@yielded/auth 0.1.0-beta.1

package/dist/drizzle/phone-model.d.mts

@@ -0,0 +1,117 @@
+import { SubjectId } from "../Schema.mjs";
+import { AuthenticationRequirement } from "../sessions/models.mjs";
+import { DrizzleMappingError } from "./model.mjs";
+import { AnyProofPersistenceMapping, ProofPersistenceMapping } from "./proof-model.mjs";
+import { PhoneNumber } from "../phone/models.mjs";
+import { PhoneAdmissionPolicy, PhoneLifecyclePolicy } from "../phone/lifecycleModels.mjs";
+import { PhoneAdmission } from "../phone/PhoneAdmission.mjs";
+import { PhonePersistence } from "../phone/PhonePersistence.mjs";
+import { PhoneSignInTargets } from "../phone/PhoneSignInTargets.mjs";
+import { Effect, Layer } from "effect";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/phone-model.d.ts
+declare const proofMapping: unique symbol;
+/** Opaque same-owner proof mapping. The builder preserves the consumer's table codecs. */
+interface PhoneProofCompletionMapping {
+  readonly [proofMapping]: AnyProofPersistenceMapping;
+}
+declare const phoneProofCompletionMapping: <Rq extends Table, S extends Table, G extends Table, Cn extends Table, Rs extends Table, A extends Table, F extends Table, C extends Table, Sub extends Table, I extends Table, Cr extends Table, N>(mapping: ProofPersistenceMapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, N>) => PhoneProofCompletionMapping;
+type PhoneColumn<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+type PhoneMappingSource<M, R = never> = M | Effect.Effect<M, DrizzleMappingError, R>;
+declare const requiredPhoneConstraints: {
+  readonly subject: "unique(id)";
+  readonly identifier: "unique(namespace,value)";
+  readonly credential: "unique(credentialId)";
+  readonly state: "unique(scope)";
+};
+/** Consumer-owned schema; encoders and allocators are synchronous and side-effect free.
+ * State stores permanent number custody and command tombstones, plus bounded admission
+ * counters. Never delete custody rows to make a recycled number eligible. A consumer's
+ * explicit recovery workflow may resolve custody only after independent authentication.
+ * Subject defaults own account provisioning; no email/profile schema is prescribed. */
+interface PhoneMapping<S extends Table, I extends Table, C extends Table, T extends Table, N> {
+  readonly moduleId: string;
+  readonly policy: PhoneLifecyclePolicy;
+  readonly admission: PhoneAdmissionPolicy;
+  readonly constraints: typeof requiredPhoneConstraints;
+  readonly proofs: PhoneProofCompletionMapping;
+  readonly subjectIds: {
+    readonly toNative: (id: SubjectId) => N;
+    readonly toSubject: (id: N) => SubjectId;
+    readonly allocate: () => N;
+  };
+  readonly subject: {
+    readonly table: S;
+    readonly id: PhoneColumn<S>;
+    readonly securityRevision: PhoneColumn<S>;
+    readonly activeCondition: SQL;
+    readonly decodeRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;
+    /** Current action policy, independently from primary sign-in assurance. */
+    readonly decodeActionRequirement?: (row: InferSelectModel<S>, action: "verify" | "change") => AuthenticationRequirement;
+    readonly encodeInsert: (input: {
+      readonly id: N;
+      readonly securityRevision: string;
+      readonly phoneNumber: PhoneNumber;
+    }) => InferInsertModel<S>;
+  };
+  readonly identifier: {
+    readonly table: I;
+    readonly namespace: PhoneColumn<I>;
+    readonly value: PhoneColumn<I>;
+    readonly subjectId: PhoneColumn<I>;
+    readonly revision: PhoneColumn<I>;
+    readonly verifiedAt: PhoneColumn<I>;
+    readonly status: PhoneColumn<I>;
+    readonly activeCondition: SQL;
+    readonly encodeStatus: (active: boolean) => unknown;
+    readonly encodeInsert: (input: {
+      readonly phoneNumber: PhoneNumber;
+      readonly subjectId: N;
+      readonly revision: string;
+      readonly verifiedAtMillis: number;
+      readonly active: boolean;
+    }) => InferInsertModel<I>;
+  };
+  readonly credential: {
+    readonly table: C;
+    readonly id: PhoneColumn<C>;
+    readonly subjectId: PhoneColumn<C>;
+    readonly revision: PhoneColumn<C>;
+    readonly status: PhoneColumn<C>;
+    readonly activeCondition: SQL;
+    readonly encodeStatus: (active: boolean) => unknown;
+    readonly encodeInsert: (input: {
+      readonly credentialId: string;
+      readonly subjectId: N;
+      readonly revision: string;
+      readonly active: boolean;
+    }) => InferInsertModel<C>;
+  };
+  readonly state: {
+    readonly table: T;
+    readonly scope: PhoneColumn<T>;
+    readonly state: PhoneColumn<T>;
+    readonly version: PhoneColumn<T>;
+    readonly encodeInsert: (input: {
+      readonly scope: string;
+      readonly state: string;
+      readonly version: string;
+    }) => InferInsertModel<T>;
+  };
+  readonly encodeInstant: (millis: number) => unknown;
+  readonly engineNowMillis: SQL;
+}
+interface D1PhoneMapping {
+  readonly d1: {
+    readonly primary: true;
+  };
+}
+interface PhonePersistenceServices {
+  readonly phonePersistence: PhonePersistence["Service"];
+  readonly phoneAdmission: PhoneAdmission["Service"];
+  readonly phoneSignInTargets: PhoneSignInTargets["Service"];
+}
+declare const phonePersistenceLayer: <E, R>(services: Effect.Effect<PhonePersistenceServices, E, R>) => Layer.Layer<PhoneAdmission | PhonePersistence | PhoneSignInTargets, E, Exclude<R, import("effect/Scope").Scope>>;
+//#endregion
+export { D1PhoneMapping, PhoneColumn, PhoneMapping, PhoneMappingSource, PhonePersistenceServices, PhoneProofCompletionMapping, phonePersistenceLayer, phoneProofCompletionMapping, requiredPhoneConstraints };
+//# sourceMappingURL=phone-model.d.mts.map

package/dist/drizzle/phone-model.mjs

@@ -0,0 +1,39 @@
+import { PhoneAdmission } from "../phone/PhoneAdmission.mjs";
+import { PhonePersistence } from "../phone/PhonePersistence.mjs";
+import { PhoneSignInTargets } from "../phone/PhoneSignInTargets.mjs";
+import { Effect, Layer } from "effect";
+//#region src/drizzle/phone-model.ts
+const proofMapping = Symbol("effect-auth/phone/proofs");
+const phoneProofCompletionMapping = (mapping) => Object.freeze({ [proofMapping]: Object.freeze({
+	...mapping,
+	request: Object.freeze({ ...mapping.request }),
+	series: Object.freeze({ ...mapping.series }),
+	generation: Object.freeze({ ...mapping.generation }),
+	continuation: Object.freeze({ ...mapping.continuation }),
+	rateScope: Object.freeze({ ...mapping.rateScope }),
+	abuseEvent: Object.freeze({ ...mapping.abuseEvent }),
+	failureEvent: Object.freeze({ ...mapping.failureEvent }),
+	command: Object.freeze({ ...mapping.command }),
+	constraints: Object.freeze({ ...mapping.constraints }),
+	authority: Object.freeze({
+		...mapping.authority,
+		identifier: Object.freeze({ ...mapping.authority.identifier }),
+		...mapping.authority.subject === void 0 ? {} : { subject: Object.freeze({ ...mapping.authority.subject }) },
+		...mapping.authority.credential === void 0 ? {} : { credential: Object.freeze({ ...mapping.authority.credential }) },
+		...mapping.authority.subjectId === void 0 ? {} : { subjectId: Object.freeze({ ...mapping.authority.subjectId }) }
+	}),
+	...mapping.d1 === void 0 ? {} : { d1: Object.freeze({ ...mapping.d1 }) }
+}) });
+/** @internal */
+const phoneProofs = (mapping) => mapping[proofMapping];
+const requiredPhoneConstraints = {
+	subject: "unique(id)",
+	identifier: "unique(namespace,value)",
+	credential: "unique(credentialId)",
+	state: "unique(scope)"
+};
+const phonePersistenceLayer = (services) => Layer.unwrap(Effect.map(services, (value) => Layer.mergeAll(Layer.succeed(PhonePersistence, value.phonePersistence), Layer.succeed(PhoneAdmission, value.phoneAdmission), Layer.succeed(PhoneSignInTargets, value.phoneSignInTargets))));
+//#endregion
+export { phonePersistenceLayer, phoneProofCompletionMapping, phoneProofs, requiredPhoneConstraints };
+
+//# sourceMappingURL=phone-model.mjs.map

package/dist/drizzle/phone-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone-model.mjs","names":[],"sources":["../../src/drizzle/phone-model.ts"],"sourcesContent":["import type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport { Effect, Layer } from \"effect\";\n\nimport type { PhoneAdmissionPolicy, PhoneLifecyclePolicy } from \"../phone/lifecycleModels\";\nimport type { PhoneNumber } from \"../phone/models\";\nimport { PhoneAdmission } from \"../phone/PhoneAdmission\";\nimport { PhonePersistence } from \"../phone/PhonePersistence\";\nimport { PhoneSignInTargets } from \"../phone/PhoneSignInTargets\";\nimport type { SubjectId } from \"../Schema\";\nimport type { AuthenticationRequirement } from \"../sessions/models\";\nimport type { DrizzleMappingError } from \"./model\";\nimport type { AnyProofPersistenceMapping, ProofPersistenceMapping } from \"./proof-model\";\nconst proofMapping = Symbol(\"effect-auth/phone/proofs\");\n\n/** Opaque same-owner proof mapping. The builder preserves the consumer's table codecs. */\nexport interface PhoneProofCompletionMapping {\n  readonly [proofMapping]: AnyProofPersistenceMapping;\n}\n\nexport const phoneProofCompletionMapping = <\n  Rq extends Table,\n  S extends Table,\n  G extends Table,\n  Cn extends Table,\n  Rs extends Table,\n  A extends Table,\n  F extends Table,\n  C extends Table,\n  Sub extends Table,\n  I extends Table,\n  Cr extends Table,\n  N,\n>(\n  mapping: ProofPersistenceMapping<Rq, S, G, Cn, Rs, A, F, C, Sub, I, Cr, N>,\n): PhoneProofCompletionMapping =>\n  Object.freeze({\n    [proofMapping]: Object.freeze({\n      ...mapping,\n      request: Object.freeze({ ...mapping.request }),\n      series: Object.freeze({ ...mapping.series }),\n      generation: Object.freeze({ ...mapping.generation }),\n      continuation: Object.freeze({ ...mapping.continuation }),\n      rateScope: Object.freeze({ ...mapping.rateScope }),\n      abuseEvent: Object.freeze({ ...mapping.abuseEvent }),\n      failureEvent: Object.freeze({ ...mapping.failureEvent }),\n      command: Object.freeze({ ...mapping.command }),\n      constraints: Object.freeze({ ...mapping.constraints }),\n      authority: Object.freeze({\n        ...mapping.authority,\n        identifier: Object.freeze({ ...mapping.authority.identifier }),\n        ...(mapping.authority.subject === undefined\n          ? {}\n          : { subject: Object.freeze({ ...mapping.authority.subject }) }),\n        ...(mapping.authority.credential === undefined\n          ? {}\n          : { credential: Object.freeze({ ...mapping.authority.credential }) }),\n        ...(mapping.authority.subjectId === undefined\n          ? {}\n          : { subjectId: Object.freeze({ ...mapping.authority.subjectId }) }),\n      }),\n      ...(mapping.d1 === undefined ? {} : { d1: Object.freeze({ ...mapping.d1 }) }),\n    }) as unknown as AnyProofPersistenceMapping,\n  });\n\n/** @internal */\nexport const phoneProofs = (mapping: PhoneProofCompletionMapping) => mapping[proofMapping];\nexport type PhoneColumn<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type PhoneMappingSource<M, R = never> = M | Effect.Effect<M, DrizzleMappingError, R>;\n\nexport const requiredPhoneConstraints = {\n  subject: \"unique(id)\",\n  identifier: \"unique(namespace,value)\",\n  credential: \"unique(credentialId)\",\n  state: \"unique(scope)\",\n} as const;\n\n/** Consumer-owned schema; encoders and allocators are synchronous and side-effect free.\n * State stores permanent number custody and command tombstones, plus bounded admission\n * counters. Never delete custody rows to make a recycled number eligible. A consumer's\n * explicit recovery workflow may resolve custody only after independent authentication.\n * Subject defaults own account provisioning; no email/profile schema is prescribed. */\nexport interface PhoneMapping<\n  S extends Table,\n  I extends Table,\n  C extends Table,\n  T extends Table,\n  N,\n> {\n  readonly moduleId: string;\n  readonly policy: PhoneLifecyclePolicy;\n  readonly admission: PhoneAdmissionPolicy;\n  readonly constraints: typeof requiredPhoneConstraints;\n  readonly proofs: PhoneProofCompletionMapping;\n  readonly subjectIds: {\n    readonly toNative: (id: SubjectId) => N;\n    readonly toSubject: (id: N) => SubjectId;\n    readonly allocate: () => N;\n  };\n  readonly subject: {\n    readonly table: S;\n    readonly id: PhoneColumn<S>;\n    readonly securityRevision: PhoneColumn<S>;\n    readonly activeCondition: SQL;\n    readonly decodeRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;\n    /** Current action policy, independently from primary sign-in assurance. */\n    readonly decodeActionRequirement?: (\n      row: InferSelectModel<S>,\n      action: \"verify\" | \"change\",\n    ) => AuthenticationRequirement;\n    readonly encodeInsert: (input: {\n      readonly id: N;\n      readonly securityRevision: string;\n      readonly phoneNumber: PhoneNumber;\n    }) => InferInsertModel<S>;\n  };\n  readonly identifier: {\n    readonly table: I;\n    readonly namespace: PhoneColumn<I>;\n    readonly value: PhoneColumn<I>;\n    readonly subjectId: PhoneColumn<I>;\n    readonly revision: PhoneColumn<I>;\n    readonly verifiedAt: PhoneColumn<I>;\n    readonly status: PhoneColumn<I>;\n    readonly activeCondition: SQL;\n    readonly encodeStatus: (active: boolean) => unknown;\n    readonly encodeInsert: (input: {\n      readonly phoneNumber: PhoneNumber;\n      readonly subjectId: N;\n      readonly revision: string;\n      readonly verifiedAtMillis: number;\n      readonly active: boolean;\n    }) => InferInsertModel<I>;\n  };\n  readonly credential: {\n    readonly table: C;\n    readonly id: PhoneColumn<C>;\n    readonly subjectId: PhoneColumn<C>;\n    readonly revision: PhoneColumn<C>;\n    readonly status: PhoneColumn<C>;\n    readonly activeCondition: SQL;\n    readonly encodeStatus: (active: boolean) => unknown;\n    readonly encodeInsert: (input: {\n      readonly credentialId: string;\n      readonly subjectId: N;\n      readonly revision: string;\n      readonly active: boolean;\n    }) => InferInsertModel<C>;\n  };\n  readonly state: {\n    readonly table: T;\n    readonly scope: PhoneColumn<T>;\n    readonly state: PhoneColumn<T>;\n    readonly version: PhoneColumn<T>;\n    readonly encodeInsert: (input: {\n      readonly scope: string;\n      readonly state: string;\n      readonly version: string;\n    }) => InferInsertModel<T>;\n  };\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly engineNowMillis: SQL;\n}\n\nexport interface D1PhoneMapping {\n  readonly d1: { readonly primary: true };\n}\n\nexport interface PhonePersistenceServices {\n  readonly phonePersistence: PhonePersistence[\"Service\"];\n  readonly phoneAdmission: PhoneAdmission[\"Service\"];\n  readonly phoneSignInTargets: PhoneSignInTargets[\"Service\"];\n}\n\nexport const phonePersistenceLayer = <E, R>(\n  services: Effect.Effect<PhonePersistenceServices, E, R>,\n) =>\n  Layer.unwrap(\n    Effect.map(services, (value) =>\n      Layer.mergeAll(\n        Layer.succeed(PhonePersistence, value.phonePersistence),\n        Layer.succeed(PhoneAdmission, value.phoneAdmission),\n        Layer.succeed(PhoneSignInTargets, value.phoneSignInTargets),\n      ),\n    ),\n  );\n"],"mappings":";;;;;AAYA,MAAM,eAAe,OAAO,0BAA0B;AAOtD,MAAa,+BAcX,YAEA,OAAO,OAAO,GACX,eAAe,OAAO,OAAO;CAC5B,GAAG;CACH,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;CAC7C,QAAQ,OAAO,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC;CAC3C,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACnD,cAAc,OAAO,OAAO,EAAE,GAAG,QAAQ,aAAa,CAAC;CACvD,WAAW,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,CAAC;CACjD,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,WAAW,CAAC;CACnD,cAAc,OAAO,OAAO,EAAE,GAAG,QAAQ,aAAa,CAAC;CACvD,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,QAAQ,CAAC;CAC7C,aAAa,OAAO,OAAO,EAAE,GAAG,QAAQ,YAAY,CAAC;CACrD,WAAW,OAAO,OAAO;EACvB,GAAG,QAAQ;EACX,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,WAAW,CAAC;EAC7D,GAAI,QAAQ,UAAU,YAAY,KAAA,IAC9B,CAAC,IACD,EAAE,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,QAAQ,CAAC,EAAE;EAC/D,GAAI,QAAQ,UAAU,eAAe,KAAA,IACjC,CAAC,IACD,EAAE,YAAY,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,WAAW,CAAC,EAAE;EACrE,GAAI,QAAQ,UAAU,cAAc,KAAA,IAChC,CAAC,IACD,EAAE,WAAW,OAAO,OAAO,EAAE,GAAG,QAAQ,UAAU,UAAU,CAAC,EAAE;CACrE,CAAC;CACD,GAAI,QAAQ,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,OAAO,OAAO,EAAE,GAAG,QAAQ,GAAG,CAAC,EAAE;AAC7E,CAAC,EACH,CAAC;;AAGH,MAAa,eAAe,YAAyC,QAAQ;AAI7E,MAAa,2BAA2B;CACtC,SAAS;CACT,YAAY;CACZ,YAAY;CACZ,OAAO;AACT;AAmGA,MAAa,yBACX,aAEA,MAAM,OACJ,OAAO,IAAI,WAAW,UACpB,MAAM,SACJ,MAAM,QAAQ,kBAAkB,MAAM,gBAAgB,GACtD,MAAM,QAAQ,gBAAgB,MAAM,cAAc,GAClD,MAAM,QAAQ,oBAAoB,MAAM,kBAAkB,CAC5D,CACF,CACF"}

package/dist/drizzle/phone-state.mjs

@@ -0,0 +1,426 @@
+import { AuthenticationRequirement, SecurityRevision } from "../sessions/models.mjs";
+import { both, makeTransactionRows } from "./transaction-owner.mjs";
+import { digest, randomId } from "../totp/crypto.mjs";
+import { PhoneCredentialSnapshot, PhoneOtpUnavailable } from "../phone/models.mjs";
+import { PhoneCommandId, PhoneCustody, PhoneLifecycleAction, PhoneLifecyclePolicy, PhoneLifecycleTarget } from "../phone/lifecycleModels.mjs";
+import { Context, Effect, Option, Schema } from "effect";
+import { sql } from "drizzle-orm";
+//#region src/drizzle/phone-state.ts
+const unavailable = () => PhoneOtpUnavailable.make({});
+const invariant = (value) => {
+	if (!value) throw unavailable();
+};
+var CurrentPhoneTransaction = class extends Context.Service()("effect-auth/drizzle/CurrentPhoneTransaction") {};
+const { equal, copiedRow, col } = makeTransactionRows(unavailable);
+const AdmissionReceipt = Schema.Struct({
+	fingerprint: Schema.NonEmptyString,
+	network: Schema.NonEmptyString,
+	accepted: Schema.Boolean,
+	expiresAtMillis: Schema.Natural
+});
+const AdmissionCounter = Schema.Struct({
+	window: Schema.Natural,
+	count: Schema.Natural
+});
+const CommandRecord = Schema.Struct({
+	commandId: PhoneCommandId,
+	action: PhoneLifecycleAction
+});
+const State = Schema.Union([
+	PhoneCustody,
+	AdmissionReceipt,
+	AdmissionCounter,
+	CommandRecord
+]);
+const storageCodec = Schema.fromJsonString(Schema.Struct({
+	moduleId: Schema.NonEmptyString,
+	record: State
+}));
+const readStored = (mapping, payload, schema) => {
+	const stored = Schema.decodeSync(storageCodec)(payload);
+	invariant(stored.moduleId === mapping.moduleId && Schema.is(schema)(stored.record));
+	return stored.record;
+};
+const stringTuple = Schema.fromJsonString(Schema.Array(Schema.String));
+const scope = (moduleId, kind, key) => digest(Schema.encodeSync(stringTuple)([
+	"effect-auth/phone/v1",
+	moduleId,
+	kind,
+	key
+]));
+const rejected = { _tag: "Rejected" };
+const stateRead = Effect.fn("PhoneNative.stateRead")(function* (mapping, key) {
+	return yield* (yield* CurrentPhoneTransaction).read(mapping.state.table, equal(mapping.state.table, { [mapping.state.scope]: key }), { limit: 1 });
+});
+const stateWrite = Effect.fn("PhoneNative.stateWrite")(function* (mapping, key, value, observed) {
+	const owner = yield* CurrentPhoneTransaction;
+	const values = {
+		[mapping.state.state]: Schema.encodeSync(storageCodec)({
+			moduleId: mapping.moduleId,
+			record: value
+		}),
+		[mapping.state.version]: randomId()
+	};
+	if (observed.rows.length === 0) observed.rows = (yield* owner.insert(mapping.state.table, {
+		...copiedRow(mapping.state.encodeInsert({
+			scope: key,
+			state: values[mapping.state.state],
+			version: values[mapping.state.version]
+		})),
+		[mapping.state.scope]: key,
+		...values
+	}, { [mapping.state.scope]: key })).rows;
+	else yield* owner.update(mapping.state.table, { [mapping.state.scope]: key }, values);
+});
+const custodyRead = Effect.fn("PhoneNative.custodyRead")(function* (mapping, phoneNumber) {
+	const key = scope(mapping.moduleId, "custody", phoneNumber), observation = yield* stateRead(mapping, key);
+	const custody = observation.rows.length === 0 ? null : readStored(mapping, observation.rows[0][mapping.state.state], PhoneCustody);
+	invariant(custody === null || custody.phoneNumber === phoneNumber);
+	return {
+		key,
+		observation,
+		custody
+	};
+});
+const capturePhone = Effect.fn("PhoneNative.capture")(function* (mapping, input) {
+	const owner = yield* CurrentPhoneTransaction;
+	const destination = yield* custodyRead(mapping, input.phoneNumber);
+	const source = input.sourcePhoneNumber === void 0 ? null : yield* custodyRead(mapping, input.sourcePhoneNumber);
+	const id = input.subjectId ?? destination.custody?.subjectId;
+	const subject = id === void 0 ? null : yield* owner.read(mapping.subject.table, equal(mapping.subject.table, { [mapping.subject.id]: mapping.subjectIds.toNative(id) }), { limit: 1 });
+	const row = subject?.rows[0];
+	const active = row !== void 0 && (yield* owner.check(sql`exists(select 1 from ${mapping.subject.table} where ${both(owner.exact(mapping.subject.table, row), mapping.subject.activeCondition)})`));
+	const targetIdentifier = yield* owner.read(mapping.identifier.table, equal(mapping.identifier.table, {
+		[mapping.identifier.namespace]: "phone",
+		[mapping.identifier.value]: input.phoneNumber
+	}), { limit: 1 });
+	let eligible = input.action === "register" ? destination.custody === null && targetIdentifier.rows.length === 0 : active && input.subjectId === id && (destination.custody === null && targetIdentifier.rows.length === 0 || destination.custody?.subjectId === id && destination.custody?.state === "unverified");
+	if (input.action === "change") eligible = eligible && input.sourcePhoneNumber !== input.phoneNumber && source?.custody?.subjectId === id && source?.custody?.state === "verified";
+	const credentials = [];
+	for (const custody of [destination.custody, source?.custody]) if (custody !== null && custody !== void 0 && custody.state === "verified" && custody.subjectId === id) {
+		const c = mapping.credential;
+		const cr = (yield* owner.read(c.table, equal(c.table, {
+			[c.id]: custody.credentialId,
+			[c.subjectId]: mapping.subjectIds.toNative(id)
+		}), { limit: 1 })).rows[0];
+		if (cr === void 0 || cr[c.revision] !== custody.credentialRevision || !(yield* owner.check(sql`exists(select 1 from ${c.table} where ${both(owner.exact(c.table, cr), c.activeCondition)})`))) eligible = false;
+		else credentials.push({
+			credentialId: custody.credentialId,
+			revision: custody.credentialRevision
+		});
+	}
+	return {
+		target: {
+			phoneNumber: input.phoneNumber,
+			custody: destination.custody,
+			source: source?.custody ?? null,
+			revision: active ? {
+				subjectId: id,
+				securityRevision: SecurityRevision.make(row[mapping.subject.securityRevision]),
+				credentials
+			} : null,
+			eligible
+		},
+		destination,
+		source,
+		subject,
+		subjectRow: row,
+		targetIdentifier
+	};
+});
+const lookupPhone = Effect.fn("PhoneNative.lookup")(function* (mapping, input) {
+	invariant(input.moduleId === mapping.moduleId);
+	const captured = yield* capturePhone(mapping, {
+		action: "verify",
+		phoneNumber: input.phoneNumber
+	});
+	const { custody, revision } = captured.target;
+	if (custody === null || custody.state !== "verified" || custody.verifiedAtMillis === null || revision === null || !revision.credentials.some((c) => c.credentialId === custody.credentialId)) return Option.none();
+	const owner = yield* CurrentPhoneTransaction, i = mapping.identifier, row = captured.targetIdentifier.rows[0];
+	if (row === void 0 || row[i.revision] !== custody.custodyRevision || !(yield* owner.check(sql`exists(select 1 from ${i.table} where ${both(owner.exact(i.table, row), equal(i.table, { [i.subjectId]: mapping.subjectIds.toNative(custody.subjectId) }), i.activeCondition)})`))) return Option.none();
+	return Option.some(Schema.decodeSync(PhoneCredentialSnapshot)({
+		moduleId: mapping.moduleId,
+		phoneNumber: input.phoneNumber,
+		custodyRevision: custody.custodyRevision,
+		verifiedAtMillis: custody.verifiedAtMillis,
+		credentialId: custody.credentialId,
+		credentialRevision: custody.credentialRevision,
+		revision
+	}));
+});
+const admitPhone = Effect.fn("PhoneNative.admit")(function* (mapping, input) {
+	invariant(input.moduleId === mapping.moduleId && Number.isSafeInteger(input.replayLifetimeMillis) && input.replayLifetimeMillis >= 0 && input.networkKey.length > 0 && input.networkKey.length <= 1024 && input.requestId.length > 0 && input.requestId.length <= 256);
+	const owner = yield* CurrentPhoneTransaction, now = yield* owner.now(mapping), policy = mapping.admission;
+	const key = scope(mapping.moduleId, "admission", input.action + "/" + input.requestId), receipt = yield* stateRead(mapping, key);
+	if (receipt.rows.length !== 0) {
+		const saved = readStored(mapping, receipt.rows[0][mapping.state.state], AdmissionReceipt);
+		if (saved.expiresAtMillis > now) owner.postconditions.push(sql`${mapping.engineNowMillis} < ${saved.expiresAtMillis}`);
+		return saved.fingerprint === input.fingerprint && saved.network === digest(input.networkKey) && saved.accepted === true && saved.expiresAtMillis > now;
+	}
+	const window = Math.floor(now / policy.windowMillis), entries = [{
+		key: scope(mapping.moduleId, "network", input.action + "/" + digest(input.networkKey)),
+		limit: input.action === "request" ? policy.networkRequests : policy.networkAttempts
+	}, ...input.action === "request" ? [{
+		key: scope(mapping.moduleId, "messages", "global"),
+		limit: policy.maximumMessages
+	}] : []].sort((a, b) => a.key.localeCompare(b.key));
+	const updates = [];
+	let accepted = true;
+	for (const entry of entries) {
+		const observed = yield* stateRead(mapping, entry.key), previous = observed.rows.length === 0 ? void 0 : readStored(mapping, observed.rows[0][mapping.state.state], AdmissionCounter);
+		const count = previous?.window === window ? previous.count : 0;
+		if (count >= entry.limit) accepted = false;
+		updates.push({
+			...entry,
+			observed,
+			count
+		});
+	}
+	if (accepted) for (const update of updates) yield* stateWrite(mapping, update.key, {
+		window,
+		count: update.count + 1
+	}, update.observed);
+	yield* stateWrite(mapping, key, {
+		fingerprint: input.fingerprint,
+		network: digest(input.networkKey),
+		accepted,
+		expiresAtMillis: now + Math.min(policy.requestRetentionMillis, input.replayLifetimeMillis)
+	}, receipt);
+	owner.postconditions.push(sql`${mapping.engineNowMillis} >= ${window * policy.windowMillis} and ${mapping.engineNowMillis} < ${(window + 1) * policy.windowMillis}`);
+	return accepted;
+});
+const preparePhoneMutation = Effect.fn("PhoneNative.prepareMutation")(function* (mapping, input) {
+	const owner = yield* CurrentPhoneTransaction;
+	invariant(input.moduleId === mapping.moduleId && Schema.encodeSync(Schema.fromJsonString(PhoneLifecyclePolicy))(input.policy) === Schema.encodeSync(Schema.fromJsonString(PhoneLifecyclePolicy))(mapping.policy));
+	const captured = yield* capturePhone(mapping, {
+		action: input.action,
+		phoneNumber: input.target.phoneNumber,
+		...input.target.revision === null ? {} : { subjectId: input.target.revision.subjectId },
+		...input.target.source === null ? {} : { sourcePhoneNumber: input.target.source.phoneNumber }
+	});
+	if (!captured.target.eligible || Schema.encodeSync(Schema.fromJsonString(PhoneLifecycleTarget))(captured.target) !== Schema.encodeSync(Schema.fromJsonString(PhoneLifecycleTarget))(input.target)) return { decision: rejected };
+	const binding = input.completion.input.binding;
+	if (input.completion.input.moduleId !== `${mapping.moduleId}/lifecycle` || input.completion.input.purpose !== "phone-lifecycle" || binding.identifier.namespace !== "phone" || binding.identifier.value !== input.target.phoneNumber) return { decision: rejected };
+	if (input.action === "register" ? binding._tag !== "Identifier" : binding._tag === "Identifier" || binding.revision.subjectId !== input.target.revision?.subjectId || binding.revision.securityRevision !== input.target.revision?.securityRevision) return { decision: rejected };
+	if (input.action === "verify" && binding._tag !== "Subject" || input.action === "change" && binding._tag !== "IdentifierChange") return { decision: rejected };
+	const commandKey = scope(mapping.moduleId, "command", input.commandId), command = yield* stateRead(mapping, commandKey);
+	if (command.rows.length !== 0) return { decision: rejected };
+	const now = yield* owner.now(mapping), guards = [];
+	const credentialGuards = [];
+	if (input.action !== "register") {
+		const authorization = input.authorization;
+		if (authorization === void 0) return { decision: rejected };
+		const { challenge, evidence } = authorization;
+		const revision = captured.target.revision;
+		if (challenge.moduleId !== mapping.moduleId || challenge.action !== input.action || challenge.commandId !== input.commandId || challenge.phoneNumber !== input.target.phoneNumber || challenge.sourcePhoneNumber !== input.target.source?.phoneNumber || challenge.flowId !== binding.flowId || challenge.bindingDigest !== binding.contextDigest || challenge.flowId !== evidence.flowId || challenge.bindingDigest !== evidence.bindingDigest || challenge.revision.subjectId !== revision.subjectId || challenge.revision.securityRevision !== revision.securityRevision || evidence.revision.subjectId !== revision.subjectId || evidence.revision.securityRevision !== revision.securityRevision) return { decision: rejected };
+		const c = mapping.credential;
+		for (const item of [...evidence.revision.credentials].sort((a, b) => a.credentialId.localeCompare(b.credentialId))) {
+			const row = (yield* owner.read(c.table, equal(c.table, {
+				[c.id]: item.credentialId,
+				[c.subjectId]: mapping.subjectIds.toNative(revision.subjectId)
+			}), { limit: 1 })).rows[0];
+			if (row === void 0 || row[c.revision] !== item.revision) return { decision: rejected };
+			const condition = sql`exists(select 1 from ${c.table} where ${both(owner.exact(c.table, row), c.activeCondition)})`;
+			if (!(yield* owner.check(condition))) return { decision: rejected };
+			credentialGuards.push({
+				id: item.credentialId,
+				condition
+			});
+		}
+		const proofs = evidence.proofs;
+		if (proofs.length === 0 || proofs.some((p) => !evidence.revision.credentials.some((c) => c.credentialId === p.credentialId))) return { decision: rejected };
+		const requirements = [
+			authorization.requirement,
+			authorization.actionRequirement,
+			...mapping.subject.decodeActionRequirement === void 0 ? [] : [Schema.decodeSync(AuthenticationRequirement)(mapping.subject.decodeActionRequirement(copiedRow(captured.subjectRow), input.action))],
+			Schema.decodeSync(AuthenticationRequirement)(mapping.subject.decodeRequirement(copiedRow(captured.subjectRow)))
+		];
+		const age = Math.min(input.policy.maximumEvidenceAgeMillis, ...requirements.map((r) => r.maximumAgeMillis)), factors = new Set(proofs.flatMap((p) => p.factors)), credentials = new Set(proofs.map((p) => p.credentialId));
+		for (const requirement of requirements) if (!requirement.alternatives.some((a) => a.factors.every((f) => factors.has(f)) && credentials.size >= a.minimumCredentials && proofs.some((p) => (!a.userVerified || p.userVerified) && (!a.phishingResistant || p.phishingResistant)))) return { decision: rejected };
+		for (const proof of proofs) {
+			const at = proof.verifiedAt.epochMilliseconds;
+			if (at > now || now - at >= age) return { decision: rejected };
+			guards.push(sql`${mapping.engineNowMillis} >= ${at} and ${mapping.engineNowMillis} < ${at + age}`);
+		}
+	}
+	const subjectId = input.action === "register" ? mapping.subjectIds.toSubject(mapping.subjectIds.allocate()) : captured.target.revision.subjectId, nativeId = mapping.subjectIds.toNative(subjectId), securityRevision = SecurityRevision.make(randomId()), credentialRevision = SecurityRevision.make(randomId()), custodyRevision = SecurityRevision.make(randomId()), credentialId = captured.target.custody?.credentialId ?? randomId();
+	invariant(mapping.subjectIds.toSubject(nativeId) === subjectId);
+	const custody = {
+		phoneNumber: input.target.phoneNumber,
+		subjectId,
+		credentialId,
+		credentialRevision,
+		custodyRevision,
+		verifiedAtMillis: now,
+		state: "verified"
+	};
+	return {
+		decision: {
+			_tag: "Accepted",
+			credential: {
+				moduleId: mapping.moduleId,
+				phoneNumber: input.target.phoneNumber,
+				custodyRevision,
+				verifiedAtMillis: now,
+				credentialId,
+				credentialRevision,
+				revision: {
+					subjectId,
+					securityRevision,
+					credentials: [{
+						credentialId,
+						revision: credentialRevision
+					}]
+				}
+			}
+		},
+		mutate: Effect.gen(function* () {
+			if (input.action === "register") yield* owner.insert(mapping.subject.table, {
+				...copiedRow(mapping.subject.encodeInsert({
+					id: nativeId,
+					securityRevision,
+					phoneNumber: input.target.phoneNumber
+				})),
+				[mapping.subject.id]: nativeId,
+				[mapping.subject.securityRevision]: securityRevision
+			}, { [mapping.subject.id]: nativeId });
+			else yield* owner.update(mapping.subject.table, { [mapping.subject.id]: nativeId }, { [mapping.subject.securityRevision]: securityRevision });
+			const i = mapping.identifier, c = mapping.credential;
+			if (captured.source?.custody) {
+				const old = captured.source.custody;
+				const ir = yield* owner.read(i.table, equal(i.table, {
+					[i.namespace]: "phone",
+					[i.value]: old.phoneNumber,
+					[i.subjectId]: nativeId
+				}), { limit: 1 });
+				invariant(ir.rows.length === 1 && ir.rows[0][i.revision] === old.custodyRevision);
+				invariant(yield* owner.check(sql`exists(select 1 from ${i.table} where ${both(owner.exact(i.table, ir.rows[0]), i.activeCondition)})`));
+				yield* owner.update(i.table, {
+					[i.namespace]: "phone",
+					[i.value]: old.phoneNumber
+				}, {
+					[i.status]: i.encodeStatus(false),
+					[i.revision]: randomId()
+				});
+				yield* owner.update(c.table, {
+					[c.id]: old.credentialId,
+					[c.subjectId]: nativeId
+				}, {
+					[c.status]: c.encodeStatus(false),
+					[c.revision]: randomId()
+				});
+				yield* stateWrite(mapping, captured.source.key, {
+					...old,
+					state: "retired",
+					custodyRevision: SecurityRevision.make(randomId()),
+					credentialRevision: SecurityRevision.make(randomId())
+				}, captured.source.observation);
+			}
+			if (captured.targetIdentifier.rows.length === 0) {
+				const inserted = yield* owner.insert(i.table, {
+					...copiedRow(i.encodeInsert({
+						phoneNumber: input.target.phoneNumber,
+						subjectId: nativeId,
+						revision: custodyRevision,
+						verifiedAtMillis: now,
+						active: true
+					})),
+					[i.namespace]: "phone",
+					[i.value]: input.target.phoneNumber,
+					[i.subjectId]: nativeId,
+					[i.revision]: custodyRevision,
+					[i.verifiedAt]: mapping.encodeInstant(now),
+					[i.status]: i.encodeStatus(true)
+				}, {
+					[i.namespace]: "phone",
+					[i.value]: input.target.phoneNumber
+				});
+				captured.targetIdentifier.rows = inserted.rows;
+			} else {
+				const row = captured.targetIdentifier.rows[0];
+				invariant(yield* owner.check(sql`exists(select 1 from ${i.table} where ${both(owner.exact(i.table, row), equal(i.table, { [i.subjectId]: nativeId }))})`));
+				yield* owner.update(i.table, {
+					[i.namespace]: "phone",
+					[i.value]: input.target.phoneNumber
+				}, {
+					[i.revision]: custodyRevision,
+					[i.verifiedAt]: mapping.encodeInstant(now),
+					[i.status]: i.encodeStatus(true)
+				});
+			}
+			const credential = yield* owner.read(c.table, equal(c.table, { [c.id]: credentialId }), { limit: 1 });
+			if (credential.rows.length === 0) credential.rows = (yield* owner.insert(c.table, {
+				...copiedRow(c.encodeInsert({
+					credentialId,
+					subjectId: nativeId,
+					revision: credentialRevision,
+					active: true
+				})),
+				[c.id]: credentialId,
+				[c.subjectId]: nativeId,
+				[c.revision]: credentialRevision,
+				[c.status]: c.encodeStatus(true)
+			}, { [c.id]: credentialId })).rows;
+			else {
+				invariant(yield* owner.check(sql`exists(select 1 from ${c.table} where ${both(owner.exact(c.table, credential.rows[0]), equal(c.table, { [c.subjectId]: nativeId }))})`));
+				yield* owner.update(c.table, { [c.id]: credentialId }, {
+					[c.revision]: credentialRevision,
+					[c.status]: c.encodeStatus(true)
+				});
+			}
+			yield* stateWrite(mapping, captured.destination.key, custody, captured.destination.observation);
+			yield* stateWrite(mapping, commandKey, {
+				commandId: input.commandId,
+				action: input.action
+			}, command);
+			owner.postconditions.push(...guards, sql`exists(select 1 from ${i.table} where ${both(equal(i.table, {
+				[i.namespace]: "phone",
+				[i.value]: input.target.phoneNumber,
+				[i.subjectId]: nativeId,
+				[i.revision]: custodyRevision,
+				[i.verifiedAt]: mapping.encodeInstant(now)
+			}), i.activeCondition)})`, ...captured.source?.custody === null || captured.source?.custody === void 0 ? [] : [sql`not exists(select 1 from ${i.table} where ${both(equal(i.table, {
+				[i.namespace]: "phone",
+				[i.value]: captured.source.custody.phoneNumber
+			}), i.activeCondition)})`, sql`not exists(select 1 from ${c.table} where ${both(equal(c.table, { [c.id]: captured.source.custody.credentialId }), c.activeCondition)})`], ...credentialGuards.filter((g) => g.id !== captured.source?.custody?.credentialId && g.id !== credentialId).map((g) => g.condition), sql`exists(select 1 from ${c.table} where ${both(equal(c.table, {
+				[c.id]: credentialId,
+				[c.subjectId]: nativeId,
+				[c.revision]: credentialRevision
+			}), c.activeCondition)})`, sql`exists(select 1 from ${mapping.subject.table} where ${both(equal(mapping.subject.table, {
+				[mapping.subject.id]: nativeId,
+				[mapping.subject.securityRevision]: securityRevision
+			}), mapping.subject.activeCondition)})`);
+			return true;
+		}),
+		appliedCondition: sql`exists(select 1 from ${mapping.state.table} where ${equal(mapping.state.table, { [mapping.state.scope]: commandKey })})`
+	};
+});
+/** Bounded cursor cleanup never removes custody or semantic-command tombstones. */
+const cleanupPhoneAdmission = Effect.fn("PhoneNative.cleanupAdmission")(function* (mapping, input) {
+	invariant(input.moduleId === mapping.moduleId && Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 1e3);
+	const owner = yield* CurrentPhoneTransaction, now = yield* owner.now(mapping), state = mapping.state;
+	const observed = yield* owner.read(state.table, input.after === void 0 ? sql`1=1` : sql`${col(state.table, state.scope)} > ${input.after}`, {
+		limit: input.limit,
+		takeOnly: true,
+		orderBy: col(state.table, state.scope)
+	});
+	let deleted = 0;
+	const rows = [...observed.rows];
+	for (const row of rows) {
+		const stored = Schema.decodeSync(storageCodec)(row[state.state]);
+		if (stored.moduleId !== mapping.moduleId) continue;
+		const record = stored.record;
+		if (Schema.is(AdmissionReceipt)(record) && record.expiresAtMillis <= now || Schema.is(AdmissionCounter)(record) && (record.window + 1) * mapping.admission.windowMillis <= now) {
+			yield* owner.remove(state.table, { [state.scope]: row[state.scope] });
+			deleted++;
+		}
+	}
+	return {
+		deleted,
+		nextCursor: rows.length === input.limit ? String(rows[rows.length - 1][state.scope]) : null
+	};
+});
+//#endregion
+export { CurrentPhoneTransaction, admitPhone, capturePhone, cleanupPhoneAdmission, col, copiedRow, equal, invariant, lookupPhone, preparePhoneMutation, unavailable };
+
+//# sourceMappingURL=phone-state.mjs.map