@yielded/auth-persistence 0.1.0-beta.10

package/dist/internal/passkey/management.mjs

@@ -0,0 +1,231 @@
+import { CurrentPasskeyTransaction } from "./state.mjs";
+import { Effect, Schema } from "effect";
+import { PasskeyCredentialSummary, PasskeyRemoved } from "@yielded/auth/Passkey";
+//#region src/internal/passkey/management.ts
+const makePasskeyManagementKernel = (operations, admission, credentials, state, writeState, transactions) => {
+	const { sql } = operations;
+	const { lockAdmission } = admission;
+	const { readModule, readPolicyGuards } = credentials;
+	const { credentialKey, copiedRow, equal, sameCredential, sameRevision } = state;
+	const invariant = state.invariant;
+	const { authorizeAction, credentialRows, currentSubject, invalidate, invalidationMatches, jsonStorage, managementPolicy, metadataAllowed, ownedCredential, removeDigest, summary } = writeState;
+	const { both } = transactions;
+	const decisionCodec = jsonStorage(Schema.Union([Schema.TaggedStruct("Renamed", { credential: PasskeyCredentialSummary }), Schema.TaggedStruct("Removed", { result: PasskeyRemoved })]));
+	const intentCodec = jsonStorage(Schema.Struct({
+		operation: Schema.Literals(["rename", "remove"]),
+		credentialId: Schema.String,
+		name: Schema.optionalKey(Schema.String)
+	}));
+	const command = Effect.fn("passkey.managementCommand")(function* (mapping, subject, commandId, credentialId, intent) {
+		const owner = yield* CurrentPasskeyTransaction;
+		const table = mapping.command;
+		const observation = yield* owner.read(table.table, equal(table.table, {
+			[table.moduleId]: mapping.moduleId,
+			[table.commandId]: commandId
+		}), { limit: 1 });
+		const row = observation.rows[0];
+		if (row === void 0) return {
+			_tag: "New",
+			observation
+		};
+		if (!mapping.read.subjectIds.equals(row[table.subjectId], subject.nativeId) || row[table.credentialId] !== credentialId || row[table.intent] !== intent) return { _tag: "Rejected" };
+		return {
+			_tag: "Replay",
+			decision: decisionCodec.decode(row[table.decision])
+		};
+	});
+	const record = Effect.fn("passkey.recordManagementCommand")(function* (mapping, subject, commandId, credentialId, intent, decision, retentionUntilMillis, observation) {
+		const owner = yield* CurrentPasskeyTransaction;
+		const table = mapping.command;
+		observation.rows = (yield* owner.insert(table.table, {
+			...table.encodeInsert({
+				moduleId: mapping.moduleId,
+				subjectId: subject.nativeId,
+				commandId,
+				credentialId
+			}),
+			[table.moduleId]: mapping.moduleId,
+			[table.commandId]: commandId,
+			[table.subjectId]: subject.nativeId,
+			[table.credentialId]: credentialId,
+			[table.intent]: intent,
+			[table.decision]: decisionCodec.encode(decision),
+			[table.retentionUntil]: mapping.clock.encodeInstant(retentionUntilMillis),
+			[table.version]: owner.marker
+		}, {
+			[table.moduleId]: mapping.moduleId,
+			[table.commandId]: commandId
+		})).rows;
+	});
+	const access = Effect.fn("passkey.managementAccess")(function* (mapping, moduleId, subjectId, mutation) {
+		if (moduleId !== mapping.moduleId || (yield* readModule(mapping)) === void 0) return void 0;
+		if (mutation) yield* lockAdmission(mapping);
+		const subject = yield* currentSubject(mapping, subjectId);
+		if (subject === void 0) return void 0;
+		yield* readPolicyGuards(mapping);
+		return (yield* metadataAllowed(mapping, subject)) ? subject : void 0;
+	});
+	return {
+		listCredentials: Effect.fn("passkey.listCredentials")(function* (mapping, input) {
+			const subject = yield* access(mapping, input.moduleId, input.subjectId, false);
+			invariant(subject !== void 0);
+			const rows = [...yield* credentialRows(mapping, subject)];
+			rows.sort((left, right) => {
+				const a = left[mapping.read.credential.credentialId], b = right[mapping.read.credential.credentialId];
+				return a < b ? -1 : a > b ? 1 : 0;
+			});
+			const eligible = rows.filter((row) => input.cursor === void 0 || row[mapping.read.credential.credentialId] > input.cursor);
+			const page = eligible.slice(0, input.limit);
+			const credentials = [];
+			for (const row of page) {
+				invariant((yield* ownedCredential(mapping, subject, row)) !== void 0);
+				credentials.push(summary(mapping, row));
+			}
+			return {
+				credentials,
+				...eligible.length > input.limit ? { cursor: credentials.at(-1).credentialId } : {}
+			};
+		}),
+		renameCredential: Effect.fn("passkey.renameCredential")(function* (mapping, input) {
+			const subject = yield* access(mapping, input.moduleId, input.subjectId, true);
+			if (subject === void 0) return { _tag: "Rejected" };
+			const intent = intentCodec.encode({
+				operation: "rename",
+				credentialId: input.credentialId,
+				name: input.name
+			});
+			const prior = yield* command(mapping, subject, input.commandId, input.credentialId, intent);
+			if (prior._tag === "Rejected") return prior;
+			const row = (yield* credentialRows(mapping, subject)).find((item) => item[mapping.read.credential.credentialId] === input.credentialId);
+			if (row === void 0 || (yield* ownedCredential(mapping, subject, row)) === void 0) return { _tag: "Rejected" };
+			if (prior._tag === "Replay") return prior.decision._tag === "Renamed" ? {
+				...prior.decision,
+				replayed: true
+			} : { _tag: "Rejected" };
+			const owner = yield* CurrentPasskeyTransaction;
+			const table = mapping.read.credential;
+			yield* owner.update(table.table, {
+				[table.credentialId]: input.credentialId,
+				[table.subjectId]: subject.nativeId
+			}, { [mapping.write.credential.name]: input.name });
+			const credential = summary(mapping, {
+				...row,
+				[mapping.write.credential.name]: input.name
+			});
+			yield* record(mapping, subject, input.commandId, input.credentialId, intent, {
+				_tag: "Renamed",
+				credential
+			}, input.retentionUntilMillis, prior.observation);
+			return {
+				_tag: "Renamed",
+				credential,
+				replayed: false
+			};
+		}),
+		inspectRemove: Effect.fn("passkey.inspectRemove")(function* (mapping, input) {
+			const subject = yield* access(mapping, input.moduleId, input.subjectId, false);
+			if (subject === void 0) return { _tag: "Rejected" };
+			const prior = yield* command(mapping, subject, input.commandId, input.credentialId, intentCodec.encode({
+				operation: "remove",
+				credentialId: input.credentialId
+			}));
+			if (prior._tag === "Rejected") return prior;
+			if (prior._tag === "Replay") return prior.decision._tag === "Removed" ? {
+				_tag: "Replay",
+				result: {
+					...prior.decision.result,
+					replayed: true
+				}
+			} : { _tag: "Rejected" };
+			const row = (yield* credentialRows(mapping, subject)).find((item) => item[mapping.read.credential.credentialId] === input.credentialId);
+			const credential = row === void 0 ? void 0 : yield* ownedCredential(mapping, subject, row);
+			return credential === void 0 ? { _tag: "Rejected" } : {
+				_tag: "Target",
+				credential
+			};
+		}),
+		removeCredential: Effect.fn("passkey.removeCredential")(function* (mapping, input) {
+			const subject = yield* access(mapping, input.moduleId, input.credential.revision.subjectId, true);
+			if (subject === void 0) return { _tag: "Rejected" };
+			const id = input.credential.credentialId;
+			const intent = intentCodec.encode({
+				operation: "remove",
+				credentialId: id
+			});
+			const prior = yield* command(mapping, subject, input.commandId, id, intent);
+			if (prior._tag === "Rejected") return prior;
+			if (prior._tag === "Replay") return prior.decision._tag === "Removed" ? {
+				_tag: "Removed",
+				result: {
+					...prior.decision.result,
+					replayed: true
+				}
+			} : { _tag: "Rejected" };
+			const row = (yield* credentialRows(mapping, subject)).find((item) => item[mapping.read.credential.credentialId] === id);
+			const credential = row === void 0 ? void 0 : yield* ownedCredential(mapping, subject, row);
+			const policy = managementPolicy(mapping, subject);
+			if (credential === void 0 || !sameCredential(input.credential, credential) || !sameRevision(input.credential.revision, credential.revision) || !invalidationMatches(mapping, input.invalidation, policy) || !invalidationMatches(mapping, input.invalidation, input.management)) return { _tag: "Rejected" };
+			if (!(yield* authorizeAction(mapping, subject, input.authorization, {
+				action: "remove",
+				commandId: input.commandId,
+				flowId: input.commandId,
+				bindingDigest: removeDigest(mapping.moduleId, input.commandId, input.credential),
+				revision: input.credential.revision
+			}, {
+				...policy,
+				maximumEvidenceAgeMillis: Math.min(policy.maximumEvidenceAgeMillis, input.management.maximumEvidenceAgeMillis)
+			}))) return { _tag: "Rejected" };
+			const owner = yield* CurrentPasskeyTransaction;
+			const remaining = yield* mapping.write.policy.remainingSignIn(subject.nativeId, id, copiedRow(subject.row));
+			if (!(yield* owner.check(remaining))) return { _tag: "LastSignInMethod" };
+			const read = mapping.read;
+			const table = read.credential;
+			yield* owner.update(table.table, {
+				[table.credentialId]: id,
+				[table.subjectId]: subject.nativeId
+			}, {
+				[table.status]: mapping.write.credential.removedStatus,
+				[table.credentialRevision]: owner.marker
+			});
+			const factor = read.authority;
+			yield* owner.update(factor.table, {
+				[factor.subjectId]: subject.nativeId,
+				[factor.credentialId]: id
+			}, {
+				[factor.status]: mapping.write.authority.removedStatus,
+				[factor.revision]: owner.marker
+			});
+			for (const observation of owner.observations) {
+				if (observation.table === table.table) observation.rows = observation.rows.filter((item) => item[table.credentialId] !== id);
+				if (observation.table === factor.table) observation.rows = observation.rows.filter((item) => item[factor.credentialId] !== id);
+			}
+			const tuple = read.credentialOwnership;
+			yield* owner.update(tuple.table, { [tuple.credentialKey]: credentialKey(credential.rpId, credential.protocolCredentialId) }, {
+				[tuple.state]: mapping.write.credentialOwnership.removedState,
+				[tuple.version]: owner.marker
+			});
+			yield* invalidate(mapping, subject, input.invalidation);
+			owner.postconditions.push(remaining, sql`not exists(select 1 from ${table.table} where ${both(equal(table.table, { [table.credentialId]: id }), table.activeCondition)})`, sql`not exists(select 1 from ${factor.table} where ${both(equal(factor.table, {
+				[factor.subjectId]: subject.nativeId,
+				[factor.credentialId]: id
+			}), factor.activeCondition)})`);
+			const result = {
+				credentialId: credential.credentialId,
+				replayed: false,
+				invalidation: input.invalidation
+			};
+			yield* record(mapping, subject, input.commandId, id, intent, {
+				_tag: "Removed",
+				result
+			}, input.retentionUntilMillis, prior.observation);
+			return {
+				_tag: "Removed",
+				result
+			};
+		})
+	};
+};
+//#endregion
+export { makePasskeyManagementKernel };
+
+//# sourceMappingURL=management.mjs.map

package/dist/internal/passkey/management.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"management.mjs","names":[],"sources":["../../../src/internal/passkey/management.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport {\n  PasskeyCredentialSummary,\n  PasskeyRemoved,\n  type PasskeyManagementPersistence,\n} from \"@yielded/auth/Passkey\";\nimport { Effect, Schema } from \"effect\";\n\nimport type { PersistenceMappingError } from \"../mapping-error\";\nimport type { SqlExpression as SQL, QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport type { makePasskeyAdmissionKernel } from \"./admission\";\nimport type { makePasskeyCredentialsKernel } from \"./credentials\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\nimport type { WriteSubject, makePasskeyWriteStateKernel } from \"./write-state\";\n\ntype Port = PasskeyManagementPersistence[\"Service\"];\n\nexport const makePasskeyManagementKernel = (\n  operations: QueryOperations,\n  admission: Pick<ReturnType<typeof makePasskeyAdmissionKernel>, \"lockAdmission\">,\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"readModule\" | \"readPolicyGuards\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    \"credentialKey\" | \"copiedRow\" | \"equal\" | \"invariant\" | \"sameCredential\" | \"sameRevision\"\n  >,\n  writeState: Pick<\n    ReturnType<typeof makePasskeyWriteStateKernel>,\n    | \"authorizeAction\"\n    | \"credentialRows\"\n    | \"currentSubject\"\n    | \"invalidate\"\n    | \"invalidationMatches\"\n    | \"jsonStorage\"\n    | \"managementPolicy\"\n    | \"metadataAllowed\"\n    | \"ownedCredential\"\n    | \"removeDigest\"\n    | \"summary\"\n  >,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n  const { sql } = operations;\n  const { lockAdmission } = admission;\n  const { readModule, readPolicyGuards } = credentials;\n  const { credentialKey, copiedRow, equal, sameCredential, sameRevision } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    authorizeAction,\n    credentialRows,\n    currentSubject,\n    invalidate,\n    invalidationMatches,\n    jsonStorage,\n    managementPolicy,\n    metadataAllowed,\n    ownedCredential,\n    removeDigest,\n    summary,\n  } = writeState;\n\n  const { both } = transactions;\n\n  const decisionCodec = jsonStorage(\n    Schema.Union([\n      Schema.TaggedStruct(\"Renamed\", { credential: PasskeyCredentialSummary }),\n      Schema.TaggedStruct(\"Removed\", { result: PasskeyRemoved }),\n    ]),\n  );\n\n  const intentCodec = jsonStorage(\n    Schema.Struct({\n      operation: Schema.Literals([\"rename\", \"remove\"]),\n      credentialId: Schema.String,\n      name: Schema.optionalKey(Schema.String),\n    }),\n  );\n\n  const command = Effect.fn(\"passkey.managementCommand\")(function* (\n    mapping: any,\n    subject: WriteSubject,\n    commandId: string,\n    credentialId: string,\n    intent: string,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.command;\n\n    const observation = yield* owner.read(\n      table.table,\n      equal(table.table, { [table.moduleId]: mapping.moduleId, [table.commandId]: commandId }),\n      { limit: 1 },\n    );\n\n    const row = observation.rows[0];\n\n    if (row === undefined) return { _tag: \"New\", observation } as const;\n    if (\n      !mapping.read.subjectIds.equals(row[table.subjectId], subject.nativeId) ||\n      row[table.credentialId] !== credentialId ||\n      row[table.intent] !== intent\n    )\n      return { _tag: \"Rejected\" } as const;\n\n    return { _tag: \"Replay\", decision: decisionCodec.decode(row[table.decision]) } as const;\n  });\n\n  const record = Effect.fn(\"passkey.recordManagementCommand\")(function* (\n    mapping: any,\n    subject: WriteSubject,\n    commandId: string,\n    credentialId: string,\n    intent: string,\n    decision: Parameters<typeof decisionCodec.encode>[0],\n    retentionUntilMillis: number,\n    observation: any,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.command;\n\n    const inserted = yield* owner.insert(\n      table.table,\n      {\n        ...table.encodeInsert({\n          moduleId: mapping.moduleId,\n          subjectId: subject.nativeId,\n          commandId,\n          credentialId,\n        }),\n        [table.moduleId]: mapping.moduleId,\n        [table.commandId]: commandId,\n        [table.subjectId]: subject.nativeId,\n        [table.credentialId]: credentialId,\n        [table.intent]: intent,\n        [table.decision]: decisionCodec.encode(decision),\n        [table.retentionUntil]: mapping.clock.encodeInstant(retentionUntilMillis),\n        [table.version]: owner.marker,\n      },\n      { [table.moduleId]: mapping.moduleId, [table.commandId]: commandId },\n    );\n\n    observation.rows = inserted.rows;\n  });\n\n  const access = Effect.fn(\"passkey.managementAccess\")(function* (\n    mapping: any,\n    moduleId: string,\n    subjectId: Parameters<Port[\"list\"]>[0][\"subjectId\"],\n    mutation: boolean,\n  ) {\n    if (moduleId !== mapping.moduleId || (yield* readModule(mapping)) === undefined)\n      return undefined;\n    if (mutation) yield* lockAdmission(mapping);\n    const subject = yield* currentSubject(mapping, subjectId);\n\n    if (subject === undefined) return undefined;\n    yield* readPolicyGuards(mapping);\n\n    return (yield* metadataAllowed(mapping, subject)) ? subject : undefined;\n  });\n\n  const listCredentials = Effect.fn(\"passkey.listCredentials\")(function* (\n    mapping: any,\n    input: Parameters<Port[\"list\"]>[0],\n  ) {\n    const subject = yield* access(mapping, input.moduleId, input.subjectId, false);\n\n    invariant(subject !== undefined);\n    const rows = [...(yield* credentialRows(mapping, subject))];\n\n    rows.sort((left, right) => {\n      const a = left[mapping.read.credential.credentialId],\n        b = right[mapping.read.credential.credentialId];\n\n      return a < b ? -1 : a > b ? 1 : 0;\n    });\n\n    const eligible = rows.filter(\n      (row) =>\n        input.cursor === undefined || row[mapping.read.credential.credentialId] > input.cursor,\n    );\n\n    const page = eligible.slice(0, input.limit);\n    const credentials = [];\n\n    for (const row of page) {\n      invariant((yield* ownedCredential(mapping, subject, row)) !== undefined);\n      credentials.push(summary(mapping, row));\n    }\n\n    return {\n      credentials,\n      ...(eligible.length > input.limit ? { cursor: credentials.at(-1)!.credentialId } : {}),\n    };\n  });\n\n  const renameCredential = Effect.fn(\"passkey.renameCredential\")(function* (\n    mapping: any,\n    input: Parameters<Port[\"rename\"]>[0],\n  ) {\n    const subject = yield* access(mapping, input.moduleId, input.subjectId, true);\n\n    if (subject === undefined) return { _tag: \"Rejected\" } as const;\n\n    const intent = intentCodec.encode({\n      operation: \"rename\",\n      credentialId: input.credentialId,\n      name: input.name,\n    });\n\n    const prior = yield* command(mapping, subject, input.commandId, input.credentialId, intent);\n\n    if (prior._tag === \"Rejected\") return prior;\n    const rows = yield* credentialRows(mapping, subject);\n\n    const row = rows.find(\n      (item) => item[mapping.read.credential.credentialId] === input.credentialId,\n    );\n\n    if (row === undefined || (yield* ownedCredential(mapping, subject, row)) === undefined)\n      return { _tag: \"Rejected\" } as const;\n    if (prior._tag === \"Replay\")\n      return prior.decision._tag === \"Renamed\"\n        ? { ...prior.decision, replayed: true }\n        : ({ _tag: \"Rejected\" } as const);\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.read.credential;\n\n    yield* owner.update(\n      table.table,\n      { [table.credentialId]: input.credentialId, [table.subjectId]: subject.nativeId },\n      { [mapping.write.credential.name]: input.name },\n    );\n    const credential = summary(mapping, { ...row, [mapping.write.credential.name]: input.name });\n\n    yield* record(\n      mapping,\n      subject,\n      input.commandId,\n      input.credentialId,\n      intent,\n      { _tag: \"Renamed\", credential },\n      input.retentionUntilMillis,\n      prior.observation,\n    );\n\n    return { _tag: \"Renamed\", credential, replayed: false } as const;\n  });\n\n  const inspectRemove = Effect.fn(\"passkey.inspectRemove\")(function* (\n    mapping: any,\n    input: Parameters<Port[\"inspectRemove\"]>[0],\n  ) {\n    const subject = yield* access(mapping, input.moduleId, input.subjectId, false);\n\n    if (subject === undefined) return { _tag: \"Rejected\" } as const;\n\n    const prior = yield* command(\n      mapping,\n      subject,\n      input.commandId,\n      input.credentialId,\n      intentCodec.encode({ operation: \"remove\", credentialId: input.credentialId }),\n    );\n\n    if (prior._tag === \"Rejected\") return prior;\n    if (prior._tag === \"Replay\")\n      return prior.decision._tag === \"Removed\"\n        ? ({ _tag: \"Replay\", result: { ...prior.decision.result, replayed: true } } as const)\n        : ({ _tag: \"Rejected\" } as const);\n\n    const row = (yield* credentialRows(mapping, subject)).find(\n      (item) => item[mapping.read.credential.credentialId] === input.credentialId,\n    );\n\n    const credential =\n      row === undefined ? undefined : yield* ownedCredential(mapping, subject, row);\n\n    return credential === undefined\n      ? ({ _tag: \"Rejected\" } as const)\n      : ({ _tag: \"Target\", credential } as const);\n  });\n\n  const removeCredential = Effect.fn(\"passkey.removeCredential\")(function* (\n    mapping: any,\n    input: Parameters<Port[\"remove\"]>[0],\n  ) {\n    const subject = yield* access(\n      mapping,\n      input.moduleId,\n      input.credential.revision.subjectId,\n      true,\n    );\n\n    if (subject === undefined) return { _tag: \"Rejected\" } as const;\n    const id = input.credential.credentialId;\n    const intent = intentCodec.encode({ operation: \"remove\", credentialId: id });\n    const prior = yield* command(mapping, subject, input.commandId, id, intent);\n\n    if (prior._tag === \"Rejected\") return prior;\n    if (prior._tag === \"Replay\")\n      return prior.decision._tag === \"Removed\"\n        ? ({ _tag: \"Removed\", result: { ...prior.decision.result, replayed: true } } as const)\n        : ({ _tag: \"Rejected\" } as const);\n\n    const row = (yield* credentialRows(mapping, subject)).find(\n      (item) => item[mapping.read.credential.credentialId] === id,\n    );\n\n    const credential =\n      row === undefined ? undefined : yield* ownedCredential(mapping, subject, row);\n\n    const policy = managementPolicy(mapping, subject);\n\n    if (\n      credential === undefined ||\n      !sameCredential(input.credential, credential) ||\n      !sameRevision(input.credential.revision, credential.revision) ||\n      !invalidationMatches(mapping, input.invalidation, policy) ||\n      !invalidationMatches(mapping, input.invalidation, input.management)\n    )\n      return { _tag: \"Rejected\" } as const;\n    if (\n      !(yield* authorizeAction(\n        mapping,\n        subject,\n        input.authorization,\n        {\n          action: \"remove\",\n          commandId: input.commandId,\n          flowId: input.commandId,\n          bindingDigest: removeDigest(mapping.moduleId, input.commandId, input.credential),\n          revision: input.credential.revision,\n        },\n        {\n          ...policy,\n          maximumEvidenceAgeMillis: Math.min(\n            policy.maximumEvidenceAgeMillis,\n            input.management.maximumEvidenceAgeMillis,\n          ),\n        },\n      ))\n    )\n      return { _tag: \"Rejected\" } as const;\n    const owner = yield* CurrentPasskeyTransaction;\n\n    const remainingEffect: Effect.Effect<SQL, PersistenceMappingError> =\n      mapping.write.policy.remainingSignIn(subject.nativeId, id, copiedRow(subject.row));\n\n    const remaining = yield* remainingEffect;\n\n    if (!(yield* owner.check(remaining))) return { _tag: \"LastSignInMethod\" } as const;\n    const read = mapping.read;\n    const table = read.credential;\n\n    yield* owner.update(\n      table.table,\n      { [table.credentialId]: id, [table.subjectId]: subject.nativeId },\n      {\n        [table.status]: mapping.write.credential.removedStatus,\n        [table.credentialRevision]: owner.marker,\n      },\n    );\n    const factor = read.authority;\n\n    yield* owner.update(\n      factor.table,\n      { [factor.subjectId]: subject.nativeId, [factor.credentialId]: id },\n      { [factor.status]: mapping.write.authority.removedStatus, [factor.revision]: owner.marker },\n    );\n    for (const observation of owner.observations) {\n      if (observation.table === table.table)\n        observation.rows = observation.rows.filter((item) => item[table.credentialId] !== id);\n      if (observation.table === factor.table)\n        observation.rows = observation.rows.filter((item) => item[factor.credentialId] !== id);\n    }\n    const tuple = read.credentialOwnership;\n\n    yield* owner.update(\n      tuple.table,\n      { [tuple.credentialKey]: credentialKey(credential.rpId, credential.protocolCredentialId) },\n      {\n        [tuple.state]: mapping.write.credentialOwnership.removedState,\n        [tuple.version]: owner.marker,\n      },\n    );\n    yield* invalidate(mapping, subject, input.invalidation);\n    owner.postconditions.push(\n      remaining,\n      sql`not exists(select 1 from ${table.table} where ${both(equal(table.table, { [table.credentialId]: id }), table.activeCondition)})`,\n      sql`not exists(select 1 from ${factor.table} where ${both(equal(factor.table, { [factor.subjectId]: subject.nativeId, [factor.credentialId]: id }), factor.activeCondition)})`,\n    );\n\n    const result = {\n      credentialId: credential.credentialId,\n      replayed: false,\n      invalidation: input.invalidation,\n    };\n\n    yield* record(\n      mapping,\n      subject,\n      input.commandId,\n      id,\n      intent,\n      { _tag: \"Removed\", result },\n      input.retentionUntilMillis,\n      prior.observation,\n    );\n\n    return { _tag: \"Removed\", result } as const;\n  });\n\n  return { listCredentials, renameCredential, inspectRemove, removeCredential };\n};\n"],"mappings":";;;;AAoBA,MAAa,+BACX,YACA,WACA,aAIA,OAIA,YAcA,iBACG;CACH,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,kBAAkB;CAC1B,MAAM,EAAE,YAAY,qBAAqB;CACzC,MAAM,EAAE,eAAe,WAAW,OAAO,gBAAgB,iBAAiB;CAC1E,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,iBACA,gBACA,gBACA,YACA,qBACA,aACA,kBACA,iBACA,iBACA,cACA,YACE;CAEJ,MAAM,EAAE,SAAS;CAEjB,MAAM,gBAAgB,YACpB,OAAO,MAAM,CACX,OAAO,aAAa,WAAW,EAAE,YAAY,yBAAyB,CAAC,GACvE,OAAO,aAAa,WAAW,EAAE,QAAQ,eAAe,CAAC,CAC3D,CAAC,CACH;CAEA,MAAM,cAAc,YAClB,OAAO,OAAO;EACZ,WAAW,OAAO,SAAS,CAAC,UAAU,QAAQ,CAAC;EAC/C,cAAc,OAAO;EACrB,MAAM,OAAO,YAAY,OAAO,MAAM;CACxC,CAAC,CACH;CAEA,MAAM,UAAU,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACrD,SACA,SACA,WACA,cACA,QACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAEtB,MAAM,cAAc,OAAO,MAAM,KAC/B,MAAM,OACN,MAAM,MAAM,OAAO;IAAG,MAAM,WAAW,QAAQ;IAAW,MAAM,YAAY;EAAU,CAAC,GACvF,EAAE,OAAO,EAAE,CACb;EAEA,MAAM,MAAM,YAAY,KAAK;EAE7B,IAAI,QAAQ,KAAA,GAAW,OAAO;GAAE,MAAM;GAAO;EAAY;EACzD,IACE,CAAC,QAAQ,KAAK,WAAW,OAAO,IAAI,MAAM,YAAY,QAAQ,QAAQ,KACtE,IAAI,MAAM,kBAAkB,gBAC5B,IAAI,MAAM,YAAY,QAEtB,OAAO,EAAE,MAAM,WAAW;EAE5B,OAAO;GAAE,MAAM;GAAU,UAAU,cAAc,OAAO,IAAI,MAAM,SAAS;EAAE;CAC/E,CAAC;CAED,MAAM,SAAS,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC1D,SACA,SACA,WACA,cACA,QACA,UACA,sBACA,aACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAuBtB,YAAY,QAAO,OArBK,MAAM,OAC5B,MAAM,OACN;GACE,GAAG,MAAM,aAAa;IACpB,UAAU,QAAQ;IAClB,WAAW,QAAQ;IACnB;IACA;GACF,CAAC;IACA,MAAM,WAAW,QAAQ;IACzB,MAAM,YAAY;IAClB,MAAM,YAAY,QAAQ;IAC1B,MAAM,eAAe;IACrB,MAAM,SAAS;IACf,MAAM,WAAW,cAAc,OAAO,QAAQ;IAC9C,MAAM,iBAAiB,QAAQ,MAAM,cAAc,oBAAoB;IACvE,MAAM,UAAU,MAAM;EACzB,GACA;IAAG,MAAM,WAAW,QAAQ;IAAW,MAAM,YAAY;EAAU,CACrE,EAAA,CAE4B;CAC9B,CAAC;CAED,MAAM,SAAS,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACnD,SACA,UACA,WACA,UACA;EACA,IAAI,aAAa,QAAQ,aAAa,OAAO,WAAW,OAAO,OAAO,KAAA,GACpE,OAAO,KAAA;EACT,IAAI,UAAU,OAAO,cAAc,OAAO;EAC1C,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS;EAExD,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;EAClC,OAAO,iBAAiB,OAAO;EAE/B,QAAQ,OAAO,gBAAgB,SAAS,OAAO,KAAK,UAAU,KAAA;CAChE,CAAC;CA8PD,OAAO;EAAE,iBA5Pe,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA;GACA,MAAM,UAAU,OAAO,OAAO,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;GAE7E,UAAU,YAAY,KAAA,CAAS;GAC/B,MAAM,OAAO,CAAC,GAAI,OAAO,eAAe,SAAS,OAAO,CAAE;GAE1D,KAAK,MAAM,MAAM,UAAU;IACzB,MAAM,IAAI,KAAK,QAAQ,KAAK,WAAW,eACrC,IAAI,MAAM,QAAQ,KAAK,WAAW;IAEpC,OAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;GAClC,CAAC;GAED,MAAM,WAAW,KAAK,QACnB,QACC,MAAM,WAAW,KAAA,KAAa,IAAI,QAAQ,KAAK,WAAW,gBAAgB,MAAM,MACpF;GAEA,MAAM,OAAO,SAAS,MAAM,GAAG,MAAM,KAAK;GAC1C,MAAM,cAAc,CAAC;GAErB,KAAK,MAAM,OAAO,MAAM;IACtB,WAAW,OAAO,gBAAgB,SAAS,SAAS,GAAG,OAAO,KAAA,CAAS;IACvE,YAAY,KAAK,QAAQ,SAAS,GAAG,CAAC;GACxC;GAEA,OAAO;IACL;IACA,GAAI,SAAS,SAAS,MAAM,QAAQ,EAAE,QAAQ,YAAY,GAAG,EAAE,CAAC,CAAE,aAAa,IAAI,CAAC;GACtF;EACF,CA2NuB;EAAG,kBAzND,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;GACA,MAAM,UAAU,OAAO,OAAO,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI;GAE5E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAErD,MAAM,SAAS,YAAY,OAAO;IAChC,WAAW;IACX,cAAc,MAAM;IACpB,MAAM,MAAM;GACd,CAAC;GAED,MAAM,QAAQ,OAAO,QAAQ,SAAS,SAAS,MAAM,WAAW,MAAM,cAAc,MAAM;GAE1F,IAAI,MAAM,SAAS,YAAY,OAAO;GAGtC,MAAM,OAAM,OAFQ,eAAe,SAAS,OAAO,EAAA,CAElC,MACd,SAAS,KAAK,QAAQ,KAAK,WAAW,kBAAkB,MAAM,YACjE;GAEA,IAAI,QAAQ,KAAA,MAAc,OAAO,gBAAgB,SAAS,SAAS,GAAG,OAAO,KAAA,GAC3E,OAAO,EAAE,MAAM,WAAW;GAC5B,IAAI,MAAM,SAAS,UACjB,OAAO,MAAM,SAAS,SAAS,YAC3B;IAAE,GAAG,MAAM;IAAU,UAAU;GAAK,IACnC,EAAE,MAAM,WAAW;GAC1B,MAAM,QAAQ,OAAO;GACrB,MAAM,QAAQ,QAAQ,KAAK;GAE3B,OAAO,MAAM,OACX,MAAM,OACN;KAAG,MAAM,eAAe,MAAM;KAAe,MAAM,YAAY,QAAQ;GAAS,GAChF,GAAG,QAAQ,MAAM,WAAW,OAAO,MAAM,KAAK,CAChD;GACA,MAAM,aAAa,QAAQ,SAAS;IAAE,GAAG;KAAM,QAAQ,MAAM,WAAW,OAAO,MAAM;GAAK,CAAC;GAE3F,OAAO,OACL,SACA,SACA,MAAM,WACN,MAAM,cACN,QACA;IAAE,MAAM;IAAW;GAAW,GAC9B,MAAM,sBACN,MAAM,WACR;GAEA,OAAO;IAAE,MAAM;IAAW;IAAY,UAAU;GAAM;EACxD,CAsKyC;EAAG,eApKtB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA;GACA,MAAM,UAAU,OAAO,OAAO,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;GAE7E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAErD,MAAM,QAAQ,OAAO,QACnB,SACA,SACA,MAAM,WACN,MAAM,cACN,YAAY,OAAO;IAAE,WAAW;IAAU,cAAc,MAAM;GAAa,CAAC,CAC9E;GAEA,IAAI,MAAM,SAAS,YAAY,OAAO;GACtC,IAAI,MAAM,SAAS,UACjB,OAAO,MAAM,SAAS,SAAS,YAC1B;IAAE,MAAM;IAAU,QAAQ;KAAE,GAAG,MAAM,SAAS;KAAQ,UAAU;IAAK;GAAE,IACvE,EAAE,MAAM,WAAW;GAE1B,MAAM,OAAO,OAAO,eAAe,SAAS,OAAO,EAAA,CAAG,MACnD,SAAS,KAAK,QAAQ,KAAK,WAAW,kBAAkB,MAAM,YACjE;GAEA,MAAM,aACJ,QAAQ,KAAA,IAAY,KAAA,IAAY,OAAO,gBAAgB,SAAS,SAAS,GAAG;GAE9E,OAAO,eAAe,KAAA,IACjB,EAAE,MAAM,WAAW,IACnB;IAAE,MAAM;IAAU;GAAW;EACpC,CAoIwD;EAAG,kBAlIlC,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;GACA,MAAM,UAAU,OAAO,OACrB,SACA,MAAM,UACN,MAAM,WAAW,SAAS,WAC1B,IACF;GAEA,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACrD,MAAM,KAAK,MAAM,WAAW;GAC5B,MAAM,SAAS,YAAY,OAAO;IAAE,WAAW;IAAU,cAAc;GAAG,CAAC;GAC3E,MAAM,QAAQ,OAAO,QAAQ,SAAS,SAAS,MAAM,WAAW,IAAI,MAAM;GAE1E,IAAI,MAAM,SAAS,YAAY,OAAO;GACtC,IAAI,MAAM,SAAS,UACjB,OAAO,MAAM,SAAS,SAAS,YAC1B;IAAE,MAAM;IAAW,QAAQ;KAAE,GAAG,MAAM,SAAS;KAAQ,UAAU;IAAK;GAAE,IACxE,EAAE,MAAM,WAAW;GAE1B,MAAM,OAAO,OAAO,eAAe,SAAS,OAAO,EAAA,CAAG,MACnD,SAAS,KAAK,QAAQ,KAAK,WAAW,kBAAkB,EAC3D;GAEA,MAAM,aACJ,QAAQ,KAAA,IAAY,KAAA,IAAY,OAAO,gBAAgB,SAAS,SAAS,GAAG;GAE9E,MAAM,SAAS,iBAAiB,SAAS,OAAO;GAEhD,IACE,eAAe,KAAA,KACf,CAAC,eAAe,MAAM,YAAY,UAAU,KAC5C,CAAC,aAAa,MAAM,WAAW,UAAU,WAAW,QAAQ,KAC5D,CAAC,oBAAoB,SAAS,MAAM,cAAc,MAAM,KACxD,CAAC,oBAAoB,SAAS,MAAM,cAAc,MAAM,UAAU,GAElE,OAAO,EAAE,MAAM,WAAW;GAC5B,IACE,EAAE,OAAO,gBACP,SACA,SACA,MAAM,eACN;IACE,QAAQ;IACR,WAAW,MAAM;IACjB,QAAQ,MAAM;IACd,eAAe,aAAa,QAAQ,UAAU,MAAM,WAAW,MAAM,UAAU;IAC/E,UAAU,MAAM,WAAW;GAC7B,GACA;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,CACF,IAEA,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,QAAQ,OAAO;GAKrB,MAAM,YAAY,OAFhB,QAAQ,MAAM,OAAO,gBAAgB,QAAQ,UAAU,IAAI,UAAU,QAAQ,GAAG,CAE3C;GAEvC,IAAI,EAAE,OAAO,MAAM,MAAM,SAAS,IAAI,OAAO,EAAE,MAAM,mBAAmB;GACxE,MAAM,OAAO,QAAQ;GACrB,MAAM,QAAQ,KAAK;GAEnB,OAAO,MAAM,OACX,MAAM,OACN;KAAG,MAAM,eAAe;KAAK,MAAM,YAAY,QAAQ;GAAS,GAChE;KACG,MAAM,SAAS,QAAQ,MAAM,WAAW;KACxC,MAAM,qBAAqB,MAAM;GACpC,CACF;GACA,MAAM,SAAS,KAAK;GAEpB,OAAO,MAAM,OACX,OAAO,OACP;KAAG,OAAO,YAAY,QAAQ;KAAW,OAAO,eAAe;GAAG,GAClE;KAAG,OAAO,SAAS,QAAQ,MAAM,UAAU;KAAgB,OAAO,WAAW,MAAM;GAAO,CAC5F;GACA,KAAK,MAAM,eAAe,MAAM,cAAc;IAC5C,IAAI,YAAY,UAAU,MAAM,OAC9B,YAAY,OAAO,YAAY,KAAK,QAAQ,SAAS,KAAK,MAAM,kBAAkB,EAAE;IACtF,IAAI,YAAY,UAAU,OAAO,OAC/B,YAAY,OAAO,YAAY,KAAK,QAAQ,SAAS,KAAK,OAAO,kBAAkB,EAAE;GACzF;GACA,MAAM,QAAQ,KAAK;GAEnB,OAAO,MAAM,OACX,MAAM,OACN,GAAG,MAAM,gBAAgB,cAAc,WAAW,MAAM,WAAW,oBAAoB,EAAE,GACzF;KACG,MAAM,QAAQ,QAAQ,MAAM,oBAAoB;KAChD,MAAM,UAAU,MAAM;GACzB,CACF;GACA,OAAO,WAAW,SAAS,SAAS,MAAM,YAAY;GACtD,MAAM,eAAe,KACnB,WACA,GAAG,4BAA4B,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,GAAG,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,eAAe,EAAE,IAClI,GAAG,4BAA4B,OAAO,MAAM,SAAS,KAAK,MAAM,OAAO,OAAO;KAAG,OAAO,YAAY,QAAQ;KAAW,OAAO,eAAe;GAAG,CAAC,GAAG,OAAO,eAAe,EAAE,EAC9K;GAEA,MAAM,SAAS;IACb,cAAc,WAAW;IACzB,UAAU;IACV,cAAc,MAAM;GACtB;GAEA,OAAO,OACL,SACA,SACA,MAAM,WACN,IACA,QACA;IAAE,MAAM;IAAW;GAAO,GAC1B,MAAM,sBACN,MAAM,WACR;GAEA,OAAO;IAAE,MAAM;IAAW;GAAO;EACnC,CAE0E;CAAE;AAC9E"}

package/dist/internal/passkey/registration-ceremony.d.mts

@@ -0,0 +1,9 @@
+import "../query-operations.mjs";
+import "../transaction-kernel.mjs";
+import "./state.mjs";
+import "./credentials.mjs";
+import "./admission.mjs";
+import "./registration-custody.mjs";
+import "./flow.mjs";
+import { Effect } from "effect";
+import { PasskeyAccess, PasskeyCeremony, PasskeyMethodPolicy } from "@yielded/auth/Passkey";

package/dist/internal/passkey/registration-ceremony.mjs

@@ -0,0 +1,129 @@
+import { CurrentPasskeyTransaction } from "./state.mjs";
+import { Effect } from "effect";
+import { PasskeyClaim, snapshotPasskeySync } from "@yielded/auth/Passkey";
+//#region src/internal/passkey/registration-ceremony.ts
+const makePasskeyRegistrationCeremonyKernel = (operations, admission, credentials, flow, registrationCustody, state, transactions) => {
+	const { sql } = operations;
+	const { admissionCondition, guardAdmission, guardChargeSet, lockAdmission, readCharges } = admission;
+	const { readModule, readPolicyGuards } = credentials;
+	const { compatiblePolicy, liveCondition, matchesAccess, readFlow, terminalFlow } = flow;
+	const { releaseRegistrationCustody } = registrationCustody;
+	const { ceremonyStorage, equal, handleKey, mappedColumns, policyStorage } = state;
+	const invariant = state.invariant;
+	const { both } = transactions;
+	/** The issuing registration authority owns the application value and reservation.
+	* This facet only compares its opaque custody and cannot issue or provision. */
+	const custody = Effect.fn("passkey.registrationCustody")(function* (mapping, ceremony, pending) {
+		const owner = yield* CurrentPasskeyTransaction;
+		invariant(ceremony.context._tag === "Registration");
+		const context = ceremony.context, intent = mapping.intent, handle = mapping.handle;
+		const identity = {
+			[intent.moduleId]: mapping.moduleId,
+			[intent.flowId]: ceremony.flowId
+		};
+		const advisory = (yield* owner.read(intent.table, equal(intent.table, identity), {
+			limit: 1,
+			lock: false,
+			observe: false
+		})).rows[0];
+		if (advisory === void 0) return false;
+		const hashedHandle = handleKey(ceremony.profile.rpId, context.userHandle);
+		const held = (yield* owner.read(handle.table, equal(handle.table, { [handle.handleKey]: hashedHandle }), {
+			limit: 1,
+			columns: mappedColumns(handle)
+		})).rows[0];
+		if (held === void 0 || !handle.isReservedState(held[handle.state]) || held[handle.handleKey] !== hashedHandle || held[handle.rpId] !== ceremony.profile.rpId || held[handle.userHandle] !== context.userHandle || held[handle.reservationId] !== advisory[intent.reservationId]) return false;
+		const heldCondition = sql`exists (select 1 from ${handle.table} where ${both(owner.exact(handle.table, held), handle.reservedCondition)})`;
+		if (!(yield* owner.check(heldCondition))) return false;
+		const row = (yield* owner.read(intent.table, equal(intent.table, identity), {
+			limit: 1,
+			columns: mappedColumns(intent)
+		})).rows[0];
+		if (row === void 0 || row[intent.commandId] !== ceremony.commandId || row[intent.fingerprint] !== context.fingerprint || row[intent.handleKey] !== hashedHandle || row[intent.reservationId] !== held[handle.reservationId] || row[intent.ceremonySnapshot] !== ceremonyStorage.encode(ceremony) || typeof row[intent.applicationSnapshot] !== "string" || new TextEncoder().encode(row[intent.applicationSnapshot]).length > 1048576 || pending && !intent.isPendingState(row[intent.state])) return false;
+		const condition = pending ? intent.pendingCondition : intent.custodyCondition;
+		if (!(yield* owner.check(sql`exists (select 1 from ${intent.table} where ${both(owner.exact(intent.table, row), condition)})`))) return false;
+		return [heldCondition, sql`exists (select 1 from ${intent.table} where ${both(owner.exact(intent.table, row), condition)})`];
+	});
+	return {
+		contextRegistration: Effect.fn("passkey.contextRegistration")(function* (mapping, access) {
+			const owner = yield* CurrentPasskeyTransaction;
+			if (access.moduleId !== mapping.moduleId) return void 0;
+			const current = yield* readModule(mapping);
+			if (current === void 0) return void 0;
+			yield* readPolicyGuards(mapping);
+			const table = mapping.flow;
+			const advisory = (yield* owner.read(table.table, equal(table.table, {
+				[table.moduleId]: mapping.moduleId,
+				[table.flowId]: access.flowId
+			}), {
+				limit: 1,
+				lock: false,
+				observe: false
+			})).rows[0];
+			if (advisory === void 0) return void 0;
+			const ceremony = ceremonyStorage.decode(advisory[table.snapshot]);
+			if (ceremony.purpose !== "registration" || !matchesAccess(ceremony, access)) return void 0;
+			const held = yield* custody(mapping, ceremony, true);
+			if (!held) return void 0;
+			const read = yield* readFlow(mapping, access.flowId);
+			if (read === void 0 || read.state !== "Pending" || ceremonyStorage.encode(read.ceremony) !== ceremonyStorage.encode(ceremony) || !compatiblePolicy(read.ceremony, read.policy, current) || !(yield* owner.check(liveCondition(mapping, ceremony)))) return void 0;
+			owner.postconditions.push(...held, liveCondition(mapping, ceremony));
+			return read.ceremony;
+		}),
+		claimRegistration: Effect.fn("passkey.claimRegistration")(function* (mapping, input) {
+			const owner = yield* CurrentPasskeyTransaction;
+			const current = yield* readModule(mapping);
+			if (current === void 0 || input.access.moduleId !== mapping.moduleId) return { _tag: "Rejected" };
+			yield* lockAdmission(mapping);
+			yield* readPolicyGuards(mapping);
+			const held = yield* custody(mapping, input.ceremony, true);
+			const read = yield* readFlow(mapping, input.access.flowId);
+			if (read === void 0 || read.state !== "Pending" || !matchesAccess(read.ceremony, input.access)) return { _tag: "Rejected" };
+			invariant(ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(input.ceremony));
+			if (!held || !compatiblePolicy(read.ceremony, read.policy, current) || policyStorage.encode(current) !== policyStorage.encode(input.policy) || !(yield* owner.check(liveCondition(mapping, read.ceremony))) || !(yield* owner.check(admissionCondition(mapping, [read.policy, current], read.ceremony, void 0, [], false, false)))) {
+				if (held) yield* releaseRegistrationCustody(mapping, read.ceremony);
+				yield* terminalFlow(mapping, read, "Rejected");
+				return { _tag: "Rejected" };
+			}
+			yield* readCharges(mapping, read.ceremony, read.policy, void 0);
+			const claimedAtMillis = yield* owner.now(mapping.clock);
+			const claim = snapshotPasskeySync(PasskeyClaim, {
+				ceremony: read.ceremony,
+				claimId: input.claimId,
+				claimedAtMillis,
+				claimExpiresAtMillis: Math.min(claimedAtMillis + read.ceremony.claimLifetimeMillis, read.ceremony.expiresAtMillis)
+			});
+			const table = mapping.flow;
+			yield* owner.update(table.table, {
+				[table.moduleId]: mapping.moduleId,
+				[table.flowId]: read.ceremony.flowId
+			}, {
+				[table.state]: table.states.Claimed,
+				[table.version]: owner.marker,
+				[table.claimId]: claim.claimId,
+				[table.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),
+				[table.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis)
+			});
+			yield* guardChargeSet(mapping, read.ceremony, void 0);
+			yield* guardAdmission(mapping, [read.policy, current], read.ceremony, void 0);
+			owner.postconditions.push(...held, liveCondition(mapping, read.ceremony, claim));
+			return {
+				_tag: "Claimed",
+				claim
+			};
+		}),
+		settleRegistration: Effect.fn("passkey.settleRegistration")(function* (mapping, claim, outcome) {
+			yield* readModule(mapping);
+			yield* lockAdmission(mapping);
+			yield* readPolicyGuards(mapping);
+			const read = yield* readFlow(mapping, claim.ceremony.flowId);
+			if (read === void 0 || read.state !== "Claimed" || read.claim === void 0 || read.claim.claimId !== claim.claimId || read.claim.claimedAtMillis !== claim.claimedAtMillis || read.claim.claimExpiresAtMillis !== claim.claimExpiresAtMillis || ceremonyStorage.encode(read.ceremony) !== ceremonyStorage.encode(claim.ceremony)) return "Rejected";
+			if (outcome === "Rejected") yield* releaseRegistrationCustody(mapping, claim.ceremony);
+			return yield* terminalFlow(mapping, read, outcome);
+		})
+	};
+};
+//#endregion
+export { makePasskeyRegistrationCeremonyKernel };
+
+//# sourceMappingURL=registration-ceremony.mjs.map

package/dist/internal/passkey/registration-ceremony.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-ceremony.mjs","names":[],"sources":["../../../src/internal/passkey/registration-ceremony.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport {\n  PasskeyClaim,\n  type PasskeyAccess,\n  type PasskeyCeremony,\n  type PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport { Effect } from \"effect\";\n\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport type { makePasskeyAdmissionKernel } from \"./admission\";\nimport type { makePasskeyCredentialsKernel } from \"./credentials\";\nimport type { makePasskeyFlowKernel } from \"./flow\";\nimport type { makePasskeyRegistrationCustodyKernel } from \"./registration-custody\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport const makePasskeyRegistrationCeremonyKernel = (\n  operations: QueryOperations,\n  admission: Pick<\n    ReturnType<typeof makePasskeyAdmissionKernel>,\n    \"admissionCondition\" | \"guardAdmission\" | \"guardChargeSet\" | \"lockAdmission\" | \"readCharges\"\n  >,\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"readModule\" | \"readPolicyGuards\"\n  >,\n  flow: Pick<\n    ReturnType<typeof makePasskeyFlowKernel>,\n    \"compatiblePolicy\" | \"liveCondition\" | \"matchesAccess\" | \"readFlow\" | \"terminalFlow\"\n  >,\n  registrationCustody: Pick<\n    ReturnType<typeof makePasskeyRegistrationCustodyKernel>,\n    \"releaseRegistrationCustody\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    \"ceremonyStorage\" | \"equal\" | \"handleKey\" | \"invariant\" | \"mappedColumns\" | \"policyStorage\"\n  >,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n  const { sql } = operations;\n\n  const { admissionCondition, guardAdmission, guardChargeSet, lockAdmission, readCharges } =\n    admission;\n\n  const { readModule, readPolicyGuards } = credentials;\n  const { compatiblePolicy, liveCondition, matchesAccess, readFlow, terminalFlow } = flow;\n  const { releaseRegistrationCustody } = registrationCustody;\n  const { ceremonyStorage, equal, handleKey, mappedColumns, policyStorage } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n  const { both } = transactions;\n\n  /** The issuing registration authority owns the application value and reservation.\n   * This facet only compares its opaque custody and cannot issue or provision. */\n  const custody = Effect.fn(\"passkey.registrationCustody\")(function* (\n    mapping: any,\n    ceremony: PasskeyCeremony,\n    pending: boolean,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    invariant(ceremony.context._tag === \"Registration\");\n\n    const context = ceremony.context,\n      intent = mapping.intent,\n      handle = mapping.handle;\n\n    const identity = { [intent.moduleId]: mapping.moduleId, [intent.flowId]: ceremony.flowId };\n\n    const advisory = (yield* owner.read(intent.table, equal(intent.table, identity), {\n      limit: 1,\n      lock: false,\n      observe: false,\n    })).rows[0];\n\n    if (advisory === undefined) return false;\n    const hashedHandle = handleKey(ceremony.profile.rpId, context.userHandle);\n\n    const held = (yield* owner.read(\n      handle.table,\n      equal(handle.table, { [handle.handleKey]: hashedHandle }),\n      { limit: 1, columns: mappedColumns(handle) },\n    )).rows[0];\n\n    if (\n      held === undefined ||\n      !handle.isReservedState(held[handle.state]) ||\n      held[handle.handleKey] !== hashedHandle ||\n      held[handle.rpId] !== ceremony.profile.rpId ||\n      held[handle.userHandle] !== context.userHandle ||\n      held[handle.reservationId] !== advisory[intent.reservationId]\n    )\n      return false;\n    const heldCondition = sql`exists (select 1 from ${handle.table} where ${both(owner.exact(handle.table, held), handle.reservedCondition)})`;\n\n    if (!(yield* owner.check(heldCondition))) return false;\n\n    const row = (yield* owner.read(intent.table, equal(intent.table, identity), {\n      limit: 1,\n      columns: mappedColumns(intent),\n    })).rows[0];\n\n    if (\n      row === undefined ||\n      row[intent.commandId] !== ceremony.commandId ||\n      row[intent.fingerprint] !== context.fingerprint ||\n      row[intent.handleKey] !== hashedHandle ||\n      row[intent.reservationId] !== held[handle.reservationId] ||\n      row[intent.ceremonySnapshot] !== ceremonyStorage.encode(ceremony) ||\n      typeof row[intent.applicationSnapshot] !== \"string\" ||\n      new TextEncoder().encode(row[intent.applicationSnapshot]).length > 1048576 ||\n      (pending && !intent.isPendingState(row[intent.state]))\n    )\n      return false;\n    const condition = pending ? intent.pendingCondition : intent.custodyCondition;\n\n    if (\n      !(yield* owner.check(\n        sql`exists (select 1 from ${intent.table} where ${both(owner.exact(intent.table, row), condition)})`,\n      ))\n    )\n      return false;\n\n    return [\n      heldCondition,\n      sql`exists (select 1 from ${intent.table} where ${both(owner.exact(intent.table, row), condition)})`,\n    ];\n  });\n\n  const contextRegistration = Effect.fn(\"passkey.contextRegistration\")(function* (\n    mapping: any,\n    access: PasskeyAccess,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    if (access.moduleId !== mapping.moduleId) return undefined;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined) return undefined;\n    yield* readPolicyGuards(mapping);\n    const table = mapping.flow;\n\n    const advisory = (yield* owner.read(\n      table.table,\n      equal(table.table, { [table.moduleId]: mapping.moduleId, [table.flowId]: access.flowId }),\n      { limit: 1, lock: false, observe: false },\n    )).rows[0];\n\n    if (advisory === undefined) return undefined;\n    const ceremony = ceremonyStorage.decode(advisory[table.snapshot]);\n\n    if (ceremony.purpose !== \"registration\" || !matchesAccess(ceremony, access)) return undefined;\n    const held = yield* custody(mapping, ceremony, true);\n\n    if (!held) return undefined;\n    const read = yield* readFlow(mapping, access.flowId);\n\n    if (\n      read === undefined ||\n      read.state !== \"Pending\" ||\n      ceremonyStorage.encode(read.ceremony) !== ceremonyStorage.encode(ceremony) ||\n      !compatiblePolicy(read.ceremony, read.policy, current) ||\n      !(yield* owner.check(liveCondition(mapping, ceremony)))\n    )\n      return undefined;\n    owner.postconditions.push(...held, liveCondition(mapping, ceremony));\n\n    return read.ceremony;\n  });\n\n  const claimRegistration = Effect.fn(\"passkey.claimRegistration\")(function* (\n    mapping: any,\n    input: {\n      readonly access: PasskeyAccess;\n      readonly policy: PasskeyMethodPolicy;\n      readonly ceremony: PasskeyCeremony;\n      readonly claimId: string;\n    },\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined || input.access.moduleId !== mapping.moduleId)\n      return { _tag: \"Rejected\" } as const;\n    yield* lockAdmission(mapping);\n    yield* readPolicyGuards(mapping);\n    const held = yield* custody(mapping, input.ceremony, true);\n    const read = yield* readFlow(mapping, input.access.flowId);\n\n    if (\n      read === undefined ||\n      read.state !== \"Pending\" ||\n      !matchesAccess(read.ceremony, input.access)\n    )\n      return { _tag: \"Rejected\" } as const;\n    invariant(ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(input.ceremony));\n    if (\n      !held ||\n      !compatiblePolicy(read.ceremony, read.policy, current) ||\n      policyStorage.encode(current) !== policyStorage.encode(input.policy) ||\n      !(yield* owner.check(liveCondition(mapping, read.ceremony))) ||\n      !(yield* owner.check(\n        admissionCondition(\n          mapping,\n          [read.policy, current],\n          read.ceremony,\n          undefined,\n          [],\n          false,\n          false,\n        ),\n      ))\n    ) {\n      if (held) yield* releaseRegistrationCustody(mapping, read.ceremony);\n      yield* terminalFlow(mapping, read, \"Rejected\");\n\n      return { _tag: \"Rejected\" } as const;\n    }\n    yield* readCharges(mapping, read.ceremony, read.policy, undefined);\n    const claimedAtMillis = yield* owner.now(mapping.clock);\n\n    const claim = snapshotPasskeySync(PasskeyClaim, {\n      ceremony: read.ceremony,\n      claimId: input.claimId,\n      claimedAtMillis,\n      claimExpiresAtMillis: Math.min(\n        claimedAtMillis + read.ceremony.claimLifetimeMillis,\n        read.ceremony.expiresAtMillis,\n      ),\n    });\n\n    const table = mapping.flow;\n\n    yield* owner.update(\n      table.table,\n      { [table.moduleId]: mapping.moduleId, [table.flowId]: read.ceremony.flowId },\n      {\n        [table.state]: table.states.Claimed,\n        [table.version]: owner.marker,\n        [table.claimId]: claim.claimId,\n        [table.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),\n        [table.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),\n      },\n    );\n    yield* guardChargeSet(mapping, read.ceremony, undefined);\n    yield* guardAdmission(mapping, [read.policy, current], read.ceremony, undefined);\n    owner.postconditions.push(...held, liveCondition(mapping, read.ceremony, claim));\n\n    return { _tag: \"Claimed\", claim } as const;\n  });\n\n  const settleRegistration = Effect.fn(\"passkey.settleRegistration\")(function* (\n    mapping: any,\n    claim: PasskeyClaim,\n    outcome: \"Rejected\" | \"Ambiguous\",\n  ) {\n    yield* readModule(mapping);\n    yield* lockAdmission(mapping);\n    yield* readPolicyGuards(mapping);\n    const read = yield* readFlow(mapping, claim.ceremony.flowId);\n\n    if (\n      read === undefined ||\n      read.state !== \"Claimed\" ||\n      read.claim === undefined ||\n      read.claim.claimId !== claim.claimId ||\n      read.claim.claimedAtMillis !== claim.claimedAtMillis ||\n      read.claim.claimExpiresAtMillis !== claim.claimExpiresAtMillis ||\n      ceremonyStorage.encode(read.ceremony) !== ceremonyStorage.encode(claim.ceremony)\n    )\n      return \"Rejected\" as const;\n\n    if (outcome === \"Rejected\") yield* releaseRegistrationCustody(mapping, claim.ceremony);\n\n    return yield* terminalFlow(mapping, read, outcome);\n  });\n\n  return { contextRegistration, claimRegistration, settleRegistration };\n};\n"],"mappings":";;;;AAoBA,MAAa,yCACX,YACA,WAIA,aAIA,MAIA,qBAIA,OAIA,iBACG;CACH,MAAM,EAAE,QAAQ;CAEhB,MAAM,EAAE,oBAAoB,gBAAgB,gBAAgB,eAAe,gBACzE;CAEF,MAAM,EAAE,YAAY,qBAAqB;CACzC,MAAM,EAAE,kBAAkB,eAAe,eAAe,UAAU,iBAAiB;CACnF,MAAM,EAAE,+BAA+B;CACvC,MAAM,EAAE,iBAAiB,OAAO,WAAW,eAAe,kBAAkB;CAC5E,MAAM,YAA+C,MAAM;CAC3D,MAAM,EAAE,SAAS;;;CAIjB,MAAM,UAAU,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACvD,SACA,UACA,SACA;EACA,MAAM,QAAQ,OAAO;EAErB,UAAU,SAAS,QAAQ,SAAS,cAAc;EAElD,MAAM,UAAU,SAAS,SACvB,SAAS,QAAQ,QACjB,SAAS,QAAQ;EAEnB,MAAM,WAAW;IAAG,OAAO,WAAW,QAAQ;IAAW,OAAO,SAAS,SAAS;EAAO;EAEzF,MAAM,YAAY,OAAO,MAAM,KAAK,OAAO,OAAO,MAAM,OAAO,OAAO,QAAQ,GAAG;GAC/E,OAAO;GACP,MAAM;GACN,SAAS;EACX,CAAC,EAAA,CAAG,KAAK;EAET,IAAI,aAAa,KAAA,GAAW,OAAO;EACnC,MAAM,eAAe,UAAU,SAAS,QAAQ,MAAM,QAAQ,UAAU;EAExE,MAAM,QAAQ,OAAO,MAAM,KACzB,OAAO,OACP,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,aAAa,CAAC,GACxD;GAAE,OAAO;GAAG,SAAS,cAAc,MAAM;EAAE,CAC7C,EAAA,CAAG,KAAK;EAER,IACE,SAAS,KAAA,KACT,CAAC,OAAO,gBAAgB,KAAK,OAAO,MAAM,KAC1C,KAAK,OAAO,eAAe,gBAC3B,KAAK,OAAO,UAAU,SAAS,QAAQ,QACvC,KAAK,OAAO,gBAAgB,QAAQ,cACpC,KAAK,OAAO,mBAAmB,SAAS,OAAO,gBAE/C,OAAO;EACT,MAAM,gBAAgB,GAAG,yBAAyB,OAAO,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,OAAO,IAAI,GAAG,OAAO,iBAAiB,EAAE;EAExI,IAAI,EAAE,OAAO,MAAM,MAAM,aAAa,IAAI,OAAO;EAEjD,MAAM,OAAO,OAAO,MAAM,KAAK,OAAO,OAAO,MAAM,OAAO,OAAO,QAAQ,GAAG;GAC1E,OAAO;GACP,SAAS,cAAc,MAAM;EAC/B,CAAC,EAAA,CAAG,KAAK;EAET,IACE,QAAQ,KAAA,KACR,IAAI,OAAO,eAAe,SAAS,aACnC,IAAI,OAAO,iBAAiB,QAAQ,eACpC,IAAI,OAAO,eAAe,gBAC1B,IAAI,OAAO,mBAAmB,KAAK,OAAO,kBAC1C,IAAI,OAAO,sBAAsB,gBAAgB,OAAO,QAAQ,KAChE,OAAO,IAAI,OAAO,yBAAyB,YAC3C,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,OAAO,oBAAoB,CAAC,CAAC,SAAS,WAClE,WAAW,CAAC,OAAO,eAAe,IAAI,OAAO,MAAM,GAEpD,OAAO;EACT,MAAM,YAAY,UAAU,OAAO,mBAAmB,OAAO;EAE7D,IACE,EAAE,OAAO,MAAM,MACb,GAAG,yBAAyB,OAAO,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,OAAO,GAAG,GAAG,SAAS,EAAE,EACpG,IAEA,OAAO;EAET,OAAO,CACL,eACA,GAAG,yBAAyB,OAAO,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,OAAO,GAAG,GAAG,SAAS,EAAE,EACpG;CACF,CAAC;CAsJD,OAAO;EAAE,qBApJmB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,QACA;GACA,MAAM,QAAQ,OAAO;GAErB,IAAI,OAAO,aAAa,QAAQ,UAAU,OAAO,KAAA;GACjD,MAAM,UAAU,OAAO,WAAW,OAAO;GAEzC,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;GAClC,OAAO,iBAAiB,OAAO;GAC/B,MAAM,QAAQ,QAAQ;GAEtB,MAAM,YAAY,OAAO,MAAM,KAC7B,MAAM,OACN,MAAM,MAAM,OAAO;KAAG,MAAM,WAAW,QAAQ;KAAW,MAAM,SAAS,OAAO;GAAO,CAAC,GACxF;IAAE,OAAO;IAAG,MAAM;IAAO,SAAS;GAAM,CAC1C,EAAA,CAAG,KAAK;GAER,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;GACnC,MAAM,WAAW,gBAAgB,OAAO,SAAS,MAAM,SAAS;GAEhE,IAAI,SAAS,YAAY,kBAAkB,CAAC,cAAc,UAAU,MAAM,GAAG,OAAO,KAAA;GACpF,MAAM,OAAO,OAAO,QAAQ,SAAS,UAAU,IAAI;GAEnD,IAAI,CAAC,MAAM,OAAO,KAAA;GAClB,MAAM,OAAO,OAAO,SAAS,SAAS,OAAO,MAAM;GAEnD,IACE,SAAS,KAAA,KACT,KAAK,UAAU,aACf,gBAAgB,OAAO,KAAK,QAAQ,MAAM,gBAAgB,OAAO,QAAQ,KACzE,CAAC,iBAAiB,KAAK,UAAU,KAAK,QAAQ,OAAO,KACrD,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,QAAQ,CAAC,IAErD,OAAO,KAAA;GACT,MAAM,eAAe,KAAK,GAAG,MAAM,cAAc,SAAS,QAAQ,CAAC;GAEnE,OAAO,KAAK;EACd,CA6G2B;EAAG,mBA3GJ,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,OAMA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,UAAU,OAAO,WAAW,OAAO;GAEzC,IAAI,YAAY,KAAA,KAAa,MAAM,OAAO,aAAa,QAAQ,UAC7D,OAAO,EAAE,MAAM,WAAW;GAC5B,OAAO,cAAc,OAAO;GAC5B,OAAO,iBAAiB,OAAO;GAC/B,MAAM,OAAO,OAAO,QAAQ,SAAS,MAAM,UAAU,IAAI;GACzD,MAAM,OAAO,OAAO,SAAS,SAAS,MAAM,OAAO,MAAM;GAEzD,IACE,SAAS,KAAA,KACT,KAAK,UAAU,aACf,CAAC,cAAc,KAAK,UAAU,MAAM,MAAM,GAE1C,OAAO,EAAE,MAAM,WAAW;GAC5B,UAAU,gBAAgB,OAAO,KAAK,QAAQ,MAAM,gBAAgB,OAAO,MAAM,QAAQ,CAAC;GAC1F,IACE,CAAC,QACD,CAAC,iBAAiB,KAAK,UAAU,KAAK,QAAQ,OAAO,KACrD,cAAc,OAAO,OAAO,MAAM,cAAc,OAAO,MAAM,MAAM,KACnE,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,KAAK,QAAQ,CAAC,MAC1D,EAAE,OAAO,MAAM,MACb,mBACE,SACA,CAAC,KAAK,QAAQ,OAAO,GACrB,KAAK,UACL,KAAA,GACA,CAAC,GACD,OACA,KACF,CACF,IACA;IACA,IAAI,MAAM,OAAO,2BAA2B,SAAS,KAAK,QAAQ;IAClE,OAAO,aAAa,SAAS,MAAM,UAAU;IAE7C,OAAO,EAAE,MAAM,WAAW;GAC5B;GACA,OAAO,YAAY,SAAS,KAAK,UAAU,KAAK,QAAQ,KAAA,CAAS;GACjE,MAAM,kBAAkB,OAAO,MAAM,IAAI,QAAQ,KAAK;GAEtD,MAAM,QAAQ,oBAAoB,cAAc;IAC9C,UAAU,KAAK;IACf,SAAS,MAAM;IACf;IACA,sBAAsB,KAAK,IACzB,kBAAkB,KAAK,SAAS,qBAChC,KAAK,SAAS,eAChB;GACF,CAAC;GAED,MAAM,QAAQ,QAAQ;GAEtB,OAAO,MAAM,OACX,MAAM,OACN;KAAG,MAAM,WAAW,QAAQ;KAAW,MAAM,SAAS,KAAK,SAAS;GAAO,GAC3E;KACG,MAAM,QAAQ,MAAM,OAAO;KAC3B,MAAM,UAAU,MAAM;KACtB,MAAM,UAAU,MAAM;KACtB,MAAM,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;KACnE,MAAM,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;GAChF,CACF;GACA,OAAO,eAAe,SAAS,KAAK,UAAU,KAAA,CAAS;GACvD,OAAO,eAAe,SAAS,CAAC,KAAK,QAAQ,OAAO,GAAG,KAAK,UAAU,KAAA,CAAS;GAC/E,MAAM,eAAe,KAAK,GAAG,MAAM,cAAc,SAAS,KAAK,UAAU,KAAK,CAAC;GAE/E,OAAO;IAAE,MAAM;IAAW;GAAM;EAClC,CA4B8C;EAAG,oBA1BtB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACjE,SACA,OACA,SACA;GACA,OAAO,WAAW,OAAO;GACzB,OAAO,cAAc,OAAO;GAC5B,OAAO,iBAAiB,OAAO;GAC/B,MAAM,OAAO,OAAO,SAAS,SAAS,MAAM,SAAS,MAAM;GAE3D,IACE,SAAS,KAAA,KACT,KAAK,UAAU,aACf,KAAK,UAAU,KAAA,KACf,KAAK,MAAM,YAAY,MAAM,WAC7B,KAAK,MAAM,oBAAoB,MAAM,mBACrC,KAAK,MAAM,yBAAyB,MAAM,wBAC1C,gBAAgB,OAAO,KAAK,QAAQ,MAAM,gBAAgB,OAAO,MAAM,QAAQ,GAE/E,OAAO;GAET,IAAI,YAAY,YAAY,OAAO,2BAA2B,SAAS,MAAM,QAAQ;GAErF,OAAO,OAAO,aAAa,SAAS,MAAM,OAAO;EACnD,CAEkE;CAAE;AACtE"}

package/dist/internal/passkey/registration-custody.d.mts

@@ -0,0 +1,2 @@
+import "./state.mjs";
+import { Effect } from "effect";

package/dist/internal/passkey/registration-custody.mjs

@@ -0,0 +1,52 @@
+import { CurrentPasskeyTransaction } from "./state.mjs";
+import { Effect } from "effect";
+//#region src/internal/passkey/registration-custody.ts
+const makePasskeyRegistrationCustodyKernel = (state) => {
+	const { ceremonyStorage, equal, handleKey } = state;
+	const invariant = state.invariant;
+	return {
+		releaseRegistrationCustody: Effect.fn("passkey.releaseRegistrationCustody")(function* (mapping, ceremony) {
+			if (mapping.registration === void 0 || ceremony.context._tag !== "Registration") return;
+			const owner = yield* CurrentPasskeyTransaction;
+			const handle = mapping.handle;
+			const intent = mapping.intent;
+			const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
+			const held = (yield* owner.read(handle.table, equal(handle.table, { [handle.handleKey]: hashed }), { limit: 1 })).rows[0];
+			const row = (yield* owner.read(intent.table, equal(intent.table, {
+				[intent.moduleId]: mapping.moduleId,
+				[intent.flowId]: ceremony.flowId
+			}), { limit: 1 })).rows[0];
+			if (row === void 0 || !intent.isPendingState(row[intent.state])) return;
+			invariant(held !== void 0 && handle.isReservedState(held[handle.state]) && held[handle.reservationId] === row[intent.reservationId] && row[intent.handleKey] === hashed && row[intent.commandId] === ceremony.commandId && row[intent.ceremonySnapshot] === ceremonyStorage.encode(ceremony));
+			yield* owner.update(intent.table, {
+				[intent.moduleId]: mapping.moduleId,
+				[intent.flowId]: ceremony.flowId
+			}, {
+				[intent.state]: intent.rejectedState,
+				[intent.version]: owner.marker
+			});
+			yield* owner.remove(handle.table, { [handle.handleKey]: hashed });
+		}),
+		scrubRegistrationIntent: Effect.fn("passkey.scrubRegistrationIntent")(function* (mapping, ceremony) {
+			if (mapping.registration === void 0 || ceremony.context._tag !== "Registration") return;
+			const owner = yield* CurrentPasskeyTransaction;
+			const intent = mapping.intent;
+			const identity = {
+				[intent.moduleId]: mapping.moduleId,
+				[intent.flowId]: ceremony.flowId
+			};
+			const row = (yield* owner.read(intent.table, equal(intent.table, identity), { limit: 1 })).rows[0];
+			if (row === void 0) return;
+			invariant((row[intent.state] === intent.acceptedState || row[intent.state] === intent.rejectedState) && row[intent.commandId] === ceremony.commandId && row[intent.ceremonySnapshot] === ceremonyStorage.encode(ceremony));
+			yield* owner.update(intent.table, identity, {
+				[intent.applicationSnapshot]: "",
+				[intent.ceremonySnapshot]: "",
+				[intent.version]: owner.marker
+			});
+		})
+	};
+};
+//#endregion
+export { makePasskeyRegistrationCustodyKernel };
+
+//# sourceMappingURL=registration-custody.mjs.map

package/dist/internal/passkey/registration-custody.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-custody.mjs","names":[],"sources":["../../../src/internal/passkey/registration-custody.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport type { PasskeyCeremony } from \"@yielded/auth/Passkey\";\nimport { Effect } from \"effect\";\n\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport const makePasskeyRegistrationCustodyKernel = (\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    \"ceremonyStorage\" | \"equal\" | \"handleKey\" | \"invariant\"\n  >,\n) => {\n  const { ceremonyStorage, equal, handleKey } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  /** SQL-local writers have no external provisioning work. A definite terminal\n   * rejection can release only its exact still-reserved handle; ambiguous owners\n   * retain custody, and an accepted transaction no longer matches this reservation. */\n  const releaseRegistrationCustody = Effect.fn(\"passkey.releaseRegistrationCustody\")(function* (\n    mapping: any,\n    ceremony: PasskeyCeremony,\n  ) {\n    if (mapping.registration === undefined || ceremony.context._tag !== \"Registration\") return;\n    const owner = yield* CurrentPasskeyTransaction;\n    const handle = mapping.handle;\n    const intent = mapping.intent;\n    const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);\n\n    const held = (yield* owner.read(\n      handle.table,\n      equal(handle.table, { [handle.handleKey]: hashed }),\n      { limit: 1 },\n    )).rows[0];\n\n    const row = (yield* owner.read(\n      intent.table,\n      equal(intent.table, {\n        [intent.moduleId]: mapping.moduleId,\n        [intent.flowId]: ceremony.flowId,\n      }),\n      { limit: 1 },\n    )).rows[0];\n\n    if (row === undefined || !intent.isPendingState(row[intent.state])) return;\n    invariant(\n      held !== undefined &&\n        handle.isReservedState(held[handle.state]) &&\n        held[handle.reservationId] === row[intent.reservationId] &&\n        row[intent.handleKey] === hashed &&\n        row[intent.commandId] === ceremony.commandId &&\n        row[intent.ceremonySnapshot] === ceremonyStorage.encode(ceremony),\n    );\n    yield* owner.update(\n      intent.table,\n      { [intent.moduleId]: mapping.moduleId, [intent.flowId]: ceremony.flowId },\n      { [intent.state]: intent.rejectedState, [intent.version]: owner.marker },\n    );\n    yield* owner.remove(handle.table, { [handle.handleKey]: hashed });\n  });\n\n  /** Keep the command/flow tombstone after retention, without retaining the\n   * application registration payload or ceremony. Ambiguous custody is never scrubbed. */\n  const scrubRegistrationIntent = Effect.fn(\"passkey.scrubRegistrationIntent\")(function* (\n    mapping: any,\n    ceremony: PasskeyCeremony,\n  ) {\n    if (mapping.registration === undefined || ceremony.context._tag !== \"Registration\") return;\n    const owner = yield* CurrentPasskeyTransaction;\n    const intent = mapping.intent;\n    const identity = { [intent.moduleId]: mapping.moduleId, [intent.flowId]: ceremony.flowId };\n\n    const row = (yield* owner.read(intent.table, equal(intent.table, identity), { limit: 1 }))\n      .rows[0];\n\n    if (row === undefined) return;\n    invariant(\n      (row[intent.state] === intent.acceptedState || row[intent.state] === intent.rejectedState) &&\n        row[intent.commandId] === ceremony.commandId &&\n        row[intent.ceremonySnapshot] === ceremonyStorage.encode(ceremony),\n    );\n    yield* owner.update(intent.table, identity, {\n      [intent.applicationSnapshot]: \"\",\n      [intent.ceremonySnapshot]: \"\",\n      [intent.version]: owner.marker,\n    });\n  });\n\n  return { releaseRegistrationCustody, scrubRegistrationIntent };\n};\n"],"mappings":";;;AAQA,MAAa,wCACX,UAIG;CACH,MAAM,EAAE,iBAAiB,OAAO,cAAc;CAC9C,MAAM,YAA+C,MAAM;CA0E3D,OAAO;EAAE,4BArE0B,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACjF,SACA,UACA;GACA,IAAI,QAAQ,iBAAiB,KAAA,KAAa,SAAS,QAAQ,SAAS,gBAAgB;GACpF,MAAM,QAAQ,OAAO;GACrB,MAAM,SAAS,QAAQ;GACvB,MAAM,SAAS,QAAQ;GACvB,MAAM,SAAS,UAAU,SAAS,QAAQ,MAAM,SAAS,QAAQ,UAAU;GAE3E,MAAM,QAAQ,OAAO,MAAM,KACzB,OAAO,OACP,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,OAAO,CAAC,GAClD,EAAE,OAAO,EAAE,CACb,EAAA,CAAG,KAAK;GAER,MAAM,OAAO,OAAO,MAAM,KACxB,OAAO,OACP,MAAM,OAAO,OAAO;KACjB,OAAO,WAAW,QAAQ;KAC1B,OAAO,SAAS,SAAS;GAC5B,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAAG,KAAK;GAER,IAAI,QAAQ,KAAA,KAAa,CAAC,OAAO,eAAe,IAAI,OAAO,MAAM,GAAG;GACpE,UACE,SAAS,KAAA,KACP,OAAO,gBAAgB,KAAK,OAAO,MAAM,KACzC,KAAK,OAAO,mBAAmB,IAAI,OAAO,kBAC1C,IAAI,OAAO,eAAe,UAC1B,IAAI,OAAO,eAAe,SAAS,aACnC,IAAI,OAAO,sBAAsB,gBAAgB,OAAO,QAAQ,CACpE;GACA,OAAO,MAAM,OACX,OAAO,OACP;KAAG,OAAO,WAAW,QAAQ;KAAW,OAAO,SAAS,SAAS;GAAO,GACxE;KAAG,OAAO,QAAQ,OAAO;KAAgB,OAAO,UAAU,MAAM;GAAO,CACzE;GACA,OAAO,MAAM,OAAO,OAAO,OAAO,GAAG,OAAO,YAAY,OAAO,CAAC;EAClE,CA6BkC;EAAG,yBAzBL,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC3E,SACA,UACA;GACA,IAAI,QAAQ,iBAAiB,KAAA,KAAa,SAAS,QAAQ,SAAS,gBAAgB;GACpF,MAAM,QAAQ,OAAO;GACrB,MAAM,SAAS,QAAQ;GACvB,MAAM,WAAW;KAAG,OAAO,WAAW,QAAQ;KAAW,OAAO,SAAS,SAAS;GAAO;GAEzF,MAAM,OAAO,OAAO,MAAM,KAAK,OAAO,OAAO,MAAM,OAAO,OAAO,QAAQ,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CACrF,KAAK;GAER,IAAI,QAAQ,KAAA,GAAW;GACvB,WACG,IAAI,OAAO,WAAW,OAAO,iBAAiB,IAAI,OAAO,WAAW,OAAO,kBAC1E,IAAI,OAAO,eAAe,SAAS,aACnC,IAAI,OAAO,sBAAsB,gBAAgB,OAAO,QAAQ,CACpE;GACA,OAAO,MAAM,OAAO,OAAO,OAAO,UAAU;KACzC,OAAO,sBAAsB;KAC7B,OAAO,mBAAmB;KAC1B,OAAO,UAAU,MAAM;GAC1B,CAAC;EACH,CAE2D;CAAE;AAC/D"}