@yielded/auth 0.1.0-beta.1

package/dist/drizzle/sqlite.mjs

@@ -0,0 +1,220 @@
+import { VerifiedEmail } from "../Schema.mjs";
+import { reportPersistenceFailure } from "../internal/diagnostics.mjs";
+import { AuthRateLimited, AuthStoreError, InvalidRegistration } from "../Errors.mjs";
+import { AuthStoreDecisions } from "../internal/AuthStoreDecisions.mjs";
+import { AuthStore, EmailOtpRejected } from "../AuthStore.mjs";
+import { InvalidOAuthState } from "../oauth/errors.mjs";
+import { OAuthStateStore } from "../oauth/OAuthStateStore.mjs";
+import { column, requireStandaloneConsume, updateValues } from "./model.mjs";
+import { OAuthStateDecisions } from "../oauth/OAuthStateDecisions.mjs";
+import { Cause, Context, DateTime, Duration, Effect, Schema } from "effect";
+import { and, eq, gt, lt, lte, ne, or, sql } from "drizzle-orm";
+//#region src/drizzle/sqlite.ts
+const storeReadError = () => AuthStoreError.make({ message: "Auth store read failed" });
+const storeWriteError = () => AuthStoreError.make({ message: "Auth store write failed" });
+const isStoreFailure = Schema.is(AuthStoreError);
+const mapStoreFailure = (failure) => (effect) => reportPersistenceFailure(effect, isStoreFailure).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, failure))));
+const mapStoreReadFailure = mapStoreFailure(storeReadError);
+const mapStoreWriteFailure = mapStoreFailure(storeWriteError);
+const selected = (row) => row;
+/**
+* Shared SQLite semantics for libSQL, Node, Bun, WASM, Durable Objects and D1.
+* Every mutation here is one conditional statement, so D1 never reaches its
+* unsupported interactive transaction and Durable Objects never suspend in a
+* transactionSync callback.
+*/
+const makeSqliteAuthStoreServices = (database, mapping, standaloneGuard) => {
+	const db = database;
+	const requireStandalone = standaloneGuard ?? Effect.suspend(() => db.$client === void 0 ? AuthStoreError.make({ message: "Use a root auth store or its decision transaction API" }) : requireStandaloneConsume({ $client: db.$client }));
+	const challengeTable = mapping.challenge.table;
+	const challengeColumns = mapping.challenge.columns;
+	const challenge = {
+		challengeId: column(challengeTable, challengeColumns.challengeId),
+		tokenDigest: column(challengeTable, challengeColumns.tokenDigest),
+		namespace: column(challengeTable, challengeColumns.namespace),
+		value: column(challengeTable, challengeColumns.value),
+		purpose: column(challengeTable, challengeColumns.purpose),
+		otpKeyId: column(challengeTable, challengeColumns.otpKeyId),
+		otpDigest: column(challengeTable, challengeColumns.otpDigest),
+		issuedAt: column(challengeTable, challengeColumns.issuedAt),
+		expiresAt: column(challengeTable, challengeColumns.expiresAt),
+		attemptLimit: column(challengeTable, challengeColumns.attemptLimit),
+		failedAttempts: column(challengeTable, challengeColumns.failedAttempts),
+		consumed: column(challengeTable, challengeColumns.consumed)
+	};
+	const registrationTable = mapping.registration.table;
+	const registrationColumns = mapping.registration.columns;
+	const registration = {
+		tokenDigest: column(registrationTable, registrationColumns.tokenDigest),
+		expiresAt: column(registrationTable, registrationColumns.expiresAt),
+		consumed: column(registrationTable, registrationColumns.consumed)
+	};
+	const issueChallenge = Effect.fn("DrizzleSqliteAuthStore.issueChallenge")(function* (input) {
+		const now = yield* DateTime.now;
+		const cooldownCutoff = DateTime.mapEpochMillis(now, (millis) => millis - Duration.toMillis(input.resendCooldown));
+		if ((yield* Effect.suspend(() => {
+			const values = mapping.challenge.encodeInsert(input, {
+				namespace: mapping.challenge.identifierNamespace,
+				failedAttempts: 0,
+				consumed: false
+			});
+			const nativeNow = mapping.challenge.encodeInstant(now);
+			const nativeCutoff = mapping.challenge.encodeInstant(cooldownCutoff);
+			const nativeIssuedAt = mapping.challenge.encodeInstant(input.issuedAt);
+			const preservedAttempts = sql`case when ${gt(challenge.expiresAt, nativeNow)} then ${challenge.failedAttempts} else 0 end`;
+			const update = mapping.challenge.encodeUpdate(input, {
+				namespace: mapping.challenge.identifierNamespace,
+				failedAttempts: preservedAttempts,
+				consumed: false
+			});
+			return db.insert(challengeTable).values(values).onConflictDoUpdate({
+				target: [
+					challenge.namespace,
+					challenge.value,
+					challenge.purpose
+				],
+				set: update,
+				setWhere: and(ne(challenge.challengeId, input.challengeId), lt(challenge.issuedAt, nativeIssuedAt), or(eq(challenge.consumed, true), lte(challenge.issuedAt, nativeCutoff)))
+			}).returning();
+		}).pipe(mapStoreWriteFailure)).length > 0) return;
+		const existing = yield* Effect.suspend(() => db.select().from(challengeTable).where(and(eq(challenge.namespace, mapping.challenge.identifierNamespace), eq(challenge.value, input.email), eq(challenge.purpose, input.purpose))).limit(1)).pipe(mapStoreReadFailure);
+		const decoded = existing[0] === void 0 ? void 0 : yield* Effect.suspend(() => mapping.challenge.decode(selected(existing[0]))).pipe(mapStoreReadFailure);
+		const retryAfterSeconds = decoded === void 0 ? Math.max(1, Math.ceil(Duration.toMillis(input.resendCooldown) / 1e3)) : Math.max(1, Math.ceil((DateTime.toEpochMillis(decoded.challenge.issuedAt) + Duration.toMillis(input.resendCooldown) - DateTime.toEpochMillis(now)) / 1e3));
+		return yield* AuthRateLimited.make({ retryAfterSeconds });
+	});
+	const consumeChallengeDecision = Effect.fn("DrizzleSqliteAuthStore.consumeChallengeDecision")(function* (input) {
+		const now = yield* DateTime.now;
+		const alternatives = Object.entries(input.otpDigests).map(([keyId, digest]) => and(eq(challenge.otpKeyId, keyId), eq(challenge.otpDigest, digest)));
+		const matches = alternatives.length === 0 ? sql`false` : or(...alternatives);
+		const rows = yield* Effect.suspend(() => db.update(challengeTable).set(updateValues([[challengeColumns.consumed, sql`case when ${matches} then true else ${challenge.consumed} end`], [challengeColumns.failedAttempts, sql`${challenge.failedAttempts} + case when ${matches} then 0 else 1 end`]])).where(and(eq(challenge.tokenDigest, input.tokenDigest), eq(challenge.consumed, false), gt(challenge.expiresAt, mapping.challenge.encodeInstant(now)), sql`${challenge.failedAttempts} < ${challenge.attemptLimit}`)).returning()).pipe(mapStoreWriteFailure);
+		if (rows[0] === void 0) return {
+			_tag: "rejected",
+			reason: "missing_challenge"
+		};
+		const decoded = yield* Effect.suspend(() => mapping.challenge.decode(selected(rows[0]))).pipe(mapStoreReadFailure);
+		if (!decoded.consumed) return {
+			_tag: "rejected",
+			reason: "bad_code"
+		};
+		return {
+			_tag: "accepted",
+			value: VerifiedEmail.make({
+				email: decoded.challenge.email,
+				purpose: decoded.challenge.purpose
+			})
+		};
+	});
+	const consumeChallenge = Effect.fn("DrizzleSqliteAuthStore.consumeChallenge")(function* (input) {
+		yield* requireStandalone;
+		const decision = yield* consumeChallengeDecision(input);
+		return decision._tag === "accepted" ? decision.value : yield* EmailOtpRejected.make({ reason: decision.reason });
+	});
+	const issueRegistration = Effect.fn("DrizzleSqliteAuthStore.issueRegistration")(function* (input) {
+		yield* Effect.suspend(() => db.insert(registrationTable).values(mapping.registration.encodeInsert(input, false))).pipe(mapStoreWriteFailure);
+	});
+	const inspectRegistration = Effect.fn("DrizzleSqliteAuthStore.inspectRegistration")(function* (tokenDigest) {
+		const now = yield* DateTime.now;
+		const rows = yield* Effect.suspend(() => db.select().from(registrationTable).where(and(eq(registration.tokenDigest, tokenDigest), eq(registration.consumed, false), gt(registration.expiresAt, mapping.registration.encodeInstant(now)))).limit(1)).pipe(mapStoreReadFailure);
+		if (rows[0] === void 0) return yield* InvalidRegistration.make();
+		return (yield* Effect.suspend(() => mapping.registration.decode(selected(rows[0]))).pipe(mapStoreReadFailure)).registration;
+	});
+	const consumeRegistrationDecision = Effect.fn("DrizzleSqliteAuthStore.consumeRegistrationDecision")(function* (input) {
+		const now = yield* DateTime.now;
+		return (yield* Effect.suspend(() => db.update(registrationTable).set(updateValues([[registrationColumns.consumed, true]])).where(and(eq(registration.tokenDigest, input.tokenDigest), eq(registration.consumed, false), gt(registration.expiresAt, mapping.registration.encodeInstant(now)))).returning({ consumed: registration.consumed })).pipe(mapStoreWriteFailure)).length === 0 ? { _tag: "rejected" } : {
+			_tag: "accepted",
+			value: void 0
+		};
+	});
+	const consumeRegistration = Effect.fn("DrizzleSqliteAuthStore.consumeRegistration")(function* (input) {
+		yield* requireStandalone;
+		if ((yield* consumeRegistrationDecision(input))._tag === "rejected") return yield* InvalidRegistration.make();
+	});
+	return {
+		authStore: AuthStore.of({
+			issueChallenge,
+			consumeChallenge,
+			issueRegistration,
+			inspectRegistration,
+			consumeRegistration
+		}),
+		decisions: {
+			consumeChallenge: consumeChallengeDecision,
+			consumeRegistration: consumeRegistrationDecision
+		}
+	};
+};
+const makeSqliteOAuthStateServices = (database, mapping, standaloneGuard) => {
+	const db = database;
+	const requireStandalone = standaloneGuard ?? Effect.suspend(() => db.$client === void 0 ? AuthStoreError.make({ message: "Use a root auth store or its decision transaction API" }) : requireStandaloneConsume({ $client: db.$client }));
+	const stateTable = mapping.oauthState.table;
+	const stateColumns = mapping.oauthState.columns;
+	const state = {
+		stateDigest: column(stateTable, stateColumns.stateDigest),
+		expiresAt: column(stateTable, stateColumns.expiresAt),
+		consumed: column(stateTable, stateColumns.consumed)
+	};
+	const issue = Effect.fn("DrizzleSqliteOAuthStateStore.issue")(function* (input) {
+		yield* Effect.suspend(() => db.insert(stateTable).values(mapping.oauthState.encodeInsert(input, false))).pipe(mapStoreWriteFailure);
+	});
+	const consumeDecision = Effect.fn("DrizzleSqliteOAuthStateStore.consumeDecision")(function* (digest) {
+		const now = yield* DateTime.now;
+		const rows = yield* Effect.suspend(() => db.update(stateTable).set(updateValues([[stateColumns.consumed, true]])).where(and(eq(state.stateDigest, digest), eq(state.consumed, false), gt(state.expiresAt, mapping.oauthState.encodeInstant(now)))).returning()).pipe(mapStoreWriteFailure);
+		if (rows[0] === void 0) return { _tag: "rejected" };
+		return {
+			_tag: "accepted",
+			value: (yield* Effect.suspend(() => mapping.oauthState.decode(selected(rows[0]))).pipe(mapStoreReadFailure)).state
+		};
+	});
+	const consume = Effect.fn("DrizzleSqliteOAuthStateStore.consume")(function* (digest) {
+		yield* requireStandalone;
+		const decision = yield* consumeDecision(digest);
+		return decision._tag === "accepted" ? decision.value : yield* InvalidOAuthState.make();
+	});
+	return {
+		oauthStateStore: OAuthStateStore.of({
+			issue,
+			consume
+		}),
+		decisions: { consumeOAuthState: consumeDecision }
+	};
+};
+const makeSqliteAuthServices = (database, mapping, standaloneGuard) => {
+	const auth = makeSqliteAuthStoreServices(database, mapping, standaloneGuard);
+	const oauth = makeSqliteOAuthStateServices(database, mapping, standaloneGuard);
+	return {
+		...auth,
+		...oauth,
+		decisions: {
+			...auth.decisions,
+			...oauth.decisions
+		}
+	};
+};
+function coordinateSqliteAuthStoreTransaction(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => database.transaction((transaction) => {
+		const decisions = makeSqliteAuthStoreServices(transaction, options.mapping).decisions;
+		const provided = Context.make(AuthStoreDecisions, decisions);
+		const work = Effect.provideContext(body, provided);
+		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+	}));
+}
+function coordinateSqliteOAuthStateTransaction(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => database.transaction((transaction) => {
+		const decisions = makeSqliteOAuthStateServices(transaction, options.mapping).decisions;
+		const provided = Context.make(OAuthStateDecisions, decisions);
+		const work = Effect.provideContext(body, provided);
+		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+	}));
+}
+function coordinateSqliteAuthTransaction(acquire, options, body) {
+	return Effect.flatMap(acquire, (database) => database.transaction((transaction) => {
+		const decisions = makeSqliteAuthServices(transaction, options.mapping).decisions;
+		const provided = Context.make(AuthStoreDecisions, decisions).pipe(Context.add(OAuthStateDecisions, decisions));
+		const work = Effect.provideContext(body, provided);
+		return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+	}));
+}
+//#endregion
+export { coordinateSqliteAuthStoreTransaction, coordinateSqliteAuthTransaction, coordinateSqliteOAuthStateTransaction, makeSqliteAuthServices, makeSqliteAuthStoreServices, makeSqliteOAuthStateServices };
+
+//# sourceMappingURL=sqlite.mjs.map

package/dist/drizzle/sqlite.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.mjs","names":[],"sources":["../../src/drizzle/sqlite.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- Drizzle's generic query builders lose the concrete consumer table through a runtime column map. Assertions stay in this adapter. */\nimport {\n  and,\n  eq,\n  gt,\n  lt,\n  lte,\n  ne,\n  or,\n  sql,\n  type AnyRelations,\n  type InferSelectModel,\n} from \"drizzle-orm\";\nimport type { QueryEffectHKTBase } from \"drizzle-orm/effect-core\";\nimport type { SQLiteColumn, AnySQLiteTable } from \"drizzle-orm/sqlite-core\";\nimport type { SQLiteEffectDatabase } from \"drizzle-orm/sqlite-core/effect/db\";\nimport { Cause, Context, DateTime, Duration, Effect, Schema } from \"effect\";\nimport type { SqlError } from \"effect/unstable/sql/SqlError\";\n\nimport { AuthStore, EmailOtpRejected } from \"../AuthStore\";\nimport { AuthRateLimited, AuthStoreError, InvalidRegistration } from \"../Errors\";\nimport { AuthStoreDecisions } from \"../internal/AuthStoreDecisions\";\nimport { reportPersistenceFailure } from \"../internal/diagnostics\";\nimport { InvalidOAuthState } from \"../oauth/errors\";\nimport { OAuthStateDecisions } from \"../oauth/OAuthStateDecisions\";\nimport { OAuthStateStore } from \"../oauth/OAuthStateStore\";\nimport type { OAuthState } from \"../oauth/schema\";\nimport {\n  VerifiedEmail,\n  type ConsumeChallenge,\n  type ConsumeRegistration,\n  type NewChallenge,\n  type NewRegistration,\n  type TokenDigest,\n} from \"../Schema\";\nimport {\n  column,\n  requireStandaloneConsume,\n  updateValues,\n  type AuthTables,\n  type AuthStoreTables,\n  type ChallengeConsumeDecision,\n  type ConsumeDecision,\n  type OAuthStateTables,\n} from \"./model\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\ntype AnyDatabase = SQLiteEffectDatabase<any, any, AnyRelations>;\ntype ClosedQueryEffectHKT = QueryEffectHKTBase & { readonly context: never };\ntype RuntimeDatabase<HKT extends ClosedQueryEffectHKT, RunResult> = SQLiteEffectDatabase<\n  HKT,\n  RunResult,\n  AnyRelations\n> &\n  Partial<Parameters<typeof requireStandaloneConsume>[0]>;\ntype TransactionOf<D extends AnyDatabase> = Parameters<Parameters<D[\"transaction\"]>[0]>[0];\n\nconst storeReadError = () => AuthStoreError.make({ message: \"Auth store read failed\" });\nconst storeWriteError = () => AuthStoreError.make({ message: \"Auth store write failed\" });\nconst isStoreFailure = Schema.is(AuthStoreError);\n\nconst mapStoreFailure =\n  (failure: () => AuthStoreError) =>\n  <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, AuthStoreError, R> =>\n    reportPersistenceFailure(effect, isStoreFailure).pipe(\n      Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, failure))),\n    );\n\nconst mapStoreReadFailure = mapStoreFailure(storeReadError);\nconst mapStoreWriteFailure = mapStoreFailure(storeWriteError);\n\nconst selected = <T extends AnySQLiteTable>(row: unknown): InferSelectModel<T> =>\n  row as InferSelectModel<T>;\n\n/**\n * Shared SQLite semantics for libSQL, Node, Bun, WASM, Durable Objects and D1.\n * Every mutation here is one conditional statement, so D1 never reaches its\n * unsupported interactive transaction and Durable Objects never suspend in a\n * transactionSync callback.\n */\nexport const makeSqliteAuthStoreServices = <\n  C extends AnySQLiteTable,\n  R extends AnySQLiteTable,\n  HKT extends ClosedQueryEffectHKT = ClosedQueryEffectHKT,\n  RunResult = unknown,\n>(\n  database: SQLiteEffectDatabase<HKT, RunResult, AnyRelations>,\n  mapping: AuthStoreTables<C, R>,\n  standaloneGuard?: Effect.Effect<void, AuthStoreError>,\n) => {\n  const db = database as RuntimeDatabase<HKT, RunResult>;\n\n  const requireStandalone =\n    standaloneGuard ??\n    Effect.suspend(() =>\n      db.$client === undefined\n        ? AuthStoreError.make({ message: \"Use a root auth store or its decision transaction API\" })\n        : requireStandaloneConsume({ $client: db.$client }),\n    );\n\n  const challengeTable = mapping.challenge.table;\n  const challengeColumns = mapping.challenge.columns;\n\n  const challenge = {\n    challengeId: column(challengeTable, challengeColumns.challengeId),\n    tokenDigest: column(challengeTable, challengeColumns.tokenDigest),\n    namespace: column(challengeTable, challengeColumns.namespace),\n    value: column(challengeTable, challengeColumns.value),\n    purpose: column(challengeTable, challengeColumns.purpose),\n    otpKeyId: column(challengeTable, challengeColumns.otpKeyId),\n    otpDigest: column(challengeTable, challengeColumns.otpDigest),\n    issuedAt: column(challengeTable, challengeColumns.issuedAt),\n    expiresAt: column(challengeTable, challengeColumns.expiresAt),\n    attemptLimit: column(challengeTable, challengeColumns.attemptLimit),\n    failedAttempts: column(challengeTable, challengeColumns.failedAttempts),\n    consumed: column(challengeTable, challengeColumns.consumed),\n  } as Record<string, SQLiteColumn>;\n\n  const registrationTable = mapping.registration.table;\n  const registrationColumns = mapping.registration.columns;\n\n  const registration = {\n    tokenDigest: column(registrationTable, registrationColumns.tokenDigest),\n    expiresAt: column(registrationTable, registrationColumns.expiresAt),\n    consumed: column(registrationTable, registrationColumns.consumed),\n  } as Record<string, SQLiteColumn>;\n\n  const issueChallenge = Effect.fn(\"DrizzleSqliteAuthStore.issueChallenge\")(function* (\n    input: NewChallenge,\n  ) {\n    const now = yield* DateTime.now;\n\n    const cooldownCutoff = DateTime.mapEpochMillis(\n      now,\n      (millis) => millis - Duration.toMillis(input.resendCooldown),\n    );\n\n    const rows = (yield* Effect.suspend(() => {\n      const values = mapping.challenge.encodeInsert(input, {\n        namespace: mapping.challenge.identifierNamespace,\n        failedAttempts: 0,\n        consumed: false,\n      });\n\n      const nativeNow = mapping.challenge.encodeInstant(now);\n      const nativeCutoff = mapping.challenge.encodeInstant(cooldownCutoff);\n      const nativeIssuedAt = mapping.challenge.encodeInstant(input.issuedAt);\n      const preservedAttempts = sql`case when ${gt(challenge.expiresAt, nativeNow)} then ${challenge.failedAttempts} else 0 end`;\n\n      const update = mapping.challenge.encodeUpdate(input, {\n        namespace: mapping.challenge.identifierNamespace,\n        failedAttempts: preservedAttempts as any,\n        consumed: false,\n      });\n\n      return db\n        .insert(challengeTable as any)\n        .values(values as any)\n        .onConflictDoUpdate({\n          target: [challenge.namespace, challenge.value, challenge.purpose],\n          set: update as any,\n          setWhere: and(\n            ne(challenge.challengeId, input.challengeId),\n            lt(challenge.issuedAt, nativeIssuedAt),\n            or(eq(challenge.consumed, true), lte(challenge.issuedAt, nativeCutoff)),\n          ),\n        })\n        .returning();\n    }).pipe(mapStoreWriteFailure)) as ReadonlyArray<unknown>;\n\n    if (rows.length > 0) return;\n\n    const existing = (yield* Effect.suspend(() =>\n      db\n        .select()\n        .from(challengeTable as any)\n        .where(\n          and(\n            eq(challenge.namespace, mapping.challenge.identifierNamespace),\n            eq(challenge.value, input.email),\n            eq(challenge.purpose, input.purpose),\n          ),\n        )\n        .limit(1),\n    ).pipe(mapStoreReadFailure)) as ReadonlyArray<unknown>;\n\n    const decoded =\n      existing[0] === undefined\n        ? undefined\n        : yield* Effect.suspend(() => mapping.challenge.decode(selected<C>(existing[0]))).pipe(\n            mapStoreReadFailure,\n          );\n\n    const retryAfterSeconds =\n      decoded === undefined\n        ? Math.max(1, Math.ceil(Duration.toMillis(input.resendCooldown) / 1000))\n        : Math.max(\n            1,\n            Math.ceil(\n              (DateTime.toEpochMillis(decoded.challenge.issuedAt) +\n                Duration.toMillis(input.resendCooldown) -\n                DateTime.toEpochMillis(now)) /\n                1000,\n            ),\n          );\n\n    return yield* AuthRateLimited.make({ retryAfterSeconds });\n  });\n\n  const consumeChallengeDecision = Effect.fn(\"DrizzleSqliteAuthStore.consumeChallengeDecision\")(\n    function* (\n      input: ConsumeChallenge,\n    ): Effect.fn.Return<ChallengeConsumeDecision, AuthStoreError> {\n      const now = yield* DateTime.now;\n\n      const alternatives = Object.entries(input.otpDigests).map(([keyId, digest]) =>\n        and(eq(challenge.otpKeyId, keyId), eq(challenge.otpDigest, digest)),\n      );\n\n      const matches = alternatives.length === 0 ? sql<boolean>`false` : or(...alternatives)!;\n\n      const rows = (yield* Effect.suspend(() =>\n        db\n          .update(challengeTable as any)\n          .set(\n            updateValues<C>([\n              [\n                challengeColumns.consumed,\n                sql`case when ${matches} then true else ${challenge.consumed} end`,\n              ],\n              [\n                challengeColumns.failedAttempts,\n                sql`${challenge.failedAttempts} + case when ${matches} then 0 else 1 end`,\n              ],\n            ]) as any,\n          )\n          .where(\n            and(\n              eq(challenge.tokenDigest, input.tokenDigest),\n              eq(challenge.consumed, false),\n              gt(challenge.expiresAt, mapping.challenge.encodeInstant(now)),\n              sql`${challenge.failedAttempts} < ${challenge.attemptLimit}`,\n            ),\n          )\n          .returning(),\n      ).pipe(mapStoreWriteFailure)) as ReadonlyArray<unknown>;\n\n      if (rows[0] === undefined) {\n        return { _tag: \"rejected\", reason: \"missing_challenge\" };\n      }\n\n      const decoded = yield* Effect.suspend(() =>\n        mapping.challenge.decode(selected<C>(rows[0])),\n      ).pipe(mapStoreReadFailure);\n\n      if (!decoded.consumed) return { _tag: \"rejected\", reason: \"bad_code\" };\n\n      return {\n        _tag: \"accepted\",\n        value: VerifiedEmail.make({\n          email: decoded.challenge.email,\n          purpose: decoded.challenge.purpose,\n        }),\n      };\n    },\n  );\n\n  const consumeChallenge = Effect.fn(\"DrizzleSqliteAuthStore.consumeChallenge\")(function* (\n    input: ConsumeChallenge,\n  ) {\n    yield* requireStandalone;\n    const decision = yield* consumeChallengeDecision(input);\n\n    return decision._tag === \"accepted\"\n      ? decision.value\n      : yield* EmailOtpRejected.make({ reason: decision.reason });\n  });\n\n  const issueRegistration = Effect.fn(\"DrizzleSqliteAuthStore.issueRegistration\")(function* (\n    input: NewRegistration,\n  ) {\n    yield* Effect.suspend(() =>\n      db\n        .insert(registrationTable as any)\n        .values(mapping.registration.encodeInsert(input, false) as any),\n    ).pipe(mapStoreWriteFailure);\n  });\n\n  const inspectRegistration = Effect.fn(\"DrizzleSqliteAuthStore.inspectRegistration\")(function* (\n    tokenDigest: TokenDigest,\n  ) {\n    const now = yield* DateTime.now;\n\n    const rows = (yield* Effect.suspend(() =>\n      db\n        .select()\n        .from(registrationTable as any)\n        .where(\n          and(\n            eq(registration.tokenDigest, tokenDigest),\n            eq(registration.consumed, false),\n            gt(registration.expiresAt, mapping.registration.encodeInstant(now)),\n          ),\n        )\n        .limit(1),\n    ).pipe(mapStoreReadFailure)) as ReadonlyArray<unknown>;\n\n    if (rows[0] === undefined) return yield* InvalidRegistration.make();\n\n    const decoded = yield* Effect.suspend(() =>\n      mapping.registration.decode(selected<R>(rows[0])),\n    ).pipe(mapStoreReadFailure);\n\n    return decoded.registration;\n  });\n\n  const consumeRegistrationDecision = Effect.fn(\n    \"DrizzleSqliteAuthStore.consumeRegistrationDecision\",\n  )(function* (\n    input: ConsumeRegistration,\n  ): Effect.fn.Return<ConsumeDecision<void>, AuthStoreError> {\n    const now = yield* DateTime.now;\n\n    const rows = (yield* Effect.suspend(() =>\n      db\n        .update(registrationTable as any)\n        .set(updateValues<R>([[registrationColumns.consumed, true]]) as any)\n        .where(\n          and(\n            eq(registration.tokenDigest, input.tokenDigest),\n            eq(registration.consumed, false),\n            gt(registration.expiresAt, mapping.registration.encodeInstant(now)),\n          ),\n        )\n        .returning({ consumed: registration.consumed }),\n    ).pipe(mapStoreWriteFailure)) as ReadonlyArray<unknown>;\n\n    return rows.length === 0 ? { _tag: \"rejected\" } : { _tag: \"accepted\", value: undefined };\n  });\n\n  const consumeRegistration = Effect.fn(\"DrizzleSqliteAuthStore.consumeRegistration\")(function* (\n    input: ConsumeRegistration,\n  ) {\n    yield* requireStandalone;\n    const decision = yield* consumeRegistrationDecision(input);\n\n    if (decision._tag === \"rejected\") return yield* InvalidRegistration.make();\n  });\n\n  return {\n    authStore: AuthStore.of({\n      issueChallenge,\n      consumeChallenge,\n      issueRegistration,\n      inspectRegistration,\n      consumeRegistration,\n    }),\n    decisions: {\n      consumeChallenge: consumeChallengeDecision,\n      consumeRegistration: consumeRegistrationDecision,\n    },\n  } as const;\n};\n\nexport const makeSqliteOAuthStateServices = <\n  S extends AnySQLiteTable,\n  HKT extends ClosedQueryEffectHKT = ClosedQueryEffectHKT,\n  RunResult = unknown,\n>(\n  database: SQLiteEffectDatabase<HKT, RunResult, AnyRelations>,\n  mapping: OAuthStateTables<S>,\n  standaloneGuard?: Effect.Effect<void, AuthStoreError>,\n) => {\n  const db = database as RuntimeDatabase<HKT, RunResult>;\n\n  const requireStandalone =\n    standaloneGuard ??\n    Effect.suspend(() =>\n      db.$client === undefined\n        ? AuthStoreError.make({ message: \"Use a root auth store or its decision transaction API\" })\n        : requireStandaloneConsume({ $client: db.$client }),\n    );\n\n  const stateTable = mapping.oauthState.table;\n  const stateColumns = mapping.oauthState.columns;\n\n  const state = {\n    stateDigest: column(stateTable, stateColumns.stateDigest),\n    expiresAt: column(stateTable, stateColumns.expiresAt),\n    consumed: column(stateTable, stateColumns.consumed),\n  } as Record<string, SQLiteColumn>;\n\n  const issue = Effect.fn(\"DrizzleSqliteOAuthStateStore.issue\")(function* (input: OAuthState) {\n    yield* Effect.suspend(() =>\n      db.insert(stateTable as any).values(mapping.oauthState.encodeInsert(input, false) as any),\n    ).pipe(mapStoreWriteFailure);\n  });\n\n  const consumeDecision = Effect.fn(\"DrizzleSqliteOAuthStateStore.consumeDecision\")(function* (\n    digest: TokenDigest,\n  ): Effect.fn.Return<ConsumeDecision<OAuthState>, AuthStoreError> {\n    const now = yield* DateTime.now;\n\n    const rows = (yield* Effect.suspend(() =>\n      db\n        .update(stateTable as any)\n        .set(updateValues<S>([[stateColumns.consumed, true]]) as any)\n        .where(\n          and(\n            eq(state.stateDigest, digest),\n            eq(state.consumed, false),\n            gt(state.expiresAt, mapping.oauthState.encodeInstant(now)),\n          ),\n        )\n        .returning(),\n    ).pipe(mapStoreWriteFailure)) as ReadonlyArray<unknown>;\n\n    if (rows[0] === undefined) return { _tag: \"rejected\" };\n\n    const decoded = yield* Effect.suspend(() =>\n      mapping.oauthState.decode(selected<S>(rows[0])),\n    ).pipe(mapStoreReadFailure);\n\n    return { _tag: \"accepted\", value: decoded.state };\n  });\n\n  const consume = Effect.fn(\"DrizzleSqliteOAuthStateStore.consume\")(function* (\n    digest: TokenDigest,\n  ) {\n    yield* requireStandalone;\n    const decision = yield* consumeDecision(digest);\n\n    return decision._tag === \"accepted\" ? decision.value : yield* InvalidOAuthState.make();\n  });\n\n  return {\n    oauthStateStore: OAuthStateStore.of({ issue, consume }),\n    decisions: { consumeOAuthState: consumeDecision },\n  } as const;\n};\n\nexport const makeSqliteAuthServices = <\n  C extends AnySQLiteTable,\n  R extends AnySQLiteTable,\n  S extends AnySQLiteTable,\n  HKT extends ClosedQueryEffectHKT = ClosedQueryEffectHKT,\n  RunResult = unknown,\n>(\n  database: SQLiteEffectDatabase<HKT, RunResult, AnyRelations>,\n  mapping: AuthTables<C, R, S>,\n  standaloneGuard?: Effect.Effect<void, AuthStoreError>,\n) => {\n  const auth = makeSqliteAuthStoreServices(database, mapping, standaloneGuard);\n  const oauth = makeSqliteOAuthStateServices(database, mapping, standaloneGuard);\n\n  return { ...auth, ...oauth, decisions: { ...auth.decisions, ...oauth.decisions } } as const;\n};\n\n/**\n * Owns the native outer commit for interactive SQLite targets. Keep rejection\n * as a decision value inside the owner; interruption before commit rolls back.\n */\nexport function coordinateSqliteAuthStoreTransaction<\n  D extends AnyDatabase,\n  C extends AnySQLiteTable,\n  R extends AnySQLiteTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: { readonly mapping: AuthStoreTables<C, R>; readonly transaction?: never },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions> | DatabaseRequirements\n>;\n\nexport function coordinateSqliteAuthStoreTransaction<\n  D extends AnyDatabase,\n  C extends AnySQLiteTable,\n  R extends AnySQLiteTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthStoreTables<C, R>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions | TxId> | DatabaseRequirements\n>;\n\nexport function coordinateSqliteAuthStoreTransaction<\n  D extends AnyDatabase,\n  C extends AnySQLiteTable,\n  R extends AnySQLiteTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthStoreTables<C, R>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n) {\n  return Effect.flatMap(acquire, (database) =>\n    database.transaction<A, E, Exclude<Requirements, AuthStoreDecisions>>((transaction) => {\n      const decisions = makeSqliteAuthStoreServices(transaction, options.mapping).decisions;\n      const provided = Context.make(AuthStoreDecisions, decisions);\n      const work = Effect.provideContext(body, provided);\n\n      return options.transaction === undefined\n        ? work\n        : Effect.provideService(\n            work,\n            options.transaction,\n            options.transaction.of(transaction as TransactionOf<D>),\n          );\n    }),\n  );\n}\n\nexport function coordinateSqliteOAuthStateTransaction<\n  D extends AnyDatabase,\n  S extends AnySQLiteTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: { readonly mapping: OAuthStateTables<S>; readonly transaction?: never },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, OAuthStateDecisions> | DatabaseRequirements\n>;\n\nexport function coordinateSqliteOAuthStateTransaction<\n  D extends AnyDatabase,\n  S extends AnySQLiteTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: OAuthStateTables<S>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, OAuthStateDecisions | TxId> | DatabaseRequirements\n>;\n\nexport function coordinateSqliteOAuthStateTransaction<\n  D extends AnyDatabase,\n  S extends AnySQLiteTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: OAuthStateTables<S>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n) {\n  return Effect.flatMap(acquire, (database) =>\n    database.transaction<A, E, Exclude<Requirements, OAuthStateDecisions>>((transaction) => {\n      const decisions = makeSqliteOAuthStateServices(transaction, options.mapping).decisions;\n      const provided = Context.make(OAuthStateDecisions, decisions);\n      const work = Effect.provideContext(body, provided);\n\n      return options.transaction === undefined\n        ? work\n        : Effect.provideService(\n            work,\n            options.transaction,\n            options.transaction.of(transaction as TransactionOf<D>),\n          );\n    }),\n  );\n}\n\nexport function coordinateSqliteAuthTransaction<\n  D extends AnyDatabase,\n  C extends AnySQLiteTable,\n  R extends AnySQLiteTable,\n  S extends AnySQLiteTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: { readonly mapping: AuthTables<C, R, S>; readonly transaction?: never },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions> | DatabaseRequirements\n>;\n\nexport function coordinateSqliteAuthTransaction<\n  D extends AnyDatabase,\n  C extends AnySQLiteTable,\n  R extends AnySQLiteTable,\n  S extends AnySQLiteTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthTables<C, R, S>;\n    readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n): Effect.Effect<\n  A,\n  E | DatabaseError | SqlError,\n  Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions | TxId> | DatabaseRequirements\n>;\n\nexport function coordinateSqliteAuthTransaction<\n  D extends AnyDatabase,\n  C extends AnySQLiteTable,\n  R extends AnySQLiteTable,\n  S extends AnySQLiteTable,\n  A,\n  E,\n  Requirements,\n  DatabaseError,\n  DatabaseRequirements,\n  TxId,\n  TxShape,\n>(\n  acquire: Effect.Effect<D, DatabaseError, DatabaseRequirements>,\n  options: {\n    readonly mapping: AuthTables<C, R, S>;\n    readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<D>>, TxShape>;\n  },\n  body: Effect.Effect<A, E, Requirements>,\n) {\n  return Effect.flatMap(acquire, (database) =>\n    database.transaction<A, E, Exclude<Requirements, AuthStoreDecisions | OAuthStateDecisions>>(\n      (transaction) => {\n        const decisions = makeSqliteAuthServices(transaction, options.mapping).decisions;\n\n        const provided = Context.make(AuthStoreDecisions, decisions).pipe(\n          Context.add(OAuthStateDecisions, decisions),\n        );\n\n        const work = Effect.provideContext(body, provided);\n\n        return options.transaction === undefined\n          ? work\n          : Effect.provideService(\n              work,\n              options.transaction,\n              options.transaction.of(transaction as TransactionOf<D>),\n            );\n      },\n    ),\n  );\n}\n"],"mappings":";;;;;;;;;;;;AAyDA,MAAM,uBAAuB,eAAe,KAAK,EAAE,SAAS,yBAAyB,CAAC;AACtF,MAAM,wBAAwB,eAAe,KAAK,EAAE,SAAS,0BAA0B,CAAC;AACxF,MAAM,iBAAiB,OAAO,GAAG,cAAc;AAE/C,MAAM,mBACH,aACS,WACR,yBAAyB,QAAQ,cAAc,CAAC,CAAC,KAC/C,OAAO,YAAY,UAAU,OAAO,UAAU,MAAM,IAAI,OAAO,OAAO,CAAC,CAAC,CAC1E;AAEJ,MAAM,sBAAsB,gBAAgB,cAAc;AAC1D,MAAM,uBAAuB,gBAAgB,eAAe;AAE5D,MAAM,YAAsC,QAC1C;;;;;;;AAQF,MAAa,+BAMX,UACA,SACA,oBACG;CACH,MAAM,KAAK;CAEX,MAAM,oBACJ,mBACA,OAAO,cACL,GAAG,YAAY,KAAA,IACX,eAAe,KAAK,EAAE,SAAS,wDAAwD,CAAC,IACxF,yBAAyB,EAAE,SAAS,GAAG,QAAQ,CAAC,CACtD;CAEF,MAAM,iBAAiB,QAAQ,UAAU;CACzC,MAAM,mBAAmB,QAAQ,UAAU;CAE3C,MAAM,YAAY;EAChB,aAAa,OAAO,gBAAgB,iBAAiB,WAAW;EAChE,aAAa,OAAO,gBAAgB,iBAAiB,WAAW;EAChE,WAAW,OAAO,gBAAgB,iBAAiB,SAAS;EAC5D,OAAO,OAAO,gBAAgB,iBAAiB,KAAK;EACpD,SAAS,OAAO,gBAAgB,iBAAiB,OAAO;EACxD,UAAU,OAAO,gBAAgB,iBAAiB,QAAQ;EAC1D,WAAW,OAAO,gBAAgB,iBAAiB,SAAS;EAC5D,UAAU,OAAO,gBAAgB,iBAAiB,QAAQ;EAC1D,WAAW,OAAO,gBAAgB,iBAAiB,SAAS;EAC5D,cAAc,OAAO,gBAAgB,iBAAiB,YAAY;EAClE,gBAAgB,OAAO,gBAAgB,iBAAiB,cAAc;EACtE,UAAU,OAAO,gBAAgB,iBAAiB,QAAQ;CAC5D;CAEA,MAAM,oBAAoB,QAAQ,aAAa;CAC/C,MAAM,sBAAsB,QAAQ,aAAa;CAEjD,MAAM,eAAe;EACnB,aAAa,OAAO,mBAAmB,oBAAoB,WAAW;EACtE,WAAW,OAAO,mBAAmB,oBAAoB,SAAS;EAClE,UAAU,OAAO,mBAAmB,oBAAoB,QAAQ;CAClE;CAEA,MAAM,iBAAiB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WACxE,OACA;EACA,MAAM,MAAM,OAAO,SAAS;EAE5B,MAAM,iBAAiB,SAAS,eAC9B,MACC,WAAW,SAAS,SAAS,SAAS,MAAM,cAAc,CAC7D;EAmCA,KAAI,OAjCiB,OAAO,cAAc;GACxC,MAAM,SAAS,QAAQ,UAAU,aAAa,OAAO;IACnD,WAAW,QAAQ,UAAU;IAC7B,gBAAgB;IAChB,UAAU;GACZ,CAAC;GAED,MAAM,YAAY,QAAQ,UAAU,cAAc,GAAG;GACrD,MAAM,eAAe,QAAQ,UAAU,cAAc,cAAc;GACnE,MAAM,iBAAiB,QAAQ,UAAU,cAAc,MAAM,QAAQ;GACrE,MAAM,oBAAoB,GAAG,aAAa,GAAG,UAAU,WAAW,SAAS,EAAE,QAAQ,UAAU,eAAe;GAE9G,MAAM,SAAS,QAAQ,UAAU,aAAa,OAAO;IACnD,WAAW,QAAQ,UAAU;IAC7B,gBAAgB;IAChB,UAAU;GACZ,CAAC;GAED,OAAO,GACJ,OAAO,cAAqB,CAAC,CAC7B,OAAO,MAAa,CAAC,CACrB,mBAAmB;IAClB,QAAQ;KAAC,UAAU;KAAW,UAAU;KAAO,UAAU;IAAO;IAChE,KAAK;IACL,UAAU,IACR,GAAG,UAAU,aAAa,MAAM,WAAW,GAC3C,GAAG,UAAU,UAAU,cAAc,GACrC,GAAG,GAAG,UAAU,UAAU,IAAI,GAAG,IAAI,UAAU,UAAU,YAAY,CAAC,CACxE;GACF,CAAC,CAAC,CACD,UAAU;EACf,CAAC,CAAC,CAAC,KAAK,oBAAoB,EAAA,CAEnB,SAAS,GAAG;EAErB,MAAM,WAAY,OAAO,OAAO,cAC9B,GACG,OAAO,CAAC,CACR,KAAK,cAAqB,CAAC,CAC3B,MACC,IACE,GAAG,UAAU,WAAW,QAAQ,UAAU,mBAAmB,GAC7D,GAAG,UAAU,OAAO,MAAM,KAAK,GAC/B,GAAG,UAAU,SAAS,MAAM,OAAO,CACrC,CACF,CAAC,CACA,MAAM,CAAC,CACZ,CAAC,CAAC,KAAK,mBAAmB;EAE1B,MAAM,UACJ,SAAS,OAAO,KAAA,IACZ,KAAA,IACA,OAAO,OAAO,cAAc,QAAQ,UAAU,OAAO,SAAY,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,KAC9E,mBACF;EAEN,MAAM,oBACJ,YAAY,KAAA,IACR,KAAK,IAAI,GAAG,KAAK,KAAK,SAAS,SAAS,MAAM,cAAc,IAAI,GAAI,CAAC,IACrE,KAAK,IACH,GACA,KAAK,MACF,SAAS,cAAc,QAAQ,UAAU,QAAQ,IAChD,SAAS,SAAS,MAAM,cAAc,IACtC,SAAS,cAAc,GAAG,KAC1B,GACJ,CACF;EAEN,OAAO,OAAO,gBAAgB,KAAK,EAAE,kBAAkB,CAAC;CAC1D,CAAC;CAED,MAAM,2BAA2B,OAAO,GAAG,iDAAiD,CAAC,CAC3F,WACE,OAC4D;EAC5D,MAAM,MAAM,OAAO,SAAS;EAE5B,MAAM,eAAe,OAAO,QAAQ,MAAM,UAAU,CAAC,CAAC,KAAK,CAAC,OAAO,YACjE,IAAI,GAAG,UAAU,UAAU,KAAK,GAAG,GAAG,UAAU,WAAW,MAAM,CAAC,CACpE;EAEA,MAAM,UAAU,aAAa,WAAW,IAAI,GAAY,UAAU,GAAG,GAAG,YAAY;EAEpF,MAAM,OAAQ,OAAO,OAAO,cAC1B,GACG,OAAO,cAAqB,CAAC,CAC7B,IACC,aAAgB,CACd,CACE,iBAAiB,UACjB,GAAG,aAAa,QAAQ,kBAAkB,UAAU,SAAS,KAC/D,GACA,CACE,iBAAiB,gBACjB,GAAG,GAAG,UAAU,eAAe,eAAe,QAAQ,mBACxD,CACF,CAAC,CACH,CAAC,CACA,MACC,IACE,GAAG,UAAU,aAAa,MAAM,WAAW,GAC3C,GAAG,UAAU,UAAU,KAAK,GAC5B,GAAG,UAAU,WAAW,QAAQ,UAAU,cAAc,GAAG,CAAC,GAC5D,GAAG,GAAG,UAAU,eAAe,KAAK,UAAU,cAChD,CACF,CAAC,CACA,UAAU,CACf,CAAC,CAAC,KAAK,oBAAoB;EAE3B,IAAI,KAAK,OAAO,KAAA,GACd,OAAO;GAAE,MAAM;GAAY,QAAQ;EAAoB;EAGzD,MAAM,UAAU,OAAO,OAAO,cAC5B,QAAQ,UAAU,OAAO,SAAY,KAAK,EAAE,CAAC,CAC/C,CAAC,CAAC,KAAK,mBAAmB;EAE1B,IAAI,CAAC,QAAQ,UAAU,OAAO;GAAE,MAAM;GAAY,QAAQ;EAAW;EAErE,OAAO;GACL,MAAM;GACN,OAAO,cAAc,KAAK;IACxB,OAAO,QAAQ,UAAU;IACzB,SAAS,QAAQ,UAAU;GAC7B,CAAC;EACH;CACF,CACF;CAEA,MAAM,mBAAmB,OAAO,GAAG,yCAAyC,CAAC,CAAC,WAC5E,OACA;EACA,OAAO;EACP,MAAM,WAAW,OAAO,yBAAyB,KAAK;EAEtD,OAAO,SAAS,SAAS,aACrB,SAAS,QACT,OAAO,iBAAiB,KAAK,EAAE,QAAQ,SAAS,OAAO,CAAC;CAC9D,CAAC;CAED,MAAM,oBAAoB,OAAO,GAAG,0CAA0C,CAAC,CAAC,WAC9E,OACA;EACA,OAAO,OAAO,cACZ,GACG,OAAO,iBAAwB,CAAC,CAChC,OAAO,QAAQ,aAAa,aAAa,OAAO,KAAK,CAAQ,CAClE,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,4CAA4C,CAAC,CAAC,WAClF,aACA;EACA,MAAM,MAAM,OAAO,SAAS;EAE5B,MAAM,OAAQ,OAAO,OAAO,cAC1B,GACG,OAAO,CAAC,CACR,KAAK,iBAAwB,CAAC,CAC9B,MACC,IACE,GAAG,aAAa,aAAa,WAAW,GACxC,GAAG,aAAa,UAAU,KAAK,GAC/B,GAAG,aAAa,WAAW,QAAQ,aAAa,cAAc,GAAG,CAAC,CACpE,CACF,CAAC,CACA,MAAM,CAAC,CACZ,CAAC,CAAC,KAAK,mBAAmB;EAE1B,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,OAAO,oBAAoB,KAAK;EAMlE,QAAO,OAJgB,OAAO,cAC5B,QAAQ,aAAa,OAAO,SAAY,KAAK,EAAE,CAAC,CAClD,CAAC,CAAC,KAAK,mBAAmB,EAAA,CAEX;CACjB,CAAC;CAED,MAAM,8BAA8B,OAAO,GACzC,oDACF,CAAC,CAAC,WACA,OACyD;EACzD,MAAM,MAAM,OAAO,SAAS;EAgB5B,QAAO,OAdc,OAAO,cAC1B,GACG,OAAO,iBAAwB,CAAC,CAChC,IAAI,aAAgB,CAAC,CAAC,oBAAoB,UAAU,IAAI,CAAC,CAAC,CAAQ,CAAC,CACnE,MACC,IACE,GAAG,aAAa,aAAa,MAAM,WAAW,GAC9C,GAAG,aAAa,UAAU,KAAK,GAC/B,GAAG,aAAa,WAAW,QAAQ,aAAa,cAAc,GAAG,CAAC,CACpE,CACF,CAAC,CACA,UAAU,EAAE,UAAU,aAAa,SAAS,CAAC,CAClD,CAAC,CAAC,KAAK,oBAAoB,EAAA,CAEf,WAAW,IAAI,EAAE,MAAM,WAAW,IAAI;GAAE,MAAM;GAAY,OAAO,KAAA;EAAU;CACzF,CAAC;CAED,MAAM,sBAAsB,OAAO,GAAG,4CAA4C,CAAC,CAAC,WAClF,OACA;EACA,OAAO;EAGP,KAAI,OAFoB,4BAA4B,KAAK,EAAA,CAE5C,SAAS,YAAY,OAAO,OAAO,oBAAoB,KAAK;CAC3E,CAAC;CAED,OAAO;EACL,WAAW,UAAU,GAAG;GACtB;GACA;GACA;GACA;GACA;EACF,CAAC;EACD,WAAW;GACT,kBAAkB;GAClB,qBAAqB;EACvB;CACF;AACF;AAEA,MAAa,gCAKX,UACA,SACA,oBACG;CACH,MAAM,KAAK;CAEX,MAAM,oBACJ,mBACA,OAAO,cACL,GAAG,YAAY,KAAA,IACX,eAAe,KAAK,EAAE,SAAS,wDAAwD,CAAC,IACxF,yBAAyB,EAAE,SAAS,GAAG,QAAQ,CAAC,CACtD;CAEF,MAAM,aAAa,QAAQ,WAAW;CACtC,MAAM,eAAe,QAAQ,WAAW;CAExC,MAAM,QAAQ;EACZ,aAAa,OAAO,YAAY,aAAa,WAAW;EACxD,WAAW,OAAO,YAAY,aAAa,SAAS;EACpD,UAAU,OAAO,YAAY,aAAa,QAAQ;CACpD;CAEA,MAAM,QAAQ,OAAO,GAAG,oCAAoC,CAAC,CAAC,WAAW,OAAmB;EAC1F,OAAO,OAAO,cACZ,GAAG,OAAO,UAAiB,CAAC,CAAC,OAAO,QAAQ,WAAW,aAAa,OAAO,KAAK,CAAQ,CAC1F,CAAC,CAAC,KAAK,oBAAoB;CAC7B,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,8CAA8C,CAAC,CAAC,WAChF,QAC+D;EAC/D,MAAM,MAAM,OAAO,SAAS;EAE5B,MAAM,OAAQ,OAAO,OAAO,cAC1B,GACG,OAAO,UAAiB,CAAC,CACzB,IAAI,aAAgB,CAAC,CAAC,aAAa,UAAU,IAAI,CAAC,CAAC,CAAQ,CAAC,CAC5D,MACC,IACE,GAAG,MAAM,aAAa,MAAM,GAC5B,GAAG,MAAM,UAAU,KAAK,GACxB,GAAG,MAAM,WAAW,QAAQ,WAAW,cAAc,GAAG,CAAC,CAC3D,CACF,CAAC,CACA,UAAU,CACf,CAAC,CAAC,KAAK,oBAAoB;EAE3B,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAMrD,OAAO;GAAE,MAAM;GAAY,QAAO,OAJX,OAAO,cAC5B,QAAQ,WAAW,OAAO,SAAY,KAAK,EAAE,CAAC,CAChD,CAAC,CAAC,KAAK,mBAAmB,EAAA,CAEgB;EAAM;CAClD,CAAC;CAED,MAAM,UAAU,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAChE,QACA;EACA,OAAO;EACP,MAAM,WAAW,OAAO,gBAAgB,MAAM;EAE9C,OAAO,SAAS,SAAS,aAAa,SAAS,QAAQ,OAAO,kBAAkB,KAAK;CACvF,CAAC;CAED,OAAO;EACL,iBAAiB,gBAAgB,GAAG;GAAE;GAAO;EAAQ,CAAC;EACtD,WAAW,EAAE,mBAAmB,gBAAgB;CAClD;AACF;AAEA,MAAa,0BAOX,UACA,SACA,oBACG;CACH,MAAM,OAAO,4BAA4B,UAAU,SAAS,eAAe;CAC3E,MAAM,QAAQ,6BAA6B,UAAU,SAAS,eAAe;CAE7E,OAAO;EAAE,GAAG;EAAM,GAAG;EAAO,WAAW;GAAE,GAAG,KAAK;GAAW,GAAG,MAAM;EAAU;CAAE;AACnF;AAiDA,SAAgB,qCAYd,SACA,SAIA,MACA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,SAAS,aAA8D,gBAAgB;EACrF,MAAM,YAAY,4BAA4B,aAAa,QAAQ,OAAO,CAAC,CAAC;EAC5E,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS;EAC3D,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eACL,MACA,QAAQ,aACR,QAAQ,YAAY,GAAG,WAA+B,CACxD;CACN,CAAC,CACH;AACF;AA2CA,SAAgB,sCAWd,SACA,SAIA,MACA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,SAAS,aAA+D,gBAAgB;EACtF,MAAM,YAAY,6BAA6B,aAAa,QAAQ,OAAO,CAAC,CAAC;EAC7E,MAAM,WAAW,QAAQ,KAAK,qBAAqB,SAAS;EAC5D,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eACL,MACA,QAAQ,aACR,QAAQ,YAAY,GAAG,WAA+B,CACxD;CACN,CAAC,CACH;AACF;AA+CA,SAAgB,gCAad,SACA,SAIA,MACA;CACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,SAAS,aACN,gBAAgB;EACf,MAAM,YAAY,uBAAuB,aAAa,QAAQ,OAAO,CAAC,CAAC;EAEvE,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS,CAAC,CAAC,KAC3D,QAAQ,IAAI,qBAAqB,SAAS,CAC5C;EAEA,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;EAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eACL,MACA,QAAQ,aACR,QAAQ,YAAY,GAAG,WAA+B,CACxD;CACN,CACF,CACF;AACF"}

package/dist/drizzle/standalone-guard.mjs

@@ -0,0 +1,19 @@
+import { Context, Effect, Option, Predicate } from "effect";
+//#region src/drizzle/standalone-guard.ts
+const transactionService = (database) => {
+	if (!Predicate.hasProperty(database, "$client") || !Predicate.hasProperty(database.$client, "transactionService") || !Context.isKey(database.$client.transactionService)) return;
+	return database.$client.transactionService;
+};
+/** Bind the client-specific transaction marker at foreign adapter construction. */
+const sqlClientStandaloneGuard = (database, unavailable) => {
+	const service = transactionService(database);
+	if (service === void 0) return Effect.suspend(() => Effect.fail(unavailable()));
+	return Effect.serviceOption(service).pipe(Effect.flatMap(Option.match({
+		onNone: () => Effect.void,
+		onSome: () => Effect.fail(unavailable())
+	})));
+};
+//#endregion
+export { sqlClientStandaloneGuard };
+
+//# sourceMappingURL=standalone-guard.mjs.map

package/dist/drizzle/standalone-guard.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"standalone-guard.mjs","names":[],"sources":["../../src/drizzle/standalone-guard.ts"],"sourcesContent":["import { Context, Effect, Option, Predicate } from \"effect\";\nimport type * as SqlClient from \"effect/unstable/sql/SqlClient\";\n\ntype TransactionService = Context.Key<\n  SqlClient.TransactionConnection,\n  SqlClient.TransactionConnection.Service\n>;\n\nconst transactionService = (database: unknown): TransactionService | undefined => {\n  if (\n    !Predicate.hasProperty(database, \"$client\") ||\n    !Predicate.hasProperty(database.$client, \"transactionService\") ||\n    !Context.isKey(database.$client.transactionService)\n  ) {\n    return undefined;\n  }\n\n  return database.$client.transactionService;\n};\n\n/** Bind the client-specific transaction marker at foreign adapter construction. */\nexport const sqlClientStandaloneGuard = <Failure>(\n  database: unknown,\n  unavailable: () => Failure,\n): Effect.Effect<void, Failure> => {\n  const service = transactionService(database);\n\n  if (service === undefined) return Effect.suspend(() => Effect.fail(unavailable()));\n\n  return Effect.serviceOption(service).pipe(\n    Effect.flatMap(\n      Option.match({\n        onNone: () => Effect.void,\n        onSome: () => Effect.fail(unavailable()),\n      }),\n    ),\n  );\n};\n"],"mappings":";;AAQA,MAAM,sBAAsB,aAAsD;CAChF,IACE,CAAC,UAAU,YAAY,UAAU,SAAS,KAC1C,CAAC,UAAU,YAAY,SAAS,SAAS,oBAAoB,KAC7D,CAAC,QAAQ,MAAM,SAAS,QAAQ,kBAAkB,GAElD;CAGF,OAAO,SAAS,QAAQ;AAC1B;;AAGA,MAAa,4BACX,UACA,gBACiC;CACjC,MAAM,UAAU,mBAAmB,QAAQ;CAE3C,IAAI,YAAY,KAAA,GAAW,OAAO,OAAO,cAAc,OAAO,KAAK,YAAY,CAAC,CAAC;CAEjF,OAAO,OAAO,cAAc,OAAO,CAAC,CAAC,KACnC,OAAO,QACL,OAAO,MAAM;EACX,cAAc,OAAO;EACrB,cAAc,OAAO,KAAK,YAAY,CAAC;CACzC,CAAC,CACH,CACF;AACF"}

package/dist/drizzle/step-up-model.d.mts

@@ -0,0 +1,65 @@
+import { SecurityRevision } from "../sessions/models.mjs";
+import { SessionStepUpIntent } from "../sessions/SessionStepUpPersistence.mjs";
+import { DrizzleMappingError } from "./model.mjs";
+import { D1SessionClockMapping, SessionAuthorityTables, SessionConstraintClassifier, SessionIdCodec, SignedSessionValidityTables, StatefulSessionTables } from "./session-model.mjs";
+import { DateTime, Effect } from "effect";
+import { InferInsertModel, Table } from "drizzle-orm";
+//#region src/drizzle/step-up-model.d.ts
+type ColumnKey<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+/** Distinct from login-pending storage. Snapshot is TEXT encoded by the core's
+ * SessionStepUpIntent schema; it contains no Claims and needs no consumer decoder. */
+interface SessionStepUpIntentTables<Intent extends Table, NativeSubjectId> {
+  readonly intent: {
+    readonly table: Intent;
+    readonly digest: ColumnKey<Intent>;
+    readonly version: ColumnKey<Intent>;
+    readonly flowId: ColumnKey<Intent>;
+    readonly subjectId: ColumnKey<Intent>;
+    readonly bindingDigest: ColumnKey<Intent>;
+    readonly snapshot: ColumnKey<Intent>;
+    readonly expiresAt: ColumnKey<Intent>;
+    readonly attemptLimit: ColumnKey<Intent>;
+    readonly failedAttempts: ColumnKey<Intent>;
+    readonly consumed: ColumnKey<Intent>;
+    readonly encodeInstant: (instant: DateTime.Utc) => unknown;
+    /** Consumer fields/defaults; the adapter sets all mapped security columns. */
+    readonly encodeInsert: (intent: SessionStepUpIntent, input: {
+      readonly subjectId: NativeSubjectId;
+    }) => InferInsertModel<Intent>;
+    readonly allocateVersion?: Effect.Effect<SecurityRevision, DrizzleMappingError>;
+    readonly allocateVersionSync?: () => SecurityRevision;
+  };
+}
+interface RequiredSessionStepUpConstraints {
+  readonly intentDigest: "unique(intent.digest)";
+  readonly intentFlow: "unique(intent.flowId)";
+}
+declare const requiredSessionStepUpConstraints: RequiredSessionStepUpConstraints;
+/** Fixed source discriminator is checked against every stored intent. A minimal
+ * pure-signed installation does not provide dummy session or tombstone tables. */
+type SessionStepUpSourceTables<Claims, Session extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = {
+  readonly kind: "StatelessSigned";
+} | ({
+  readonly kind: "StateAssistedSigned";
+  readonly constraints: {
+    readonly tombstoneOwner: "unique(tombstone.subjectId,tombstone.sessionId)";
+  };
+} & SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId>) | {
+  readonly kind: "Stateful";
+  readonly constraints: {
+    readonly sessionDigest: "unique(session.digest)";
+  };
+  readonly sessionId: SessionIdCodec<NativeSessionId>;
+  readonly session: StatefulSessionTables<Claims, Session, Table, NativeSubjectId, NativeSessionId>["session"] & {
+    readonly credentialVersion: ColumnKey<Session>;
+    readonly authenticatedAt: ColumnKey<Session>;
+  };
+};
+type SessionStepUpMapping<Claims, Subject extends Table, Credential extends Table, Intent extends Table, Session extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> & SessionStepUpIntentTables<Intent, NativeSubjectId> & SessionConstraintClassifier & {
+  readonly source: SessionStepUpSourceTables<Claims, Session, Tombstone, NativeSubjectId, NativeSessionId>;
+  readonly constraints: RequiredSessionStepUpConstraints;
+};
+type D1SessionStepUpMapping<Claims, Subject extends Table, Credential extends Table, Intent extends Table, Session extends Table, Tombstone extends Table, NativeSubjectId, NativeSessionId> = SessionStepUpMapping<Claims, Subject, Credential, Intent, Session, Tombstone, NativeSubjectId, NativeSessionId> & D1SessionClockMapping;
+//#endregion
+export { D1SessionStepUpMapping, RequiredSessionStepUpConstraints, SessionStepUpIntentTables, SessionStepUpMapping, SessionStepUpSourceTables, requiredSessionStepUpConstraints };
+//# sourceMappingURL=step-up-model.d.mts.map

package/dist/drizzle/step-up-model.mjs

@@ -0,0 +1,9 @@
+//#region src/drizzle/step-up-model.ts
+const requiredSessionStepUpConstraints = {
+	intentDigest: "unique(intent.digest)",
+	intentFlow: "unique(intent.flowId)"
+};
+//#endregion
+export { requiredSessionStepUpConstraints };
+
+//# sourceMappingURL=step-up-model.mjs.map

package/dist/drizzle/step-up-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-model.mjs","names":[],"sources":["../../src/drizzle/step-up-model.ts"],"sourcesContent":["import type { InferInsertModel, Table } from \"drizzle-orm\";\nimport type { DateTime, Effect } from \"effect\";\n\nimport type { SecurityRevision } from \"../sessions/models\";\nimport type { SessionStepUpIntent } from \"../sessions/SessionStepUpPersistence\";\nimport type { DrizzleMappingError } from \"./model\";\nimport type {\n  D1SessionClockMapping,\n  SessionAuthorityTables,\n  SessionConstraintClassifier,\n  SessionIdCodec,\n  SignedSessionValidityTables,\n  StatefulSessionTables,\n} from \"./session-model\";\n\ntype ColumnKey<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\n\n/** Distinct from login-pending storage. Snapshot is TEXT encoded by the core's\n * SessionStepUpIntent schema; it contains no Claims and needs no consumer decoder. */\nexport interface SessionStepUpIntentTables<Intent extends Table, NativeSubjectId> {\n  readonly intent: {\n    readonly table: Intent;\n    readonly digest: ColumnKey<Intent>;\n    readonly version: ColumnKey<Intent>;\n    readonly flowId: ColumnKey<Intent>;\n    readonly subjectId: ColumnKey<Intent>;\n    readonly bindingDigest: ColumnKey<Intent>;\n    readonly snapshot: ColumnKey<Intent>;\n    readonly expiresAt: ColumnKey<Intent>;\n    readonly attemptLimit: ColumnKey<Intent>;\n    readonly failedAttempts: ColumnKey<Intent>;\n    readonly consumed: ColumnKey<Intent>;\n    readonly encodeInstant: (instant: DateTime.Utc) => unknown;\n    /** Consumer fields/defaults; the adapter sets all mapped security columns. */\n    readonly encodeInsert: (\n      intent: SessionStepUpIntent,\n      input: { readonly subjectId: NativeSubjectId },\n    ) => InferInsertModel<Intent>;\n    readonly allocateVersion?: Effect.Effect<SecurityRevision, DrizzleMappingError>;\n    readonly allocateVersionSync?: () => SecurityRevision;\n  };\n}\n\nexport interface RequiredSessionStepUpConstraints {\n  readonly intentDigest: \"unique(intent.digest)\";\n  readonly intentFlow: \"unique(intent.flowId)\";\n}\n\nexport const requiredSessionStepUpConstraints: RequiredSessionStepUpConstraints = {\n  intentDigest: \"unique(intent.digest)\",\n  intentFlow: \"unique(intent.flowId)\",\n};\n\n/** Fixed source discriminator is checked against every stored intent. A minimal\n * pure-signed installation does not provide dummy session or tombstone tables. */\nexport type SessionStepUpSourceTables<\n  Claims,\n  Session extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> =\n  | { readonly kind: \"StatelessSigned\" }\n  | ({\n      readonly kind: \"StateAssistedSigned\";\n      readonly constraints: {\n        readonly tombstoneOwner: \"unique(tombstone.subjectId,tombstone.sessionId)\";\n      };\n    } & SignedSessionValidityTables<Tombstone, NativeSubjectId, NativeSessionId>)\n  | {\n      readonly kind: \"Stateful\";\n      readonly constraints: { readonly sessionDigest: \"unique(session.digest)\" };\n      readonly sessionId: SessionIdCodec<NativeSessionId>;\n      readonly session: StatefulSessionTables<\n        Claims,\n        Session,\n        Table,\n        NativeSubjectId,\n        NativeSessionId\n      >[\"session\"] & {\n        readonly credentialVersion: ColumnKey<Session>;\n        readonly authenticatedAt: ColumnKey<Session>;\n        /** encodeRotation must persist the full replacement Claims/provenance and\n         * these queryable security fields, never preserve the old proof payload. */\n      };\n    };\n\nexport type SessionStepUpMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Intent extends Table,\n  Session extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> = SessionAuthorityTables<Subject, Credential, NativeSubjectId> &\n  SessionStepUpIntentTables<Intent, NativeSubjectId> &\n  SessionConstraintClassifier & {\n    readonly source: SessionStepUpSourceTables<\n      Claims,\n      Session,\n      Tombstone,\n      NativeSubjectId,\n      NativeSessionId\n    >;\n    readonly constraints: RequiredSessionStepUpConstraints;\n  };\n\nexport type D1SessionStepUpMapping<\n  Claims,\n  Subject extends Table,\n  Credential extends Table,\n  Intent extends Table,\n  Session extends Table,\n  Tombstone extends Table,\n  NativeSubjectId,\n  NativeSessionId,\n> = SessionStepUpMapping<\n  Claims,\n  Subject,\n  Credential,\n  Intent,\n  Session,\n  Tombstone,\n  NativeSubjectId,\n  NativeSessionId\n> &\n  D1SessionClockMapping;\n"],"mappings":";AAgDA,MAAa,mCAAqE;CAChF,cAAc;CACd,YAAY;AACd"}

package/dist/drizzle/step-up-state.mjs

@@ -0,0 +1,34 @@
+import { SessionStepUpInvalid, SessionUnavailable } from "../sessions/errors.mjs";
+import { AuthenticationEvidence, SessionMetadata } from "../sessions/models.mjs";
+import { SessionStepUpIntent, SessionStepUpRequirement } from "../sessions/SessionStepUpPersistence.mjs";
+import { DateTime, Effect, Schema } from "effect";
+//#region src/drizzle/step-up-state.ts
+const stepUpIntentCodec = Schema.fromJsonString(SessionStepUpIntent);
+const BoundedSnapshot = Schema.String.check(Schema.isMaxLength(131072));
+const encodeStepUpIntent = (intent) => Schema.encodeEffect(stepUpIntentCodec)(intent).pipe(Effect.flatMap(Schema.decodeEffect(BoundedSnapshot)), Effect.mapError(() => SessionUnavailable.make({})));
+const decodeStepUpIntent = (snapshot) => Schema.decodeEffect(BoundedSnapshot)(snapshot).pipe(Effect.flatMap(Schema.decodeEffect(stepUpIntentCodec)), Effect.mapError(() => SessionUnavailable.make({})));
+const sameStepUpRevision = (left, right) => left.subjectId === right.subjectId && left.securityRevision === right.securityRevision && left.credentials.length === right.credentials.length && new Set(left.credentials.map((c) => c.credentialId)).size === left.credentials.length && left.credentials.every((item) => right.credentials.some((other) => item.credentialId === other.credentialId && item.revision === other.revision));
+const stepUpIntentLive = (intent, kind, now) => {
+	const n = DateTime.toEpochMillis(now), authenticated = DateTime.toEpochMillis(intent.sourceAuthenticatedAt), idle = DateTime.toEpochMillis(intent.sourceExpiresAt), absolute = DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt), expires = DateTime.toEpochMillis(intent.expiresAt);
+	return intent.sourceKind === kind && authenticated <= n && n < expires && expires <= idle && idle <= absolute;
+};
+const evidenceEncoding = Schema.encodeSync(Schema.fromJsonString(AuthenticationEvidence));
+const requirementEncoding = Schema.encodeSync(Schema.fromJsonString(SessionStepUpRequirement));
+const metadataEncoding = Schema.encodeSync(Schema.fromJsonString(SessionMetadata));
+/** Validate core-owned plans before driver allocation/SQL expansion. No bearer or Claims decoding. */
+const validateStepUpPlan = Effect.fn("DrizzleStepUp.validatePlan")(function* (plan) {
+	const { intent, source, replacement, evidence } = plan;
+	const original = source.inspection;
+	if (requirementEncoding(plan.profileRequirement) !== requirementEncoding(intent.requirement) || replacement.inspection.session.subjectId !== evidence.revision.subjectId || replacement.inspection.session.securityRevision !== evidence.revision.securityRevision || intent.revision.credentials.some((item) => !evidence.revision.credentials.some((actual) => actual.credentialId === item.credentialId && actual.revision === item.revision))) return yield* SessionStepUpInvalid.make({});
+	if (intent.sourceKind !== source.guard._tag || intent.sourceKind !== replacement._tag || intent.sourceSessionId !== original.session.sessionId || intent.sourceCredentialVersion !== original.credentialVersion || !sameStepUpRevision(intent.revision, original.provenance.evidence.revision) || intent.revision.subjectId !== evidence.revision.subjectId || intent.revision.securityRevision !== evidence.revision.securityRevision || intent.flowId !== evidence.flowId || intent.bindingDigest !== evidence.bindingDigest || DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !== DateTime.toEpochMillis(original.session.assurance.authenticatedAt) || DateTime.toEpochMillis(intent.sourceExpiresAt) !== DateTime.toEpochMillis(original.session.expiresAt) || DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !== DateTime.toEpochMillis(original.session.absoluteExpiresAt) || DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !== DateTime.toEpochMillis(replacement.inspection.session.assurance.authenticatedAt) || DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !== DateTime.toEpochMillis(replacement.inspection.session.absoluteExpiresAt) || evidenceEncoding(replacement.inspection.provenance.evidence) !== evidenceEncoding(evidence)) return yield* SessionStepUpInvalid.make({});
+	if (replacement._tag === "Stateful" && (source.guard._tag !== "Stateful" || source.guard.digest !== replacement.expectedDigest || source.guard.rowVersion !== replacement.expectedRowVersion || replacement.inspection.session.sessionId !== intent.sourceSessionId)) return yield* SessionStepUpInvalid.make({});
+	if (replacement._tag === "StateAssistedSigned" && (replacement.tombstoneSessionId !== intent.sourceSessionId || DateTime.toEpochMillis(replacement.tombstoneUntil) !== DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt))) return yield* SessionStepUpInvalid.make({});
+	if (replacement._tag !== "Stateful" && replacement.inspection.session.sessionId === intent.sourceSessionId) return yield* SessionStepUpInvalid.make({});
+});
+/** Compare a consumer-decoded encoded update/readback with the intended rotation.
+* Claims are consumer-owned; their lossless round trip remains the codec contract. */
+const stepUpRotationMatches = (plan, record) => plan.replacement._tag === "Stateful" && record.digest === plan.replacement.nextDigest && record.credentialVersion === plan.replacement.inspection.credentialVersion && metadataEncoding(record) === metadataEncoding(plan.replacement.inspection.session) && evidenceEncoding(record.provenance.evidence) === evidenceEncoding(plan.evidence);
+//#endregion
+export { decodeStepUpIntent, encodeStepUpIntent, sameStepUpRevision, stepUpIntentCodec, stepUpIntentLive, stepUpRotationMatches, validateStepUpPlan };
+
+//# sourceMappingURL=step-up-state.mjs.map

package/dist/drizzle/step-up-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-state.mjs","names":[],"sources":["../../src/drizzle/step-up-state.ts"],"sourcesContent":["import { DateTime, Effect, Schema } from \"effect\";\n\nimport { SessionStepUpInvalid, SessionUnavailable } from \"../sessions/errors\";\nimport {\n  AuthenticationEvidence,\n  type AuthenticationRevision,\n  SessionMetadata,\n} from \"../sessions/models\";\nimport type { StatefulSessionRecord } from \"../sessions/persistence\";\nimport {\n  SessionStepUpIntent,\n  SessionStepUpRequirement,\n  type SessionStepUpCompletionPlan,\n} from \"../sessions/SessionStepUpPersistence\";\n\nexport const stepUpIntentCodec = Schema.fromJsonString(SessionStepUpIntent);\nconst BoundedSnapshot = Schema.String.check(Schema.isMaxLength(131072));\n\nexport const encodeStepUpIntent = (intent: SessionStepUpIntent) =>\n  Schema.encodeEffect(stepUpIntentCodec)(intent).pipe(\n    Effect.flatMap(Schema.decodeEffect(BoundedSnapshot)),\n    Effect.mapError(() => SessionUnavailable.make({})),\n  );\n\nexport const decodeStepUpIntent = (snapshot: string) =>\n  Schema.decodeEffect(BoundedSnapshot)(snapshot).pipe(\n    Effect.flatMap(Schema.decodeEffect(stepUpIntentCodec)),\n    Effect.mapError(() => SessionUnavailable.make({})),\n  );\n\nexport const sameStepUpRevision = (left: AuthenticationRevision, right: AuthenticationRevision) =>\n  left.subjectId === right.subjectId &&\n  left.securityRevision === right.securityRevision &&\n  left.credentials.length === right.credentials.length &&\n  new Set(left.credentials.map((c) => c.credentialId)).size === left.credentials.length &&\n  left.credentials.every((item) =>\n    right.credentials.some(\n      (other) => item.credentialId === other.credentialId && item.revision === other.revision,\n    ),\n  );\n\nexport const stepUpIntentLive = (\n  intent: SessionStepUpIntent,\n  kind: SessionStepUpIntent[\"sourceKind\"],\n  now: DateTime.Utc,\n) => {\n  const n = DateTime.toEpochMillis(now),\n    authenticated = DateTime.toEpochMillis(intent.sourceAuthenticatedAt),\n    idle = DateTime.toEpochMillis(intent.sourceExpiresAt),\n    absolute = DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt),\n    expires = DateTime.toEpochMillis(intent.expiresAt);\n\n  return (\n    intent.sourceKind === kind &&\n    authenticated <= n &&\n    n < expires &&\n    expires <= idle &&\n    idle <= absolute\n  );\n};\n\nconst evidenceEncoding = Schema.encodeSync(Schema.fromJsonString(AuthenticationEvidence));\nconst requirementEncoding = Schema.encodeSync(Schema.fromJsonString(SessionStepUpRequirement));\nconst metadataEncoding = Schema.encodeSync(Schema.fromJsonString(SessionMetadata));\n\n/** Validate core-owned plans before driver allocation/SQL expansion. No bearer or Claims decoding. */\nexport const validateStepUpPlan = Effect.fn(\"DrizzleStepUp.validatePlan\")(function* <Claims>(\n  plan: SessionStepUpCompletionPlan<Claims>,\n) {\n  const { intent, source, replacement, evidence } = plan;\n  const original = source.inspection;\n\n  if (\n    requirementEncoding(plan.profileRequirement) !== requirementEncoding(intent.requirement) ||\n    replacement.inspection.session.subjectId !== evidence.revision.subjectId ||\n    replacement.inspection.session.securityRevision !== evidence.revision.securityRevision ||\n    intent.revision.credentials.some(\n      (item) =>\n        !evidence.revision.credentials.some(\n          (actual) =>\n            actual.credentialId === item.credentialId && actual.revision === item.revision,\n        ),\n    )\n  )\n    return yield* SessionStepUpInvalid.make({});\n  if (\n    intent.sourceKind !== source.guard._tag ||\n    intent.sourceKind !== replacement._tag ||\n    intent.sourceSessionId !== original.session.sessionId ||\n    intent.sourceCredentialVersion !== original.credentialVersion ||\n    !sameStepUpRevision(intent.revision, original.provenance.evidence.revision) ||\n    intent.revision.subjectId !== evidence.revision.subjectId ||\n    intent.revision.securityRevision !== evidence.revision.securityRevision ||\n    intent.flowId !== evidence.flowId ||\n    intent.bindingDigest !== evidence.bindingDigest ||\n    DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !==\n      DateTime.toEpochMillis(original.session.assurance.authenticatedAt) ||\n    DateTime.toEpochMillis(intent.sourceExpiresAt) !==\n      DateTime.toEpochMillis(original.session.expiresAt) ||\n    DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !==\n      DateTime.toEpochMillis(original.session.absoluteExpiresAt) ||\n    DateTime.toEpochMillis(intent.sourceAuthenticatedAt) !==\n      DateTime.toEpochMillis(replacement.inspection.session.assurance.authenticatedAt) ||\n    DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt) !==\n      DateTime.toEpochMillis(replacement.inspection.session.absoluteExpiresAt) ||\n    evidenceEncoding(replacement.inspection.provenance.evidence) !== evidenceEncoding(evidence)\n  )\n    return yield* SessionStepUpInvalid.make({});\n  if (\n    replacement._tag === \"Stateful\" &&\n    (source.guard._tag !== \"Stateful\" ||\n      source.guard.digest !== replacement.expectedDigest ||\n      source.guard.rowVersion !== replacement.expectedRowVersion ||\n      replacement.inspection.session.sessionId !== intent.sourceSessionId)\n  )\n    return yield* SessionStepUpInvalid.make({});\n  if (\n    replacement._tag === \"StateAssistedSigned\" &&\n    (replacement.tombstoneSessionId !== intent.sourceSessionId ||\n      DateTime.toEpochMillis(replacement.tombstoneUntil) !==\n        DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt))\n  )\n    return yield* SessionStepUpInvalid.make({});\n  if (\n    replacement._tag !== \"Stateful\" &&\n    replacement.inspection.session.sessionId === intent.sourceSessionId\n  )\n    return yield* SessionStepUpInvalid.make({});\n});\n\n/** Compare a consumer-decoded encoded update/readback with the intended rotation.\n * Claims are consumer-owned; their lossless round trip remains the codec contract. */\nexport const stepUpRotationMatches = <Claims>(\n  plan: SessionStepUpCompletionPlan<Claims>,\n  record: StatefulSessionRecord<Claims>,\n) =>\n  plan.replacement._tag === \"Stateful\" &&\n  record.digest === plan.replacement.nextDigest &&\n  record.credentialVersion === plan.replacement.inspection.credentialVersion &&\n  metadataEncoding(record) === metadataEncoding(plan.replacement.inspection.session) &&\n  evidenceEncoding(record.provenance.evidence) === evidenceEncoding(plan.evidence);\n"],"mappings":";;;;;AAeA,MAAa,oBAAoB,OAAO,eAAe,mBAAmB;AAC1E,MAAM,kBAAkB,OAAO,OAAO,MAAM,OAAO,YAAY,MAAM,CAAC;AAEtE,MAAa,sBAAsB,WACjC,OAAO,aAAa,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,KAC7C,OAAO,QAAQ,OAAO,aAAa,eAAe,CAAC,GACnD,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD;AAEF,MAAa,sBAAsB,aACjC,OAAO,aAAa,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,KAC7C,OAAO,QAAQ,OAAO,aAAa,iBAAiB,CAAC,GACrD,OAAO,eAAe,mBAAmB,KAAK,CAAC,CAAC,CAAC,CACnD;AAEF,MAAa,sBAAsB,MAA8B,UAC/D,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,UAC9C,IAAI,IAAI,KAAK,YAAY,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK,YAAY,UAC/E,KAAK,YAAY,OAAO,SACtB,MAAM,YAAY,MACf,UAAU,KAAK,iBAAiB,MAAM,gBAAgB,KAAK,aAAa,MAAM,QACjF,CACF;AAEF,MAAa,oBACX,QACA,MACA,QACG;CACH,MAAM,IAAI,SAAS,cAAc,GAAG,GAClC,gBAAgB,SAAS,cAAc,OAAO,qBAAqB,GACnE,OAAO,SAAS,cAAc,OAAO,eAAe,GACpD,WAAW,SAAS,cAAc,OAAO,uBAAuB,GAChE,UAAU,SAAS,cAAc,OAAO,SAAS;CAEnD,OACE,OAAO,eAAe,QACtB,iBAAiB,KACjB,IAAI,WACJ,WAAW,QACX,QAAQ;AAEZ;AAEA,MAAM,mBAAmB,OAAO,WAAW,OAAO,eAAe,sBAAsB,CAAC;AACxF,MAAM,sBAAsB,OAAO,WAAW,OAAO,eAAe,wBAAwB,CAAC;AAC7F,MAAM,mBAAmB,OAAO,WAAW,OAAO,eAAe,eAAe,CAAC;;AAGjF,MAAa,qBAAqB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACxE,MACA;CACA,MAAM,EAAE,QAAQ,QAAQ,aAAa,aAAa;CAClD,MAAM,WAAW,OAAO;CAExB,IACE,oBAAoB,KAAK,kBAAkB,MAAM,oBAAoB,OAAO,WAAW,KACvF,YAAY,WAAW,QAAQ,cAAc,SAAS,SAAS,aAC/D,YAAY,WAAW,QAAQ,qBAAqB,SAAS,SAAS,oBACtE,OAAO,SAAS,YAAY,MACzB,SACC,CAAC,SAAS,SAAS,YAAY,MAC5B,WACC,OAAO,iBAAiB,KAAK,gBAAgB,OAAO,aAAa,KAAK,QAC1E,CACJ,GAEA,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,IACE,OAAO,eAAe,OAAO,MAAM,QACnC,OAAO,eAAe,YAAY,QAClC,OAAO,oBAAoB,SAAS,QAAQ,aAC5C,OAAO,4BAA4B,SAAS,qBAC5C,CAAC,mBAAmB,OAAO,UAAU,SAAS,WAAW,SAAS,QAAQ,KAC1E,OAAO,SAAS,cAAc,SAAS,SAAS,aAChD,OAAO,SAAS,qBAAqB,SAAS,SAAS,oBACvD,OAAO,WAAW,SAAS,UAC3B,OAAO,kBAAkB,SAAS,iBAClC,SAAS,cAAc,OAAO,qBAAqB,MACjD,SAAS,cAAc,SAAS,QAAQ,UAAU,eAAe,KACnE,SAAS,cAAc,OAAO,eAAe,MAC3C,SAAS,cAAc,SAAS,QAAQ,SAAS,KACnD,SAAS,cAAc,OAAO,uBAAuB,MACnD,SAAS,cAAc,SAAS,QAAQ,iBAAiB,KAC3D,SAAS,cAAc,OAAO,qBAAqB,MACjD,SAAS,cAAc,YAAY,WAAW,QAAQ,UAAU,eAAe,KACjF,SAAS,cAAc,OAAO,uBAAuB,MACnD,SAAS,cAAc,YAAY,WAAW,QAAQ,iBAAiB,KACzE,iBAAiB,YAAY,WAAW,WAAW,QAAQ,MAAM,iBAAiB,QAAQ,GAE1F,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,IACE,YAAY,SAAS,eACpB,OAAO,MAAM,SAAS,cACrB,OAAO,MAAM,WAAW,YAAY,kBACpC,OAAO,MAAM,eAAe,YAAY,sBACxC,YAAY,WAAW,QAAQ,cAAc,OAAO,kBAEtD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,IACE,YAAY,SAAS,0BACpB,YAAY,uBAAuB,OAAO,mBACzC,SAAS,cAAc,YAAY,cAAc,MAC/C,SAAS,cAAc,OAAO,uBAAuB,IAEzD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;CAC5C,IACE,YAAY,SAAS,cACrB,YAAY,WAAW,QAAQ,cAAc,OAAO,iBAEpD,OAAO,OAAO,qBAAqB,KAAK,CAAC,CAAC;AAC9C,CAAC;;;AAID,MAAa,yBACX,MACA,WAEA,KAAK,YAAY,SAAS,cAC1B,OAAO,WAAW,KAAK,YAAY,cACnC,OAAO,sBAAsB,KAAK,YAAY,WAAW,qBACzD,iBAAiB,MAAM,MAAM,iBAAiB,KAAK,YAAY,WAAW,OAAO,KACjF,iBAAiB,OAAO,WAAW,QAAQ,MAAM,iBAAiB,KAAK,QAAQ"}

package/dist/drizzle/totp-model.d.mts

@@ -0,0 +1,85 @@
+import { SubjectId } from "../Schema.mjs";
+import { AuthenticationRequirement } from "../sessions/models.mjs";
+import { PendingAuthenticationContext } from "../sessions/PendingAuthentication.mjs";
+import { DrizzleMappingError } from "./model.mjs";
+import { TotpPolicy } from "../totp/models.mjs";
+import { TotpPersistence } from "../totp/TotpPersistence.mjs";
+import { Effect, Layer } from "effect";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/totp-model.d.ts
+type TotpColumn<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+type TotpMappingSource<M, R = never> = M | Effect.Effect<M, DrizzleMappingError, R>;
+declare const requiredTotpConstraints: {
+  readonly factor: "unique(scope)";
+  readonly credential: "unique(credentialId)";
+  readonly subject: "unique(id)";
+};
+/** A dedicated encrypted factor row plus the shared authentication credential authority.
+ * factorEnabled is the consumer's TOTP requirement bit; central primary methods must
+ * read it when choosing their AuthenticationRequirement. Other factor policy is untouched.
+ * State JSON stores ciphertext and recovery digests only. The same table retains
+ * domain-separated management command tombstones; retain them while command IDs
+ * can be replayed. Encoders and current requirement decoding cannot suspend.
+ */
+interface TotpMapping<S extends Table, F extends Table, C extends Table, N> {
+  readonly moduleId: string;
+  readonly policy: TotpPolicy;
+  readonly constraints: typeof requiredTotpConstraints;
+  readonly subjectIds: {
+    readonly toNative: (id: SubjectId) => N;
+    readonly toSubject: (id: N) => SubjectId;
+  };
+  readonly subject: {
+    readonly table: S;
+    readonly id: TotpColumn<S>;
+    readonly securityRevision: TotpColumn<S>;
+    readonly factorEnabled: TotpColumn<S>;
+    readonly activeCondition: SQL;
+    readonly encodeEnabled: (enabled: boolean) => unknown;
+    readonly decodeRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;
+  };
+  readonly factor: {
+    readonly table: F;
+    readonly scope: TotpColumn<F>;
+    readonly state: TotpColumn<F>;
+    readonly version: TotpColumn<F>;
+    readonly encodeInsert: (value: {
+      readonly scope: string;
+      readonly state: string;
+      readonly version: string;
+    }) => InferInsertModel<F>;
+  };
+  readonly credential: {
+    readonly table: C;
+    readonly id: TotpColumn<C>;
+    readonly subjectId: TotpColumn<C>;
+    readonly revision: TotpColumn<C>;
+    readonly status: TotpColumn<C>;
+    readonly activeCondition: SQL;
+    readonly encodeStatus: (active: boolean) => unknown;
+    readonly encodeInsert: (value: {
+      readonly credentialId: string;
+      readonly subjectId: N;
+      readonly revision: string;
+      readonly active: boolean;
+    }) => InferInsertModel<C>;
+  };
+  /** Unix epoch milliseconds, evaluated again at the final conditional write. */
+  readonly engineNowMillis: SQL;
+  /** Required for reset-with-recovery-code. Must assert the exact unconsumed,
+   * unexpired, unexhausted pending flow, binding digest and original credential
+   * revisions. No request-supplied SQL or external I/O is accepted. */
+  readonly pendingCondition?: (target: PendingAuthenticationContext, subjectId: N) => SQL;
+}
+interface D1TotpMapping {
+  readonly d1: {
+    readonly primary: true;
+  };
+}
+interface TotpPersistenceServices {
+  readonly totpPersistence: TotpPersistence["Service"];
+}
+declare const totpPersistenceLayer: <E, R>(services: Effect.Effect<TotpPersistenceServices, E, R>) => Layer.Layer<TotpPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
+//#endregion
+export { D1TotpMapping, TotpColumn, TotpMapping, TotpMappingSource, TotpPersistenceServices, requiredTotpConstraints, totpPersistenceLayer };
+//# sourceMappingURL=totp-model.d.mts.map

package/dist/drizzle/totp-model.mjs

@@ -0,0 +1,13 @@
+import { TotpPersistence } from "../totp/TotpPersistence.mjs";
+import { Effect, Layer } from "effect";
+//#region src/drizzle/totp-model.ts
+const requiredTotpConstraints = {
+	factor: "unique(scope)",
+	credential: "unique(credentialId)",
+	subject: "unique(id)"
+};
+const totpPersistenceLayer = (services) => Layer.effect(TotpPersistence, Effect.map(services, (value) => value.totpPersistence));
+//#endregion
+export { requiredTotpConstraints, totpPersistenceLayer };
+
+//# sourceMappingURL=totp-model.mjs.map

package/dist/drizzle/totp-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp-model.mjs","names":[],"sources":["../../src/drizzle/totp-model.ts"],"sourcesContent":["import type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport { Effect, Layer } from \"effect\";\n\nimport type { SubjectId } from \"../Schema\";\nimport type { AuthenticationRequirement } from \"../sessions/models\";\nimport type { PendingAuthenticationContext } from \"../sessions/PendingAuthentication\";\nimport type { TotpPolicy } from \"../totp/models\";\nimport { TotpPersistence } from \"../totp/TotpPersistence\";\nimport type { DrizzleMappingError } from \"./model\";\nexport type TotpColumn<T extends Table> = Extract<keyof T[\"_\"][\"columns\"], string>;\nexport type TotpMappingSource<M, R = never> = M | Effect.Effect<M, DrizzleMappingError, R>;\n\nexport const requiredTotpConstraints = {\n  factor: \"unique(scope)\",\n  credential: \"unique(credentialId)\",\n  subject: \"unique(id)\",\n} as const;\n\n/** A dedicated encrypted factor row plus the shared authentication credential authority.\n * factorEnabled is the consumer's TOTP requirement bit; central primary methods must\n * read it when choosing their AuthenticationRequirement. Other factor policy is untouched.\n * State JSON stores ciphertext and recovery digests only. The same table retains\n * domain-separated management command tombstones; retain them while command IDs\n * can be replayed. Encoders and current requirement decoding cannot suspend.\n */\nexport interface TotpMapping<S extends Table, F extends Table, C extends Table, N> {\n  readonly moduleId: string;\n  readonly policy: TotpPolicy;\n  readonly constraints: typeof requiredTotpConstraints;\n  readonly subjectIds: {\n    readonly toNative: (id: SubjectId) => N;\n    readonly toSubject: (id: N) => SubjectId;\n  };\n  readonly subject: {\n    readonly table: S;\n    readonly id: TotpColumn<S>;\n    readonly securityRevision: TotpColumn<S>;\n    readonly factorEnabled: TotpColumn<S>;\n    readonly activeCondition: SQL;\n    readonly encodeEnabled: (enabled: boolean) => unknown;\n    readonly decodeRequirement: (row: InferSelectModel<S>) => AuthenticationRequirement;\n  };\n  readonly factor: {\n    readonly table: F;\n    readonly scope: TotpColumn<F>;\n    readonly state: TotpColumn<F>;\n    readonly version: TotpColumn<F>;\n    readonly encodeInsert: (value: {\n      readonly scope: string;\n      readonly state: string;\n      readonly version: string;\n    }) => InferInsertModel<F>;\n  };\n  readonly credential: {\n    readonly table: C;\n    readonly id: TotpColumn<C>;\n    readonly subjectId: TotpColumn<C>;\n    readonly revision: TotpColumn<C>;\n    readonly status: TotpColumn<C>;\n    readonly activeCondition: SQL;\n    readonly encodeStatus: (active: boolean) => unknown;\n    readonly encodeInsert: (value: {\n      readonly credentialId: string;\n      readonly subjectId: N;\n      readonly revision: string;\n      readonly active: boolean;\n    }) => InferInsertModel<C>;\n  };\n  /** Unix epoch milliseconds, evaluated again at the final conditional write. */\n  readonly engineNowMillis: SQL;\n  /** Required for reset-with-recovery-code. Must assert the exact unconsumed,\n   * unexpired, unexhausted pending flow, binding digest and original credential\n   * revisions. No request-supplied SQL or external I/O is accepted. */\n  readonly pendingCondition?: (target: PendingAuthenticationContext, subjectId: N) => SQL;\n}\n\nexport interface D1TotpMapping {\n  readonly d1: { readonly primary: true };\n}\n\nexport interface TotpPersistenceServices {\n  readonly totpPersistence: TotpPersistence[\"Service\"];\n}\n\nexport const totpPersistenceLayer = <E, R>(\n  services: Effect.Effect<TotpPersistenceServices, E, R>,\n) =>\n  Layer.effect(\n    TotpPersistence,\n    Effect.map(services, (value) => value.totpPersistence),\n  );\n"],"mappings":";;;AAYA,MAAa,0BAA0B;CACrC,QAAQ;CACR,YAAY;CACZ,SAAS;AACX;AAoEA,MAAa,wBACX,aAEA,MAAM,OACJ,iBACA,OAAO,IAAI,WAAW,UAAU,MAAM,eAAe,CACvD"}

package/dist/drizzle/totp-state.d.mts

@@ -0,0 +1,39 @@
+import "./transaction-owner.mjs";
+import { TotpRecord } from "../totp/models.mjs";
+import "../totp/errors.mjs";
+import { Context, Effect } from "effect";
+import { SQL } from "drizzle-orm";
+//#region src/drizzle/totp-state.d.ts
+declare const encodeTotpRecord: (record: TotpRecord) => string;
+declare const decodeTotpRecord: (state: string) => {
+  readonly moduleId: string;
+  readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
+  readonly credentialId: string;
+  readonly revision: string;
+  readonly version: string;
+  readonly secret: {
+    readonly keyId: string;
+    readonly nonce: string;
+    readonly ciphertext: string;
+    readonly revision: string;
+  } | null;
+  readonly pending: {
+    readonly revision: string;
+    readonly enrollmentId: string;
+    readonly secret: {
+      readonly keyId: string;
+      readonly nonce: string;
+      readonly ciphertext: string;
+      readonly revision: string;
+    };
+    readonly expiresAtMillis: number;
+    readonly failedAttempts: number;
+  } | null;
+  readonly recoveryDigests: readonly (string & import("effect/Brand").Brand<"effect-auth/TokenDigest">)[];
+  readonly acceptedStep: number;
+  readonly attemptWindow: number;
+  readonly failedAttempts: number;
+};
+//#endregion
+export { decodeTotpRecord, encodeTotpRecord };
+//# sourceMappingURL=totp-state.d.mts.map