@yielded/auth-persistence 0.1.0-beta.10

package/dist/internal/passkey/target.mjs

@@ -0,0 +1,190 @@
+import { CurrentPasskeyTransaction } from "./state.mjs";
+import { Effect, Schema } from "effect";
+import { PasskeyAccess, PasskeyAssertionVerified, PasskeyCeremony, PasskeyClaim, PasskeyClaimDecision, PasskeyCleanupResult, PasskeyConfigurationError, PasskeyCredential, PasskeyEnrollmentSnapshot, PasskeyEvidence, PasskeyInstant, PasskeyIssueDecision, PasskeyMethodPolicy, PasskeyModuleId, PasskeyProfile, PasskeyProtocolCredentialId, PasskeySettlement, snapshotPasskeySync } from "@yielded/auth/Passkey";
+import { SubjectId } from "@yielded/auth/Schema";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+//#region src/internal/passkey/target.ts
+const makePasskeyTargetKernel = (credentials, flow, registrationCeremony, state, execution) => {
+	const { captureEnrollmentContext, lookupCredential } = credentials;
+	const { assertionPurposes, claimAssertion, cleanupCeremonies, contextAssertion, issueAssertion, settleAssertion } = flow;
+	const { claimRegistration, contextRegistration, settleRegistration } = registrationCeremony;
+	const { captureMapping, nonce, unavailable, validateMapping } = state;
+	const invariant = state.invariant;
+	const { coordinateTransactionOwner, makeTransactionExecution, sqlClientTransactionStandaloneGuard } = execution;
+	const sqlClientPasskeyStandaloneGuard = (database) => sqlClientTransactionStandaloneGuard(unavailable, database);
+	const emptyHooks = {
+		before: () => Effect.void,
+		after: () => Effect.succeed([])
+	};
+	const makePasskeyExecution = (database, hooks, configuration) => {
+		const execution = makeTransactionExecution(CurrentPasskeyTransaction, database, configuration, unavailable, nonce);
+		return {
+			...execution,
+			run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
+		};
+	};
+	const issueInput = Schema.Struct({
+		ceremony: PasskeyCeremony,
+		policy: PasskeyMethodPolicy
+	});
+	const claimInput = Schema.Struct({
+		access: PasskeyAccess,
+		policy: PasskeyMethodPolicy,
+		ceremony: PasskeyCeremony,
+		claimId: PasskeyClaim.fields.claimId,
+		credential: Schema.optionalKey(PasskeyCredential)
+	});
+	const settleInput = Schema.Struct({
+		claim: PasskeyClaim,
+		nowMillis: PasskeyInstant,
+		outcome: Schema.Union([
+			Schema.TaggedStruct("Rejected", {}),
+			Schema.TaggedStruct("Ambiguous", {}),
+			Schema.TaggedStruct("Assertion", {
+				credential: PasskeyCredential,
+				assertion: PasskeyAssertionVerified,
+				evidence: PasskeyEvidence
+			})
+		])
+	});
+	const cleanupInput = Schema.Struct({
+		moduleId: PasskeyModuleId,
+		nowMillis: PasskeyInstant,
+		limit: Schema.Int.check(Schema.isBetween({
+			minimum: 1,
+			maximum: 1e3
+		}))
+	});
+	const lookupInput = Schema.Struct({
+		rpId: PasskeyProfile.fields.rpId,
+		protocolCredentialId: PasskeyProtocolCredentialId
+	});
+	const contextInput = Schema.Struct({
+		moduleId: PasskeyModuleId,
+		rpId: PasskeyProfile.fields.rpId,
+		subjectId: SubjectId
+	});
+	const inputs = {
+		issue: issueInput,
+		context: PasskeyAccess,
+		claim: claimInput,
+		settle: settleInput,
+		cleanup: cleanupInput
+	};
+	const capturedService = (service, schemas, execute) => Object.freeze(Object.fromEntries(Object.entries(service).map(([name, method]) => [name, (original, prepare) => Effect.suspend(() => {
+		invariant(execute.active());
+		return method(snapshotPasskeySync(schemas[name], original), prepare);
+	}).pipe(Effect.onExit((exit) => Effect.sync(() => {
+		if (exit._tag === "Failure") execute.poison();
+	})), Effect.catchDefect(() => Effect.fail(unavailable())))])));
+	const prepareValue = (value, prepare) => Effect.flatMap(CurrentPasskeyTransaction, (owner) => Effect.sync(() => {
+		owner.guards.push(owner.journal.prepare(void 0));
+		const receipt = prepare(value, owner.journal);
+		invariant(receipt !== null && typeof receipt === "object" && receipt._tag === "PreparedCommit" && typeof receipt.read === "object" && Effect.isEffect(receipt.read));
+		owner.guards.push(receipt);
+		return receipt;
+	}));
+	const requirePurpose = (purpose, registration, enrollment = false) => invariant(enrollment ? purpose === "enrollment" : registration ? purpose === "registration" : assertionPurposes.some((supported) => supported === purpose));
+	/** Context is advisory. Retain observations and final predicates without taking
+	* later-ranked locks before a subsequent mutation acquires its full lock set. */
+	const observationalContext = (operation) => Effect.flatMap(CurrentPasskeyTransaction, (owner) => operation.pipe(Effect.provideService(CurrentPasskeyTransaction, {
+		...owner,
+		read: (table, where, options) => owner.read(table, where, {
+			...options,
+			lock: false
+		})
+	})));
+	const makePasskeyPersistence = (mapping, execute, configuration, registration = false, enrollment = false) => capturedService({
+		issue: (input, prepare) => Effect.suspend(() => {
+			invariant(!registration && !enrollment);
+			requirePurpose(input.ceremony.purpose, false);
+			return execute.run(Effect.gen(function* () {
+				const value = yield* issueAssertion(mapping, input.ceremony, input.policy);
+				return yield* prepareValue(snapshotPasskeySync(PasskeyIssueDecision, value), prepare);
+			}));
+		}),
+		context: (access) => Effect.suspend(() => {
+			requirePurpose(access.purpose, registration, enrollment);
+			return execute.run(observationalContext(registration ? contextRegistration(mapping, access) : contextAssertion(mapping, access)), false);
+		}),
+		claim: (input, prepare) => Effect.suspend(() => {
+			requirePurpose(input.access.purpose, registration, enrollment);
+			requirePurpose(input.ceremony.purpose, registration, enrollment);
+			invariant(!registration && !enrollment || input.credential === void 0);
+			return execute.run(Effect.gen(function* () {
+				const value = yield* registration ? claimRegistration(mapping, input) : claimAssertion(mapping, input);
+				return yield* prepareValue(snapshotPasskeySync(PasskeyClaimDecision, value), prepare);
+			}));
+		}),
+		settle: (input, prepare) => Effect.suspend(() => {
+			requirePurpose(input.claim.ceremony.purpose, registration, enrollment);
+			invariant(!registration && !enrollment || input.outcome._tag !== "Assertion");
+			return execute.run(Effect.gen(function* () {
+				const value = yield* registration ? settleRegistration(mapping, input.claim, input.outcome._tag) : settleAssertion(mapping, input.claim, input.outcome, configuration.dialect);
+				return yield* prepareValue(snapshotPasskeySync(PasskeySettlement, value), prepare);
+			}));
+		}),
+		cleanup: (input, prepare) => execute.run(Effect.gen(function* () {
+			const value = yield* cleanupCeremonies(mapping, input, registration ? ["registration"] : enrollment ? ["enrollment"] : assertionPurposes);
+			return yield* prepareValue(snapshotPasskeySync(PasskeyCleanupResult, value), prepare);
+		}))
+	}, inputs, execute);
+	const credentialService = (mapping, execute) => capturedService({ lookup: (input) => execute.run(lookupCredential(mapping, input.rpId, input.protocolCredentialId), false) }, { lookup: lookupInput }, execute);
+	const enrollmentService = (mapping, execute) => capturedService({ capture: (input) => execute.run(Effect.map(captureEnrollmentContext(mapping, input), (value) => value === void 0 ? void 0 : snapshotPasskeySync(PasskeyEnrollmentSnapshot, value)), false) }, { capture: contextInput }, execute);
+	const registrationServices = (mapping, execute, configuration) => ({
+		capabilities: Object.freeze({
+			purposes: Object.freeze(["registration"]),
+			issue: "registration-authority",
+			assertionSettlement: false
+		}),
+		passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true)
+	});
+	const capturedMapping = (source, kind, configuration) => Effect.flatMap(Effect.isEffect(source) ? source : Effect.succeed(source), (mapping) => Effect.try({
+		try: () => {
+			const captured = captureMapping(mapping);
+			validateMapping(captured, kind);
+			if (configuration.mode === "batch") invariant(captured.d1?.primary === true);
+			return captured;
+		},
+		catch: () => PasskeyConfigurationError.make({})
+	}));
+	const makeTargetPasskeyCredentials = (database, source, configuration) => Effect.map(capturedMapping(source, "read", configuration), (mapping) => ({ passkeyCredentials: credentialService(mapping, makePasskeyExecution(database, emptyHooks, configuration)) }));
+	const makeTargetPasskeyEnrollmentContext = (database, source, configuration) => Effect.map(capturedMapping(source, "context", configuration), (mapping) => ({ passkeyEnrollmentContext: enrollmentService(mapping, makePasskeyExecution(database, emptyHooks, configuration)) }));
+	const makeTargetPasskeyPersistence = (database, source, configuration) => Effect.gen(function* () {
+		const mapping = yield* capturedMapping(source, "assertion", configuration);
+		const hooks = yield* LifecycleHooks;
+		return { passkeyPersistence: makePasskeyPersistence(mapping, makePasskeyExecution(database, hooks, configuration), configuration) };
+	});
+	const makeTargetPasskeyRegistration = (database, source, configuration) => Effect.gen(function* () {
+		const mapping = yield* capturedMapping(source, "registration", configuration);
+		const hooks = yield* LifecycleHooks;
+		return registrationServices(mapping, makePasskeyExecution(database, hooks, configuration), configuration);
+	});
+	const coordinateTargetPasskey = (database, source, configuration, owner) => Effect.flatMap(capturedMapping(source, "assertion", configuration), (mapping) => Effect.flatMap(LifecycleHooks, (hooks) => coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, Effect.void, unavailable, nonce, (execution) => ({ passkeyPersistence: makePasskeyPersistence(mapping, {
+		...execution,
+		run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
+	}, configuration) }), owner).pipe(Effect.provideService(LifecycleHooks, hooks))));
+	const coordinateTargetPasskeyRegistration = (database, source, configuration, owner) => Effect.flatMap(capturedMapping(source, "registration", configuration), (mapping) => Effect.flatMap(LifecycleHooks, (hooks) => coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, Effect.void, unavailable, nonce, (execution) => registrationServices(mapping, {
+		...execution,
+		run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
+	}, configuration), owner).pipe(Effect.provideService(LifecycleHooks, hooks))));
+	return {
+		sqlClientPasskeyStandaloneGuard,
+		makePasskeyExecution,
+		capturedService,
+		prepareValue,
+		observationalContext,
+		makePasskeyPersistence,
+		capturedMapping,
+		makeTargetPasskeyCredentials,
+		makeTargetPasskeyEnrollmentContext,
+		makeTargetPasskeyPersistence,
+		makeTargetPasskeyRegistration,
+		coordinateTargetPasskey,
+		coordinateTargetPasskeyRegistration
+	};
+};
+//#endregion
+export { makePasskeyTargetKernel };
+
+//# sourceMappingURL=target.mjs.map

package/dist/internal/passkey/target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"target.mjs","names":[],"sources":["../../../src/internal/passkey/target.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport { type PreparedCommit, LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  PasskeyConfigurationError,\n  type PasskeyUnavailable,\n  type PasskeyCredentials,\n  type PasskeyEnrollmentContext,\n  type PasskeyPersistence,\n  type PreparePasskeyCommit,\n  PasskeyAccess,\n  PasskeyAssertionVerified,\n  PasskeyCeremony,\n  PasskeyClaim,\n  PasskeyClaimDecision,\n  PasskeyCleanupResult,\n  PasskeyCredential,\n  PasskeyEnrollmentSnapshot,\n  PasskeyEvidence,\n  PasskeyInstant,\n  PasskeyIssueDecision,\n  PasskeyModuleId,\n  PasskeyProfile,\n  PasskeyProtocolCredentialId,\n  PasskeySettlement,\n  PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport { SubjectId } from \"@yielded/auth/Schema\";\nimport { Effect, Schema } from \"effect\";\nimport type { Statement } from \"effect/unstable/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"../mapping-error\";\nimport type {\n  PasskeyCredentialServices,\n  PasskeyEnrollmentContextServices,\n  PasskeyMappingSource,\n  PasskeyPersistenceServices,\n} from \"../models/passkey-model\";\nimport type { PasskeyRegistrationCeremonyServices } from \"../models/passkey-registration-ceremony-model\";\nimport type {\n  TransactionCoordinatorError,\n  TransactionExecution,\n  TransactionTargetConfiguration,\n  makeTransactionExecutionKernel,\n} from \"../transaction-execution-kernel\";\nimport type { makePasskeyCredentialsKernel } from \"./credentials\";\nimport type { makePasskeyFlowKernel } from \"./flow\";\nimport type { makePasskeyRegistrationCeremonyKernel } from \"./registration-ceremony\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport type PasskeyTargetConfiguration = TransactionTargetConfiguration<PasskeyUnavailable>;\n\nexport type PasskeyCoordinatorError<E> =\n  | TransactionCoordinatorError<E, PasskeyUnavailable>\n  | PasskeyConfigurationError\n  | PersistenceMappingError;\n\nexport type PasskeyExecution = TransactionExecution<\n  PasskeyUnavailable,\n  CurrentPasskeyTransaction,\n  never\n>;\n\nexport const makePasskeyTargetKernel = (\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"captureEnrollmentContext\" | \"lookupCredential\"\n  >,\n  flow: Pick<\n    ReturnType<typeof makePasskeyFlowKernel>,\n    | \"assertionPurposes\"\n    | \"claimAssertion\"\n    | \"cleanupCeremonies\"\n    | \"contextAssertion\"\n    | \"issueAssertion\"\n    | \"settleAssertion\"\n  >,\n  registrationCeremony: Pick<\n    ReturnType<typeof makePasskeyRegistrationCeremonyKernel>,\n    \"claimRegistration\" | \"contextRegistration\" | \"settleRegistration\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    \"captureMapping\" | \"invariant\" | \"nonce\" | \"unavailable\" | \"validateMapping\"\n  >,\n  execution: Pick<\n    ReturnType<typeof makeTransactionExecutionKernel>,\n    | \"coordinateTransactionOwner\"\n    | \"makeTransactionExecution\"\n    | \"sqlClientTransactionStandaloneGuard\"\n  >,\n) => {\n  const { captureEnrollmentContext, lookupCredential } = credentials;\n\n  const {\n    assertionPurposes,\n    claimAssertion,\n    cleanupCeremonies,\n    contextAssertion,\n    issueAssertion,\n    settleAssertion,\n  } = flow;\n\n  const { claimRegistration, contextRegistration, settleRegistration } = registrationCeremony;\n  const { captureMapping, nonce, unavailable, validateMapping } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    coordinateTransactionOwner,\n    makeTransactionExecution,\n    sqlClientTransactionStandaloneGuard,\n  } = execution;\n\n  const sqlClientPasskeyStandaloneGuard = (\n    database: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n  ) => sqlClientTransactionStandaloneGuard(unavailable, database);\n\n  const emptyHooks: LifecycleHooks[\"Service\"] = {\n    before: () => Effect.void,\n    after: () => Effect.succeed([]),\n  };\n\n  const makePasskeyExecution = (\n    database: Parameters<typeof makeTransactionExecution>[1],\n    hooks: LifecycleHooks[\"Service\"],\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyExecution => {\n    const execution = makeTransactionExecution(\n      CurrentPasskeyTransaction,\n      database,\n      configuration,\n      unavailable,\n      nonce,\n    );\n\n    return {\n      ...execution,\n      run: (operation, mutation) =>\n        execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    };\n  };\n\n  const issueInput = Schema.Struct({ ceremony: PasskeyCeremony, policy: PasskeyMethodPolicy });\n\n  const claimInput = Schema.Struct({\n    access: PasskeyAccess,\n    policy: PasskeyMethodPolicy,\n    ceremony: PasskeyCeremony,\n    claimId: PasskeyClaim.fields.claimId,\n    credential: Schema.optionalKey(PasskeyCredential),\n  });\n\n  const settleInput = Schema.Struct({\n    claim: PasskeyClaim,\n    nowMillis: PasskeyInstant,\n    outcome: Schema.Union([\n      Schema.TaggedStruct(\"Rejected\", {}),\n      Schema.TaggedStruct(\"Ambiguous\", {}),\n      Schema.TaggedStruct(\"Assertion\", {\n        credential: PasskeyCredential,\n        assertion: PasskeyAssertionVerified,\n        evidence: PasskeyEvidence,\n      }),\n    ]),\n  });\n\n  const cleanupInput = Schema.Struct({\n    moduleId: PasskeyModuleId,\n    nowMillis: PasskeyInstant,\n    limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n  });\n\n  const lookupInput = Schema.Struct({\n    rpId: PasskeyProfile.fields.rpId,\n    protocolCredentialId: PasskeyProtocolCredentialId,\n  });\n\n  const contextInput = Schema.Struct({\n    moduleId: PasskeyModuleId,\n    rpId: PasskeyProfile.fields.rpId,\n    subjectId: SubjectId,\n  });\n\n  const inputs = {\n    issue: issueInput,\n    context: PasskeyAccess,\n    claim: claimInput,\n    settle: settleInput,\n    cleanup: cleanupInput,\n  };\n\n  const capturedService = <S>(\n    service: S,\n    schemas: Record<string, Schema.Codec<any, any, never, never>>,\n    execute: PasskeyExecution,\n  ): S =>\n    Object.freeze(\n      Object.fromEntries(\n        Object.entries(\n          service as Record<string, (...args: any[]) => Effect.Effect<any, PasskeyUnavailable>>,\n        ).map(([name, method]) => [\n          name,\n          (original: any, prepare?: any) =>\n            Effect.suspend(() => {\n              invariant(execute.active());\n              const input = snapshotPasskeySync(schemas[name]!, original);\n\n              return method(input, prepare);\n            }).pipe(\n              Effect.onExit((exit) =>\n                Effect.sync(() => {\n                  if (exit._tag === \"Failure\") execute.poison();\n                }),\n              ),\n              Effect.catchDefect(() => Effect.fail(unavailable())),\n            ),\n        ]),\n      ),\n    ) as S;\n\n  const prepareValue = <Value, A>(\n    value: Value,\n    prepare: PreparePasskeyCommit<Value, A>,\n  ): Effect.Effect<PreparedCommit<A>, never, CurrentPasskeyTransaction> =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      Effect.sync(() => {\n        owner.guards.push(owner.journal.prepare(undefined));\n        const receipt = prepare(value, owner.journal);\n\n        invariant(\n          receipt !== null &&\n            typeof receipt === \"object\" &&\n            receipt._tag === \"PreparedCommit\" &&\n            typeof receipt.read === \"object\" &&\n            Effect.isEffect(receipt.read),\n        );\n        owner.guards.push(receipt);\n\n        return receipt;\n      }),\n    );\n\n  const requirePurpose = (purpose: string, registration: boolean, enrollment = false) =>\n    invariant(\n      enrollment\n        ? purpose === \"enrollment\"\n        : registration\n          ? purpose === \"registration\"\n          : assertionPurposes.some((supported) => supported === purpose),\n    );\n\n  /** Context is advisory. Retain observations and final predicates without taking\n   * later-ranked locks before a subsequent mutation acquires its full lock set. */\n  const observationalContext = <A, E, R>(operation: Effect.Effect<A, E, R>) =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      operation.pipe(\n        Effect.provideService(CurrentPasskeyTransaction, {\n          ...owner,\n          read: (table, where, options) => owner.read(table, where, { ...options, lock: false }),\n        }),\n      ),\n    );\n\n  const makePasskeyPersistence = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n    registration = false,\n    enrollment = false,\n  ): PasskeyPersistence[\"Service\"] =>\n    capturedService<PasskeyPersistence[\"Service\"]>(\n      {\n        issue: (input, prepare) =>\n          Effect.suspend(() => {\n            invariant(!registration && !enrollment);\n            requirePurpose(input.ceremony.purpose, false);\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* issueAssertion(mapping, input.ceremony, input.policy);\n\n                return yield* prepareValue(\n                  snapshotPasskeySync(PasskeyIssueDecision, value),\n                  prepare,\n                );\n              }),\n            );\n          }),\n        context: (access) =>\n          Effect.suspend(() => {\n            requirePurpose(access.purpose, registration, enrollment);\n\n            return execute.run(\n              observationalContext(\n                registration\n                  ? contextRegistration(mapping, access)\n                  : contextAssertion(mapping, access),\n              ),\n              false,\n            );\n          }),\n        claim: (input, prepare) =>\n          Effect.suspend(() => {\n            requirePurpose(input.access.purpose, registration, enrollment);\n            requirePurpose(input.ceremony.purpose, registration, enrollment);\n            invariant((!registration && !enrollment) || input.credential === undefined);\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* registration\n                  ? claimRegistration(mapping, input)\n                  : claimAssertion(mapping, input);\n\n                return yield* prepareValue(\n                  snapshotPasskeySync(PasskeyClaimDecision, value),\n                  prepare,\n                );\n              }),\n            );\n          }),\n        settle: (input, prepare) =>\n          Effect.suspend(() => {\n            requirePurpose(input.claim.ceremony.purpose, registration, enrollment);\n            invariant((!registration && !enrollment) || input.outcome._tag !== \"Assertion\");\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* registration\n                  ? settleRegistration(\n                      mapping,\n                      input.claim,\n                      input.outcome._tag as \"Rejected\" | \"Ambiguous\",\n                    )\n                  : settleAssertion(mapping, input.claim, input.outcome, configuration.dialect);\n\n                return yield* prepareValue(snapshotPasskeySync(PasskeySettlement, value), prepare);\n              }),\n            );\n          }),\n        cleanup: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const value = yield* cleanupCeremonies(\n                mapping,\n                input,\n                registration ? [\"registration\"] : enrollment ? [\"enrollment\"] : assertionPurposes,\n              );\n\n              return yield* prepareValue(snapshotPasskeySync(PasskeyCleanupResult, value), prepare);\n            }),\n          ),\n      },\n      inputs,\n      execute,\n    );\n\n  const credentialService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyCredentials[\"Service\"] =>\n    capturedService<PasskeyCredentials[\"Service\"]>(\n      {\n        lookup: (input) =>\n          execute.run(lookupCredential(mapping, input.rpId, input.protocolCredentialId), false),\n      },\n      { lookup: lookupInput },\n      execute,\n    );\n\n  const enrollmentService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyEnrollmentContext[\"Service\"] =>\n    capturedService<PasskeyEnrollmentContext[\"Service\"]>(\n      {\n        capture: (input) =>\n          execute.run(\n            Effect.map(captureEnrollmentContext(mapping, input), (value) =>\n              value === undefined\n                ? undefined\n                : snapshotPasskeySync(PasskeyEnrollmentSnapshot, value),\n            ),\n            false,\n          ),\n      },\n      { capture: contextInput },\n      execute,\n    );\n\n  const registrationServices = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyRegistrationCeremonyServices => ({\n    capabilities: Object.freeze({\n      purposes: Object.freeze([\"registration\"] as const),\n      issue: \"registration-authority\",\n      assertionSettlement: false,\n    }),\n    passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true),\n  });\n\n  const capturedMapping = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    kind: \"read\" | \"context\" | \"assertion\" | \"registration\",\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<M, PasskeyConfigurationError | PersistenceMappingError, RSetup> =>\n    Effect.flatMap(Effect.isEffect(source) ? source : Effect.succeed(source), (mapping) =>\n      Effect.try({\n        try: () => {\n          const captured = captureMapping(mapping);\n\n          validateMapping(captured, kind);\n          if (configuration.mode === \"batch\") invariant((captured as any).d1?.primary === true);\n\n          return captured;\n        },\n        catch: () => PasskeyConfigurationError.make({}),\n      }),\n    );\n\n  const makeTargetPasskeyCredentials = <M, RSetup>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyCredentialServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup\n  > =>\n    Effect.map(capturedMapping(source, \"read\", configuration), (mapping) => ({\n      passkeyCredentials: credentialService(\n        mapping,\n        makePasskeyExecution(database, emptyHooks, configuration),\n      ),\n    }));\n\n  const makeTargetPasskeyEnrollmentContext = <M, RSetup>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyEnrollmentContextServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup\n  > =>\n    Effect.map(capturedMapping(source, \"context\", configuration), (mapping) => ({\n      passkeyEnrollmentContext: enrollmentService(\n        mapping,\n        makePasskeyExecution(database, emptyHooks, configuration),\n      ),\n    }));\n\n  const makeTargetPasskeyPersistence = <M, RSetup>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyPersistenceServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | LifecycleHooks\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"assertion\", configuration);\n      const hooks = yield* LifecycleHooks;\n\n      return {\n        passkeyPersistence: makePasskeyPersistence(\n          mapping,\n          makePasskeyExecution(database, hooks, configuration),\n          configuration,\n        ),\n      };\n    });\n\n  const makeTargetPasskeyRegistration = <M, RSetup>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyRegistrationCeremonyServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | LifecycleHooks\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"registration\", configuration);\n      const hooks = yield* LifecycleHooks;\n\n      return registrationServices(\n        mapping,\n        makePasskeyExecution(database, hooks, configuration),\n        configuration,\n      );\n    });\n\n  const coordinateTargetPasskey = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: PasskeyPersistenceServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n    Effect.flatMap(capturedMapping(source, \"assertion\", configuration), (mapping) =>\n      Effect.flatMap(LifecycleHooks, (hooks) =>\n        coordinateTransactionOwner(\n          database,\n          CurrentPasskeyTransaction,\n          configuration,\n          Effect.void,\n          unavailable,\n          nonce,\n          (execution) => ({\n            passkeyPersistence: makePasskeyPersistence(\n              mapping,\n              {\n                ...execution,\n                run: (operation, mutation) =>\n                  execution\n                    .run(operation, mutation)\n                    .pipe(Effect.provideService(LifecycleHooks, hooks)),\n              },\n              configuration,\n            ),\n          }),\n          owner,\n        ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      ),\n    );\n\n  const coordinateTargetPasskeyRegistration = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: PasskeyRegistrationCeremonyServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n    Effect.flatMap(capturedMapping(source, \"registration\", configuration), (mapping) =>\n      Effect.flatMap(LifecycleHooks, (hooks) =>\n        coordinateTransactionOwner(\n          database,\n          CurrentPasskeyTransaction,\n          configuration,\n          Effect.void,\n          unavailable,\n          nonce,\n          (execution) =>\n            registrationServices(\n              mapping,\n              {\n                ...execution,\n                run: (operation, mutation) =>\n                  execution\n                    .run(operation, mutation)\n                    .pipe(Effect.provideService(LifecycleHooks, hooks)),\n              },\n              configuration,\n            ),\n          owner,\n        ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      ),\n    );\n\n  return {\n    sqlClientPasskeyStandaloneGuard,\n    makePasskeyExecution,\n    capturedService,\n    prepareValue,\n    observationalContext,\n    makePasskeyPersistence,\n    capturedMapping,\n    makeTargetPasskeyCredentials,\n    makeTargetPasskeyEnrollmentContext,\n    makeTargetPasskeyPersistence,\n    makeTargetPasskeyRegistration,\n    coordinateTargetPasskey,\n    coordinateTargetPasskeyRegistration,\n  };\n};\n"],"mappings":";;;;;;AAiEA,MAAa,2BACX,aAIA,MASA,sBAIA,OAIA,cAMG;CACH,MAAM,EAAE,0BAA0B,qBAAqB;CAEvD,MAAM,EACJ,mBACA,gBACA,mBACA,kBACA,gBACA,oBACE;CAEJ,MAAM,EAAE,mBAAmB,qBAAqB,uBAAuB;CACvE,MAAM,EAAE,gBAAgB,OAAO,aAAa,oBAAoB;CAChE,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,4BACA,0BACA,wCACE;CAEJ,MAAM,mCACJ,aACG,oCAAoC,aAAa,QAAQ;CAE9D,MAAM,aAAwC;EAC5C,cAAc,OAAO;EACrB,aAAa,OAAO,QAAQ,CAAC,CAAC;CAChC;CAEA,MAAM,wBACJ,UACA,OACA,kBACqB;EACrB,MAAM,YAAY,yBAChB,2BACA,UACA,eACA,aACA,KACF;EAEA,OAAO;GACL,GAAG;GACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACxF;CACF;CAEA,MAAM,aAAa,OAAO,OAAO;EAAE,UAAU;EAAiB,QAAQ;CAAoB,CAAC;CAE3F,MAAM,aAAa,OAAO,OAAO;EAC/B,QAAQ;EACR,QAAQ;EACR,UAAU;EACV,SAAS,aAAa,OAAO;EAC7B,YAAY,OAAO,YAAY,iBAAiB;CAClD,CAAC;CAED,MAAM,cAAc,OAAO,OAAO;EAChC,OAAO;EACP,WAAW;EACX,SAAS,OAAO,MAAM;GACpB,OAAO,aAAa,YAAY,CAAC,CAAC;GAClC,OAAO,aAAa,aAAa,CAAC,CAAC;GACnC,OAAO,aAAa,aAAa;IAC/B,YAAY;IACZ,WAAW;IACX,UAAU;GACZ,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,eAAe,OAAO,OAAO;EACjC,UAAU;EACV,WAAW;EACX,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAK,CAAC,CAAC;CACzE,CAAC;CAED,MAAM,cAAc,OAAO,OAAO;EAChC,MAAM,eAAe,OAAO;EAC5B,sBAAsB;CACxB,CAAC;CAED,MAAM,eAAe,OAAO,OAAO;EACjC,UAAU;EACV,MAAM,eAAe,OAAO;EAC5B,WAAW;CACb,CAAC;CAED,MAAM,SAAS;EACb,OAAO;EACP,SAAS;EACT,OAAO;EACP,QAAQ;EACR,SAAS;CACX;CAEA,MAAM,mBACJ,SACA,SACA,YAEA,OAAO,OACL,OAAO,YACL,OAAO,QACL,OACF,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CACxB,OACC,UAAe,YACd,OAAO,cAAc;EACnB,UAAU,QAAQ,OAAO,CAAC;EAG1B,OAAO,OAFO,oBAAoB,QAAQ,OAAQ,QAEhC,GAAG,OAAO;CAC9B,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;EAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;CAC9C,CAAC,CACH,GACA,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD,CACJ,CAAC,CACH,CACF;CAEF,MAAM,gBACJ,OACA,YAEA,OAAO,QAAQ,4BAA4B,UACzC,OAAO,WAAW;EAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;EAClD,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO;EAE5C,UACE,YAAY,QACV,OAAO,YAAY,YACnB,QAAQ,SAAS,oBACjB,OAAO,QAAQ,SAAS,YACxB,OAAO,SAAS,QAAQ,IAAI,CAChC;EACA,MAAM,OAAO,KAAK,OAAO;EAEzB,OAAO;CACT,CAAC,CACH;CAEF,MAAM,kBAAkB,SAAiB,cAAuB,aAAa,UAC3E,UACE,aACI,YAAY,eACZ,eACE,YAAY,iBACZ,kBAAkB,MAAM,cAAc,cAAc,OAAO,CACnE;;;CAIF,MAAM,wBAAiC,cACrC,OAAO,QAAQ,4BAA4B,UACzC,UAAU,KACR,OAAO,eAAe,2BAA2B;EAC/C,GAAG;EACH,OAAO,OAAO,OAAO,YAAY,MAAM,KAAK,OAAO,OAAO;GAAE,GAAG;GAAS,MAAM;EAAM,CAAC;CACvF,CAAC,CACH,CACF;CAEF,MAAM,0BACJ,SACA,SACA,eACA,eAAe,OACf,aAAa,UAEb,gBACE;EACE,QAAQ,OAAO,YACb,OAAO,cAAc;GACnB,UAAU,CAAC,gBAAgB,CAAC,UAAU;GACtC,eAAe,MAAM,SAAS,SAAS,KAAK;GAE5C,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,MAAM;IAEzE,OAAO,OAAO,aACZ,oBAAoB,sBAAsB,KAAK,GAC/C,OACF;GACF,CAAC,CACH;EACF,CAAC;EACH,UAAU,WACR,OAAO,cAAc;GACnB,eAAe,OAAO,SAAS,cAAc,UAAU;GAEvD,OAAO,QAAQ,IACb,qBACE,eACI,oBAAoB,SAAS,MAAM,IACnC,iBAAiB,SAAS,MAAM,CACtC,GACA,KACF;EACF,CAAC;EACH,QAAQ,OAAO,YACb,OAAO,cAAc;GACnB,eAAe,MAAM,OAAO,SAAS,cAAc,UAAU;GAC7D,eAAe,MAAM,SAAS,SAAS,cAAc,UAAU;GAC/D,UAAW,CAAC,gBAAgB,CAAC,cAAe,MAAM,eAAe,KAAA,CAAS;GAE1E,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eACjB,kBAAkB,SAAS,KAAK,IAChC,eAAe,SAAS,KAAK;IAEjC,OAAO,OAAO,aACZ,oBAAoB,sBAAsB,KAAK,GAC/C,OACF;GACF,CAAC,CACH;EACF,CAAC;EACH,SAAS,OAAO,YACd,OAAO,cAAc;GACnB,eAAe,MAAM,MAAM,SAAS,SAAS,cAAc,UAAU;GACrE,UAAW,CAAC,gBAAgB,CAAC,cAAe,MAAM,QAAQ,SAAS,WAAW;GAE9E,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eACjB,mBACE,SACA,MAAM,OACN,MAAM,QAAQ,IAChB,IACA,gBAAgB,SAAS,MAAM,OAAO,MAAM,SAAS,cAAc,OAAO;IAE9E,OAAO,OAAO,aAAa,oBAAoB,mBAAmB,KAAK,GAAG,OAAO;GACnF,CAAC,CACH;EACF,CAAC;EACH,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,kBACnB,SACA,OACA,eAAe,CAAC,cAAc,IAAI,aAAa,CAAC,YAAY,IAAI,iBAClE;GAEA,OAAO,OAAO,aAAa,oBAAoB,sBAAsB,KAAK,GAAG,OAAO;EACtF,CAAC,CACH;CACJ,GACA,QACA,OACF;CAEF,MAAM,qBACJ,SACA,YAEA,gBACE,EACE,SAAS,UACP,QAAQ,IAAI,iBAAiB,SAAS,MAAM,MAAM,MAAM,oBAAoB,GAAG,KAAK,EACxF,GACA,EAAE,QAAQ,YAAY,GACtB,OACF;CAEF,MAAM,qBACJ,SACA,YAEA,gBACE,EACE,UAAU,UACR,QAAQ,IACN,OAAO,IAAI,yBAAyB,SAAS,KAAK,IAAI,UACpD,UAAU,KAAA,IACN,KAAA,IACA,oBAAoB,2BAA2B,KAAK,CAC1D,GACA,KACF,EACJ,GACA,EAAE,SAAS,aAAa,GACxB,OACF;CAEF,MAAM,wBACJ,SACA,SACA,mBACyC;EACzC,cAAc,OAAO,OAAO;GAC1B,UAAU,OAAO,OAAO,CAAC,cAAc,CAAU;GACjD,OAAO;GACP,qBAAqB;EACvB,CAAC;EACD,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,IAAI;CAClF;CAEA,MAAM,mBACJ,QACA,MACA,kBAEA,OAAO,QAAQ,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM,IAAI,YACzE,OAAO,IAAI;EACT,WAAW;GACT,MAAM,WAAW,eAAe,OAAO;GAEvC,gBAAgB,UAAU,IAAI;GAC9B,IAAI,cAAc,SAAS,SAAS,UAAW,SAAiB,IAAI,YAAY,IAAI;GAEpF,OAAO;EACT;EACA,aAAa,0BAA0B,KAAK,CAAC,CAAC;CAChD,CAAC,CACH;CAEF,MAAM,gCACJ,UACA,QACA,kBAMA,OAAO,IAAI,gBAAgB,QAAQ,QAAQ,aAAa,IAAI,aAAa,EACvE,oBAAoB,kBAClB,SACA,qBAAqB,UAAU,YAAY,aAAa,CAC1D,EACF,EAAE;CAEJ,MAAM,sCACJ,UACA,QACA,kBAMA,OAAO,IAAI,gBAAgB,QAAQ,WAAW,aAAa,IAAI,aAAa,EAC1E,0BAA0B,kBACxB,SACA,qBAAqB,UAAU,YAAY,aAAa,CAC1D,EACF,EAAE;CAEJ,MAAM,gCACJ,UACA,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,aAAa,aAAa;EACzE,MAAM,QAAQ,OAAO;EAErB,OAAO,EACL,oBAAoB,uBAClB,SACA,qBAAqB,UAAU,OAAO,aAAa,GACnD,aACF,EACF;CACF,CAAC;CAEH,MAAM,iCACJ,UACA,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,gBAAgB,aAAa;EAC5E,MAAM,QAAQ,OAAO;EAErB,OAAO,qBACL,SACA,qBAAqB,UAAU,OAAO,aAAa,GACnD,aACF;CACF,CAAC;CAEH,MAAM,2BACJ,UACA,QACA,eACA,UAMA,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,aAAa,IAAI,YACnE,OAAO,QAAQ,iBAAiB,UAC9B,2BACE,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,eAAe,EACd,oBAAoB,uBAClB,SACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,UACG,IAAI,WAAW,QAAQ,CAAC,CACxB,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxD,GACA,aACF,EACF,IACA,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD,CACF;CAEF,MAAM,uCACJ,UACA,QACA,eACA,UAMA,OAAO,QAAQ,gBAAgB,QAAQ,gBAAgB,aAAa,IAAI,YACtE,OAAO,QAAQ,iBAAiB,UAC9B,2BACE,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,cACC,qBACE,SACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,UACG,IAAI,WAAW,QAAQ,CAAC,CACxB,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxD,GACA,aACF,GACF,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD,CACF;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/internal/passkey/write-state.d.mts

@@ -0,0 +1,17 @@
+import "../query-operations.mjs";
+import "../mapping-error.mjs";
+import "../transaction-kernel.mjs";
+import "./state.mjs";
+import { DateTime, Effect, Schema } from "effect";
+import { PasskeyActionAuthorization, PasskeyCeremony, PasskeyCredential, PasskeyManagementPolicy, PasskeyRevision } from "@yielded/auth/Passkey";
+import { SubjectId } from "@yielded/auth/Schema";
+import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
+//#region src/internal/passkey/write-state.d.ts
+export interface WriteSubject {
+  readonly subjectId: SubjectId;
+  readonly nativeId: any;
+  readonly row: Record<string, any>;
+  readonly revision: typeof PasskeyRevision.Type;
+}
+//#endregion
+//# sourceMappingURL=write-state.d.mts.map

package/dist/internal/passkey/write-state.mjs

@@ -0,0 +1,345 @@
+import { CurrentPasskeyTransaction } from "./state.mjs";
+import { DateTime, Effect, Encoding, Schema } from "effect";
+import { PasskeyBegin, PasskeyCredential, PasskeyCredentialSummary, PasskeyDescriptor, PasskeyLabel, PasskeyManagementPolicy, PasskeyModuleId, PasskeyProfile, PasskeyRequirement, PasskeyRevision, PasskeyUserHandle, snapshotPasskeySync } from "@yielded/auth/Passkey";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { TokenDigest } from "@yielded/auth/Schema";
+import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
+//#region src/internal/passkey/write-state.ts
+const makePasskeyWriteStateKernel = (operations, state, transactions) => {
+	const { sql } = operations;
+	const { col, copiedRow, credentialKey, equal, handleKey, mappedColumns, sameCredential, sameRevision, subjectScope } = state;
+	const invariant = state.invariant;
+	const { both } = transactions;
+	const jsonStorage = (schema) => {
+		const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));
+		return {
+			encode: (value) => Schema.encodeSync(codec)(snapshotPasskeySync(schema, value)),
+			decode: (text) => {
+				return Schema.decodeUnknownSync(codec)(text);
+			}
+		};
+	};
+	const digest = (schema, value) => TokenDigest.make(Encoding.encodeBase64Url(sha256(new TextEncoder().encode(jsonStorage(schema).encode(value)))));
+	const currentSubject = Effect.fn("passkey.currentWriteSubject")(function* (mapping, subjectId) {
+		const owner = yield* CurrentPasskeyTransaction;
+		const read = mapping.read;
+		const table = read.subject;
+		const nativeId = read.subjectIds.toNative(subjectId);
+		invariant(read.subjectIds.toSubject(nativeId) === subjectId);
+		const row = (yield* owner.read(table.table, equal(table.table, { [table.id]: nativeId }), {
+			limit: 1,
+			columns: [.../* @__PURE__ */ new Set([
+				table.id,
+				table.status,
+				table.securityRevision,
+				...mapping.write.policy.subjectColumns
+			])]
+		})).rows[0];
+		if (row === void 0 || !table.isActiveStatus(row[table.status])) return void 0;
+		invariant(read.subjectIds.equals(table.decodeId(copiedRow(row)), nativeId));
+		const active = sql`exists(select 1 from ${table.table} where ${both(equal(table.table, { [table.id]: nativeId }), table.activeCondition)})`;
+		if (!(yield* owner.check(active))) return void 0;
+		owner.postconditions.push(active);
+		const factor = read.authority;
+		const factors = (yield* owner.read(factor.table, both(equal(factor.table, { [factor.subjectId]: nativeId }), factor.activeCondition), {
+			limit: 64,
+			columns: mappedColumns(factor),
+			orderBy: col(factor.table, factor.credentialId)
+		})).rows;
+		const revision = snapshotPasskeySync(PasskeyRevision, {
+			subjectId,
+			securityRevision: row[table.securityRevision],
+			credentials: factors.map((value) => ({
+				credentialId: value[factor.credentialId],
+				revision: value[factor.revision]
+			}))
+		});
+		invariant(new Set(revision.credentials.map((item) => item.credentialId)).size === revision.credentials.length);
+		return {
+			subjectId,
+			nativeId,
+			row,
+			revision
+		};
+	});
+	const credentialRows = Effect.fn("passkey.writeCredentialRows")(function* (mapping, subject, rpId) {
+		const owner = yield* CurrentPasskeyTransaction;
+		const table = mapping.read.credential;
+		return (yield* owner.read(table.table, both(equal(table.table, { [table.subjectId]: subject.nativeId }), table.activeCondition, rpId === void 0 ? void 0 : equal(table.table, { [table.rpId]: rpId })), {
+			limit: 64,
+			orderBy: col(table.table, table.credentialId)
+		})).rows;
+	});
+	const summary = (mapping, row) => {
+		const table = mapping.read.credential;
+		const write = mapping.write.credential;
+		const decoded = table.decode(copiedRow(row));
+		return snapshotPasskeySync(PasskeyCredentialSummary, {
+			credentialId: decoded.credentialId,
+			name: row[write.name],
+			primarySignIn: decoded.primarySignIn,
+			createdAtMillis: mapping.clock.decodeInstant(row[write.createdAt]),
+			...row[mapping.telemetry.lastUsedAt] === null || row[mapping.telemetry.lastUsedAt] === void 0 ? {} : { lastUsedAtMillis: mapping.clock.decodeInstant(row[mapping.telemetry.lastUsedAt]) }
+		});
+	};
+	const ownedCredential = Effect.fn("passkey.ownedWriteCredential")(function* (mapping, subject, row) {
+		const owner = yield* CurrentPasskeyTransaction;
+		const read = mapping.read;
+		const table = read.credential;
+		const decoded = snapshotPasskeySync(PasskeyCredential, {
+			...table.decode(copiedRow(row)),
+			revision: subject.revision,
+			active: true
+		});
+		invariant(decoded.credentialId === row[table.credentialId] && decoded.profile.rpId === decoded.rpId && read.subjectIds.equals(table.decodeSubjectId(copiedRow(row)), subject.nativeId));
+		const ownership = read.credentialOwnership;
+		const key = credentialKey(decoded.rpId, decoded.protocolCredentialId);
+		const tuple = (yield* owner.read(ownership.table, equal(ownership.table, { [ownership.credentialKey]: key }), {
+			limit: 1,
+			columns: mappedColumns(ownership)
+		})).rows[0];
+		if (tuple === void 0 || !ownership.isOwnedState(tuple[ownership.state]) || !read.subjectIds.equals(ownership.decodeSubjectId(copiedRow(tuple)), subject.nativeId)) return void 0;
+		invariant(tuple[ownership.rpId] === decoded.rpId && tuple[ownership.protocolCredentialId] === decoded.protocolCredentialId && tuple[ownership.credentialId] === decoded.credentialId && row[table.credentialKey] === key);
+		const handle = read.handleOwnership;
+		const hashedHandle = handleKey(decoded.rpId, decoded.userHandle);
+		const held = (yield* owner.read(handle.table, equal(handle.table, { [handle.handleKey]: hashedHandle }), {
+			limit: 1,
+			columns: mappedColumns(handle)
+		})).rows[0];
+		if (held === void 0 || !handle.isOwnedState(held[handle.state]) || !read.subjectIds.equals(handle.decodeSubjectId(copiedRow(held)), subject.nativeId)) return void 0;
+		invariant(held[handle.rpId] === decoded.rpId && held[handle.userHandle] === decoded.userHandle && row[table.handleKey] === hashedHandle);
+		invariant(subject.revision.credentials.some((item) => item.credentialId === decoded.credentialId && item.revision === row[table.credentialRevision]));
+		return decoded;
+	});
+	const managementPolicy = (mapping, subject) => snapshotPasskeySync(PasskeyManagementPolicy, mapping.write.policy.management(copiedRow(subject.row)));
+	const metadataAllowed = Effect.fn("passkey.metadataAllowed")(function* (mapping, subject) {
+		const owner = yield* CurrentPasskeyTransaction;
+		const condition = mapping.write.policy.metadata(subject.nativeId);
+		const allowed = yield* owner.check(condition);
+		if (allowed) owner.postconditions.push(condition);
+		return allowed;
+	});
+	const enrollmentDigest = (ceremony) => {
+		invariant(ceremony.context._tag === "Enrollment");
+		const context = ceremony.context;
+		return digest(Schema.Tuple([
+			PasskeyModuleId,
+			Schema.Literal("enrollment"),
+			Schema.Struct({
+				...PasskeyBegin.fields,
+				name: PasskeyLabel
+			}),
+			PasskeyProfile,
+			PasskeyRevision,
+			PasskeyUserHandle,
+			Schema.Array(PasskeyDescriptor)
+		]), [
+			ceremony.moduleId,
+			"enrollment",
+			{
+				flowId: ceremony.flowId,
+				commandId: ceremony.commandId,
+				profileId: ceremony.profile.profileId,
+				name: context.name
+			},
+			ceremony.profile,
+			context.revision,
+			context.userHandle,
+			ceremony.allowedCredentials
+		]);
+	};
+	const removeDigest = (moduleId, commandId, credential) => digest(Schema.Tuple([
+		PasskeyModuleId,
+		Schema.Literal("remove"),
+		PasskeyBegin.fields.commandId,
+		PasskeyCredential
+	]), [
+		PasskeyModuleId.make(moduleId),
+		"remove",
+		PasskeyBegin.fields.commandId.make(commandId),
+		credential
+	]);
+	const authorizeAction = Effect.fn("passkey.authorizeWriteAction")(function* (mapping, subject, authorization, expected, policy, original) {
+		const owner = yield* CurrentPasskeyTransaction;
+		const { challenge, evidence } = authorization;
+		if (challenge.moduleId !== mapping.moduleId || challenge.action !== expected.action || challenge.commandId !== expected.commandId || challenge.flowId !== expected.flowId || challenge.bindingDigest !== expected.bindingDigest || evidence.flowId !== expected.flowId || evidence.bindingDigest !== expected.bindingDigest || !sameRevision(challenge.revision, expected.revision) || subject.revision.subjectId !== expected.revision.subjectId || subject.revision.securityRevision !== expected.revision.securityRevision || evidence.revision.subjectId !== subject.subjectId || evidence.revision.securityRevision !== subject.revision.securityRevision) return false;
+		for (const revision of [expected.revision, evidence.revision]) if (revision.credentials.some((item) => !subject.revision.credentials.some((current) => current.credentialId === item.credentialId && current.revision === item.revision))) return false;
+		const now = yield* owner.now(mapping.clock);
+		if (evidence.proofs.some((proof) => DateTime.toEpochMillis(proof.verifiedAt) > now || !evidence.revision.credentials.some((item) => item.credentialId === proof.credentialId))) return false;
+		const currentRequirement = mapping.write.policy.requirement(copiedRow(subject.row), expected.action);
+		const current = snapshotPasskeySync(PasskeyRequirement, yield* currentRequirement);
+		for (const requirement of [
+			authorization.requirement,
+			current,
+			...original === void 0 ? [] : [original]
+		]) {
+			const age = Math.min(policy.maximumEvidenceAgeMillis, requirement.maximumAgeMillis);
+			const fresh = evidence.proofs.filter((proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age);
+			const factors = new Set(fresh.flatMap((proof) => proof.factors));
+			if (!requirement.alternatives.some((alternative) => alternative.factors.every((factor) => factors.has(factor)) && new Set(fresh.map((proof) => proof.credentialId)).size >= alternative.minimumCredentials && fresh.some((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)))) return false;
+			owner.postconditions.push(both(sql`${mapping.clock.engineNowMillis} >= ${now}`, ...fresh.map((proof) => sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`)));
+		}
+		const condition = mapping.write.policy.action(subject.nativeId, authorization);
+		if (!(yield* owner.check(condition))) return false;
+		owner.postconditions.push(condition);
+		return true;
+	});
+	const invalidationMatches = (mapping, supplied, policy) => jsonStorage(SessionInvalidationWindow).encode(supplied) === jsonStorage(SessionInvalidationWindow).encode(mapping.invalidation.window) && (!policy.requireImmediateInvalidation || supplied.existingSessions === "immediate");
+	const invalidate = Effect.fn("passkey.invalidateCredentialChange")(function* (mapping, subject, invalidation) {
+		const owner = yield* CurrentPasskeyTransaction;
+		const table = mapping.read.subject;
+		const revision = PasskeyRevision.fields.securityRevision.make(owner.marker);
+		yield* owner.update(table.table, { [table.id]: subject.nativeId }, { [table.securityRevision]: revision });
+		const input = {
+			subjectId: subject.nativeId,
+			previousRevision: subject.revision.securityRevision,
+			securityRevision: revision,
+			invalidation
+		};
+		for (const mutation of mapping.invalidation.mutations) {
+			yield* owner.write(owner.database.update(mutation.table).set(mutation.values(input)).where(mutation.where(input)));
+			owner.postconditions.push(mutation.postcondition(input));
+		}
+		owner.postconditions.push(mapping.invalidation.postcondition(input));
+		const flow = mapping.flow;
+		const where = both(equal(flow.table, { [flow.subjectScope]: subjectScope(subject.subjectId) }), sql`${col(flow.table, flow.state)} in (${flow.states.Pending}, ${flow.states.Claimed})`);
+		yield* owner.write(owner.database.update(flow.table).set({
+			[flow.state]: flow.states.Rejected,
+			[flow.version]: owner.marker
+		}).where(where));
+		for (const observation of owner.observations) if (observation.table === flow.table) observation.rows = observation.rows.map((row) => row[flow.subjectScope] === subjectScope(subject.subjectId) && [flow.states.Pending, flow.states.Claimed].includes(row[flow.state]) ? {
+			...row,
+			[flow.state]: flow.states.Rejected,
+			[flow.version]: owner.marker
+		} : row);
+		owner.postconditions.push(sql`not exists(select 1 from ${flow.table} where ${where})`);
+		return revision;
+	});
+	const validRegistration = (ceremony, verified) => ceremony.profile.algorithms.some((algorithm) => algorithm === verified.algorithm) && (ceremony.profile.userVerification !== "required" || verified.userVerified) && (!verified.backupState || verified.backupEligible) && !ceremony.allowedCredentials.some((item) => item.id === verified.protocolCredentialId);
+	return {
+		jsonStorage,
+		digest,
+		currentSubject,
+		credentialRows,
+		summary,
+		ownedCredential,
+		managementPolicy,
+		metadataAllowed,
+		enrollmentDigest,
+		removeDigest,
+		authorizeAction,
+		invalidationMatches,
+		invalidate,
+		validRegistration,
+		insertCredential: Effect.fn("passkey.insertCredential")(function* (mapping, subject, ceremony, verified, now) {
+			const owner = yield* CurrentPasskeyTransaction;
+			invariant(ceremony.context._tag === "Enrollment" || ceremony.context._tag === "Registration");
+			const read = mapping.read;
+			const write = mapping.write;
+			const id = PasskeyCredential.fields.credentialId.make(owner.marker);
+			const credential = snapshotPasskeySync(PasskeyCredential, {
+				credentialId: id,
+				rpId: ceremony.profile.rpId,
+				protocolCredentialId: verified.protocolCredentialId,
+				userHandle: ceremony.context.userHandle,
+				publicKey: verified.publicKey,
+				algorithm: verified.algorithm,
+				profile: ceremony.profile,
+				revision: {
+					...subject.revision,
+					credentials: [...subject.revision.credentials, {
+						credentialId: id,
+						revision: PasskeyRevision.fields.securityRevision.make(owner.marker)
+					}]
+				},
+				active: true,
+				primarySignIn: ceremony.profile.primarySignIn && verified.userVerified,
+				enrollmentUserVerified: verified.userVerified,
+				backupEligible: verified.backupEligible,
+				backupState: verified.backupState,
+				counter: verified.counter,
+				maximumCounter: verified.counter
+			});
+			const safe = snapshotPasskeySync(PasskeyCredentialSummary, {
+				credentialId: id,
+				name: ceremony.context.name,
+				primarySignIn: credential.primarySignIn,
+				createdAtMillis: now
+			});
+			const input = {
+				subjectId: subject.nativeId,
+				credential,
+				summary: safe,
+				marker: owner.marker
+			};
+			const tupleKey = credentialKey(credential.rpId, credential.protocolCredentialId);
+			const hashedHandle = handleKey(credential.rpId, credential.userHandle);
+			const tuple = read.credentialOwnership;
+			const absent = yield* owner.read(tuple.table, equal(tuple.table, { [tuple.credentialKey]: tupleKey }), { limit: 1 });
+			invariant(absent.rows.length === 0);
+			const inserted = yield* owner.insert(tuple.table, {
+				...write.credentialOwnership.encodeInsert(input),
+				[tuple.credentialKey]: tupleKey,
+				[tuple.rpId]: credential.rpId,
+				[tuple.protocolCredentialId]: credential.protocolCredentialId,
+				[tuple.subjectId]: subject.nativeId,
+				[tuple.credentialId]: id,
+				[tuple.state]: write.credentialOwnership.ownedState,
+				[tuple.version]: owner.marker,
+				[tuple.reservationId]: null
+			}, { [tuple.credentialKey]: tupleKey });
+			absent.rows = inserted.rows;
+			const table = read.credential;
+			const values = {
+				...write.credential.encodeInsert(input),
+				[table.credentialId]: id,
+				[table.subjectId]: subject.nativeId,
+				[table.rpId]: credential.rpId,
+				[table.protocolCredentialId]: credential.protocolCredentialId,
+				[table.credentialKey]: tupleKey,
+				[table.handleKey]: hashedHandle,
+				[table.userHandle]: credential.userHandle,
+				[table.algorithm]: credential.algorithm,
+				[table.credentialRevision]: owner.marker,
+				[table.status]: write.credential.activeStatus,
+				[table.primarySignIn]: write.credential.encodePrimarySignIn(credential.primarySignIn),
+				[table.enrollmentUserVerified]: write.credential.encodeEnrollmentUserVerified(credential.enrollmentUserVerified),
+				[table.backupEligible]: write.credential.encodeBackupEligible(credential.backupEligible),
+				[table.backupState]: mapping.telemetry.encodeBackupState(credential.backupState),
+				[table.counter]: credential.counter,
+				[table.maximumCounter]: credential.maximumCounter,
+				[write.credential.name]: safe.name,
+				[write.credential.createdAt]: mapping.clock.encodeInstant(now),
+				[mapping.telemetry.lastUsedAt]: null
+			};
+			yield* owner.insert(table.table, values, { [table.credentialId]: id });
+			for (const observation of owner.observations) if (observation.table === table.table && observation.rows !== inserted.rows && !observation.rows.some((row) => row[table.credentialId] === id)) observation.rows = [...observation.rows, values];
+			const factor = read.authority;
+			const factorValues = {
+				...write.authority.encodeInsert(input),
+				[factor.subjectId]: subject.nativeId,
+				[factor.credentialId]: id,
+				[factor.revision]: owner.marker,
+				[factor.status]: write.authority.activeStatus
+			};
+			yield* owner.insert(factor.table, factorValues, {
+				[factor.subjectId]: subject.nativeId,
+				[factor.credentialId]: id
+			});
+			for (const observation of owner.observations) if (observation.table === factor.table && !observation.rows.some((row) => row[factor.credentialId] === id)) observation.rows = [...observation.rows, factorValues];
+			const decoded = snapshotPasskeySync(PasskeyCredential, {
+				...table.decode(copiedRow(values)),
+				revision: credential.revision,
+				active: true
+			});
+			invariant(sameCredential(decoded, credential) && decoded.counter === credential.counter && decoded.maximumCounter === credential.maximumCounter && decoded.backupState === credential.backupState);
+			invariant(summary(mapping, values).credentialId === id);
+			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now}`);
+			return safe;
+		})
+	};
+};
+//#endregion
+export { makePasskeyWriteStateKernel };
+
+//# sourceMappingURL=write-state.mjs.map