@yielded/auth 0.1.0-beta.1

package/dist/drizzle/passkey-write-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-write-target.mjs","names":["M.PasskeyCeremony","M.PasskeyActionAuthorization","M.PasskeyClaim","M.PasskeyRegistrationVerified","M.PasskeyInstant","M.PasskeyModuleId","M.PasskeyCommandId","M.PasskeyCredentialId","M.PasskeyLabel","M.PasskeyCredential","M.PasskeyCredentialSummary","M.PasskeyRemoved","M.PasskeyRegistrationResult","M.PasskeyIssueDecision"],"sources":["../../src/drizzle/passkey-write-target.ts"],"sourcesContent":["import { getTableColumns } from \"drizzle-orm\";\n/* oxlint-disable no-explicit-any -- private execution bridge; target wrappers retain payload, table, ID, and requirement types. */\nimport { Effect, Layer, Schema } from \"effect\";\nimport type { Statement } from \"effect/unstable/sql/Statement\";\n\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { PasskeyConfigurationError } from \"../passkey/errors\";\nimport * as M from \"../passkey/models\";\nimport { PasskeyManagementPersistence } from \"../passkey/PasskeyManagementPersistence\";\nimport { PasskeyManagementPolicy, PasskeyMethodPolicy } from \"../passkey/policy\";\nimport { snapshotPasskeySync } from \"../passkey/snapshot\";\nimport { SubjectId } from \"../Schema\";\nimport { SessionInvalidationWindow } from \"../sessions/invalidation\";\nimport { completeEnrollment, issueEnrollment } from \"./passkey-enrollment\";\nimport {\n  inspectRemove,\n  listCredentials,\n  removeCredential,\n  renameCredential,\n} from \"./passkey-management\";\nimport type { PasskeyMappingSource } from \"./passkey-model\";\nimport {\n  completeRegistration,\n  inspectRegistration,\n  issueRegistration,\n} from \"./passkey-registration-write\";\nimport { CurrentPasskeyTransaction, invariant, nonce, unavailable } from \"./passkey-state\";\nimport {\n  capturedMapping,\n  capturedService,\n  makePasskeyExecution,\n  makePasskeyPersistence,\n  observationalContext,\n  prepareValue,\n  type PasskeyExecution,\n  type PasskeyCoordinatorError,\n  type PasskeyTargetConfiguration,\n} from \"./passkey-target\";\nimport type {\n  PasskeyManagementServices,\n  PasskeyRegistrationServices,\n  PasskeyRegistrationWriter,\n} from \"./passkey-write-model\";\nimport { coordinateTransactionOwner } from \"./transaction-execution\";\n\nexport const passkeyManagementPersistenceLayer = <E, R>(\n  services: Effect.Effect<PasskeyManagementServices, E, R>,\n) =>\n  Layer.effect(\n    PasskeyManagementPersistence,\n    Effect.map(services, (value) => value.passkeyManagementPersistence),\n  );\n\nconst issueSchema = Schema.Struct({\n  ceremony: M.PasskeyCeremony,\n  policy: PasskeyMethodPolicy,\n  management: PasskeyManagementPolicy,\n  authorization: M.PasskeyActionAuthorization,\n});\n\nconst completeSchema = Schema.Struct({\n  claim: M.PasskeyClaim,\n  verified: M.PasskeyRegistrationVerified,\n  authorization: M.PasskeyActionAuthorization,\n  management: PasskeyManagementPolicy,\n  invalidation: SessionInvalidationWindow,\n  nowMillis: M.PasskeyInstant,\n});\n\nconst metadata = { moduleId: M.PasskeyModuleId, subjectId: SubjectId };\n\nconst identity = {\n  ...metadata,\n  commandId: M.PasskeyCommandId,\n  credentialId: M.PasskeyCredentialId,\n};\n\nconst retention = { nowMillis: M.PasskeyInstant, retentionUntilMillis: M.PasskeyInstant };\n\nconst managementSchemas = {\n  list: Schema.Struct({\n    ...metadata,\n    cursor: Schema.optionalKey(M.PasskeyCredentialId),\n    limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 64 })),\n  }),\n  issueEnrollment: issueSchema,\n  completeEnrollment: completeSchema,\n  inspectRemove: Schema.Struct(identity),\n  rename: Schema.Struct({ ...identity, ...retention, name: M.PasskeyLabel }),\n  remove: Schema.Struct({\n    moduleId: M.PasskeyModuleId,\n    commandId: M.PasskeyCommandId,\n    credential: M.PasskeyCredential,\n    authorization: M.PasskeyActionAuthorization,\n    management: PasskeyManagementPolicy,\n    invalidation: SessionInvalidationWindow,\n    ...retention,\n  }),\n};\n\nconst enrolled = Schema.Union([\n  Schema.TaggedStruct(\"Enrolled\", { credential: M.PasskeyCredentialSummary }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n]);\n\nconst renamed = Schema.Union([\n  Schema.TaggedStruct(\"Renamed\", {\n    credential: M.PasskeyCredentialSummary,\n    replayed: Schema.Boolean,\n  }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n]);\n\nconst removed = Schema.Union([\n  Schema.TaggedStruct(\"Removed\", { result: M.PasskeyRemoved }),\n  Schema.TaggedStruct(\"Rejected\", {}),\n  Schema.TaggedStruct(\"LastSignInMethod\", {}),\n]);\n\nconst registrationDecision = Schema.Union([\n  M.PasskeyRegistrationResult,\n  Schema.TaggedStruct(\"Rejected\", {}),\n]);\n\nconst managementService = (\n  mapping: any,\n  execute: PasskeyExecution,\n): PasskeyManagementPersistence[\"Service\"] =>\n  capturedService<PasskeyManagementPersistence[\"Service\"]>(\n    {\n      list: (input) => execute.run(observationalContext(listCredentials(mapping, input)), false),\n      inspectRemove: (input) =>\n        execute.run(observationalContext(inspectRemove(mapping, input)), false),\n      issueEnrollment: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            return yield* prepareValue(\n              snapshotPasskeySync(M.PasskeyIssueDecision, yield* issueEnrollment(mapping, input)),\n              prepare,\n            );\n          }),\n        ),\n      completeEnrollment: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            return yield* prepareValue(\n              snapshotPasskeySync(enrolled, yield* completeEnrollment(mapping, input)),\n              prepare,\n            );\n          }),\n        ),\n      rename: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            return yield* prepareValue(\n              snapshotPasskeySync(renamed, yield* renameCredential(mapping, input)),\n              prepare,\n            );\n          }),\n        ),\n      remove: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            return yield* prepareValue(\n              snapshotPasskeySync(removed, yield* removeCredential(mapping, input)),\n              prepare,\n            );\n          }),\n        ),\n    },\n    managementSchemas,\n    execute,\n  );\n\nconst registrationService = <R>(\n  mapping: any,\n  execute: PasskeyExecution,\n): PasskeyRegistrationWriter<R> =>\n  capturedService<PasskeyRegistrationWriter<R>>(\n    {\n      inspect: (registration) =>\n        execute.run(observationalContext(inspectRegistration(mapping, registration)), false),\n      issueRegistration: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            return yield* prepareValue(\n              snapshotPasskeySync(M.PasskeyIssueDecision, yield* issueRegistration(mapping, input)),\n              prepare,\n            );\n          }),\n        ),\n      completeRegistration: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            return yield* prepareValue(\n              snapshotPasskeySync(\n                registrationDecision,\n                yield* completeRegistration(mapping, input),\n              ),\n              prepare,\n            );\n          }),\n        ),\n    },\n    {\n      inspect: Schema.toType(mapping.registration.schema),\n      issueRegistration: Schema.Struct({\n        ceremony: M.PasskeyCeremony,\n        policy: PasskeyMethodPolicy,\n        registration: Schema.toType(mapping.registration.schema),\n      }),\n      completeRegistration: Schema.Struct({\n        claim: M.PasskeyClaim,\n        verified: M.PasskeyRegistrationVerified,\n        nowMillis: M.PasskeyInstant,\n      }),\n    },\n    execute,\n  );\n\nconst descriptor = (table: any) => {\n  const columns = getTableColumns(table.table);\n\n  for (const [field, name] of Object.entries(table))\n    if (typeof name === \"string\" && !field.endsWith(\"State\"))\n      invariant(columns[name] !== undefined);\n};\n\nconst writeMapping = <M, RSetup>(\n  source: PasskeyMappingSource<M, RSetup>,\n  configuration: PasskeyTargetConfiguration,\n  registration: boolean,\n) =>\n  Effect.flatMap(capturedMapping(source, \"assertion\", configuration), (mapping) =>\n    Effect.try({\n      try: () => {\n        const m = mapping as any;\n\n        for (const name of [m.write.credential.name, m.write.credential.createdAt])\n          invariant(getTableColumns(m.read.credential.table)[name] !== undefined);\n        for (const name of m.write.policy.subjectColumns)\n          invariant(getTableColumns(m.read.subject.table)[name] !== undefined);\n        invariant(\n          m.write.credential.activeStatus !== m.write.credential.removedStatus &&\n            m.write.authority.activeStatus !== m.write.authority.removedStatus &&\n            m.write.credentialOwnership.ownedState !== m.write.credentialOwnership.removedState,\n        );\n        invariant(\n          m.read.credential.isActiveStatus(m.write.credential.activeStatus) &&\n            !m.read.credential.isActiveStatus(m.write.credential.removedStatus) &&\n            m.read.authority.isActiveStatus(m.write.authority.activeStatus) &&\n            !m.read.authority.isActiveStatus(m.write.authority.removedStatus) &&\n            m.read.credentialOwnership.isOwnedState(m.write.credentialOwnership.ownedState) &&\n            !m.read.credentialOwnership.isOwnedState(m.write.credentialOwnership.removedState) &&\n            m.read.handleOwnership.isOwnedState(m.write.handleOwnership.ownedState),\n        );\n        if (registration) {\n          descriptor(m.intent);\n          descriptor(m.handle);\n          invariant(m.handle.table === m.read.handleOwnership.table);\n          invariant(\n            m.handle.reservedState !== m.write.handleOwnership.ownedState &&\n              m.intent.pendingState !== m.intent.acceptedState &&\n              m.intent.rejectedState !== m.intent.pendingState &&\n              m.intent.rejectedState !== m.intent.acceptedState,\n          );\n          invariant(\n            m.registrationConstraints.intentFlow.join(\"/\") === \"moduleId/flowId\" &&\n              m.registrationConstraints.intentCommand.join(\"/\") === \"moduleId/commandId\" &&\n              m.registrationConstraints.handle.join(\"/\") === \"handleKey\",\n          );\n        } else {\n          descriptor(m.command);\n          invariant(m.managementConstraints.command.join(\"/\") === \"moduleId/commandId\");\n          snapshotPasskeySync(SessionInvalidationWindow, m.invalidation.window);\n          invariant(\n            m.invalidation.window.trigger === \"credential-change\" &&\n              m.invalidation.mutations.length <= 32,\n          );\n        }\n\n        return mapping;\n      },\n      catch: () => PasskeyConfigurationError.make({}),\n    }),\n  );\n\nconst managementServices = (\n  mapping: any,\n  execute: PasskeyExecution,\n  configuration: PasskeyTargetConfiguration,\n): PasskeyManagementServices => ({\n  passkeyManagementPersistence: managementService(mapping, execute),\n  passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, false, true),\n});\n\nconst registrationServices = <R>(\n  mapping: any,\n  execute: PasskeyExecution,\n  configuration: PasskeyTargetConfiguration,\n): PasskeyRegistrationServices<R> => ({\n  passkeyRegistrationAuthority: registrationService<R>(mapping, execute),\n  passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true),\n});\n\nexport const makeTargetPasskeyManagement = <M, RSetup>(\n  database: any,\n  source: PasskeyMappingSource<M, RSetup>,\n  configuration: PasskeyTargetConfiguration,\n) =>\n  Effect.gen(function* () {\n    const mapping = yield* writeMapping(source, configuration, false);\n    const hooks = yield* LifecycleHooks;\n\n    return managementServices(\n      mapping,\n      makePasskeyExecution(database, hooks, configuration),\n      configuration,\n    );\n  });\n\nexport const makeTargetPasskeyRegistrationWriter = <M, R, RSetup>(\n  database: any,\n  source: PasskeyMappingSource<M, RSetup>,\n  configuration: PasskeyTargetConfiguration,\n) =>\n  Effect.gen(function* () {\n    const mapping = yield* writeMapping(source, configuration, true);\n    const hooks = yield* LifecycleHooks;\n\n    return registrationServices<R>(\n      mapping,\n      makePasskeyExecution(database, hooks, configuration),\n      configuration,\n    );\n  });\n\nexport const coordinateTargetPasskeyManagement = <M, RSetup, Transaction, A, E, R>(\n  database: any,\n  source: PasskeyMappingSource<M, RSetup>,\n  configuration: PasskeyTargetConfiguration,\n  body: (\n    transaction: Transaction,\n    services: PasskeyManagementServices,\n    append: (statement: Statement<unknown>) => void,\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n  Effect.gen(function* () {\n    const mapping = yield* writeMapping(source, configuration, false);\n    const hooks = yield* LifecycleHooks;\n\n    return yield* coordinateTransactionOwner(\n      database,\n      CurrentPasskeyTransaction,\n      configuration,\n      Effect.void,\n      unavailable,\n      nonce,\n      (execute) =>\n        managementServices(\n          mapping,\n          {\n            ...execute,\n            run: (operation, mutation) =>\n              execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n          },\n          configuration,\n        ),\n      body,\n    ).pipe(Effect.provideService(LifecycleHooks, hooks));\n  });\n\nexport const coordinateTargetPasskeyRegistrationWriter = <M, Value, RSetup, Transaction, A, E, R>(\n  database: any,\n  source: PasskeyMappingSource<M, RSetup>,\n  configuration: PasskeyTargetConfiguration,\n  body: (\n    transaction: Transaction,\n    services: PasskeyRegistrationServices<Value>,\n    append: (statement: Statement<unknown>) => void,\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n  Effect.gen(function* () {\n    const mapping = yield* writeMapping(source, configuration, true);\n    const hooks = yield* LifecycleHooks;\n\n    return yield* coordinateTransactionOwner(\n      database,\n      CurrentPasskeyTransaction,\n      configuration,\n      Effect.void,\n      unavailable,\n      nonce,\n      (execute) =>\n        registrationServices<Value>(\n          mapping,\n          {\n            ...execute,\n            run: (operation, mutation) =>\n              execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n          },\n          configuration,\n        ),\n      body,\n    ).pipe(Effect.provideService(LifecycleHooks, hooks));\n  });\n"],"mappings":";;;;;;;;;;;;;;;;;AA6CA,MAAa,qCACX,aAEA,MAAM,OACJ,8BACA,OAAO,IAAI,WAAW,UAAU,MAAM,4BAA4B,CACpE;AAEF,MAAM,cAAc,OAAO,OAAO;CAChC,UAAUA;CACV,QAAQ;CACR,YAAY;CACZ,eAAeC;AACjB,CAAC;AAED,MAAM,iBAAiB,OAAO,OAAO;CACnC,OAAOC;CACP,UAAUC;CACV,eAAeF;CACf,YAAY;CACZ,cAAc;CACd,WAAWG;AACb,CAAC;AAED,MAAM,WAAW;CAAE,UAAUC;CAAmB,WAAW;AAAU;AAErE,MAAM,WAAW;CACf,GAAG;CACH,WAAWC;CACX,cAAcC;AAChB;AAEA,MAAM,YAAY;CAAE,WAAWH;CAAkB,sBAAsBA;AAAiB;AAExF,MAAM,oBAAoB;CACxB,MAAM,OAAO,OAAO;EAClB,GAAG;EACH,QAAQ,OAAO,YAAYG,mBAAqB;EAChD,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAG,CAAC,CAAC;CACvE,CAAC;CACD,iBAAiB;CACjB,oBAAoB;CACpB,eAAe,OAAO,OAAO,QAAQ;CACrC,QAAQ,OAAO,OAAO;EAAE,GAAG;EAAU,GAAG;EAAW,MAAMC;CAAe,CAAC;CACzE,QAAQ,OAAO,OAAO;EACpB,UAAUH;EACV,WAAWC;EACX,YAAYG;EACZ,eAAeR;EACf,YAAY;EACZ,cAAc;EACd,GAAG;CACL,CAAC;AACH;AAEA,MAAM,WAAW,OAAO,MAAM,CAC5B,OAAO,aAAa,YAAY,EAAE,YAAYS,yBAA2B,CAAC,GAC1E,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;AAED,MAAM,UAAU,OAAO,MAAM,CAC3B,OAAO,aAAa,WAAW;CAC7B,YAAYA;CACZ,UAAU,OAAO;AACnB,CAAC,GACD,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;AAED,MAAM,UAAU,OAAO,MAAM;CAC3B,OAAO,aAAa,WAAW,EAAE,QAAQC,eAAiB,CAAC;CAC3D,OAAO,aAAa,YAAY,CAAC,CAAC;CAClC,OAAO,aAAa,oBAAoB,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,uBAAuB,OAAO,MAAM,CACxCC,2BACA,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;AAED,MAAM,qBACJ,SACA,YAEA,gBACE;CACE,OAAO,UAAU,QAAQ,IAAI,qBAAqB,gBAAgB,SAAS,KAAK,CAAC,GAAG,KAAK;CACzF,gBAAgB,UACd,QAAQ,IAAI,qBAAqB,cAAc,SAAS,KAAK,CAAC,GAAG,KAAK;CACxE,kBAAkB,OAAO,YACvB,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,OAAO,OAAO,aACZ,oBAAoBC,sBAAwB,OAAO,gBAAgB,SAAS,KAAK,CAAC,GAClF,OACF;CACF,CAAC,CACH;CACF,qBAAqB,OAAO,YAC1B,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,OAAO,OAAO,aACZ,oBAAoB,UAAU,OAAO,mBAAmB,SAAS,KAAK,CAAC,GACvE,OACF;CACF,CAAC,CACH;CACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,OAAO,OAAO,aACZ,oBAAoB,SAAS,OAAO,iBAAiB,SAAS,KAAK,CAAC,GACpE,OACF;CACF,CAAC,CACH;CACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,OAAO,OAAO,aACZ,oBAAoB,SAAS,OAAO,iBAAiB,SAAS,KAAK,CAAC,GACpE,OACF;CACF,CAAC,CACH;AACJ,GACA,mBACA,OACF;AAEF,MAAM,uBACJ,SACA,YAEA,gBACE;CACE,UAAU,iBACR,QAAQ,IAAI,qBAAqB,oBAAoB,SAAS,YAAY,CAAC,GAAG,KAAK;CACrF,oBAAoB,OAAO,YACzB,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,OAAO,OAAO,aACZ,oBAAoBA,sBAAwB,OAAO,kBAAkB,SAAS,KAAK,CAAC,GACpF,OACF;CACF,CAAC,CACH;CACF,uBAAuB,OAAO,YAC5B,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,OAAO,OAAO,aACZ,oBACE,sBACA,OAAO,qBAAqB,SAAS,KAAK,CAC5C,GACA,OACF;CACF,CAAC,CACH;AACJ,GACA;CACE,SAAS,OAAO,OAAO,QAAQ,aAAa,MAAM;CAClD,mBAAmB,OAAO,OAAO;EAC/B,UAAUb;EACV,QAAQ;EACR,cAAc,OAAO,OAAO,QAAQ,aAAa,MAAM;CACzD,CAAC;CACD,sBAAsB,OAAO,OAAO;EAClC,OAAOE;EACP,UAAUC;EACV,WAAWC;CACb,CAAC;AACH,GACA,OACF;AAEF,MAAM,cAAc,UAAe;CACjC,MAAM,UAAU,gBAAgB,MAAM,KAAK;CAE3C,KAAK,MAAM,CAAC,OAAO,SAAS,OAAO,QAAQ,KAAK,GAC9C,IAAI,OAAO,SAAS,YAAY,CAAC,MAAM,SAAS,OAAO,GACrD,UAAU,QAAQ,UAAU,KAAA,CAAS;AAC3C;AAEA,MAAM,gBACJ,QACA,eACA,iBAEA,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,aAAa,IAAI,YACnE,OAAO,IAAI;CACT,WAAW;EACT,MAAM,IAAI;EAEV,KAAK,MAAM,QAAQ,CAAC,EAAE,MAAM,WAAW,MAAM,EAAE,MAAM,WAAW,SAAS,GACvE,UAAU,gBAAgB,EAAE,KAAK,WAAW,KAAK,CAAC,CAAC,UAAU,KAAA,CAAS;EACxE,KAAK,MAAM,QAAQ,EAAE,MAAM,OAAO,gBAChC,UAAU,gBAAgB,EAAE,KAAK,QAAQ,KAAK,CAAC,CAAC,UAAU,KAAA,CAAS;EACrE,UACE,EAAE,MAAM,WAAW,iBAAiB,EAAE,MAAM,WAAW,iBACrD,EAAE,MAAM,UAAU,iBAAiB,EAAE,MAAM,UAAU,iBACrD,EAAE,MAAM,oBAAoB,eAAe,EAAE,MAAM,oBAAoB,YAC3E;EACA,UACE,EAAE,KAAK,WAAW,eAAe,EAAE,MAAM,WAAW,YAAY,KAC9D,CAAC,EAAE,KAAK,WAAW,eAAe,EAAE,MAAM,WAAW,aAAa,KAClE,EAAE,KAAK,UAAU,eAAe,EAAE,MAAM,UAAU,YAAY,KAC9D,CAAC,EAAE,KAAK,UAAU,eAAe,EAAE,MAAM,UAAU,aAAa,KAChE,EAAE,KAAK,oBAAoB,aAAa,EAAE,MAAM,oBAAoB,UAAU,KAC9E,CAAC,EAAE,KAAK,oBAAoB,aAAa,EAAE,MAAM,oBAAoB,YAAY,KACjF,EAAE,KAAK,gBAAgB,aAAa,EAAE,MAAM,gBAAgB,UAAU,CAC1E;EACA,IAAI,cAAc;GAChB,WAAW,EAAE,MAAM;GACnB,WAAW,EAAE,MAAM;GACnB,UAAU,EAAE,OAAO,UAAU,EAAE,KAAK,gBAAgB,KAAK;GACzD,UACE,EAAE,OAAO,kBAAkB,EAAE,MAAM,gBAAgB,cACjD,EAAE,OAAO,iBAAiB,EAAE,OAAO,iBACnC,EAAE,OAAO,kBAAkB,EAAE,OAAO,gBACpC,EAAE,OAAO,kBAAkB,EAAE,OAAO,aACxC;GACA,UACE,EAAE,wBAAwB,WAAW,KAAK,GAAG,MAAM,qBACjD,EAAE,wBAAwB,cAAc,KAAK,GAAG,MAAM,wBACtD,EAAE,wBAAwB,OAAO,KAAK,GAAG,MAAM,WACnD;EACF,OAAO;GACL,WAAW,EAAE,OAAO;GACpB,UAAU,EAAE,sBAAsB,QAAQ,KAAK,GAAG,MAAM,oBAAoB;GAC5E,oBAAoB,2BAA2B,EAAE,aAAa,MAAM;GACpE,UACE,EAAE,aAAa,OAAO,YAAY,uBAChC,EAAE,aAAa,UAAU,UAAU,EACvC;EACF;EAEA,OAAO;CACT;CACA,aAAa,0BAA0B,KAAK,CAAC,CAAC;AAChD,CAAC,CACH;AAEF,MAAM,sBACJ,SACA,SACA,mBAC+B;CAC/B,8BAA8B,kBAAkB,SAAS,OAAO;CAChE,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,OAAO,IAAI;AACzF;AAEA,MAAM,wBACJ,SACA,SACA,mBACoC;CACpC,8BAA8B,oBAAuB,SAAS,OAAO;CACrE,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,IAAI;AAClF;AAEA,MAAa,+BACX,UACA,QACA,kBAEA,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,KAAK;CAChE,MAAM,QAAQ,OAAO;CAErB,OAAO,mBACL,SACA,qBAAqB,UAAU,OAAO,aAAa,GACnD,aACF;AACF,CAAC;AAEH,MAAa,uCACX,UACA,QACA,kBAEA,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,IAAI;CAC/D,MAAM,QAAQ,OAAO;CAErB,OAAO,qBACL,SACA,qBAAqB,UAAU,OAAO,aAAa,GACnD,aACF;AACF,CAAC;AAEH,MAAa,qCACX,UACA,QACA,eACA,SAMA,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,KAAK;CAChE,MAAM,QAAQ,OAAO;CAErB,OAAO,OAAO,2BACZ,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,YACC,mBACE,SACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,QAAQ,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACtF,GACA,aACF,GACF,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;AACrD,CAAC;AAEH,MAAa,6CACX,UACA,QACA,eACA,SAMA,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,IAAI;CAC/D,MAAM,QAAQ,OAAO;CAErB,OAAO,OAAO,2BACZ,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,YACC,qBACE,SACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,QAAQ,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACtF,GACA,aACF,GACF,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;AACrD,CAAC"}

package/dist/drizzle/password-model.d.mts

@@ -0,0 +1,330 @@
+import { AuthenticationRequirement, SecurityRevision } from "../sessions/models.mjs";
+import { LoginIdentifier, RecoveryReference } from "../identity/models.mjs";
+import { DrizzleMappingError, SubjectIdCodec } from "./model.mjs";
+import { PasswordAction, PasswordAttemptId, PasswordCredentialSnapshot, PasswordReplacement } from "../password/methods/models.mjs";
+import { EncodedPasswordHash } from "../password/models.mjs";
+import { PasswordRegistrationDecision } from "../password/methods/module.mjs";
+import { Effect, Redacted } from "effect";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/password-model.d.ts
+type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+type PasswordAttemptAction = "sign-in" | "change";
+type PasswordAttemptState = "pending" | "verified" | "rejected";
+type PasswordRateScopeKind = "action" | "identifier" | "subject";
+interface PasswordScopeKeys {
+  readonly action: string;
+  readonly identifier: string;
+  readonly subject?: string;
+}
+interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {
+  readonly table: Subject;
+  readonly id: ColumnKey<Subject>;
+  readonly status: ColumnKey<Subject>;
+  readonly securityRevision: ColumnKey<Subject>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly decodeRequirement: (row: InferSelectModel<Subject>) => Effect.Effect<AuthenticationRequirement, DrizzleMappingError>;
+  /** Current policy for this exact credential mutation, decoded under the subject lock. */
+  readonly decodeActionRequirement: (row: InferSelectModel<Subject>, action: PasswordAction) => Effect.Effect<AuthenticationRequirement, DrizzleMappingError>;
+  readonly nextSecurityRevision?: (current: SecurityRevision) => Effect.Effect<SecurityRevision, DrizzleMappingError>;
+  readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;
+  /** Required only by D1 conditional statements. */
+  readonly d1ActiveStatusValue?: unknown;
+}
+interface PasswordIdentifierTable<Identifier extends Table, NativeSubjectId> {
+  readonly table: Identifier;
+  readonly namespace: ColumnKey<Identifier>;
+  readonly value: ColumnKey<Identifier>;
+  readonly subjectId: ColumnKey<Identifier>;
+  readonly verifiedAt: ColumnKey<Identifier>;
+  readonly bindingRevision: ColumnKey<Identifier>;
+  /** Consumer-owned current login/recovery eligibility, including row status. */
+  readonly isCurrent: (row: InferSelectModel<Identifier>) => boolean;
+  /** Required by D1 so current ownership/eligibility is rechecked in the batch. */
+  readonly d1CurrentCondition?: (input: {
+    readonly identifier: LoginIdentifier;
+    readonly nativeSubjectId: NativeSubjectId;
+  }) => SQL;
+  readonly encodeInitialInsert: (identifier: LoginIdentifier, subjectId: NativeSubjectId, bindingRevision: SecurityRevision) => InferInsertModel<Identifier>;
+}
+interface PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {
+  readonly table: Credential;
+  readonly subjectId: ColumnKey<Credential>;
+  readonly credentialId: ColumnKey<Credential>;
+  readonly revision: ColumnKey<Credential>;
+  readonly status?: ColumnKey<Credential>;
+  readonly isActiveStatus?: (value: unknown) => boolean;
+  readonly d1ActiveStatusValue?: unknown;
+  readonly encodeInsert: (input: {
+    readonly subjectId: NativeSubjectId;
+    readonly credentialId: string;
+    readonly revision: SecurityRevision;
+  }) => InferInsertModel<Credential>;
+  readonly encodeRevision: (revision: SecurityRevision) => Partial<InferInsertModel<Credential>>;
+}
+interface PasswordCredentialTable<Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> {
+  readonly table: Credential;
+  readonly moduleId: ColumnKey<Credential>;
+  readonly subjectId: ColumnKey<Credential>;
+  readonly credentialId: ColumnKey<Credential>;
+  readonly credentialRevision: ColumnKey<Credential>;
+  readonly verifierVersion: ColumnKey<Credential>;
+  readonly verifier: ColumnKey<Credential>;
+  readonly normalization: ColumnKey<Credential>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly subjectId: NativeSubjectId;
+    readonly credentialId: string;
+    readonly credentialRevision: SecurityRevision;
+    readonly verifierVersion: SecurityRevision;
+    readonly replacement: PasswordReplacement;
+  }) => InferInsertModel<Credential>;
+  readonly encodeVerifier: (verifier: Redacted.Redacted<EncodedPasswordHash>, verifierVersion: SecurityRevision) => Partial<InferInsertModel<Credential>>;
+  readonly encodeReplacement: (input: {
+    readonly replacement: PasswordReplacement;
+    readonly credentialRevision: SecurityRevision;
+    readonly verifierVersion: SecurityRevision;
+  }) => Partial<InferInsertModel<Credential>>;
+  readonly decode: (input: {
+    readonly moduleId: string;
+    readonly subject: InferSelectModel<Subject>;
+    readonly identifier: InferSelectModel<Identifier>;
+    readonly credential: InferSelectModel<Credential>;
+  }) => Effect.Effect<PasswordCredentialSnapshot, DrizzleMappingError>;
+}
+interface PasswordAttemptRecord {
+  readonly moduleId: string;
+  readonly action: PasswordAttemptAction;
+  readonly attemptId: PasswordAttemptId;
+  readonly identifier: LoginIdentifier;
+  readonly subjectId?: string;
+  readonly credentialId?: string;
+  readonly securityRevision?: SecurityRevision;
+  readonly credentialRevision?: SecurityRevision;
+  readonly verifierVersion?: SecurityRevision;
+  readonly identifierBindingRevision?: SecurityRevision;
+  readonly admittedAtMillis: number;
+  readonly deadlineMillis: number;
+  readonly retentionUntilMillis: number;
+}
+interface PasswordAttemptTable<Attempt extends Table, NativeSubjectId> {
+  readonly table: Attempt;
+  readonly moduleId: ColumnKey<Attempt>;
+  readonly action: ColumnKey<Attempt>;
+  readonly attemptId: ColumnKey<Attempt>;
+  readonly identifierNamespace: ColumnKey<Attempt>;
+  readonly identifierValue: ColumnKey<Attempt>;
+  readonly subjectId: ColumnKey<Attempt>;
+  readonly credentialId: ColumnKey<Attempt>;
+  readonly securityRevision: ColumnKey<Attempt>;
+  readonly credentialRevision: ColumnKey<Attempt>;
+  readonly verifierVersion: ColumnKey<Attempt>;
+  readonly identifierBindingRevision: ColumnKey<Attempt>;
+  readonly admittedAt: ColumnKey<Attempt>;
+  readonly deadline: ColumnKey<Attempt>;
+  readonly retentionUntil: ColumnKey<Attempt>;
+  readonly state: ColumnKey<Attempt>;
+  readonly encodeInsert: (record: PasswordAttemptRecord, input: {
+    readonly nativeSubjectId?: NativeSubjectId;
+    readonly state: "pending";
+  }) => InferInsertModel<Attempt>;
+}
+interface PasswordRateScopeTable<RateScope extends Table> {
+  readonly table: RateScope;
+  readonly moduleId: ColumnKey<RateScope>;
+  readonly action: ColumnKey<RateScope>;
+  readonly scopeKind: ColumnKey<RateScope>;
+  readonly scopeKey: ColumnKey<RateScope>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly action: PasswordAttemptAction;
+    readonly scopeKind: PasswordRateScopeKind;
+    readonly scopeKey: string;
+  }) => InferInsertModel<RateScope>;
+}
+interface PasswordChargeTable<Charge extends Table> {
+  readonly table: Charge;
+  readonly moduleId: ColumnKey<Charge>;
+  readonly action: ColumnKey<Charge>;
+  readonly scopeKind: ColumnKey<Charge>;
+  readonly scopeKey: ColumnKey<Charge>;
+  readonly attemptId: ColumnKey<Charge>;
+  readonly occurredAt: ColumnKey<Charge>;
+  readonly retentionUntil: ColumnKey<Charge>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly action: PasswordAttemptAction;
+    readonly scopeKind: PasswordRateScopeKind;
+    readonly scopeKey: string;
+    readonly attemptId: PasswordAttemptId;
+    readonly occurredAtMillis: number;
+    readonly retentionUntilMillis: number;
+  }) => InferInsertModel<Charge>;
+}
+interface PasswordCommandTable<Command extends Table> {
+  readonly table: Command;
+  readonly moduleId: ColumnKey<Command>;
+  readonly commandId: ColumnKey<Command>;
+  readonly action: ColumnKey<Command>;
+  readonly bindingDigest: ColumnKey<Command>;
+  readonly decision: ColumnKey<Command>;
+  readonly retentionUntil: ColumnKey<Command>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly commandId: string;
+    readonly action: string;
+    readonly bindingDigest: string;
+    readonly decision: "changed";
+    readonly retentionUntilMillis: number;
+  }) => InferInsertModel<Command>;
+}
+interface RequiredPasswordConstraints {
+  readonly identifier: "unique(identifier.namespace,identifier.value)";
+  readonly authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)";
+  readonly credentialSubject: "unique(credential.moduleId,credential.subjectId)";
+  readonly credentialId: "unique(credential.moduleId,credential.credentialId)";
+  readonly attempt: "unique(attempt.moduleId,attempt.attemptId)";
+  readonly rateScope: "unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)";
+  readonly charge: "unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)";
+  readonly command: "unique(command.moduleId,command.commandId)";
+}
+declare const requiredPasswordConstraints: RequiredPasswordConstraints;
+interface PasswordConstraintClassifier {
+  /** Match only the mapped command uniqueness constraint. */
+  readonly isCommandConflict: (cause: unknown) => boolean;
+  /** Match only the mapped rate-scope uniqueness constraint. */
+  readonly isRateScopeConflict: (cause: unknown) => boolean;
+}
+interface PasswordD1Clock {
+  readonly engineNow: SQL;
+  readonly engineNowMillis: SQL;
+  readonly engineInstantMinus: (millis: number) => SQL;
+  readonly engineInstantPlus: (millis: number) => SQL;
+}
+interface PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, NativeSubjectId> extends PasswordConstraintClassifier {
+  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;
+  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId>;
+  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;
+  /** Every factor revision named by action evidence, including non-password factors. */
+  readonly authorityCredential: PasswordAuthorityCredentialTable<AuthorityCredential, NativeSubjectId>;
+  readonly attempt: PasswordAttemptTable<Attempt, NativeSubjectId>;
+  readonly rateScope: PasswordRateScopeTable<RateScope>;
+  readonly charge: PasswordChargeTable<Charge>;
+  readonly command: PasswordCommandTable<Command>;
+  readonly subjectId: SubjectIdCodec<NativeSubjectId>;
+  readonly constraints: RequiredPasswordConstraints;
+  readonly scopeKeys: (input: {
+    readonly moduleId: string;
+    readonly action: PasswordAttemptAction;
+    readonly identifier: LoginIdentifier;
+    readonly subjectId?: string;
+  }) => PasswordScopeKeys;
+  readonly encodeInstant: (epochMillis: number) => unknown;
+  readonly decodeInstant: (native: unknown) => Effect.Effect<number, DrizzleMappingError>;
+  readonly allocateAttemptId?: Effect.Effect<PasswordAttemptId, DrizzleMappingError>;
+  readonly allocateAttemptIdSync?: () => PasswordAttemptId;
+  readonly allocateCredentialId?: Effect.Effect<string, DrizzleMappingError>;
+  readonly allocateCredentialIdSync?: () => string;
+  readonly allocateRevision?: Effect.Effect<SecurityRevision, DrizzleMappingError>;
+  readonly allocateRevisionSync?: () => SecurityRevision;
+  readonly commandRetentionMillis: number;
+  /** All semantic replacements still bump subject revision. This flag only declares bearer invalidation latency. */
+  readonly sessionInvalidation: "same-authority-immediate" | "original-absolute-expiry";
+  readonly d1?: PasswordD1Clock;
+}
+type D1PasswordPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, NativeSubjectId> = PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, NativeSubjectId> & {
+  readonly d1: PasswordD1Clock;
+  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId> & {
+    readonly d1ActiveStatusValue: unknown;
+  };
+  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId> & {
+    readonly d1CurrentCondition: (input: {
+      readonly identifier: LoginIdentifier;
+      readonly nativeSubjectId: NativeSubjectId;
+    }) => SQL;
+  };
+  readonly authorityCredential: PasswordAuthorityCredentialTable<AuthorityCredential, NativeSubjectId> & {
+    readonly d1ActiveStatusValue: unknown;
+  };
+};
+type PasswordRegistrationState = "pending" | "created";
+interface PasswordRegistrationIntent<Registration> {
+  readonly moduleId: string;
+  readonly requestId: string;
+  readonly identifier: LoginIdentifier;
+  readonly registration: Registration;
+  readonly replacement: PasswordReplacement;
+}
+interface PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> {
+  readonly table: Request;
+  readonly moduleId: ColumnKey<Request>;
+  readonly requestId: ColumnKey<Request>;
+  readonly state: ColumnKey<Request>;
+  readonly subjectId: ColumnKey<Request>;
+  readonly recoveryReference: ColumnKey<Request>;
+  readonly encodeInsert: (input: PasswordRegistrationIntent<Registration>, state: {
+    readonly state: PasswordRegistrationState;
+    readonly nativeSubjectId?: NativeSubjectId;
+    readonly recoveryReference?: typeof RecoveryReference.Type;
+  }) => InferInsertModel<Request>;
+  /** Replay projection must never expose a stored subject or decode protected intent. */
+  readonly decodeReplay: (row: InferSelectModel<Request>) => Effect.Effect<Exclude<PasswordRegistrationDecision, {
+    readonly _tag: "Created";
+  }>, DrizzleMappingError>;
+}
+interface PasswordRegistrationProvisioning<Registration, Subject extends Table, NativeSubjectId> {
+  readonly encodeSubjectInsert: (input: PasswordRegistrationIntent<Registration>, values: {
+    readonly nativeSubjectId: NativeSubjectId | undefined;
+    readonly securityRevision: SecurityRevision;
+  }) => InferInsertModel<Subject>;
+  readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, DrizzleMappingError>;
+  readonly allocateSubjectIdSync?: () => NativeSubjectId;
+  /** Interactive targets use this for database-generated/autoincrement keys. */
+  readonly decodeGeneratedId?: (rows: ReadonlyArray<unknown>) => Effect.Effect<NativeSubjectId, DrizzleMappingError>;
+}
+interface RequiredPasswordRegistrationConstraints {
+  readonly request: "unique(registration.moduleId,registration.requestId)";
+  readonly recoveryReference: "unique(registration.recoveryReference)";
+  readonly identifier: "unique(identifier.namespace,identifier.value)";
+  readonly credentialSubject: "unique(credential.moduleId,credential.subjectId)";
+  readonly authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)";
+}
+declare const requiredPasswordRegistrationConstraints: RequiredPasswordRegistrationConstraints;
+interface PasswordRegistrationConstraintClassifier {
+  readonly isRequestConflict: (cause: unknown) => boolean;
+  readonly isIdentifierConflict: (cause: unknown) => boolean;
+  readonly isCredentialConflict: (cause: unknown) => boolean;
+}
+type PasswordRegistrationMapping<Registration, Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Request extends Table, NativeSubjectId> = PasswordRegistrationConstraintClassifier & {
+  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;
+  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId>;
+  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;
+  readonly authorityCredential: PasswordAuthorityCredentialTable<AuthorityCredential, NativeSubjectId>;
+  readonly registration: PasswordRegistrationTable<Registration, Request, NativeSubjectId>;
+  readonly subjectId: SubjectIdCodec<NativeSubjectId>;
+  readonly constraints: RequiredPasswordRegistrationConstraints;
+  readonly allocateCredentialId?: Effect.Effect<string, DrizzleMappingError>;
+  readonly allocateCredentialIdSync?: () => string;
+  readonly allocateRevision?: Effect.Effect<SecurityRevision, DrizzleMappingError>;
+  readonly allocateRevisionSync?: () => SecurityRevision;
+} & ({
+  readonly mode: "atomic";
+  readonly provisioning: PasswordRegistrationProvisioning<Registration, Subject, NativeSubjectId> & ({
+    readonly idMode: "allocated";
+    readonly allocateSubjectId: Effect.Effect<NativeSubjectId, DrizzleMappingError>;
+  } | {
+    readonly idMode: "synchronous";
+    readonly allocateSubjectIdSync: () => NativeSubjectId;
+  } | {
+    readonly idMode: "generated";
+    readonly decodeGeneratedId: (rows: ReadonlyArray<unknown>) => Effect.Effect<NativeSubjectId, DrizzleMappingError>;
+  });
+} | {
+  readonly mode: "pending";
+  readonly allocateRecoveryReference?: Effect.Effect<typeof RecoveryReference.Type, DrizzleMappingError>;
+  readonly allocateRecoveryReferenceSync?: () => typeof RecoveryReference.Type;
+});
+type AnyPasswordPersistenceMapping = PasswordPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
+type AnyPasswordRegistrationMapping<Registration = unknown> = PasswordRegistrationMapping<Registration, Table, Table, Table, Table, Table, unknown>;
+//#endregion
+export { AnyPasswordPersistenceMapping, AnyPasswordRegistrationMapping, D1PasswordPersistenceMapping, PasswordAttemptAction, PasswordAttemptRecord, PasswordAttemptState, PasswordAttemptTable, PasswordAuthorityCredentialTable, PasswordChargeTable, PasswordCommandTable, PasswordConstraintClassifier, PasswordCredentialTable, PasswordD1Clock, PasswordIdentifierTable, PasswordPersistenceMapping, PasswordRateScopeKind, PasswordRateScopeTable, PasswordRegistrationConstraintClassifier, PasswordRegistrationIntent, PasswordRegistrationMapping, PasswordRegistrationProvisioning, PasswordRegistrationState, PasswordRegistrationTable, PasswordScopeKeys, PasswordSubjectTable, RequiredPasswordConstraints, RequiredPasswordRegistrationConstraints, requiredPasswordConstraints, requiredPasswordRegistrationConstraints };
+//# sourceMappingURL=password-model.d.mts.map

package/dist/drizzle/password-model.mjs

@@ -0,0 +1,22 @@
+//#region src/drizzle/password-model.ts
+const requiredPasswordConstraints = {
+	identifier: "unique(identifier.namespace,identifier.value)",
+	authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)",
+	credentialSubject: "unique(credential.moduleId,credential.subjectId)",
+	credentialId: "unique(credential.moduleId,credential.credentialId)",
+	attempt: "unique(attempt.moduleId,attempt.attemptId)",
+	rateScope: "unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)",
+	charge: "unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)",
+	command: "unique(command.moduleId,command.commandId)"
+};
+const requiredPasswordRegistrationConstraints = {
+	request: "unique(registration.moduleId,registration.requestId)",
+	recoveryReference: "unique(registration.recoveryReference)",
+	identifier: "unique(identifier.namespace,identifier.value)",
+	credentialSubject: "unique(credential.moduleId,credential.subjectId)",
+	authorityCredential: "unique(authorityCredential.subjectId,authorityCredential.credentialId)"
+};
+//#endregion
+export { requiredPasswordConstraints, requiredPasswordRegistrationConstraints };
+
+//# sourceMappingURL=password-model.mjs.map

package/dist/drizzle/password-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-model.mjs","names":[],"sources":["../../src/drizzle/password-model.ts"],"sourcesContent":["import type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { Effect, Redacted } from \"effect\";\n\nimport { type RecoveryReference, type LoginIdentifier } from \"../identity/models\";\nimport type {\n  PasswordAction,\n  PasswordAttemptId,\n  PasswordCredentialSnapshot,\n  PasswordReplacement,\n} from \"../password/methods/models\";\nimport type { PasswordRegistrationDecision } from \"../password/methods/module\";\nimport type { EncodedPasswordHash } from \"../password/models\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"../sessions/models\";\nimport type { DrizzleMappingError, SubjectIdCodec } from \"./model\";\n\ntype ColumnKey<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\n\nexport type PasswordAttemptAction = \"sign-in\" | \"change\";\nexport type PasswordAttemptState = \"pending\" | \"verified\" | \"rejected\";\nexport type PasswordRateScopeKind = \"action\" | \"identifier\" | \"subject\";\n\nexport interface PasswordScopeKeys {\n  readonly action: string;\n  readonly identifier: string;\n  readonly subject?: string;\n}\n\nexport interface PasswordSubjectTable<Subject extends Table, _NativeSubjectId> {\n  readonly table: Subject;\n  readonly id: ColumnKey<Subject>;\n  readonly status: ColumnKey<Subject>;\n  readonly securityRevision: ColumnKey<Subject>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly decodeRequirement: (\n    row: InferSelectModel<Subject>,\n  ) => Effect.Effect<AuthenticationRequirement, DrizzleMappingError>;\n  /** Current policy for this exact credential mutation, decoded under the subject lock. */\n  readonly decodeActionRequirement: (\n    row: InferSelectModel<Subject>,\n    action: PasswordAction,\n  ) => Effect.Effect<AuthenticationRequirement, DrizzleMappingError>;\n  readonly nextSecurityRevision?: (\n    current: SecurityRevision,\n  ) => Effect.Effect<SecurityRevision, DrizzleMappingError>;\n  readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  /** Required only by D1 conditional statements. */\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface PasswordIdentifierTable<Identifier extends Table, NativeSubjectId> {\n  readonly table: Identifier;\n  readonly namespace: ColumnKey<Identifier>;\n  readonly value: ColumnKey<Identifier>;\n  readonly subjectId: ColumnKey<Identifier>;\n  readonly verifiedAt: ColumnKey<Identifier>;\n  readonly bindingRevision: ColumnKey<Identifier>;\n  /** Consumer-owned current login/recovery eligibility, including row status. */\n  readonly isCurrent: (row: InferSelectModel<Identifier>) => boolean;\n  /** Required by D1 so current ownership/eligibility is rechecked in the batch. */\n  readonly d1CurrentCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n  }) => SQL;\n  readonly encodeInitialInsert: (\n    identifier: LoginIdentifier,\n    subjectId: NativeSubjectId,\n    bindingRevision: SecurityRevision,\n  ) => InferInsertModel<Identifier>;\n}\n\nexport interface PasswordAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {\n  readonly table: Credential;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly revision: ColumnKey<Credential>;\n  readonly status?: ColumnKey<Credential>;\n  readonly isActiveStatus?: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n  readonly encodeInsert: (input: {\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => InferInsertModel<Credential>;\n  readonly encodeRevision: (revision: SecurityRevision) => Partial<InferInsertModel<Credential>>;\n}\n\nexport interface PasswordCredentialTable<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> {\n  readonly table: Credential;\n  readonly moduleId: ColumnKey<Credential>;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly credentialRevision: ColumnKey<Credential>;\n  readonly verifierVersion: ColumnKey<Credential>;\n  readonly verifier: ColumnKey<Credential>;\n  readonly normalization: ColumnKey<Credential>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n    readonly replacement: PasswordReplacement;\n  }) => InferInsertModel<Credential>;\n  readonly encodeVerifier: (\n    verifier: Redacted.Redacted<EncodedPasswordHash>,\n    verifierVersion: SecurityRevision,\n  ) => Partial<InferInsertModel<Credential>>;\n  readonly encodeReplacement: (input: {\n    readonly replacement: PasswordReplacement;\n    readonly credentialRevision: SecurityRevision;\n    readonly verifierVersion: SecurityRevision;\n  }) => Partial<InferInsertModel<Credential>>;\n  readonly decode: (input: {\n    readonly moduleId: string;\n    readonly subject: InferSelectModel<Subject>;\n    readonly identifier: InferSelectModel<Identifier>;\n    readonly credential: InferSelectModel<Credential>;\n  }) => Effect.Effect<PasswordCredentialSnapshot, DrizzleMappingError>;\n}\n\nexport interface PasswordAttemptRecord {\n  readonly moduleId: string;\n  readonly action: PasswordAttemptAction;\n  readonly attemptId: PasswordAttemptId;\n  readonly identifier: LoginIdentifier;\n  readonly subjectId?: string;\n  readonly credentialId?: string;\n  readonly securityRevision?: SecurityRevision;\n  readonly credentialRevision?: SecurityRevision;\n  readonly verifierVersion?: SecurityRevision;\n  readonly identifierBindingRevision?: SecurityRevision;\n  readonly admittedAtMillis: number;\n  readonly deadlineMillis: number;\n  readonly retentionUntilMillis: number;\n}\n\nexport interface PasswordAttemptTable<Attempt extends Table, NativeSubjectId> {\n  readonly table: Attempt;\n  readonly moduleId: ColumnKey<Attempt>;\n  readonly action: ColumnKey<Attempt>;\n  readonly attemptId: ColumnKey<Attempt>;\n  readonly identifierNamespace: ColumnKey<Attempt>;\n  readonly identifierValue: ColumnKey<Attempt>;\n  readonly subjectId: ColumnKey<Attempt>;\n  readonly credentialId: ColumnKey<Attempt>;\n  readonly securityRevision: ColumnKey<Attempt>;\n  readonly credentialRevision: ColumnKey<Attempt>;\n  readonly verifierVersion: ColumnKey<Attempt>;\n  readonly identifierBindingRevision: ColumnKey<Attempt>;\n  readonly admittedAt: ColumnKey<Attempt>;\n  readonly deadline: ColumnKey<Attempt>;\n  readonly retentionUntil: ColumnKey<Attempt>;\n  readonly state: ColumnKey<Attempt>;\n  readonly encodeInsert: (\n    record: PasswordAttemptRecord,\n    input: { readonly nativeSubjectId?: NativeSubjectId; readonly state: \"pending\" },\n  ) => InferInsertModel<Attempt>;\n}\n\nexport interface PasswordRateScopeTable<RateScope extends Table> {\n  readonly table: RateScope;\n  readonly moduleId: ColumnKey<RateScope>;\n  readonly action: ColumnKey<RateScope>;\n  readonly scopeKind: ColumnKey<RateScope>;\n  readonly scopeKey: ColumnKey<RateScope>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly action: PasswordAttemptAction;\n    readonly scopeKind: PasswordRateScopeKind;\n    readonly scopeKey: string;\n  }) => InferInsertModel<RateScope>;\n}\n\nexport interface PasswordChargeTable<Charge extends Table> {\n  readonly table: Charge;\n  readonly moduleId: ColumnKey<Charge>;\n  readonly action: ColumnKey<Charge>;\n  readonly scopeKind: ColumnKey<Charge>;\n  readonly scopeKey: ColumnKey<Charge>;\n  readonly attemptId: ColumnKey<Charge>;\n  readonly occurredAt: ColumnKey<Charge>;\n  readonly retentionUntil: ColumnKey<Charge>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly action: PasswordAttemptAction;\n    readonly scopeKind: PasswordRateScopeKind;\n    readonly scopeKey: string;\n    readonly attemptId: PasswordAttemptId;\n    readonly occurredAtMillis: number;\n    readonly retentionUntilMillis: number;\n  }) => InferInsertModel<Charge>;\n}\n\nexport interface PasswordCommandTable<Command extends Table> {\n  readonly table: Command;\n  readonly moduleId: ColumnKey<Command>;\n  readonly commandId: ColumnKey<Command>;\n  readonly action: ColumnKey<Command>;\n  readonly bindingDigest: ColumnKey<Command>;\n  readonly decision: ColumnKey<Command>;\n  readonly retentionUntil: ColumnKey<Command>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly action: string;\n    readonly bindingDigest: string;\n    readonly decision: \"changed\";\n    readonly retentionUntilMillis: number;\n  }) => InferInsertModel<Command>;\n}\n\nexport interface RequiredPasswordConstraints {\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n  readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n  readonly credentialId: \"unique(credential.moduleId,credential.credentialId)\";\n  readonly attempt: \"unique(attempt.moduleId,attempt.attemptId)\";\n  readonly rateScope: \"unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)\";\n  readonly charge: \"unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)\";\n  readonly command: \"unique(command.moduleId,command.commandId)\";\n}\n\nexport const requiredPasswordConstraints: RequiredPasswordConstraints = {\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n  credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n  credentialId: \"unique(credential.moduleId,credential.credentialId)\",\n  attempt: \"unique(attempt.moduleId,attempt.attemptId)\",\n  rateScope: \"unique(rateScope.moduleId,rateScope.action,rateScope.scopeKind,rateScope.scopeKey)\",\n  charge: \"unique(charge.moduleId,charge.action,charge.scopeKind,charge.scopeKey,charge.attemptId)\",\n  command: \"unique(command.moduleId,command.commandId)\",\n};\n\nexport interface PasswordConstraintClassifier {\n  /** Match only the mapped command uniqueness constraint. */\n  readonly isCommandConflict: (cause: unknown) => boolean;\n  /** Match only the mapped rate-scope uniqueness constraint. */\n  readonly isRateScopeConflict: (cause: unknown) => boolean;\n}\n\nexport interface PasswordD1Clock {\n  readonly engineNow: SQL;\n  readonly engineNowMillis: SQL;\n  readonly engineInstantMinus: (millis: number) => SQL;\n  readonly engineInstantPlus: (millis: number) => SQL;\n}\n\nexport interface PasswordPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  RateScope extends Table,\n  Charge extends Table,\n  Command extends Table,\n  NativeSubjectId,\n> extends PasswordConstraintClassifier {\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId>;\n  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  /** Every factor revision named by action evidence, including non-password factors. */\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly attempt: PasswordAttemptTable<Attempt, NativeSubjectId>;\n  readonly rateScope: PasswordRateScopeTable<RateScope>;\n  readonly charge: PasswordChargeTable<Charge>;\n  readonly command: PasswordCommandTable<Command>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredPasswordConstraints;\n  readonly scopeKeys: (input: {\n    readonly moduleId: string;\n    readonly action: PasswordAttemptAction;\n    readonly identifier: LoginIdentifier;\n    readonly subjectId?: string;\n  }) => PasswordScopeKeys;\n  readonly encodeInstant: (epochMillis: number) => unknown;\n  readonly decodeInstant: (native: unknown) => Effect.Effect<number, DrizzleMappingError>;\n  readonly allocateAttemptId?: Effect.Effect<PasswordAttemptId, DrizzleMappingError>;\n  readonly allocateAttemptIdSync?: () => PasswordAttemptId;\n  readonly allocateCredentialId?: Effect.Effect<string, DrizzleMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, DrizzleMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n  readonly commandRetentionMillis: number;\n  /** All semantic replacements still bump subject revision. This flag only declares bearer invalidation latency. */\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n  readonly d1?: PasswordD1Clock;\n}\n\nexport type D1PasswordPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  RateScope extends Table,\n  Charge extends Table,\n  Command extends Table,\n  NativeSubjectId,\n> = PasswordPersistenceMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Attempt,\n  RateScope,\n  Charge,\n  Command,\n  NativeSubjectId\n> & {\n  readonly d1: PasswordD1Clock;\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId> & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId> & {\n    readonly d1CurrentCondition: (input: {\n      readonly identifier: LoginIdentifier;\n      readonly nativeSubjectId: NativeSubjectId;\n    }) => SQL;\n  };\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  > & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n};\n\nexport type PasswordRegistrationState = \"pending\" | \"created\";\n\nexport interface PasswordRegistrationIntent<Registration> {\n  readonly moduleId: string;\n  readonly requestId: string;\n  readonly identifier: LoginIdentifier;\n  readonly registration: Registration;\n  readonly replacement: PasswordReplacement;\n}\n\nexport interface PasswordRegistrationTable<Registration, Request extends Table, NativeSubjectId> {\n  readonly table: Request;\n  readonly moduleId: ColumnKey<Request>;\n  readonly requestId: ColumnKey<Request>;\n  readonly state: ColumnKey<Request>;\n  readonly subjectId: ColumnKey<Request>;\n  readonly recoveryReference: ColumnKey<Request>;\n  readonly encodeInsert: (\n    input: PasswordRegistrationIntent<Registration>,\n    state: {\n      readonly state: PasswordRegistrationState;\n      readonly nativeSubjectId?: NativeSubjectId;\n      readonly recoveryReference?: typeof RecoveryReference.Type;\n    },\n  ) => InferInsertModel<Request>;\n  /** Replay projection must never expose a stored subject or decode protected intent. */\n  readonly decodeReplay: (\n    row: InferSelectModel<Request>,\n  ) => Effect.Effect<\n    Exclude<PasswordRegistrationDecision, { readonly _tag: \"Created\" }>,\n    DrizzleMappingError\n  >;\n}\n\nexport interface PasswordRegistrationProvisioning<\n  Registration,\n  Subject extends Table,\n  NativeSubjectId,\n> {\n  readonly encodeSubjectInsert: (\n    input: PasswordRegistrationIntent<Registration>,\n    values: {\n      readonly nativeSubjectId: NativeSubjectId | undefined;\n      readonly securityRevision: SecurityRevision;\n    },\n  ) => InferInsertModel<Subject>;\n  readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, DrizzleMappingError>;\n  readonly allocateSubjectIdSync?: () => NativeSubjectId;\n  /** Interactive targets use this for database-generated/autoincrement keys. */\n  readonly decodeGeneratedId?: (\n    rows: ReadonlyArray<unknown>,\n  ) => Effect.Effect<NativeSubjectId, DrizzleMappingError>;\n}\n\nexport interface RequiredPasswordRegistrationConstraints {\n  readonly request: \"unique(registration.moduleId,registration.requestId)\";\n  readonly recoveryReference: \"unique(registration.recoveryReference)\";\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly credentialSubject: \"unique(credential.moduleId,credential.subjectId)\";\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n}\n\nexport const requiredPasswordRegistrationConstraints: RequiredPasswordRegistrationConstraints = {\n  request: \"unique(registration.moduleId,registration.requestId)\",\n  recoveryReference: \"unique(registration.recoveryReference)\",\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  credentialSubject: \"unique(credential.moduleId,credential.subjectId)\",\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n};\n\nexport interface PasswordRegistrationConstraintClassifier {\n  readonly isRequestConflict: (cause: unknown) => boolean;\n  readonly isIdentifierConflict: (cause: unknown) => boolean;\n  readonly isCredentialConflict: (cause: unknown) => boolean;\n}\n\nexport type PasswordRegistrationMapping<\n  Registration,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Request extends Table,\n  NativeSubjectId,\n> = PasswordRegistrationConstraintClassifier & {\n  readonly subject: PasswordSubjectTable<Subject, NativeSubjectId>;\n  readonly identifier: PasswordIdentifierTable<Identifier, NativeSubjectId>;\n  readonly credential: PasswordCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly authorityCredential: PasswordAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  >;\n  readonly registration: PasswordRegistrationTable<Registration, Request, NativeSubjectId>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredPasswordRegistrationConstraints;\n  readonly allocateCredentialId?: Effect.Effect<string, DrizzleMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, DrizzleMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n} & (\n    | {\n        readonly mode: \"atomic\";\n        readonly provisioning: PasswordRegistrationProvisioning<\n          Registration,\n          Subject,\n          NativeSubjectId\n        > &\n          (\n            | {\n                readonly idMode: \"allocated\";\n                readonly allocateSubjectId: Effect.Effect<NativeSubjectId, DrizzleMappingError>;\n              }\n            | {\n                readonly idMode: \"synchronous\";\n                readonly allocateSubjectIdSync: () => NativeSubjectId;\n              }\n            | {\n                readonly idMode: \"generated\";\n                readonly decodeGeneratedId: (\n                  rows: ReadonlyArray<unknown>,\n                ) => Effect.Effect<NativeSubjectId, DrizzleMappingError>;\n              }\n          );\n      }\n    | {\n        readonly mode: \"pending\";\n        readonly allocateRecoveryReference?: Effect.Effect<\n          typeof RecoveryReference.Type,\n          DrizzleMappingError\n        >;\n        readonly allocateRecoveryReferenceSync?: () => typeof RecoveryReference.Type;\n      }\n  );\n\nexport type AnyPasswordPersistenceMapping = PasswordPersistenceMapping<\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\n\nexport type AnyPasswordRegistrationMapping<Registration = unknown> = PasswordRegistrationMapping<\n  Registration,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\n"],"mappings":";AAmOA,MAAa,8BAA2D;CACtE,YAAY;CACZ,qBAAqB;CACrB,mBAAmB;CACnB,cAAc;CACd,SAAS;CACT,WAAW;CACX,QAAQ;CACR,SAAS;AACX;AAkKA,MAAa,0CAAmF;CAC9F,SAAS;CACT,mBAAmB;CACnB,YAAY;CACZ,mBAAmB;CACnB,qBAAqB;AACvB"}

package/dist/drizzle/password-prepared-model.d.mts

@@ -0,0 +1,93 @@
+import { DrizzleMappingError } from "./model.mjs";
+import { PasswordPreparedReady, PasswordPreparedReservation, PasswordPreparedVersion } from "../password/methods/preparedModels.mjs";
+import { D1PasswordPersistenceMapping, PasswordPersistenceMapping } from "./password-model.mjs";
+import { D1ProofPersistenceMapping, ProofPersistenceMapping, RequiredProofConstraints } from "./proof-model.mjs";
+import { Effect } from "effect";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/password-prepared-model.d.ts
+type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+type PasswordPreparedState = "Preparing" | "Ready" | "Consumed" | "Cancelled" | "Expired";
+/** The retained intent is also its nonrefundable admission charge. Scalar identity,
+ * scope and timing columns survive sensitive snapshot/digest erasure. */
+interface PasswordPreparedIntentTable<Intent extends Table, NativeSubjectId> {
+  readonly table: Intent;
+  readonly moduleId: ColumnKey<Intent>;
+  readonly intentId: ColumnKey<Intent>;
+  readonly commandId: ColumnKey<Intent>;
+  readonly subjectId: ColumnKey<Intent>;
+  readonly action: ColumnKey<Intent>;
+  readonly generation: ColumnKey<Intent>;
+  readonly version: ColumnKey<Intent>;
+  readonly state: ColumnKey<Intent>;
+  readonly digest: ColumnKey<Intent>;
+  readonly snapshot: ColumnKey<Intent>;
+  readonly identifierScope: ColumnKey<Intent>;
+  readonly createdAt: ColumnKey<Intent>;
+  readonly admittedAt: ColumnKey<Intent>;
+  readonly admissionRetainUntil: ColumnKey<Intent>;
+  readonly preparationExpiresAt: ColumnKey<Intent>;
+  readonly expiresAt: ColumnKey<Intent>;
+  readonly retainUntil: ColumnKey<Intent>;
+  readonly states: Readonly<Record<PasswordPreparedState, InferSelectModel<Intent>[ColumnKey<Intent>]>>;
+  readonly encodeInsert: (input: {
+    readonly reservation: PasswordPreparedReservation;
+    readonly nativeSubjectId: NativeSubjectId;
+    readonly identifierScope: string;
+    readonly admittedAtMillis: number;
+    readonly admissionRetainUntilMillis: number;
+    /** Bounded private core codec output; contains a salted verifier for Change/Reset. */
+    readonly snapshot: string;
+  }) => InferInsertModel<Intent>;
+  readonly encodeReady: (input: {
+    readonly ready: PasswordPreparedReady;
+    readonly snapshot: string;
+  }) => Partial<InferInsertModel<Intent>>;
+  /** Erase snapshot and digest, preserving every identity/scope/time column. */
+  readonly encodeTerminal: (state: Exclude<PasswordPreparedState, "Preparing" | "Ready">) => Partial<InferInsertModel<Intent>>;
+}
+/** One permanent row per configured module; never one row per attacker input.
+ * Native owners lock this before subject → identifier → sorted credentials → intent.
+ * It serializes admission and maintenance without process-local locks. */
+interface PasswordPreparedAdmissionTable<Admission extends Table> {
+  readonly table: Admission;
+  readonly moduleId: ColumnKey<Admission>;
+  readonly intentId: ColumnKey<Admission>;
+  readonly admittedAt: ColumnKey<Admission>;
+  readonly admissionRetainUntil: ColumnKey<Admission>;
+  readonly encodeInsert: (moduleId: string) => InferInsertModel<Admission>;
+}
+declare const requiredPasswordPreparedConstraints: {
+  readonly admission: "unique(admission.moduleId)";
+  readonly intent: "unique(intent.moduleId,intent.intentId)";
+  readonly command: "unique(intent.moduleId,intent.commandId)";
+  readonly digest: "unique(intent.digest)";
+};
+type RequiredPasswordPreparedConstraints = typeof requiredPasswordPreparedConstraints;
+interface PasswordPreparedPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, Intent extends Table, Admission extends Table, NativeSubjectId> {
+  readonly password: PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, NativeSubjectId>;
+  readonly intent: PasswordPreparedIntentTable<Intent, NativeSubjectId>;
+  readonly admission: PasswordPreparedAdmissionTable<Admission>;
+  readonly constraints: RequiredPasswordPreparedConstraints;
+  readonly allocateVersion?: Effect.Effect<PasswordPreparedVersion, DrizzleMappingError>;
+  /** Required by synchronous owners, invoked inside their actual transactionSync. */
+  readonly allocateVersionSync?: () => PasswordPreparedVersion;
+}
+type D1PasswordPreparedPersistenceMapping<Subject extends Table, Identifier extends Table, Credential extends Table, AuthorityCredential extends Table, Attempt extends Table, RateScope extends Table, Charge extends Table, Command extends Table, Intent extends Table, Admission extends Table, NativeSubjectId> = PasswordPreparedPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, Intent, Admission, NativeSubjectId> & {
+  /** Convert a stored native instant to epoch milliseconds in the same SQL engine. */
+  readonly admissionClock: {
+    readonly toMillis: (instant: SQL) => SQL;
+  };
+  readonly password: D1PasswordPersistenceMapping<Subject, Identifier, Credential, AuthorityCredential, Attempt, RateScope, Charge, Command, NativeSubjectId>;
+};
+/** Optional real proof completion authority. Request/delivery/abuse capabilities
+ * are not required to complete the original continuation. */
+type PasswordPreparedProofMapping<Series extends Table, Continuation extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = Pick<ProofPersistenceMapping<Table, Series, Table, Continuation, Table, Table, Table, Command, Subject, Identifier, Credential, NativeSubjectId>, "series" | "continuation" | "command" | "authority" | "scopeKeys" | "encodeInstant" | "decodeInstant" | "allocateVersion" | "allocateVersionSync" | "isSeriesConflict" | "isCommandConflict" | "d1"> & {
+  readonly constraints: Pick<RequiredProofConstraints, "series" | "continuationId" | "continuationDigest" | "command">;
+};
+type D1PasswordPreparedProofMapping<Series extends Table, Continuation extends Table, Command extends Table, Subject extends Table, Identifier extends Table, Credential extends Table, NativeSubjectId> = Pick<D1ProofPersistenceMapping<Table, Series, Table, Continuation, Table, Table, Table, Command, Subject, Identifier, Credential, NativeSubjectId>, Exclude<keyof PasswordPreparedProofMapping<Series, Continuation, Command, Subject, Identifier, Credential, NativeSubjectId>, "constraints">> & {
+  readonly constraints: PasswordPreparedProofMapping<Series, Continuation, Command, Subject, Identifier, Credential, NativeSubjectId>["constraints"];
+};
+type AnyPasswordPreparedPersistenceMapping = PasswordPreparedPersistenceMapping<Table, Table, Table, Table, Table, Table, Table, Table, Table, Table, unknown>;
+//#endregion
+export { AnyPasswordPreparedPersistenceMapping, D1PasswordPreparedPersistenceMapping, D1PasswordPreparedProofMapping, PasswordPreparedAdmissionTable, PasswordPreparedIntentTable, PasswordPreparedPersistenceMapping, PasswordPreparedProofMapping, PasswordPreparedState, RequiredPasswordPreparedConstraints, requiredPasswordPreparedConstraints };
+//# sourceMappingURL=password-prepared-model.d.mts.map

package/dist/drizzle/password-prepared-model.mjs

@@ -0,0 +1,11 @@
+//#region src/drizzle/password-prepared-model.ts
+const requiredPasswordPreparedConstraints = {
+	admission: "unique(admission.moduleId)",
+	intent: "unique(intent.moduleId,intent.intentId)",
+	command: "unique(intent.moduleId,intent.commandId)",
+	digest: "unique(intent.digest)"
+};
+//#endregion
+export { requiredPasswordPreparedConstraints };
+
+//# sourceMappingURL=password-prepared-model.mjs.map

package/dist/drizzle/password-prepared-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-prepared-model.mjs","names":[],"sources":["../../src/drizzle/password-prepared-model.ts"],"sourcesContent":["import type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { Effect } from \"effect\";\n\nimport type {\n  PasswordPreparedReady,\n  PasswordPreparedReservation,\n  PasswordPreparedVersion,\n} from \"../password/methods/preparedModels\";\nimport type { DrizzleMappingError } from \"./model\";\nimport type { D1PasswordPersistenceMapping, PasswordPersistenceMapping } from \"./password-model\";\nimport type {\n  D1ProofPersistenceMapping,\n  ProofPersistenceMapping,\n  RequiredProofConstraints,\n} from \"./proof-model\";\n\ntype ColumnKey<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type PasswordPreparedState = \"Preparing\" | \"Ready\" | \"Consumed\" | \"Cancelled\" | \"Expired\";\n\n/** The retained intent is also its nonrefundable admission charge. Scalar identity,\n * scope and timing columns survive sensitive snapshot/digest erasure. */\nexport interface PasswordPreparedIntentTable<Intent extends Table, NativeSubjectId> {\n  readonly table: Intent;\n  readonly moduleId: ColumnKey<Intent>;\n  readonly intentId: ColumnKey<Intent>;\n  readonly commandId: ColumnKey<Intent>;\n  readonly subjectId: ColumnKey<Intent>;\n  readonly action: ColumnKey<Intent>;\n  readonly generation: ColumnKey<Intent>;\n  readonly version: ColumnKey<Intent>;\n  readonly state: ColumnKey<Intent>;\n  readonly digest: ColumnKey<Intent>;\n  readonly snapshot: ColumnKey<Intent>;\n  readonly identifierScope: ColumnKey<Intent>;\n  readonly createdAt: ColumnKey<Intent>;\n  readonly admittedAt: ColumnKey<Intent>;\n  readonly admissionRetainUntil: ColumnKey<Intent>;\n  readonly preparationExpiresAt: ColumnKey<Intent>;\n  readonly expiresAt: ColumnKey<Intent>;\n  readonly retainUntil: ColumnKey<Intent>;\n  readonly states: Readonly<\n    Record<PasswordPreparedState, InferSelectModel<Intent>[ColumnKey<Intent>]>\n  >;\n  readonly encodeInsert: (input: {\n    readonly reservation: PasswordPreparedReservation;\n    readonly nativeSubjectId: NativeSubjectId;\n    readonly identifierScope: string;\n    readonly admittedAtMillis: number;\n    readonly admissionRetainUntilMillis: number;\n    /** Bounded private core codec output; contains a salted verifier for Change/Reset. */\n    readonly snapshot: string;\n  }) => InferInsertModel<Intent>;\n  readonly encodeReady: (input: {\n    readonly ready: PasswordPreparedReady;\n    readonly snapshot: string;\n  }) => Partial<InferInsertModel<Intent>>;\n  /** Erase snapshot and digest, preserving every identity/scope/time column. */\n  readonly encodeTerminal: (\n    state: Exclude<PasswordPreparedState, \"Preparing\" | \"Ready\">,\n  ) => Partial<InferInsertModel<Intent>>;\n}\n\n/** One permanent row per configured module; never one row per attacker input.\n * Native owners lock this before subject → identifier → sorted credentials → intent.\n * It serializes admission and maintenance without process-local locks. */\nexport interface PasswordPreparedAdmissionTable<Admission extends Table> {\n  readonly table: Admission;\n  readonly moduleId: ColumnKey<Admission>;\n  readonly intentId: ColumnKey<Admission>;\n  readonly admittedAt: ColumnKey<Admission>;\n  readonly admissionRetainUntil: ColumnKey<Admission>;\n  readonly encodeInsert: (moduleId: string) => InferInsertModel<Admission>;\n}\n\nexport const requiredPasswordPreparedConstraints = {\n  admission: \"unique(admission.moduleId)\",\n  intent: \"unique(intent.moduleId,intent.intentId)\",\n  command: \"unique(intent.moduleId,intent.commandId)\",\n  digest: \"unique(intent.digest)\",\n} as const;\n\nexport type RequiredPasswordPreparedConstraints = typeof requiredPasswordPreparedConstraints;\n\nexport interface PasswordPreparedPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  RateScope extends Table,\n  Charge extends Table,\n  Command extends Table,\n  Intent extends Table,\n  Admission extends Table,\n  NativeSubjectId,\n> {\n  readonly password: PasswordPersistenceMapping<\n    Subject,\n    Identifier,\n    Credential,\n    AuthorityCredential,\n    Attempt,\n    RateScope,\n    Charge,\n    Command,\n    NativeSubjectId\n  >;\n  readonly intent: PasswordPreparedIntentTable<Intent, NativeSubjectId>;\n  readonly admission: PasswordPreparedAdmissionTable<Admission>;\n  readonly constraints: RequiredPasswordPreparedConstraints;\n  readonly allocateVersion?: Effect.Effect<PasswordPreparedVersion, DrizzleMappingError>;\n  /** Required by synchronous owners, invoked inside their actual transactionSync. */\n  readonly allocateVersionSync?: () => PasswordPreparedVersion;\n}\n\nexport type D1PasswordPreparedPersistenceMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Attempt extends Table,\n  RateScope extends Table,\n  Charge extends Table,\n  Command extends Table,\n  Intent extends Table,\n  Admission extends Table,\n  NativeSubjectId,\n> = PasswordPreparedPersistenceMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Attempt,\n  RateScope,\n  Charge,\n  Command,\n  Intent,\n  Admission,\n  NativeSubjectId\n> & {\n  /** Convert a stored native instant to epoch milliseconds in the same SQL engine. */\n  readonly admissionClock: { readonly toMillis: (instant: SQL) => SQL };\n  readonly password: D1PasswordPersistenceMapping<\n    Subject,\n    Identifier,\n    Credential,\n    AuthorityCredential,\n    Attempt,\n    RateScope,\n    Charge,\n    Command,\n    NativeSubjectId\n  >;\n};\n\n/** Optional real proof completion authority. Request/delivery/abuse capabilities\n * are not required to complete the original continuation. */\nexport type PasswordPreparedProofMapping<\n  Series extends Table,\n  Continuation extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = Pick<\n  ProofPersistenceMapping<\n    Table,\n    Series,\n    Table,\n    Continuation,\n    Table,\n    Table,\n    Table,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >,\n  | \"series\"\n  | \"continuation\"\n  | \"command\"\n  | \"authority\"\n  | \"scopeKeys\"\n  | \"encodeInstant\"\n  | \"decodeInstant\"\n  | \"allocateVersion\"\n  | \"allocateVersionSync\"\n  | \"isSeriesConflict\"\n  | \"isCommandConflict\"\n  | \"d1\"\n> & {\n  readonly constraints: Pick<\n    RequiredProofConstraints,\n    \"series\" | \"continuationId\" | \"continuationDigest\" | \"command\"\n  >;\n};\n\nexport type D1PasswordPreparedProofMapping<\n  Series extends Table,\n  Continuation extends Table,\n  Command extends Table,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> = Pick<\n  D1ProofPersistenceMapping<\n    Table,\n    Series,\n    Table,\n    Continuation,\n    Table,\n    Table,\n    Table,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >,\n  Exclude<\n    keyof PasswordPreparedProofMapping<\n      Series,\n      Continuation,\n      Command,\n      Subject,\n      Identifier,\n      Credential,\n      NativeSubjectId\n    >,\n    \"constraints\"\n  >\n> & {\n  readonly constraints: PasswordPreparedProofMapping<\n    Series,\n    Continuation,\n    Command,\n    Subject,\n    Identifier,\n    Credential,\n    NativeSubjectId\n  >[\"constraints\"];\n};\n\nexport type AnyPasswordPreparedPersistenceMapping = PasswordPreparedPersistenceMapping<\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  Table,\n  unknown\n>;\n"],"mappings":";AA0EA,MAAa,sCAAsC;CACjD,WAAW;CACX,QAAQ;CACR,SAAS;CACT,QAAQ;AACV"}