).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, mutation?.retryable) ? unavailable() : error))), translateFailure);
+			return value;
+		}), { mode: "batch" }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
+	}));
+}
+const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+const translateContextFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(PasswordRejected)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => Schema.is(PasswordRejected)(error) ? error : unavailable()))));
+const executeStandalone = (plan) => Effect.suspend(() => {
+	let retryable;
+	return coordinateCommit(() => Effect.gen(function* () {
+		const database = yield* CurrentD1PlanningDatabase;
+		const planned = yield* plan;
+		retryable = planned.retryable;
+		yield* database.$client.batch([...planned.statements, ...planned.postconditions ?? []]);
+		return planned.receipt;
+	}), { mode: "batch" }).pipe(Effect.map((result) => result.value), Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, (error) => everyFailureMatches(cause, retryable) ? unavailable() : error))));
+});
+//#endregion
+export { coordinateD1PasswordPreparedPersistence, makeD1PasswordPreparedPersistenceServices };
+
+//# sourceMappingURL=d1-password-prepared.mjs.map