@yielded/auth 0.1.0-beta.1

package/dist/drizzle/password-prepared-state.mjs

@@ -0,0 +1,107 @@
+import { SubjectId, TokenDigest } from "../Schema.mjs";
+import { SessionInvalidationWindow } from "../sessions/invalidation.mjs";
+import { AuthenticationProof, AuthenticationRequirement } from "../sessions/models.mjs";
+import { PasswordUnavailable } from "../password/methods/errors.mjs";
+import { ProofBinding, ProofContinuationId, ProofPurpose } from "../proofs/models.mjs";
+import { PasswordAction, PasswordCommandId, PasswordCredentialSnapshot } from "../password/methods/models.mjs";
+import { passwordSqlKernel } from "./password-sql.mjs";
+import { PasswordPreparedConfiguration, PasswordPreparedIntentId, PasswordPreparedRequirement, PasswordPreparedReservation, PasswordPreparedReset, encodePasswordPreparedReady, snapshotPasswordPreparedReady, snapshotPasswordPreparedReservation } from "../password/methods/preparedModels.mjs";
+import { DateTime, Effect, Redacted, Schema } from "effect";
+//#region src/drizzle/password-prepared-state.ts
+const unavailable = () => PasswordUnavailable.make({});
+const Instant = Schema.Int.check(Schema.isBetween({
+	minimum: 0,
+	maximum: 864e13
+}));
+const Label = Schema.NonEmptyString.check(Schema.isMaxLength(256));
+const CompletionInput = Schema.Struct({
+	moduleId: Label,
+	purpose: ProofPurpose,
+	continuationId: ProofContinuationId,
+	continuationDigest: TokenDigest.check(Schema.isMaxLength(256)),
+	binding: ProofBinding,
+	nowMillis: Instant
+});
+const ContextInput = Schema.Struct({
+	moduleId: Label,
+	generation: PasswordPreparedConfiguration.fields.generation,
+	digest: TokenDigest.check(Schema.isMaxLength(256)),
+	nowMillis: Instant
+});
+const ReserveInput = Schema.Struct({
+	moduleId: Label,
+	generation: PasswordPreparedConfiguration.fields.generation,
+	intentId: PasswordPreparedIntentId,
+	commandId: PasswordCommandId,
+	action: PasswordAction,
+	subjectId: SubjectId.check(Schema.isMaxLength(256)),
+	nowMillis: Instant,
+	policy: PasswordPreparedConfiguration,
+	invalidation: SessionInvalidationWindow,
+	reset: Schema.optionalKey(PasswordPreparedReset),
+	completion: Schema.optionalKey(CompletionInput)
+});
+const reserveCodec = Schema.fromJsonString(ReserveInput);
+const snapshotReserve = (input) => Schema.encodeEffect(reserveCodec)(input).pipe(Effect.flatMap(Schema.decodeEffect(Schema.String.check(Schema.isMaxLength(131072)))), Effect.flatMap(Schema.decodeEffect(reserveCodec)), Effect.mapError(unavailable));
+const reservationCodec = Schema.fromJsonString(PasswordPreparedReservation);
+const encodeReservation = (input) => snapshotPasswordPreparedReservation(input).pipe(Effect.flatMap(Schema.encodeEffect(reservationCodec)), Effect.mapError(unavailable));
+const reservationOf = (ready) => {
+	const { replacement: _replacement, challenge: _challenge, baseEvidence: _evidence, digest: _digest, issuedAtMillis: _issued, expiresAtMillis: _expires, ...reservation } = ready;
+	return {
+		...reservation,
+		_tag: "Preparing"
+	};
+};
+const sameRevision = (a, b) => a.subjectId === b.subjectId && a.securityRevision === b.securityRevision && a.credentials.length === b.credentials.length && a.credentials.every((c) => b.credentials.some((d) => c.credentialId === d.credentialId && c.revision === d.revision));
+const scopeJson = Schema.encodeSync(Schema.fromJsonString(Schema.Array(Schema.String)));
+const invalidationJson = Schema.encodeSync(Schema.fromJsonString(SessionInvalidationWindow));
+const proofJson = Schema.encodeSync(Schema.fromJsonString(AuthenticationProof));
+const identifierScope = (record) => record.credential === void 0 ? scopeJson(["prepared-subject", record.revision.subjectId]) : scopeJson([
+	"prepared-identifier",
+	record.credential.identifier.namespace,
+	record.credential.identifier.value
+]);
+const credentialCodec = Schema.fromJsonString(PasswordCredentialSnapshot);
+const sameCredential = Effect.fn("DrizzlePasswordPrepared.sameCredential")(function* (a, b) {
+	if (a === void 0 || b === void 0) return a === b;
+	return (yield* Schema.encodeEffect(credentialCodec)(a).pipe(Effect.mapError(unavailable))) === (yield* Schema.encodeEffect(credentialCodec)(b).pipe(Effect.mapError(unavailable)));
+});
+const requirementJson = Schema.encodeSync(Schema.fromJsonString(AuthenticationRequirement.fields.alternatives));
+const requirementShape = (value) => requirementJson(value.alternatives);
+const snapshotMutation = Effect.fn("DrizzlePasswordPrepared.snapshotMutation")(function* (input) {
+	const intent = yield* snapshotPasswordPreparedReady(input.intent);
+	const mutation = yield* passwordSqlKernel.snapshotMutationInput(input.mutation);
+	const capturedRequirement = yield* Schema.decodeEffect(PasswordPreparedRequirement)(input.capturedRequirement).pipe(Effect.mapError(unavailable));
+	const currentRequirement = yield* Schema.decodeEffect(PasswordPreparedRequirement)(input.currentRequirement).pipe(Effect.mapError(unavailable));
+	const original = intent.challenge, actual = mutation.authorization.challenge;
+	if (mutation.moduleId !== intent.moduleId || mutation.commandId !== intent.commandId || !sameRevision(mutation.expectedRevision, intent.revision) || !(yield* sameCredential(mutation.credential, intent.credential)) || Redacted.value(mutation.replacement.verifier) !== Redacted.value(intent.replacement.verifier) || mutation.replacement.normalization !== intent.replacement.normalization || actual.moduleId !== original.moduleId || actual.action !== original.action || actual.commandId !== original.commandId || actual.bindingDigest !== original.bindingDigest || actual.targetCredentialId !== original.targetCredentialId || !sameRevision(actual.revision, original.revision) || invalidationJson(mutation.invalidation) !== invalidationJson(intent.invalidation) || requirementShape(capturedRequirement) !== requirementShape(intent.capturedRequirement) || capturedRequirement.maximumAgeMillis > intent.capturedRequirement.maximumAgeMillis) return yield* unavailable();
+	return {
+		intent,
+		mutation,
+		capturedRequirement,
+		currentRequirement,
+		nowMillis: input.nowMillis
+	};
+});
+const evidenceCurrent = (input, current, now) => {
+	const requirements = [
+		input.mutation.authorization.requirement,
+		input.intent.capturedRequirement,
+		input.capturedRequirement,
+		current,
+		input.currentRequirement
+	];
+	if (requirementShape(input.currentRequirement) !== requirementShape(current) || input.currentRequirement.maximumAgeMillis > current.maximumAgeMillis || now < input.intent.issuedAtMillis || now >= input.intent.expiresAtMillis || !requirements.every((requirement) => passwordSqlKernel.evidenceSatisfiedAt(input.mutation.authorization.evidence, requirement, now))) return false;
+	const age = Math.min(...requirements.map((requirement) => requirement.maximumAgeMillis));
+	return (input.intent.baseEvidence?.proofs ?? []).every((proof) => {
+		const verified = DateTime.toEpochMillis(proof.verifiedAt);
+		return verified <= now && now - verified < age && input.mutation.authorization.evidence.proofs.some((actual) => proofJson(actual) === proofJson(proof));
+	});
+};
+Effect.fn("DrizzlePasswordPrepared.sameReady")(function* (a, b) {
+	return (yield* encodePasswordPreparedReady(a)) === (yield* encodePasswordPreparedReady(b));
+});
+//#endregion
+export { CompletionInput, ContextInput, encodeReservation, evidenceCurrent, identifierScope, reservationOf, sameRevision, snapshotMutation, snapshotReserve, unavailable };
+
+//# sourceMappingURL=password-prepared-state.mjs.map

package/dist/drizzle/password-prepared-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-prepared-state.mjs","names":[],"sources":["../../src/drizzle/password-prepared-state.ts"],"sourcesContent":["import { DateTime, Effect, Redacted, Schema } from \"effect\";\n\nimport { PasswordUnavailable } from \"../password/methods/errors\";\nimport {\n  PasswordAction,\n  PasswordCommandId,\n  PasswordCredentialSnapshot,\n} from \"../password/methods/models\";\nimport type {\n  PasswordPreparedMutation,\n  PasswordPreparedPersistence,\n} from \"../password/methods/PasswordPreparedPersistence\";\nimport {\n  PasswordPreparedConfiguration,\n  PasswordPreparedIntentId,\n  PasswordPreparedReservation,\n  PasswordPreparedReset,\n  PasswordPreparedRequirement,\n  snapshotPasswordPreparedReservation,\n  snapshotPasswordPreparedReady,\n  encodePasswordPreparedReady,\n  type PasswordPreparedReady,\n} from \"../password/methods/preparedModels\";\nimport { ProofBinding, ProofContinuationId, ProofPurpose } from \"../proofs/models\";\nimport { SubjectId, TokenDigest } from \"../Schema\";\nimport { SessionInvalidationWindow } from \"../sessions/invalidation\";\nimport type { AuthenticationRevision } from \"../sessions/models\";\nimport { AuthenticationProof, AuthenticationRequirement } from \"../sessions/models\";\nimport { passwordSqlKernel } from \"./password-sql\";\n\nexport const unavailable = () => PasswordUnavailable.make({});\nconst Instant = Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: 8640000000000000 }));\nconst Label = Schema.NonEmptyString.check(Schema.isMaxLength(256));\n\nexport const CompletionInput = Schema.Struct({\n  moduleId: Label,\n  purpose: ProofPurpose,\n  continuationId: ProofContinuationId,\n  continuationDigest: TokenDigest.check(Schema.isMaxLength(256)),\n  binding: ProofBinding,\n  nowMillis: Instant,\n});\n\nexport const ContextInput = Schema.Struct({\n  moduleId: Label,\n  generation: PasswordPreparedConfiguration.fields.generation,\n  digest: TokenDigest.check(Schema.isMaxLength(256)),\n  nowMillis: Instant,\n});\n\nconst ReserveInput = Schema.Struct({\n  moduleId: Label,\n  generation: PasswordPreparedConfiguration.fields.generation,\n  intentId: PasswordPreparedIntentId,\n  commandId: PasswordCommandId,\n  action: PasswordAction,\n  subjectId: SubjectId.check(Schema.isMaxLength(256)),\n  nowMillis: Instant,\n  policy: PasswordPreparedConfiguration,\n  invalidation: SessionInvalidationWindow,\n  reset: Schema.optionalKey(PasswordPreparedReset),\n  completion: Schema.optionalKey(CompletionInput),\n});\n\nconst reserveCodec = Schema.fromJsonString(ReserveInput);\n\nexport const snapshotReserve = (input: Parameters<PasswordPreparedPersistence[\"reserve\"]>[0]) =>\n  Schema.encodeEffect(reserveCodec)(input).pipe(\n    Effect.flatMap(Schema.decodeEffect(Schema.String.check(Schema.isMaxLength(131072)))),\n    Effect.flatMap(Schema.decodeEffect(reserveCodec)),\n    Effect.mapError(unavailable),\n  );\n\nconst reservationCodec = Schema.fromJsonString(PasswordPreparedReservation);\n\nexport const encodeReservation = (input: PasswordPreparedReservation) =>\n  snapshotPasswordPreparedReservation(input).pipe(\n    Effect.flatMap(Schema.encodeEffect(reservationCodec)),\n    Effect.mapError(unavailable),\n  );\n\nexport const decodeReservation = (input: string) =>\n  Schema.decodeEffect(Schema.String.check(Schema.isMaxLength(131072)))(input).pipe(\n    Effect.flatMap(Schema.decodeEffect(reservationCodec)),\n    Effect.flatMap(snapshotPasswordPreparedReservation),\n    Effect.mapError(unavailable),\n  );\n\nexport const reservationOf = (ready: PasswordPreparedReady): PasswordPreparedReservation => {\n  const {\n    replacement: _replacement,\n    challenge: _challenge,\n    baseEvidence: _evidence,\n    digest: _digest,\n    issuedAtMillis: _issued,\n    expiresAtMillis: _expires,\n    ...reservation\n  } = ready;\n\n  return { ...reservation, _tag: \"Preparing\" };\n};\n\nexport const sameRevision = (a: AuthenticationRevision, b: AuthenticationRevision) =>\n  a.subjectId === b.subjectId &&\n  a.securityRevision === b.securityRevision &&\n  a.credentials.length === b.credentials.length &&\n  a.credentials.every((c) =>\n    b.credentials.some((d) => c.credentialId === d.credentialId && c.revision === d.revision),\n  );\n\nconst scopeJson = Schema.encodeSync(Schema.fromJsonString(Schema.Array(Schema.String)));\nconst invalidationJson = Schema.encodeSync(Schema.fromJsonString(SessionInvalidationWindow));\nconst proofJson = Schema.encodeSync(Schema.fromJsonString(AuthenticationProof));\n\nexport const identifierScope = (\n  record: Pick<PasswordPreparedReservation, \"credential\" | \"revision\">,\n) =>\n  record.credential === undefined\n    ? scopeJson([\"prepared-subject\", record.revision.subjectId])\n    : scopeJson([\n        \"prepared-identifier\",\n        record.credential.identifier.namespace,\n        record.credential.identifier.value,\n      ]);\n\nconst credentialCodec = Schema.fromJsonString(PasswordCredentialSnapshot);\n\nconst sameCredential = Effect.fn(\"DrizzlePasswordPrepared.sameCredential\")(function* (\n  a: PasswordPreparedReservation[\"credential\"],\n  b: PasswordPreparedReservation[\"credential\"],\n) {\n  if (a === undefined || b === undefined) return a === b;\n\n  return (\n    (yield* Schema.encodeEffect(credentialCodec)(a).pipe(Effect.mapError(unavailable))) ===\n    (yield* Schema.encodeEffect(credentialCodec)(b).pipe(Effect.mapError(unavailable)))\n  );\n});\n\nconst requirementJson = Schema.encodeSync(\n  Schema.fromJsonString(AuthenticationRequirement.fields.alternatives),\n);\n\nconst requirementShape = (value: AuthenticationRequirement) => requirementJson(value.alternatives);\n\nexport const snapshotMutation = Effect.fn(\"DrizzlePasswordPrepared.snapshotMutation\")(function* (\n  input: PasswordPreparedMutation,\n) {\n  const intent = yield* snapshotPasswordPreparedReady(input.intent);\n  const mutation = yield* passwordSqlKernel.snapshotMutationInput(input.mutation);\n\n  const capturedRequirement = yield* Schema.decodeEffect(PasswordPreparedRequirement)(\n    input.capturedRequirement,\n  ).pipe(Effect.mapError(unavailable));\n\n  const currentRequirement = yield* Schema.decodeEffect(PasswordPreparedRequirement)(\n    input.currentRequirement,\n  ).pipe(Effect.mapError(unavailable));\n\n  const original = intent.challenge,\n    actual = mutation.authorization.challenge;\n\n  if (\n    mutation.moduleId !== intent.moduleId ||\n    mutation.commandId !== intent.commandId ||\n    !sameRevision(mutation.expectedRevision, intent.revision) ||\n    !(yield* sameCredential(mutation.credential, intent.credential)) ||\n    Redacted.value(mutation.replacement.verifier) !== Redacted.value(intent.replacement.verifier) ||\n    mutation.replacement.normalization !== intent.replacement.normalization ||\n    actual.moduleId !== original.moduleId ||\n    actual.action !== original.action ||\n    actual.commandId !== original.commandId ||\n    actual.bindingDigest !== original.bindingDigest ||\n    actual.targetCredentialId !== original.targetCredentialId ||\n    !sameRevision(actual.revision, original.revision) ||\n    invalidationJson(mutation.invalidation) !== invalidationJson(intent.invalidation) ||\n    requirementShape(capturedRequirement) !== requirementShape(intent.capturedRequirement) ||\n    capturedRequirement.maximumAgeMillis > intent.capturedRequirement.maximumAgeMillis\n  )\n    return yield* unavailable();\n\n  return { intent, mutation, capturedRequirement, currentRequirement, nowMillis: input.nowMillis };\n});\n\nexport const evidenceCurrent = (\n  input: PasswordPreparedMutation,\n  current: AuthenticationRequirement,\n  now: number,\n) => {\n  const requirements = [\n    input.mutation.authorization.requirement,\n    input.intent.capturedRequirement,\n    input.capturedRequirement,\n    current,\n    input.currentRequirement,\n  ];\n\n  if (\n    requirementShape(input.currentRequirement) !== requirementShape(current) ||\n    input.currentRequirement.maximumAgeMillis > current.maximumAgeMillis ||\n    now < input.intent.issuedAtMillis ||\n    now >= input.intent.expiresAtMillis ||\n    !requirements.every((requirement) =>\n      passwordSqlKernel.evidenceSatisfiedAt(\n        input.mutation.authorization.evidence,\n        requirement,\n        now,\n      ),\n    )\n  )\n    return false;\n  const age = Math.min(...requirements.map((requirement) => requirement.maximumAgeMillis));\n\n  return (input.intent.baseEvidence?.proofs ?? []).every((proof) => {\n    const verified = DateTime.toEpochMillis(proof.verifiedAt);\n\n    return (\n      verified <= now &&\n      now - verified < age &&\n      input.mutation.authorization.evidence.proofs.some(\n        (actual) => proofJson(actual) === proofJson(proof),\n      )\n    );\n  });\n};\n\nexport const sameReady = Effect.fn(\"DrizzlePasswordPrepared.sameReady\")(function* (\n  a: PasswordPreparedReady,\n  b: PasswordPreparedReady,\n) {\n  return (yield* encodePasswordPreparedReady(a)) === (yield* encodePasswordPreparedReady(b));\n});\n"],"mappings":";;;;;;;;;;AA8BA,MAAa,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;AAC5D,MAAM,UAAU,OAAO,IAAI,MAAM,OAAO,UAAU;CAAE,SAAS;CAAG,SAAS;AAAiB,CAAC,CAAC;AAC5F,MAAM,QAAQ,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC;AAEjE,MAAa,kBAAkB,OAAO,OAAO;CAC3C,UAAU;CACV,SAAS;CACT,gBAAgB;CAChB,oBAAoB,YAAY,MAAM,OAAO,YAAY,GAAG,CAAC;CAC7D,SAAS;CACT,WAAW;AACb,CAAC;AAED,MAAa,eAAe,OAAO,OAAO;CACxC,UAAU;CACV,YAAY,8BAA8B,OAAO;CACjD,QAAQ,YAAY,MAAM,OAAO,YAAY,GAAG,CAAC;CACjD,WAAW;AACb,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,UAAU;CACV,YAAY,8BAA8B,OAAO;CACjD,UAAU;CACV,WAAW;CACX,QAAQ;CACR,WAAW,UAAU,MAAM,OAAO,YAAY,GAAG,CAAC;CAClD,WAAW;CACX,QAAQ;CACR,cAAc;CACd,OAAO,OAAO,YAAY,qBAAqB;CAC/C,YAAY,OAAO,YAAY,eAAe;AAChD,CAAC;AAED,MAAM,eAAe,OAAO,eAAe,YAAY;AAEvD,MAAa,mBAAmB,UAC9B,OAAO,aAAa,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,KACvC,OAAO,QAAQ,OAAO,aAAa,OAAO,OAAO,MAAM,OAAO,YAAY,MAAM,CAAC,CAAC,CAAC,GACnF,OAAO,QAAQ,OAAO,aAAa,YAAY,CAAC,GAChD,OAAO,SAAS,WAAW,CAC7B;AAEF,MAAM,mBAAmB,OAAO,eAAe,2BAA2B;AAE1E,MAAa,qBAAqB,UAChC,oCAAoC,KAAK,CAAC,CAAC,KACzC,OAAO,QAAQ,OAAO,aAAa,gBAAgB,CAAC,GACpD,OAAO,SAAS,WAAW,CAC7B;AASF,MAAa,iBAAiB,UAA8D;CAC1F,MAAM,EACJ,aAAa,cACb,WAAW,YACX,cAAc,WACd,QAAQ,SACR,gBAAgB,SAChB,iBAAiB,UACjB,GAAG,gBACD;CAEJ,OAAO;EAAE,GAAG;EAAa,MAAM;CAAY;AAC7C;AAEA,MAAa,gBAAgB,GAA2B,MACtD,EAAE,cAAc,EAAE,aAClB,EAAE,qBAAqB,EAAE,oBACzB,EAAE,YAAY,WAAW,EAAE,YAAY,UACvC,EAAE,YAAY,OAAO,MACnB,EAAE,YAAY,MAAM,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,CAC1F;AAEF,MAAM,YAAY,OAAO,WAAW,OAAO,eAAe,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC;AACtF,MAAM,mBAAmB,OAAO,WAAW,OAAO,eAAe,yBAAyB,CAAC;AAC3F,MAAM,YAAY,OAAO,WAAW,OAAO,eAAe,mBAAmB,CAAC;AAE9E,MAAa,mBACX,WAEA,OAAO,eAAe,KAAA,IAClB,UAAU,CAAC,oBAAoB,OAAO,SAAS,SAAS,CAAC,IACzD,UAAU;CACR;CACA,OAAO,WAAW,WAAW;CAC7B,OAAO,WAAW,WAAW;AAC/B,CAAC;AAEP,MAAM,kBAAkB,OAAO,eAAe,0BAA0B;AAExE,MAAM,iBAAiB,OAAO,GAAG,wCAAwC,CAAC,CAAC,WACzE,GACA,GACA;CACA,IAAI,MAAM,KAAA,KAAa,MAAM,KAAA,GAAW,OAAO,MAAM;CAErD,QACG,OAAO,OAAO,aAAa,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC,QAChF,OAAO,OAAO,aAAa,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;AAErF,CAAC;AAED,MAAM,kBAAkB,OAAO,WAC7B,OAAO,eAAe,0BAA0B,OAAO,YAAY,CACrE;AAEA,MAAM,oBAAoB,UAAqC,gBAAgB,MAAM,YAAY;AAEjG,MAAa,mBAAmB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WACpF,OACA;CACA,MAAM,SAAS,OAAO,8BAA8B,MAAM,MAAM;CAChE,MAAM,WAAW,OAAO,kBAAkB,sBAAsB,MAAM,QAAQ;CAE9E,MAAM,sBAAsB,OAAO,OAAO,aAAa,2BAA2B,CAAC,CACjF,MAAM,mBACR,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;CAEnC,MAAM,qBAAqB,OAAO,OAAO,aAAa,2BAA2B,CAAC,CAChF,MAAM,kBACR,CAAC,CAAC,KAAK,OAAO,SAAS,WAAW,CAAC;CAEnC,MAAM,WAAW,OAAO,WACtB,SAAS,SAAS,cAAc;CAElC,IACE,SAAS,aAAa,OAAO,YAC7B,SAAS,cAAc,OAAO,aAC9B,CAAC,aAAa,SAAS,kBAAkB,OAAO,QAAQ,KACxD,EAAE,OAAO,eAAe,SAAS,YAAY,OAAO,UAAU,MAC9D,SAAS,MAAM,SAAS,YAAY,QAAQ,MAAM,SAAS,MAAM,OAAO,YAAY,QAAQ,KAC5F,SAAS,YAAY,kBAAkB,OAAO,YAAY,iBAC1D,OAAO,aAAa,SAAS,YAC7B,OAAO,WAAW,SAAS,UAC3B,OAAO,cAAc,SAAS,aAC9B,OAAO,kBAAkB,SAAS,iBAClC,OAAO,uBAAuB,SAAS,sBACvC,CAAC,aAAa,OAAO,UAAU,SAAS,QAAQ,KAChD,iBAAiB,SAAS,YAAY,MAAM,iBAAiB,OAAO,YAAY,KAChF,iBAAiB,mBAAmB,MAAM,iBAAiB,OAAO,mBAAmB,KACrF,oBAAoB,mBAAmB,OAAO,oBAAoB,kBAElE,OAAO,OAAO,YAAY;CAE5B,OAAO;EAAE;EAAQ;EAAU;EAAqB;EAAoB,WAAW,MAAM;CAAU;AACjG,CAAC;AAED,MAAa,mBACX,OACA,SACA,QACG;CACH,MAAM,eAAe;EACnB,MAAM,SAAS,cAAc;EAC7B,MAAM,OAAO;EACb,MAAM;EACN;EACA,MAAM;CACR;CAEA,IACE,iBAAiB,MAAM,kBAAkB,MAAM,iBAAiB,OAAO,KACvE,MAAM,mBAAmB,mBAAmB,QAAQ,oBACpD,MAAM,MAAM,OAAO,kBACnB,OAAO,MAAM,OAAO,mBACpB,CAAC,aAAa,OAAO,gBACnB,kBAAkB,oBAChB,MAAM,SAAS,cAAc,UAC7B,aACA,GACF,CACF,GAEA,OAAO;CACT,MAAM,MAAM,KAAK,IAAI,GAAG,aAAa,KAAK,gBAAgB,YAAY,gBAAgB,CAAC;CAEvF,QAAQ,MAAM,OAAO,cAAc,UAAU,CAAC,EAAA,CAAG,OAAO,UAAU;EAChE,MAAM,WAAW,SAAS,cAAc,MAAM,UAAU;EAExD,OACE,YAAY,OACZ,MAAM,WAAW,OACjB,MAAM,SAAS,cAAc,SAAS,OAAO,MAC1C,WAAW,UAAU,MAAM,MAAM,UAAU,KAAK,CACnD;CAEJ,CAAC;AACH;AAEyB,OAAO,GAAG,mCAAmC,CAAC,CAAC,WACtE,GACA,GACA;CACA,QAAQ,OAAO,4BAA4B,CAAC,QAAQ,OAAO,4BAA4B,CAAC;AAC1F,CAAC"}

package/dist/drizzle/password-prepared-target.d.mts

@@ -0,0 +1,12 @@
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { PasswordPreparedPersistence } from "../password/methods/PasswordPreparedPersistence.mjs";
+import "./password-target.mjs";
+import { Context, Effect, Layer } from "effect";
+import "effect/unstable/sql/SqlError";
+//#region src/drizzle/password-prepared-target.d.ts
+declare const passwordPreparedPersistenceLayer: <Id>(tag: Context.Key<Id, PasswordPreparedPersistence>, services: Effect.Effect<{
+  readonly passwordPreparedPersistence: PasswordPreparedPersistence;
+}, never, LifecycleHooks>) => Layer.Layer<Id, never, LifecycleHooks>;
+//#endregion
+export { passwordPreparedPersistenceLayer };
+//# sourceMappingURL=password-prepared-target.d.mts.map

package/dist/drizzle/password-prepared-target.mjs

@@ -0,0 +1,57 @@
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { coordinateCommit, hasCommitScope } from "../hooks/commit.mjs";
+import { PasswordUnavailable } from "../password/methods/errors.mjs";
+import { CurrentPasswordPreparedTransaction, PasswordPreparedJournalGuards, PasswordPreparedPostconditions } from "./PasswordPreparedPostconditions.mjs";
+import { passwordOptions } from "./password-target.mjs";
+import { makeSqlPasswordPreparedPersistence } from "./password-prepared-sql.mjs";
+import { Cause, Effect, Layer } from "effect";
+//#region src/drizzle/password-prepared-target.ts
+const makeTargetPasswordPreparedPersistenceServices = (database, mapping, configuration, proofMapping) => Effect.gen(function* () {
+	return { passwordPreparedPersistence: yield* makeSqlPasswordPreparedPersistence(database, mapping, passwordOptions(configuration, proofMapping)) };
+});
+const coordinateTargetPasswordPreparedPersistence = (database, mapping, configuration, proofMapping, owner) => Effect.gen(function* () {
+	const hooks = yield* LifecycleHooks;
+	if (yield* hasCommitScope) return yield* PasswordUnavailable.make({});
+	yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;
+	return (yield* coordinateCommit(() => database.transaction((transaction) => Effect.gen(function* () {
+		const guards = [];
+		const postconditions = [];
+		let poisoned = false;
+		let acceptingPostconditions = true;
+		const services = yield* makeSqlPasswordPreparedPersistence(transaction, mapping, passwordOptions(configuration, proofMapping, true));
+		const protect = (effect) => effect.pipe(Effect.onError(() => Effect.sync(() => {
+			poisoned = true;
+		})));
+		const value = yield* owner(transaction, { passwordPreparedPersistence: {
+			reserve: (input, prepare) => protect(services.reserve(input, prepare)),
+			publishReady: (input, prepare) => protect(services.publishReady(input, prepare)),
+			context: (input) => protect(services.context(input)),
+			complete: (input, prepare) => protect(services.complete(input, prepare)),
+			resetWithProof: (input, prepare) => protect(services.resetWithProof(input, prepare)),
+			cancel: (input, prepare) => protect(services.cancel(input, prepare)),
+			cleanup: (input, prepare) => protect(services.cleanup(input, prepare))
+		} }).pipe(Effect.provideService(PasswordPreparedJournalGuards, { register: (guard) => {
+			if (!acceptingPostconditions) return false;
+			guards.push(guard);
+			return true;
+		} }), Effect.provideService(PasswordPreparedPostconditions, { register: (check) => {
+			if (!acceptingPostconditions) return false;
+			postconditions.push(check);
+			return true;
+		} }), Effect.ensuring(Effect.sync(() => {
+			acceptingPostconditions = false;
+		})));
+		if (poisoned) return yield* PasswordUnavailable.make({});
+		for (const guard of guards) {
+			const status = yield* Effect.result(guard.read);
+			if (status._tag === "Success" || status.failure._tag !== "CommitPending") return yield* PasswordUnavailable.make({});
+		}
+		for (const check of postconditions) yield* check.pipe(Effect.provideService(CurrentPasswordPreparedTransaction, transaction), Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => PasswordUnavailable.make({})))));
+		return value;
+	})), { mode: configuration.mode }).pipe(Effect.provideService(LifecycleHooks, hooks))).value;
+});
+const passwordPreparedPersistenceLayer = (tag, services) => Layer.effect(tag, Effect.map(services, (value) => value.passwordPreparedPersistence));
+//#endregion
+export { coordinateTargetPasswordPreparedPersistence, makeTargetPasswordPreparedPersistenceServices, passwordPreparedPersistenceLayer };
+
+//# sourceMappingURL=password-prepared-target.mjs.map

package/dist/drizzle/password-prepared-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-prepared-target.mjs","names":[],"sources":["../../src/drizzle/password-prepared-target.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- concrete driver modules restore native table/database types. */\nimport type { Context } from \"effect\";\nimport { Cause, Effect, Layer } from \"effect\";\nimport type * as SqlError from \"effect/unstable/sql/SqlError\";\n\nimport { coordinateCommit, hasCommitScope, type PreparedCommit } from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { PasswordUnavailable } from \"../password/methods/errors\";\nimport type { PasswordPreparedPersistence } from \"../password/methods/PasswordPreparedPersistence\";\nimport { makeSqlPasswordPreparedPersistence } from \"./password-prepared-sql\";\nimport type { PasswordSqlDatabase } from \"./password-sql\";\nimport {\n  passwordOptions,\n  type PasswordTargetConfiguration,\n  type PasswordCoordinatorError,\n} from \"./password-target\";\nimport {\n  CurrentPasswordPreparedTransaction,\n  PasswordPreparedPostconditions,\n  PasswordPreparedJournalGuards,\n  type PasswordPreparedPostcondition,\n} from \"./PasswordPreparedPostconditions\";\n\nexport const makeTargetPasswordPreparedPersistenceServices = (\n  database: any,\n  mapping: any,\n  configuration: PasswordTargetConfiguration,\n  proofMapping?: any,\n) =>\n  Effect.gen(function* () {\n    return {\n      passwordPreparedPersistence: yield* makeSqlPasswordPreparedPersistence(\n        database,\n        mapping,\n        passwordOptions(configuration, proofMapping),\n      ),\n    };\n  });\n\nexport const coordinateTargetPasswordPreparedPersistence = <Transaction, A, E, R>(\n  database: {\n    readonly transaction: <Out, Err, Env>(\n      body: (transaction: Transaction) => Effect.Effect<Out, Err, Env>,\n    ) => Effect.Effect<Out, Err | SqlError.SqlError, Env>;\n  },\n  mapping: any,\n  configuration: PasswordTargetConfiguration,\n  proofMapping: any | undefined,\n  owner: (\n    transaction: Transaction,\n    services: { readonly passwordPreparedPersistence: PasswordPreparedPersistence },\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordCoordinatorError<E>, R | LifecycleHooks> =>\n  Effect.gen(function* () {\n    const hooks = yield* LifecycleHooks;\n\n    if (yield* hasCommitScope) return yield* PasswordUnavailable.make({});\n    yield* configuration.coordinatorGuard ?? configuration.standaloneGuard;\n\n    const result = yield* coordinateCommit(\n      () =>\n        database.transaction((transaction) =>\n          Effect.gen(function* () {\n            const guards: Array<PreparedCommit<void>> = [];\n            const postconditions: Array<PasswordPreparedPostcondition> = [];\n            let poisoned = false;\n            let acceptingPostconditions = true;\n\n            const services = yield* makeSqlPasswordPreparedPersistence(\n              transaction as unknown as PasswordSqlDatabase,\n              mapping,\n              passwordOptions(configuration, proofMapping, true),\n            );\n\n            const protect = <Out, Err, Env>(effect: Effect.Effect<Out, Err, Env>) =>\n              effect.pipe(\n                Effect.onError(() =>\n                  Effect.sync(() => {\n                    poisoned = true;\n                  }),\n                ),\n              );\n\n            const value = yield* owner(transaction, {\n              passwordPreparedPersistence: {\n                reserve: (input, prepare) => protect(services.reserve(input, prepare)),\n                publishReady: (input, prepare) => protect(services.publishReady(input, prepare)),\n                context: (input) => protect(services.context(input)),\n                complete: (input, prepare) => protect(services.complete(input, prepare)),\n                resetWithProof: (input, prepare) =>\n                  protect(services.resetWithProof(input, prepare)),\n                cancel: (input, prepare) => protect(services.cancel(input, prepare)),\n                cleanup: (input, prepare) => protect(services.cleanup(input, prepare)),\n              },\n            }).pipe(\n              Effect.provideService(PasswordPreparedJournalGuards, {\n                register: (guard) => {\n                  if (!acceptingPostconditions) return false;\n                  guards.push(guard);\n\n                  return true;\n                },\n              }),\n              Effect.provideService(PasswordPreparedPostconditions, {\n                register: (check) => {\n                  if (!acceptingPostconditions) return false;\n                  postconditions.push(check);\n\n                  return true;\n                },\n              }),\n              Effect.ensuring(\n                Effect.sync(() => {\n                  acceptingPostconditions = false;\n                }),\n              ),\n            );\n\n            if (poisoned) return yield* PasswordUnavailable.make({});\n            for (const guard of guards) {\n              const status = yield* Effect.result(guard.read);\n\n              if (status._tag === \"Success\" || status.failure._tag !== \"CommitPending\")\n                return yield* PasswordUnavailable.make({});\n            }\n\n            for (const check of postconditions)\n              yield* check.pipe(\n                Effect.provideService(\n                  CurrentPasswordPreparedTransaction,\n                  transaction as unknown as PasswordSqlDatabase,\n                ),\n                Effect.catchCause((cause) =>\n                  Effect.failCause(Cause.map(cause, () => PasswordUnavailable.make({}))),\n                ),\n              );\n\n            return value;\n          }),\n        ),\n      { mode: configuration.mode },\n    ).pipe(Effect.provideService(LifecycleHooks, hooks));\n\n    return result.value;\n  });\n\nexport const passwordPreparedPersistenceLayer = <Id>(\n  tag: Context.Key<Id, PasswordPreparedPersistence>,\n  services: Effect.Effect<\n    { readonly passwordPreparedPersistence: PasswordPreparedPersistence },\n    never,\n    LifecycleHooks\n  >,\n) =>\n  Layer.effect(\n    tag,\n    Effect.map(services, (value) => value.passwordPreparedPersistence),\n  );\n"],"mappings":";;;;;;;;AAuBA,MAAa,iDACX,UACA,SACA,eACA,iBAEA,OAAO,IAAI,aAAa;CACtB,OAAO,EACL,6BAA6B,OAAO,mCAClC,UACA,SACA,gBAAgB,eAAe,YAAY,CAC7C,EACF;AACF,CAAC;AAEH,MAAa,+CACX,UAKA,SACA,eACA,cACA,UAKA,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,OAAO;CAErB,IAAI,OAAO,gBAAgB,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;CACpE,OAAO,cAAc,oBAAoB,cAAc;CAsFvD,QAAO,OApFe,uBAElB,SAAS,aAAa,gBACpB,OAAO,IAAI,aAAa;EACtB,MAAM,SAAsC,CAAC;EAC7C,MAAM,iBAAuD,CAAC;EAC9D,IAAI,WAAW;EACf,IAAI,0BAA0B;EAE9B,MAAM,WAAW,OAAO,mCACtB,aACA,SACA,gBAAgB,eAAe,cAAc,IAAI,CACnD;EAEA,MAAM,WAA0B,WAC9B,OAAO,KACL,OAAO,cACL,OAAO,WAAW;GAChB,WAAW;EACb,CAAC,CACH,CACF;EAEF,MAAM,QAAQ,OAAO,MAAM,aAAa,EACtC,6BAA6B;GAC3B,UAAU,OAAO,YAAY,QAAQ,SAAS,QAAQ,OAAO,OAAO,CAAC;GACrE,eAAe,OAAO,YAAY,QAAQ,SAAS,aAAa,OAAO,OAAO,CAAC;GAC/E,UAAU,UAAU,QAAQ,SAAS,QAAQ,KAAK,CAAC;GACnD,WAAW,OAAO,YAAY,QAAQ,SAAS,SAAS,OAAO,OAAO,CAAC;GACvE,iBAAiB,OAAO,YACtB,QAAQ,SAAS,eAAe,OAAO,OAAO,CAAC;GACjD,SAAS,OAAO,YAAY,QAAQ,SAAS,OAAO,OAAO,OAAO,CAAC;GACnE,UAAU,OAAO,YAAY,QAAQ,SAAS,QAAQ,OAAO,OAAO,CAAC;EACvE,EACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,+BAA+B,EACnD,WAAW,UAAU;GACnB,IAAI,CAAC,yBAAyB,OAAO;GACrC,OAAO,KAAK,KAAK;GAEjB,OAAO;EACT,EACF,CAAC,GACD,OAAO,eAAe,gCAAgC,EACpD,WAAW,UAAU;GACnB,IAAI,CAAC,yBAAyB,OAAO;GACrC,eAAe,KAAK,KAAK;GAEzB,OAAO;EACT,EACF,CAAC,GACD,OAAO,SACL,OAAO,WAAW;GAChB,0BAA0B;EAC5B,CAAC,CACH,CACF;EAEA,IAAI,UAAU,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;EACvD,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,SAAS,OAAO,OAAO,OAAO,MAAM,IAAI;GAE9C,IAAI,OAAO,SAAS,aAAa,OAAO,QAAQ,SAAS,iBACvD,OAAO,OAAO,oBAAoB,KAAK,CAAC,CAAC;EAC7C;EAEA,KAAK,MAAM,SAAS,gBAClB,OAAO,MAAM,KACX,OAAO,eACL,oCACA,WACF,GACA,OAAO,YAAY,UACjB,OAAO,UAAU,MAAM,IAAI,aAAa,oBAAoB,KAAK,CAAC,CAAC,CAAC,CAAC,CACvE,CACF;EAEF,OAAO;CACT,CAAC,CACH,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,EAAA,CAErC;AAChB,CAAC;AAEH,MAAa,oCACX,KACA,aAMA,MAAM,OACJ,KACA,OAAO,IAAI,WAAW,UAAU,MAAM,2BAA2B,CACnE"}

package/dist/drizzle/password-registration.d.mts

@@ -0,0 +1,23 @@
+import { LoginIdentifier } from "../identity/models.mjs";
+import "../hooks/LifecycleHooks.mjs";
+import { PreparedCommit } from "../hooks/commit.mjs";
+import { PasswordUnavailable } from "../password/methods/errors.mjs";
+import { PasswordReplacement } from "../password/methods/models.mjs";
+import { PreparePasswordCommit } from "../password/methods/PasswordPersistence.mjs";
+import { PasswordRegistrationDecision } from "../password/methods/module.mjs";
+import "./password-model.mjs";
+import "./password-sql.mjs";
+import { Effect } from "effect";
+//#region src/drizzle/password-registration.d.ts
+interface PasswordRegistrationAuthority<Registration> {
+  readonly register: <A>(input: {
+    readonly moduleId: string;
+    readonly requestId: string;
+    readonly identifier: LoginIdentifier;
+    readonly registration: Registration;
+    readonly replacement: PasswordReplacement;
+  }, prepare: PreparePasswordCommit<PasswordRegistrationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
+}
+//#endregion
+export { PasswordRegistrationAuthority };
+//# sourceMappingURL=password-registration.d.mts.map

package/dist/drizzle/password-registration.mjs

@@ -0,0 +1,136 @@
+import { HookConfigurationError } from "../hooks/models.mjs";
+import { reportPersistenceFailure } from "../internal/diagnostics.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { CurrentCommitJournal, coordinateCommit, hasCommitScope } from "../hooks/commit.mjs";
+import { PasswordUnavailable } from "../password/methods/errors.mjs";
+import { requiredPasswordRegistrationConstraints } from "./password-model.mjs";
+import { DrizzleMappingError, column, isMappedConstraintConflict } from "./model.mjs";
+import { ProofUnavailable } from "../proofs/errors.mjs";
+import { CurrentProofSql } from "./proof-sql.mjs";
+import { CurrentPasswordSql } from "./password-sql.mjs";
+import { Cause, Effect, Schema } from "effect";
+import { and, eq } from "drizzle-orm";
+//#region src/drizzle/password-registration.ts
+const unavailable = () => PasswordUnavailable.make({});
+const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
+const validConstraints = (mapping) => Object.entries(requiredPasswordRegistrationConstraints).every(([key, value]) => mapping.constraints[key] === value);
+const selectRows = (query, locking) => locking && typeof query.for === "function" ? query.for("update") : query;
+const allocate = (mode, asyncValue, syncValue) => {
+	if (mode === "synchronous") return syncValue === void 0 ? Effect.fail(unavailable()) : Effect.try({
+		try: syncValue,
+		catch: (cause) => new DrizzleMappingError({
+			operation: "mapping",
+			cause
+		})
+	});
+	if (asyncValue !== void 0) return asyncValue;
+	return syncValue === void 0 ? Effect.fail(unavailable()) : Effect.try({
+		try: syncValue,
+		catch: (cause) => new DrizzleMappingError({
+			operation: "mapping",
+			cause
+		})
+	});
+};
+const registrationRows = Effect.fn("Drizzle.registrationRows")(function* (mapping, moduleId, requestId, locking) {
+	const database = yield* CurrentPasswordSql;
+	const module = column(mapping.registration.table, mapping.registration.moduleId);
+	const request = column(mapping.registration.table, mapping.registration.requestId);
+	const query = database.select().from(mapping.registration.table).where(and(eq(module, moduleId), eq(request, requestId))).limit(1);
+	return yield* selectRows(query, locking);
+});
+const registerIn = Effect.fn("DrizzlePasswordRegistration.registerIn")(function* (mapping, configuration, input, allocated, prepare) {
+	const database = yield* CurrentPasswordSql;
+	const journal = yield* CurrentCommitJournal;
+	const existing = (yield* registrationRows(mapping, input.moduleId, input.requestId, configuration.locking))[0];
+	if (existing !== void 0) return prepare(yield* mapping.registration.decodeReplay(existing), journal);
+	const intent = {
+		moduleId: input.moduleId,
+		requestId: input.requestId,
+		identifier: input.identifier,
+		registration: input.registration,
+		replacement: input.replacement
+	};
+	if (mapping.mode === "pending") {
+		if (allocated.recoveryReference === void 0) return yield* unavailable();
+		const receipt = prepare({
+			_tag: "Pending",
+			reference: allocated.recoveryReference
+		}, journal);
+		yield* database.insert(mapping.registration.table).values(mapping.registration.encodeInsert(intent, {
+			state: "pending",
+			recoveryReference: allocated.recoveryReference
+		}));
+		return receipt;
+	}
+	let nativeSubjectId = allocated.nativeSubjectId;
+	const subjectInsert = database.insert(mapping.subject.table).values(mapping.provisioning.encodeSubjectInsert(intent, {
+		nativeSubjectId,
+		securityRevision: allocated.securityRevision
+	}));
+	if (mapping.provisioning.idMode === "generated") {
+		const rows = yield* configuration.generatedSubjectRows(subjectInsert);
+		nativeSubjectId = yield* mapping.provisioning.decodeGeneratedId(rows);
+	} else yield* subjectInsert;
+	if (nativeSubjectId === void 0) return yield* unavailable();
+	const receipt = prepare({
+		_tag: "Created",
+		subjectId: yield* mapping.subjectId.toSubject(nativeSubjectId)
+	}, journal);
+	yield* database.insert(mapping.identifier.table).values(mapping.identifier.encodeInitialInsert(input.identifier, nativeSubjectId, allocated.identifierRevision));
+	yield* database.insert(mapping.credential.table).values(mapping.credential.encodeInsert({
+		moduleId: input.moduleId,
+		subjectId: nativeSubjectId,
+		credentialId: allocated.credentialId,
+		credentialRevision: allocated.credentialRevision,
+		verifierVersion: allocated.verifierVersion,
+		replacement: input.replacement
+	}));
+	yield* database.insert(mapping.authorityCredential.table).values(mapping.authorityCredential.encodeInsert({
+		subjectId: nativeSubjectId,
+		credentialId: allocated.credentialId,
+		revision: allocated.credentialRevision
+	}));
+	yield* database.insert(mapping.registration.table).values(mapping.registration.encodeInsert(intent, {
+		state: "created",
+		nativeSubjectId
+	}));
+	return receipt;
+});
+const makeSqlPasswordRegistrationAuthority = Effect.fn("makeSqlPasswordRegistrationAuthority")(function* (database, mapping, configuration) {
+	const hooks = yield* LifecycleHooks;
+	return { register: (input, prepare) => Effect.gen(function* () {
+		if (!validConstraints(mapping)) return yield* unavailable();
+		const credentialId = yield* allocate(configuration.mode, mapping.allocateCredentialId, mapping.allocateCredentialIdSync);
+		const securityRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+		const credentialRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+		const identifierRevision = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+		const verifierVersion = yield* allocate(configuration.mode, mapping.allocateRevision, mapping.allocateRevisionSync);
+		const nativeSubjectId = mapping.mode !== "atomic" || mapping.provisioning.idMode === "generated" ? void 0 : yield* allocate(configuration.mode, mapping.provisioning.allocateSubjectId, mapping.provisioning.allocateSubjectIdSync);
+		const recoveryReference = mapping.mode === "pending" ? yield* allocate(configuration.mode, mapping.allocateRecoveryReference, mapping.allocateRecoveryReferenceSync) : void 0;
+		const run = coordinateCommit(() => database.transaction((transaction) => registerIn(mapping, configuration, input, {
+			credentialId,
+			securityRevision,
+			identifierRevision,
+			credentialRevision,
+			verifierVersion,
+			...nativeSubjectId === void 0 ? {} : { nativeSubjectId },
+			...recoveryReference === void 0 ? {} : { recoveryReference }
+		}, prepare).pipe(Effect.provideService(CurrentPasswordSql, transaction), Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode }).pipe(Effect.map((result) => result.value));
+		return yield* (configuration.coordinated !== true ? Effect.gen(function* () {
+			if (yield* hasCommitScope) return yield* unavailable();
+			yield* configuration.standaloneGuard;
+			return yield* run;
+		}) : run).pipe(Effect.catchCause((cause) => {
+			if (cause.reasons.every(Cause.isFailReason) && isMappedConstraintConflict(mapping.isRequestConflict, cause) || cause.reasons.every(Cause.isFailReason) && isMappedConstraintConflict(mapping.isIdentifierConflict, cause) || cause.reasons.every(Cause.isFailReason) && isMappedConstraintConflict(mapping.isCredentialConflict, cause)) return coordinateCommit((journal) => database.transaction((transaction) => Effect.gen(function* () {
+				const row = (yield* registrationRows(mapping, input.moduleId, input.requestId, configuration.locking))[0];
+				return prepare(row === void 0 ? { _tag: "Suppressed" } : yield* mapping.registration.decodeReplay(row), journal);
+			}).pipe(Effect.provideService(CurrentPasswordSql, transaction), Effect.provideService(CurrentProofSql, transaction))), { mode: configuration.mode }).pipe(Effect.map((result) => result.value));
+			return Effect.failCause(cause);
+		}));
+	}).pipe(Effect.provideService(CurrentPasswordSql, database), Effect.provideService(LifecycleHooks, hooks), translateFailure) };
+});
+//#endregion
+export { makeSqlPasswordRegistrationAuthority };
+
+//# sourceMappingURL=password-registration.mjs.map

package/dist/drizzle/password-registration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-registration.mjs","names":[],"sources":["../../src/drizzle/password-registration.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- registration plans bridge consumer-owned Drizzle rows. */\nimport { and, eq } from \"drizzle-orm\";\nimport { Cause, Effect, Schema } from \"effect\";\n\nimport {\n  coordinateCommit,\n  CurrentCommitJournal,\n  hasCommitScope,\n  type PreparedCommit,\n} from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { HookConfigurationError } from \"../hooks/models\";\nimport type { LoginIdentifier } from \"../identity/models\";\nimport { reportPersistenceFailure } from \"../internal/diagnostics\";\nimport { PasswordUnavailable } from \"../password/methods/errors\";\nimport type { PasswordReplacement } from \"../password/methods/models\";\nimport type { PasswordRegistrationDecision } from \"../password/methods/module\";\nimport type { PreparePasswordCommit } from \"../password/methods/PasswordPersistence\";\nimport { ProofUnavailable } from \"../proofs/errors\";\nimport { column, isMappedConstraintConflict, DrizzleMappingError } from \"./model\";\nimport {\n  type AnyPasswordRegistrationMapping,\n  requiredPasswordRegistrationConstraints,\n} from \"./password-model\";\nimport {\n  CurrentPasswordSql,\n  type PasswordSqlDatabase,\n  type PasswordSqlQuery,\n} from \"./password-sql\";\nimport { CurrentProofSql, type ProofSqlDatabase } from \"./proof-sql\";\n\ntype Database = PasswordSqlDatabase;\ntype Mapping<Registration> = AnyPasswordRegistrationMapping<Registration>;\nconst unavailable = () => PasswordUnavailable.make({});\n\nconst translateFailure = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasswordUnavailable, R> =>\n  reportPersistenceFailure(\n    effect,\n    (error) =>\n      Schema.is(PasswordUnavailable)(error) ||\n      Schema.is(ProofUnavailable)(error) ||\n      Schema.is(HookConfigurationError)(error),\n  ).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));\n\nexport interface PasswordRegistrationAuthority<Registration> {\n  readonly register: <A>(\n    input: {\n      readonly moduleId: string;\n      readonly requestId: string;\n      readonly identifier: LoginIdentifier;\n      readonly registration: Registration;\n      readonly replacement: PasswordReplacement;\n    },\n    prepare: PreparePasswordCommit<PasswordRegistrationDecision, A>,\n  ) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;\n}\n\nexport interface PasswordRegistrationConfiguration {\n  readonly mode: \"interactive\" | \"synchronous\";\n  readonly locking: boolean;\n  readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;\n  readonly coordinated?: boolean;\n  readonly generatedSubjectRows: (query: PasswordSqlQuery) => PasswordSqlQuery;\n}\n\nconst validConstraints = <Registration>(mapping: Mapping<Registration>) =>\n  Object.entries(requiredPasswordRegistrationConstraints).every(\n    ([key, value]) =>\n      mapping.constraints[key as keyof typeof requiredPasswordRegistrationConstraints] === value,\n  );\n\nconst selectRows = (query: PasswordSqlQuery, locking: boolean) =>\n  locking && typeof query.for === \"function\" ? query.for(\"update\") : query;\n\nconst allocate = <A>(\n  mode: PasswordRegistrationConfiguration[\"mode\"],\n  asyncValue: Effect.Effect<A, DrizzleMappingError> | undefined,\n  syncValue: (() => A) | undefined,\n) => {\n  if (mode === \"synchronous\")\n    return syncValue === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({\n          try: syncValue,\n          catch: (cause) => new DrizzleMappingError({ operation: \"mapping\", cause }),\n        });\n  if (asyncValue !== undefined) return asyncValue;\n\n  return syncValue === undefined\n    ? Effect.fail(unavailable())\n    : Effect.try({\n        try: syncValue,\n        catch: (cause) => new DrizzleMappingError({ operation: \"mapping\", cause }),\n      });\n};\n\nconst registrationRows = Effect.fn(\"Drizzle.registrationRows\")(function* <Registration>(\n  mapping: Mapping<Registration>,\n  moduleId: string,\n  requestId: string,\n  locking: boolean,\n) {\n  const database = yield* CurrentPasswordSql;\n\n  const module = column(mapping.registration.table, mapping.registration.moduleId);\n  const request = column(mapping.registration.table, mapping.registration.requestId);\n\n  const query = database\n    .select()\n    .from(mapping.registration.table)\n    .where(and(eq(module, moduleId), eq(request, requestId)))\n    .limit(1);\n\n  return yield* selectRows(query, locking);\n});\n\nconst registerIn = Effect.fn(\"DrizzlePasswordRegistration.registerIn\")(function* <Registration, A>(\n  mapping: Mapping<Registration>,\n  configuration: PasswordRegistrationConfiguration,\n  input: {\n    readonly moduleId: string;\n    readonly requestId: string;\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration;\n    readonly replacement: PasswordReplacement;\n  },\n  allocated: {\n    readonly credentialId: string;\n    readonly securityRevision: any;\n    readonly identifierRevision: any;\n    readonly credentialRevision: any;\n    readonly verifierVersion: any;\n    readonly nativeSubjectId?: unknown;\n    readonly recoveryReference?: any;\n  },\n  prepare: PreparePasswordCommit<PasswordRegistrationDecision, A>,\n) {\n  const database = yield* CurrentPasswordSql;\n  const journal = yield* CurrentCommitJournal;\n\n  const existing = (yield* registrationRows(\n    mapping,\n    input.moduleId,\n    input.requestId,\n    configuration.locking,\n  ))[0];\n\n  if (existing !== undefined)\n    return prepare(yield* mapping.registration.decodeReplay(existing), journal);\n\n  const intent = {\n    moduleId: input.moduleId,\n    requestId: input.requestId,\n    identifier: input.identifier,\n    registration: input.registration,\n    replacement: input.replacement,\n  };\n\n  if (mapping.mode === \"pending\") {\n    if (allocated.recoveryReference === undefined) return yield* unavailable();\n    const receipt = prepare({ _tag: \"Pending\", reference: allocated.recoveryReference }, journal);\n\n    yield* database.insert(mapping.registration.table).values(\n      mapping.registration.encodeInsert(intent, {\n        state: \"pending\",\n        recoveryReference: allocated.recoveryReference,\n      }),\n    );\n\n    return receipt;\n  }\n  let nativeSubjectId = allocated.nativeSubjectId;\n\n  const subjectInsert = database.insert(mapping.subject.table).values(\n    mapping.provisioning.encodeSubjectInsert(intent, {\n      nativeSubjectId,\n      securityRevision: allocated.securityRevision,\n    }),\n  );\n\n  if (mapping.provisioning.idMode === \"generated\") {\n    const rows = yield* configuration.generatedSubjectRows(subjectInsert);\n\n    nativeSubjectId = yield* mapping.provisioning.decodeGeneratedId(rows);\n  } else yield* subjectInsert;\n  if (nativeSubjectId === undefined) return yield* unavailable();\n  const subjectId = yield* mapping.subjectId.toSubject(nativeSubjectId);\n  const receipt = prepare({ _tag: \"Created\", subjectId }, journal);\n\n  yield* database\n    .insert(mapping.identifier.table)\n    .values(\n      mapping.identifier.encodeInitialInsert(\n        input.identifier,\n        nativeSubjectId,\n        allocated.identifierRevision,\n      ),\n    );\n  yield* database.insert(mapping.credential.table).values(\n    mapping.credential.encodeInsert({\n      moduleId: input.moduleId,\n      subjectId: nativeSubjectId,\n      credentialId: allocated.credentialId,\n      credentialRevision: allocated.credentialRevision,\n      verifierVersion: allocated.verifierVersion,\n      replacement: input.replacement,\n    }),\n  );\n  yield* database.insert(mapping.authorityCredential.table).values(\n    mapping.authorityCredential.encodeInsert({\n      subjectId: nativeSubjectId,\n      credentialId: allocated.credentialId,\n      revision: allocated.credentialRevision,\n    }),\n  );\n  yield* database.insert(mapping.registration.table).values(\n    mapping.registration.encodeInsert(intent, {\n      state: \"created\",\n      nativeSubjectId,\n    }),\n  );\n\n  return receipt;\n});\n\nexport const makeSqlPasswordRegistrationAuthority = Effect.fn(\n  \"makeSqlPasswordRegistrationAuthority\",\n)(function* <Registration>(\n  database: Database,\n  mapping: Mapping<Registration>,\n  configuration: PasswordRegistrationConfiguration,\n): Effect.fn.Return<PasswordRegistrationAuthority<Registration>, never, LifecycleHooks> {\n  const hooks = yield* LifecycleHooks;\n\n  return {\n    register: (input, prepare) =>\n      Effect.gen(function* () {\n        if (!validConstraints(mapping)) return yield* unavailable();\n\n        const credentialId = yield* allocate(\n          configuration.mode,\n          mapping.allocateCredentialId,\n          mapping.allocateCredentialIdSync,\n        );\n\n        const securityRevision = yield* allocate(\n          configuration.mode,\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const credentialRevision = yield* allocate(\n          configuration.mode,\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const identifierRevision = yield* allocate(\n          configuration.mode,\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const verifierVersion = yield* allocate(\n          configuration.mode,\n          mapping.allocateRevision,\n          mapping.allocateRevisionSync,\n        );\n\n        const nativeSubjectId =\n          mapping.mode !== \"atomic\" || mapping.provisioning.idMode === \"generated\"\n            ? undefined\n            : yield* allocate(\n                configuration.mode,\n                mapping.provisioning.allocateSubjectId,\n                mapping.provisioning.allocateSubjectIdSync,\n              );\n\n        const recoveryReference =\n          mapping.mode === \"pending\"\n            ? yield* allocate(\n                configuration.mode,\n                mapping.allocateRecoveryReference,\n                mapping.allocateRecoveryReferenceSync,\n              )\n            : undefined;\n\n        const run = coordinateCommit(\n          () =>\n            database.transaction((transaction) =>\n              registerIn(\n                mapping,\n                configuration,\n                input,\n                {\n                  credentialId,\n                  securityRevision,\n                  identifierRevision,\n                  credentialRevision,\n                  verifierVersion,\n                  ...(nativeSubjectId === undefined ? {} : { nativeSubjectId }),\n                  ...(recoveryReference === undefined ? {} : { recoveryReference }),\n                },\n                prepare,\n              ).pipe(\n                Effect.provideService(CurrentPasswordSql, transaction),\n                Effect.provideService(CurrentProofSql, transaction as unknown as ProofSqlDatabase),\n              ),\n            ),\n          { mode: configuration.mode },\n        ).pipe(Effect.map((result) => result.value));\n\n        const guarded =\n          configuration.coordinated !== true\n            ? Effect.gen(function* () {\n                if (yield* hasCommitScope) return yield* unavailable();\n                yield* configuration.standaloneGuard;\n\n                return yield* run;\n              })\n            : run;\n\n        return yield* guarded.pipe(\n          Effect.catchCause((cause) => {\n            if (\n              (cause.reasons.every(Cause.isFailReason) &&\n                isMappedConstraintConflict(mapping.isRequestConflict, cause)) ||\n              (cause.reasons.every(Cause.isFailReason) &&\n                isMappedConstraintConflict(mapping.isIdentifierConflict, cause)) ||\n              (cause.reasons.every(Cause.isFailReason) &&\n                isMappedConstraintConflict(mapping.isCredentialConflict, cause))\n            )\n              return coordinateCommit(\n                (journal) =>\n                  database.transaction((transaction) =>\n                    Effect.gen(function* () {\n                      const row = (yield* registrationRows(\n                        mapping,\n                        input.moduleId,\n                        input.requestId,\n                        configuration.locking,\n                      ))[0];\n\n                      const decision =\n                        row === undefined\n                          ? ({ _tag: \"Suppressed\" } as const)\n                          : yield* mapping.registration.decodeReplay(row);\n\n                      return prepare(decision, journal);\n                    }).pipe(\n                      Effect.provideService(CurrentPasswordSql, transaction),\n                      Effect.provideService(\n                        CurrentProofSql,\n                        transaction as unknown as ProofSqlDatabase,\n                      ),\n                    ),\n                  ),\n                { mode: configuration.mode },\n              ).pipe(Effect.map((result) => result.value));\n\n            return Effect.failCause(cause);\n          }),\n        );\n      }).pipe(\n        Effect.provideService(CurrentPasswordSql, database),\n        Effect.provideService(LifecycleHooks, hooks),\n        translateFailure,\n      ),\n  };\n});\n"],"mappings":";;;;;;;;;;;;;AAiCA,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;AAErD,MAAM,oBACJ,WAEA,yBACE,SACC,UACC,OAAO,GAAG,mBAAmB,CAAC,CAAC,KAAK,KACpC,OAAO,GAAG,gBAAgB,CAAC,CAAC,KAAK,KACjC,OAAO,GAAG,sBAAsB,CAAC,CAAC,KAAK,CAC3C,CAAC,CAAC,KAAK,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,aAAa,YAAY,CAAC,CAAC,CAAC,CAAC;AAuB9F,MAAM,oBAAkC,YACtC,OAAO,QAAQ,uCAAuC,CAAC,CAAC,OACrD,CAAC,KAAK,WACL,QAAQ,YAAY,SAAiE,KACzF;AAEF,MAAM,cAAc,OAAyB,YAC3C,WAAW,OAAO,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,IAAI;AAErE,MAAM,YACJ,MACA,YACA,cACG;CACH,IAAI,SAAS,eACX,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;EACT,KAAK;EACL,QAAQ,UAAU,IAAI,oBAAoB;GAAE,WAAW;GAAW;EAAM,CAAC;CAC3E,CAAC;CACP,IAAI,eAAe,KAAA,GAAW,OAAO;CAErC,OAAO,cAAc,KAAA,IACjB,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;EACT,KAAK;EACL,QAAQ,UAAU,IAAI,oBAAoB;GAAE,WAAW;GAAW;EAAM,CAAC;CAC3E,CAAC;AACP;AAEA,MAAM,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,UACA,WACA,SACA;CACA,MAAM,WAAW,OAAO;CAExB,MAAM,SAAS,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,QAAQ;CAC/E,MAAM,UAAU,OAAO,QAAQ,aAAa,OAAO,QAAQ,aAAa,SAAS;CAEjF,MAAM,QAAQ,SACX,OAAO,CAAC,CACR,KAAK,QAAQ,aAAa,KAAK,CAAC,CAChC,MAAM,IAAI,GAAG,QAAQ,QAAQ,GAAG,GAAG,SAAS,SAAS,CAAC,CAAC,CAAC,CACxD,MAAM,CAAC;CAEV,OAAO,OAAO,WAAW,OAAO,OAAO;AACzC,CAAC;AAED,MAAM,aAAa,OAAO,GAAG,wCAAwC,CAAC,CAAC,WACrE,SACA,eACA,OAOA,WASA,SACA;CACA,MAAM,WAAW,OAAO;CACxB,MAAM,UAAU,OAAO;CAEvB,MAAM,YAAY,OAAO,iBACvB,SACA,MAAM,UACN,MAAM,WACN,cAAc,OAChB,EAAA,CAAG;CAEH,IAAI,aAAa,KAAA,GACf,OAAO,QAAQ,OAAO,QAAQ,aAAa,aAAa,QAAQ,GAAG,OAAO;CAE5E,MAAM,SAAS;EACb,UAAU,MAAM;EAChB,WAAW,MAAM;EACjB,YAAY,MAAM;EAClB,cAAc,MAAM;EACpB,aAAa,MAAM;CACrB;CAEA,IAAI,QAAQ,SAAS,WAAW;EAC9B,IAAI,UAAU,sBAAsB,KAAA,GAAW,OAAO,OAAO,YAAY;EACzE,MAAM,UAAU,QAAQ;GAAE,MAAM;GAAW,WAAW,UAAU;EAAkB,GAAG,OAAO;EAE5F,OAAO,SAAS,OAAO,QAAQ,aAAa,KAAK,CAAC,CAAC,OACjD,QAAQ,aAAa,aAAa,QAAQ;GACxC,OAAO;GACP,mBAAmB,UAAU;EAC/B,CAAC,CACH;EAEA,OAAO;CACT;CACA,IAAI,kBAAkB,UAAU;CAEhC,MAAM,gBAAgB,SAAS,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,OAC3D,QAAQ,aAAa,oBAAoB,QAAQ;EAC/C;EACA,kBAAkB,UAAU;CAC9B,CAAC,CACH;CAEA,IAAI,QAAQ,aAAa,WAAW,aAAa;EAC/C,MAAM,OAAO,OAAO,cAAc,qBAAqB,aAAa;EAEpE,kBAAkB,OAAO,QAAQ,aAAa,kBAAkB,IAAI;CACtE,OAAO,OAAO;CACd,IAAI,oBAAoB,KAAA,GAAW,OAAO,OAAO,YAAY;CAE7D,MAAM,UAAU,QAAQ;EAAE,MAAM;EAAW,WAAA,OADlB,QAAQ,UAAU,UAAU,eAAe;CACf,GAAG,OAAO;CAE/D,OAAO,SACJ,OAAO,QAAQ,WAAW,KAAK,CAAC,CAChC,OACC,QAAQ,WAAW,oBACjB,MAAM,YACN,iBACA,UAAU,kBACZ,CACF;CACF,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK,CAAC,CAAC,OAC/C,QAAQ,WAAW,aAAa;EAC9B,UAAU,MAAM;EAChB,WAAW;EACX,cAAc,UAAU;EACxB,oBAAoB,UAAU;EAC9B,iBAAiB,UAAU;EAC3B,aAAa,MAAM;CACrB,CAAC,CACH;CACA,OAAO,SAAS,OAAO,QAAQ,oBAAoB,KAAK,CAAC,CAAC,OACxD,QAAQ,oBAAoB,aAAa;EACvC,WAAW;EACX,cAAc,UAAU;EACxB,UAAU,UAAU;CACtB,CAAC,CACH;CACA,OAAO,SAAS,OAAO,QAAQ,aAAa,KAAK,CAAC,CAAC,OACjD,QAAQ,aAAa,aAAa,QAAQ;EACxC,OAAO;EACP;CACF,CAAC,CACH;CAEA,OAAO;AACT,CAAC;AAED,MAAa,uCAAuC,OAAO,GACzD,sCACF,CAAC,CAAC,WACA,UACA,SACA,eACsF;CACtF,MAAM,QAAQ,OAAO;CAErB,OAAO,EACL,WAAW,OAAO,YAChB,OAAO,IAAI,aAAa;EACtB,IAAI,CAAC,iBAAiB,OAAO,GAAG,OAAO,OAAO,YAAY;EAE1D,MAAM,eAAe,OAAO,SAC1B,cAAc,MACd,QAAQ,sBACR,QAAQ,wBACV;EAEA,MAAM,mBAAmB,OAAO,SAC9B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,qBAAqB,OAAO,SAChC,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,kBAAkB,OAAO,SAC7B,cAAc,MACd,QAAQ,kBACR,QAAQ,oBACV;EAEA,MAAM,kBACJ,QAAQ,SAAS,YAAY,QAAQ,aAAa,WAAW,cACzD,KAAA,IACA,OAAO,SACL,cAAc,MACd,QAAQ,aAAa,mBACrB,QAAQ,aAAa,qBACvB;EAEN,MAAM,oBACJ,QAAQ,SAAS,YACb,OAAO,SACL,cAAc,MACd,QAAQ,2BACR,QAAQ,6BACV,IACA,KAAA;EAEN,MAAM,MAAM,uBAER,SAAS,aAAa,gBACpB,WACE,SACA,eACA,OACA;GACE;GACA;GACA;GACA;GACA;GACA,GAAI,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB;GAC3D,GAAI,sBAAsB,KAAA,IAAY,CAAC,IAAI,EAAE,kBAAkB;EACjE,GACA,OACF,CAAC,CAAC,KACA,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eAAe,iBAAiB,WAA0C,CACnF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;EAY3C,OAAO,QATL,cAAc,gBAAgB,OAC1B,OAAO,IAAI,aAAa;GACtB,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,cAAc;GAErB,OAAO,OAAO;EAChB,CAAC,IACD,IAAA,CAEgB,KACpB,OAAO,YAAY,UAAU;GAC3B,IACG,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,mBAAmB,KAAK,KAC5D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,KAC/D,MAAM,QAAQ,MAAM,MAAM,YAAY,KACrC,2BAA2B,QAAQ,sBAAsB,KAAK,GAEhE,OAAO,kBACJ,YACC,SAAS,aAAa,gBACpB,OAAO,IAAI,aAAa;IACtB,MAAM,OAAO,OAAO,iBAClB,SACA,MAAM,UACN,MAAM,WACN,cAAc,OAChB,EAAA,CAAG;IAOH,OAAO,QAJL,QAAQ,KAAA,IACH,EAAE,MAAM,aAAa,IACtB,OAAO,QAAQ,aAAa,aAAa,GAAG,GAEzB,OAAO;GAClC,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,WAAW,GACrD,OAAO,eACL,iBACA,WACF,CACF,CACF,GACF,EAAE,MAAM,cAAc,KAAK,CAC7B,CAAC,CAAC,KAAK,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC;GAE7C,OAAO,OAAO,UAAU,KAAK;EAC/B,CAAC,CACH;CACF,CAAC,CAAC,CAAC,KACD,OAAO,eAAe,oBAAoB,QAAQ,GAClD,OAAO,eAAe,gBAAgB,KAAK,GAC3C,gBACF,EACJ;AACF,CAAC"}

package/dist/drizzle/password-sql.d.mts

@@ -0,0 +1,20 @@
+import "../Schema.mjs";
+import "../sessions/models.mjs";
+import "../identity/models.mjs";
+import "../hooks/models.mjs";
+import "../hooks/LifecycleHooks.mjs";
+import "../hooks/commit.mjs";
+import "../password/methods/errors.mjs";
+import "./model.mjs";
+import "../password/methods/models.mjs";
+import "../proofs/ProofPersistence.mjs";
+import "../proofs/completion.mjs";
+import "../password/methods/policy.mjs";
+import "../password/methods/PasswordPersistence.mjs";
+import "./password-model.mjs";
+import "./proof-sql.mjs";
+import "../Password.mjs";
+import { Context, DateTime, Effect, Option, Redacted } from "effect";
+import { sql } from "drizzle-orm";
+import "effect/unstable/sql/SqlError";
+import "drizzle-orm/effect-core";