@yielded/auth-persistence 0.1.0-beta.10

package/dist/internal/models/email-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-model.mjs","names":[],"sources":["../../../src/internal/models/email-model.ts"],"sourcesContent":["import type { EmailAction, EmailRegistrationDecision } from \"@yielded/auth/Email\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type { ProofBinding, ProofContinuationId, ProofPurpose } from \"@yielded/auth/Proofs\";\nimport type { TokenDigest } from \"@yielded/auth/Schema\";\nimport type { AuthenticationRequirement, SecurityRevision } from \"@yielded/auth/Sessions\";\nimport type { Effect } from \"effect\";\n\nimport type { AnyTableModel, TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError, SubjectIdCodec } from \"./common\";\n\ntype ColumnKey<T extends Table> = T[\"column\"];\n\nexport interface EmailSubjectReadTable<Subject extends Table> {\n  readonly table: Subject[\"table\"];\n  readonly id: ColumnKey<Subject>;\n  readonly status: ColumnKey<Subject>;\n  readonly securityRevision: ColumnKey<Subject>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface EmailSubjectTable<Subject extends Table> extends EmailSubjectReadTable<Subject> {\n  readonly decodeActionRequirement: (\n    row: Subject[\"select\"],\n    action: EmailAction,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  readonly nextSecurityRevision?: (\n    current: SecurityRevision,\n  ) => Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly nextSecurityRevisionSync?: (current: SecurityRevision) => SecurityRevision;\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface EmailIdentifierReadTable<Identifier extends Table> {\n  readonly table: Identifier[\"table\"];\n  readonly namespace: ColumnKey<Identifier>;\n  readonly value: ColumnKey<Identifier>;\n  readonly subjectId: ColumnKey<Identifier>;\n  readonly verifiedAt: ColumnKey<Identifier>;\n  readonly bindingRevision: ColumnKey<Identifier>;\n  readonly isCurrent: (row: Identifier[\"select\"]) => boolean;\n}\n\nexport interface EmailIdentifierTable<\n  Identifier extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> extends EmailIdentifierReadTable<Identifier> {\n  /** True only for an active, unverified binding. Confirming it preserves existing sessions. */\n  readonly isMutableTarget: (row: Identifier[\"select\"]) => boolean;\n  readonly encodeVerifiedInsert: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly subjectId: NativeSubjectId;\n    readonly verifiedAtMillis: number;\n    readonly bindingRevision: SecurityRevision;\n  }) => Identifier[\"insert\"];\n  readonly encodeVerification: (input: {\n    readonly verifiedAtMillis: number;\n    readonly bindingRevision: SecurityRevision;\n  }) => Partial<Identifier[\"insert\"]>;\n  /** Must make the selected source unavailable to sign-in. */\n  readonly encodeRetirement: (input: {\n    readonly source: LoginIdentifier;\n    readonly bindingRevision: SecurityRevision;\n  }) => Partial<Identifier[\"insert\"]>;\n  readonly d1CurrentCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n    readonly bindingRevision: SecurityRevision;\n  }) => Expression;\n  readonly d1MutableTargetCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n  }) => Expression;\n}\n\nexport interface EmailCredentialReadTable<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  _NativeSubjectId,\n> {\n  readonly table: Credential[\"table\"];\n  readonly moduleId: ColumnKey<Credential>;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly identifierNamespace: ColumnKey<Credential>;\n  readonly identifierValue: ColumnKey<Credential>;\n  readonly credentialRevision: ColumnKey<Credential>;\n  readonly status: ColumnKey<Credential>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly decode: (input: {\n    readonly moduleId: string;\n    readonly subject: Subject[\"select\"];\n    readonly identifier: Identifier[\"select\"];\n    readonly credential: Credential[\"select\"];\n  }) => Effect.Effect<\n    import(\"@yielded/auth/Email\").EmailCredentialSnapshot,\n    PersistenceMappingError\n  >;\n}\n\nexport interface EmailCredentialTable<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> extends EmailCredentialReadTable<Subject, Identifier, Credential, NativeSubjectId> {\n  readonly encodeVerifiedInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly identifier: LoginIdentifier;\n    readonly credentialRevision: SecurityRevision;\n  }) => Credential[\"insert\"];\n  readonly encodeActivation: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly credentialRevision: SecurityRevision;\n  }) => Partial<Credential[\"insert\"]>;\n  readonly encodeRetirement: (input: {\n    readonly source: LoginIdentifier;\n    readonly credentialRevision: SecurityRevision;\n  }) => Partial<Credential[\"insert\"]>;\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface EmailAuthorityCredentialTable<Credential extends Table, NativeSubjectId> {\n  readonly table: Credential[\"table\"];\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly revision: ColumnKey<Credential>;\n  readonly status: ColumnKey<Credential>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly encodeInsert: (input: {\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => Credential[\"insert\"];\n  readonly encodeActivation: (revision: SecurityRevision) => Partial<Credential[\"insert\"]>;\n  readonly encodeRetirement: (revision: SecurityRevision) => Partial<Credential[\"insert\"]>;\n  readonly d1ActiveStatusValue?: unknown;\n}\n\nexport interface EmailCommandTable<Command extends Table> {\n  readonly table: Command[\"table\"];\n  readonly moduleId: ColumnKey<Command>;\n  readonly commandId: ColumnKey<Command>;\n  readonly action: ColumnKey<Command>;\n  readonly bindingDigest: ColumnKey<Command>;\n  readonly retentionUntil: ColumnKey<Command>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly action: EmailAction;\n    readonly bindingDigest: TokenDigest;\n    readonly retentionUntilMillis: number;\n  }) => Command[\"insert\"];\n}\n\nexport interface RequiredEmailSignInConstraints {\n  readonly identifier: \"unique(identifier.namespace,identifier.value)\";\n  readonly credentialId: \"unique(emailCredential.moduleId,emailCredential.credentialId)\";\n  readonly credentialIdentifier: \"unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)\";\n}\n\nexport const requiredEmailSignInConstraints: RequiredEmailSignInConstraints = {\n  identifier: \"unique(identifier.namespace,identifier.value)\",\n  credentialId: \"unique(emailCredential.moduleId,emailCredential.credentialId)\",\n  credentialIdentifier:\n    \"unique(emailCredential.moduleId,emailCredential.identifierNamespace,emailCredential.identifierValue)\",\n};\n\nexport interface EmailSignInMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  NativeSubjectId,\n> {\n  readonly subject: EmailSubjectReadTable<Subject>;\n  readonly identifier: EmailIdentifierReadTable<Identifier>;\n  readonly credential: EmailCredentialReadTable<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n  readonly constraints: RequiredEmailSignInConstraints;\n  readonly decodeInstant: (native: unknown) => Effect.Effect<number, PersistenceMappingError>;\n}\n\nexport interface RequiredEmailAddressConstraints extends RequiredEmailSignInConstraints {\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n  readonly command: \"unique(emailCommand.moduleId,emailCommand.commandId)\";\n}\n\nexport const requiredEmailAddressConstraints: RequiredEmailAddressConstraints = {\n  ...requiredEmailSignInConstraints,\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n  command: \"unique(emailCommand.moduleId,emailCommand.commandId)\",\n};\n\nexport interface EmailD1Clock<Expression extends SqlExpression = SqlExpression> {\n  readonly engineNow: Expression;\n  readonly engineNowMillis: Expression;\n  readonly engineInstantPlus: (millis: number) => Expression;\n}\n\nexport interface EmailAddressMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Command extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> extends EmailSignInMapping<Subject, Identifier, Credential, NativeSubjectId> {\n  readonly subject: EmailSubjectTable<Subject>;\n  readonly identifier: EmailIdentifierTable<Identifier, NativeSubjectId, Expression>;\n  readonly credential: EmailCredentialTable<Subject, Identifier, Credential, NativeSubjectId>;\n  readonly authorityCredential: EmailAuthorityCredentialTable<AuthorityCredential, NativeSubjectId>;\n  readonly command: EmailCommandTable<Command>;\n  readonly constraints: RequiredEmailAddressConstraints;\n  readonly addressCardinality: \"single\" | \"multiple\";\n  readonly changeDisposition: \"retire-source\";\n  readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocateCredentialIdSync?: () => string;\n  readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n  readonly allocateRevisionSync?: () => SecurityRevision;\n  readonly encodeInstant: (epochMillis: number) => unknown;\n  readonly commandRetentionMillis: number;\n  readonly sessionInvalidation: \"same-authority-immediate\" | \"original-absolute-expiry\";\n  readonly isCommandConflict: (cause: unknown) => boolean;\n  readonly isIdentifierConflict: (cause: unknown) => boolean;\n  readonly isCredentialConflict: (cause: unknown) => boolean;\n  readonly d1?: EmailD1Clock<Expression>;\n}\n\nexport type D1EmailAddressMapping<\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Command extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = EmailAddressMapping<\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Command,\n  NativeSubjectId,\n  Expression\n> & {\n  readonly d1: EmailD1Clock<Expression>;\n  readonly subject: EmailSubjectTable<Subject> & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n  readonly identifier: EmailIdentifierTable<Identifier, NativeSubjectId, Expression> & {\n    readonly d1CurrentCondition: NonNullable<\n      EmailIdentifierTable<Identifier, NativeSubjectId, Expression>[\"d1CurrentCondition\"]\n    >;\n    readonly d1MutableTargetCondition: NonNullable<\n      EmailIdentifierTable<Identifier, NativeSubjectId, Expression>[\"d1MutableTargetCondition\"]\n    >;\n  };\n  readonly credential: EmailCredentialTable<Subject, Identifier, Credential, NativeSubjectId> & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n  readonly authorityCredential: EmailAuthorityCredentialTable<\n    AuthorityCredential,\n    NativeSubjectId\n  > & {\n    readonly d1ActiveStatusValue: unknown;\n  };\n};\n\nexport type EmailRegistrationState = \"pending\" | \"registered\";\n\nexport interface EmailRegistrationIntent<Registration> {\n  readonly moduleId: string;\n  readonly commandId: string;\n  readonly identifier: LoginIdentifier;\n  readonly registration: Registration;\n  readonly fingerprint: TokenDigest;\n  readonly completion: {\n    readonly moduleId: string;\n    readonly purpose: ProofPurpose;\n    readonly continuationId: ProofContinuationId;\n    readonly binding: ProofBinding;\n  };\n}\n\nexport interface EmailRegistrationTable<Registration, Request extends Table, NativeSubjectId> {\n  readonly table: Request[\"table\"];\n  readonly moduleId: ColumnKey<Request>;\n  readonly commandId: ColumnKey<Request>;\n  readonly fingerprint: ColumnKey<Request>;\n  readonly state: ColumnKey<Request>;\n  readonly subjectId: ColumnKey<Request>;\n  readonly pendingReference: ColumnKey<Request>;\n  readonly retentionUntil: ColumnKey<Request>;\n  readonly encodeInsert: (\n    input: EmailRegistrationIntent<Registration>,\n    state: {\n      readonly state: EmailRegistrationState;\n      readonly nativeSubjectId?: NativeSubjectId;\n      readonly pendingReference?: string;\n      readonly retentionUntilMillis: number;\n    },\n  ) => Request[\"insert\"];\n  readonly decodeReplay: (row: Request[\"select\"]) => Effect.Effect<\n    Exclude<\n      EmailRegistrationDecision,\n      {\n        readonly _tag: \"Registered\";\n      }\n    >,\n    PersistenceMappingError\n  >;\n}\n\nexport interface EmailRegistrationProvisioning<\n  Registration,\n  Subject extends Table,\n  NativeSubjectId,\n> {\n  readonly encodeSubjectInsert: (\n    input: EmailRegistrationIntent<Registration>,\n    values: {\n      readonly nativeSubjectId: NativeSubjectId | undefined;\n      readonly securityRevision: SecurityRevision;\n    },\n  ) => Subject[\"insert\"];\n  readonly allocateSubjectId?: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n  readonly allocateSubjectIdSync?: () => NativeSubjectId;\n  readonly decodeGeneratedId?: (\n    rows: ReadonlyArray<unknown>,\n  ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n}\n\nexport interface EmailRegistrationIdentifierTable<\n  Identifier extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: Identifier[\"table\"];\n  readonly namespace: ColumnKey<Identifier>;\n  readonly value: ColumnKey<Identifier>;\n  readonly subjectId: ColumnKey<Identifier>;\n  readonly verifiedAt: ColumnKey<Identifier>;\n  readonly bindingRevision: ColumnKey<Identifier>;\n  readonly isCurrent: (row: Identifier[\"select\"]) => boolean;\n  readonly d1CurrentCondition?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly nativeSubjectId: NativeSubjectId;\n    readonly bindingRevision: SecurityRevision;\n  }) => Expression;\n  readonly encodeVerifiedInsert: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly subjectId: NativeSubjectId;\n    readonly verifiedAtMillis: number;\n    readonly bindingRevision: SecurityRevision;\n  }) => Identifier[\"insert\"];\n}\n\nexport interface EmailRegistrationCredentialTable<Credential extends Table, NativeSubjectId> {\n  readonly table: Credential[\"table\"];\n  readonly moduleId: ColumnKey<Credential>;\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly identifierNamespace: ColumnKey<Credential>;\n  readonly identifierValue: ColumnKey<Credential>;\n  readonly credentialRevision: ColumnKey<Credential>;\n  readonly status: ColumnKey<Credential>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n  readonly encodeVerifiedInsert: (input: {\n    readonly moduleId: string;\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly identifier: LoginIdentifier;\n    readonly credentialRevision: SecurityRevision;\n  }) => Credential[\"insert\"];\n}\n\nexport interface EmailRegistrationAuthorityCredentialTable<\n  Credential extends Table,\n  NativeSubjectId,\n> {\n  readonly table: Credential[\"table\"];\n  readonly subjectId: ColumnKey<Credential>;\n  readonly credentialId: ColumnKey<Credential>;\n  readonly revision: ColumnKey<Credential>;\n  readonly status: ColumnKey<Credential>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly d1ActiveStatusValue?: unknown;\n  readonly encodeInsert: (input: {\n    readonly subjectId: NativeSubjectId;\n    readonly credentialId: string;\n    readonly revision: SecurityRevision;\n  }) => Credential[\"insert\"];\n}\n\nexport interface RequiredEmailRegistrationConstraints extends RequiredEmailSignInConstraints {\n  readonly authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\";\n  readonly request: \"unique(emailRegistration.moduleId,emailRegistration.commandId)\";\n  readonly pendingReference: \"unique(emailRegistration.pendingReference)\";\n}\n\nexport const requiredEmailRegistrationConstraints: RequiredEmailRegistrationConstraints = {\n  ...requiredEmailSignInConstraints,\n  authorityCredential: \"unique(authorityCredential.subjectId,authorityCredential.credentialId)\",\n  request: \"unique(emailRegistration.moduleId,emailRegistration.commandId)\",\n  pendingReference: \"unique(emailRegistration.pendingReference)\",\n};\n\ntype EmailRegistrationBase<Registration, Request extends Table, NativeSubjectId> = {\n  readonly registration: EmailRegistrationTable<Registration, Request, NativeSubjectId>;\n  readonly constraints: Pick<RequiredEmailRegistrationConstraints, \"request\" | \"pendingReference\">;\n  readonly inspect: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration;\n  }) => Effect.Effect<\n    {\n      readonly fingerprint: TokenDigest;\n      readonly eligible: boolean;\n    },\n    PersistenceMappingError\n  >;\n  /** Projects one detached value of the factory-specific Registration Type. */\n  readonly snapshotRegistration: (\n    registration: Registration,\n  ) => Effect.Effect<Registration, PersistenceMappingError>;\n  /** Required by synchronous transaction-bound services. */\n  readonly snapshotRegistrationSync?: (registration: Registration) => Registration;\n  /** Required by synchronous Durable Object transaction-bound services. */\n  readonly inspectSync?: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration;\n  }) => {\n    readonly fingerprint: TokenDigest;\n    readonly eligible: boolean;\n  };\n  readonly allocatePendingReference?: Effect.Effect<string, PersistenceMappingError>;\n  readonly allocatePendingReferenceSync?: () => string;\n  readonly encodeInstant: (epochMillis: number) => unknown;\n  readonly retentionMillis: number;\n  readonly isRequestConflict: (cause: unknown) => boolean;\n};\n\nexport type EmailRegistrationMapping<\n  Registration,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Request extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = EmailRegistrationBase<Registration, Request, NativeSubjectId> &\n  (\n    | {\n        readonly mode: \"atomic\";\n        readonly subject: EmailSubjectReadTable<Subject>;\n        readonly identifier: EmailRegistrationIdentifierTable<\n          Identifier,\n          NativeSubjectId,\n          Expression\n        >;\n        readonly credential: EmailRegistrationCredentialTable<Credential, NativeSubjectId>;\n        readonly authorityCredential: EmailRegistrationAuthorityCredentialTable<\n          AuthorityCredential,\n          NativeSubjectId\n        >;\n        readonly subjectId: SubjectIdCodec<NativeSubjectId>;\n        readonly constraints: RequiredEmailRegistrationConstraints;\n        readonly allocateCredentialId?: Effect.Effect<string, PersistenceMappingError>;\n        readonly allocateCredentialIdSync?: () => string;\n        readonly allocateRevision?: Effect.Effect<SecurityRevision, PersistenceMappingError>;\n        readonly allocateRevisionSync?: () => SecurityRevision;\n        readonly isIdentifierConflict: (cause: unknown) => boolean;\n        readonly isCredentialConflict: (cause: unknown) => boolean;\n        readonly provisioning: EmailRegistrationProvisioning<\n          Registration,\n          Subject,\n          NativeSubjectId\n        > &\n          (\n            | {\n                readonly idMode: \"allocated\";\n                readonly allocateSubjectId: Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n              }\n            | {\n                readonly idMode: \"synchronous\";\n                readonly allocateSubjectIdSync: () => NativeSubjectId;\n              }\n            | {\n                readonly idMode: \"generated\";\n                readonly decodeGeneratedId: (\n                  rows: ReadonlyArray<unknown>,\n                ) => Effect.Effect<NativeSubjectId, PersistenceMappingError>;\n              }\n          );\n      }\n    | {\n        readonly mode: \"pending\";\n      }\n  );\n\nexport type AnyEmailSignInMapping = EmailSignInMapping<\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown\n>;\n\nexport type AnyEmailAddressMapping<Expression extends SqlExpression = SqlExpression> =\n  EmailAddressMapping<\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    AnyTableModel,\n    unknown,\n    Expression\n  >;\n\nexport type AnyEmailRegistrationMapping<\n  Registration = unknown,\n  Expression extends SqlExpression = SqlExpression,\n> = EmailRegistrationMapping<\n  Registration,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  AnyTableModel,\n  unknown,\n  Expression\n>;\n\nexport type D1EmailRegistrationMapping<\n  Registration,\n  Subject extends Table,\n  Identifier extends Table,\n  Credential extends Table,\n  AuthorityCredential extends Table,\n  Request extends Table,\n  NativeSubjectId,\n  Expression extends SqlExpression = SqlExpression,\n> = EmailRegistrationMapping<\n  Registration,\n  Subject,\n  Identifier,\n  Credential,\n  AuthorityCredential,\n  Request,\n  NativeSubjectId,\n  Expression\n> & {\n  readonly d1: EmailD1Clock<Expression>;\n};\n"],"mappings":";AAqKA,MAAa,iCAAiE;CAC5E,YAAY;CACZ,cAAc;CACd,sBACE;AACJ;AAqBA,MAAa,kCAAmE;CAC9E,GAAG;CACH,qBAAqB;CACrB,SAAS;AACX;AAmNA,MAAa,uCAA6E;CACxF,GAAG;CACH,qBAAqB;CACrB,SAAS;CACT,kBAAkB;AACpB"}

package/dist/internal/models/passkey-model.d.mts

@@ -0,0 +1,266 @@
+import { SqlExpression, TableModel } from "../query-operations.mjs";
+import { PersistenceMappingError } from "../mapping-error.mjs";
+import "./common.mjs";
+import { Effect, Layer } from "effect";
+import { PasskeyCeremony, PasskeyCredential, PasskeyCredentials, PasskeyEnrollmentContext, PasskeyMethodPolicy, PasskeyPersistence } from "@yielded/auth/Passkey";
+import { SubjectId } from "@yielded/auth/Schema";
+//#region src/internal/models/passkey-model.d.ts
+export type PasskeyColumn<T extends TableModel> = T["column"];
+export type PasskeyMappingSource<M, RSetup = never> = M | Effect.Effect<M, PersistenceMappingError, RSetup>;
+export interface PasskeyCredentialServices {
+  readonly passkeyCredentials: PasskeyCredentials["Service"];
+}
+export interface PasskeyPersistenceServices {
+  readonly passkeyPersistence: PasskeyPersistence["Service"];
+}
+export interface PasskeyEnrollmentContextServices {
+  readonly passkeyEnrollmentContext: PasskeyEnrollmentContext["Service"];
+}
+export declare const passkeyCredentialsLayer: <E, R>(services: Effect.Effect<PasskeyCredentialServices, E, R>) => Layer.Layer<PasskeyCredentials, E, R>;
+export declare const passkeyPersistenceLayer: <E, R>(services: Effect.Effect<PasskeyPersistenceServices, E, R>) => Layer.Layer<PasskeyPersistence, E, R>;
+export declare const passkeyEnrollmentContextLayer: <E, R>(services: Effect.Effect<PasskeyEnrollmentContextServices, E, R>) => Layer.Layer<PasskeyEnrollmentContext, E, R>;
+/** Native IDs roundtrip exactly; protocol IDs and authentication references are
+ * different identities. These callbacks never suspend inside an owner. */
+export interface PasskeySubjectIdCodec<N> {
+  readonly toNative: (id: SubjectId) => N;
+  readonly toSubject: (id: N) => SubjectId;
+  readonly equals: (left: N, right: N) => boolean;
+}
+export interface PasskeyClock<Expression extends SqlExpression = SqlExpression> {
+  readonly encodeInstant: (millis: number) => unknown;
+  readonly decodeInstant: (value: unknown) => number;
+  readonly engineNowMillis: Expression;
+  readonly toMillis: (expression: Expression) => Expression;
+  readonly fromMillis: (expression: Expression) => Expression;
+}
+export interface PasskeySubjectReadTable<T extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+  readonly table: T["table"];
+  readonly id: PasskeyColumn<T>;
+  readonly status: PasskeyColumn<T>;
+  readonly securityRevision: PasskeyColumn<T>;
+  readonly decodeId: (row: Readonly<Partial<T["select"]>>) => N;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: Expression;
+}
+export interface PasskeyFactorReadTable<T extends TableModel, Expression extends SqlExpression = SqlExpression> {
+  readonly table: T["table"];
+  readonly subjectId: PasskeyColumn<T>;
+  readonly credentialId: PasskeyColumn<T>;
+  readonly revision: PasskeyColumn<T>;
+  readonly status: PasskeyColumn<T>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: Expression;
+}
+/** decode uses only these declared columns. Counter columns are native integral
+ * numbers; BS may use a consumer enum. Name/creation metadata is not required. */
+export interface PasskeyCredentialReadTable<T extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+  readonly table: T["table"];
+  readonly credentialId: PasskeyColumn<T>;
+  readonly subjectId: PasskeyColumn<T>;
+  readonly rpId: PasskeyColumn<T>;
+  readonly protocolCredentialId: PasskeyColumn<T>;
+  readonly credentialKey: PasskeyColumn<T>;
+  readonly handleKey: PasskeyColumn<T>;
+  readonly userHandle: PasskeyColumn<T>;
+  readonly publicKey: PasskeyColumn<T>;
+  readonly algorithm: PasskeyColumn<T>;
+  readonly profile: PasskeyColumn<T>;
+  readonly credentialRevision: PasskeyColumn<T>;
+  readonly status: PasskeyColumn<T>;
+  readonly primarySignIn: PasskeyColumn<T>;
+  readonly enrollmentUserVerified: PasskeyColumn<T>;
+  readonly backupEligible: PasskeyColumn<T>;
+  readonly backupState: PasskeyColumn<T>;
+  readonly counter: PasskeyColumn<T>;
+  readonly maximumCounter: PasskeyColumn<T>;
+  readonly decode: (row: Readonly<Partial<T["select"]>>) => Omit<PasskeyCredential, "revision" | "active">;
+  readonly decodeSubjectId: (row: Readonly<Partial<T["select"]>>) => N;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: Expression;
+}
+export interface PasskeyCredentialOwnershipTable<T extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+  readonly table: T["table"];
+  readonly credentialKey: PasskeyColumn<T>;
+  readonly rpId: PasskeyColumn<T>;
+  readonly protocolCredentialId: PasskeyColumn<T>;
+  readonly subjectId: PasskeyColumn<T>;
+  readonly credentialId: PasskeyColumn<T>;
+  readonly state: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly reservationId: PasskeyColumn<T>;
+  readonly ownedCondition: Expression;
+  readonly isOwnedState: (value: unknown) => boolean;
+  readonly decodeSubjectId: (row: Readonly<Partial<T["select"]>>) => N;
+}
+/** Reservations do not manufacture a subject; bound handles are RP-global. */
+export interface PasskeyHandleReadTable<T extends TableModel> {
+  readonly table: T["table"];
+  readonly handleKey: PasskeyColumn<T>;
+  readonly rpId: PasskeyColumn<T>;
+  readonly userHandle: PasskeyColumn<T>;
+  readonly state: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly reservationId: PasskeyColumn<T>;
+}
+export interface PasskeyHandleReservationTable<T extends TableModel, Expression extends SqlExpression = SqlExpression> extends PasskeyHandleReadTable<T> {
+  readonly reservedCondition: Expression;
+  readonly isReservedState: (value: unknown) => boolean;
+}
+export interface PasskeyHandleOwnershipTable<T extends TableModel, N, Expression extends SqlExpression = SqlExpression> extends PasskeyHandleReadTable<T> {
+  readonly subjectId: PasskeyColumn<T>;
+  readonly ownedCondition: Expression;
+  readonly isOwnedState: (value: unknown) => boolean;
+  readonly decodeSubjectId: (row: Readonly<Partial<T["select"]>>) => N;
+}
+export declare const requiredPasskeyCredentialConstraints: {
+  readonly credentialId: readonly ["credentialId"];
+  readonly factor: readonly ["subjectId", "credentialId"];
+  readonly credentialOwnership: readonly ["credentialKey"];
+  readonly handleOwnership: readonly ["handleKey"];
+  readonly boundSubjectHandle: readonly ["rpId", "subjectId"];
+};
+export interface PasskeyCredentialMapping<S extends TableModel, C extends TableModel, F extends TableModel, Ownership extends TableModel, Handle extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+  readonly subject: PasskeySubjectReadTable<S, N, Expression>;
+  readonly credential: PasskeyCredentialReadTable<C, N, Expression>;
+  readonly authority: PasskeyFactorReadTable<F, Expression>;
+  readonly credentialOwnership: PasskeyCredentialOwnershipTable<Ownership, N, Expression>;
+  readonly handleOwnership: PasskeyHandleOwnershipTable<Handle, N, Expression>;
+  readonly subjectIds: PasskeySubjectIdCodec<N>;
+  readonly constraints: typeof requiredPasskeyCredentialConstraints;
+}
+/** A stable additional policy row, acquired before RP/credential locks. The
+ * factory checks column names without erasing the consumer table at its input. */
+declare const PasskeyPolicyGuardTypeId: unique symbol;
+export interface PasskeyPolicyGuard<Expression extends SqlExpression = SqlExpression> {
+  readonly [PasskeyPolicyGuardTypeId]: true;
+  readonly scope: string;
+  readonly table: object;
+  readonly columns: ReadonlyArray<string>;
+  readonly where: (moduleId: string) => Expression;
+  readonly condition: (moduleId: string) => Expression;
+}
+export declare const passkeyPolicyGuard: <T extends TableModel, Expression extends SqlExpression = SqlExpression>(input: {
+  readonly scope: string;
+  readonly table: T["table"];
+  readonly columns: ReadonlyArray<PasskeyColumn<T>>;
+  readonly where: (moduleId: string) => Expression;
+  readonly condition: (moduleId: string) => Expression;
+}) => PasskeyPolicyGuard<Expression>;
+export interface PasskeyModuleTable<T extends TableModel, Expression extends SqlExpression = SqlExpression> {
+  readonly table: T["table"];
+  readonly moduleId: PasskeyColumn<T>;
+  readonly status: PasskeyColumn<T>;
+  readonly policyRevision: PasskeyColumn<T>;
+  /** All physical fields used by decodeMethodPolicy, including policyRevision. */
+  readonly policyColumns: ReadonlyArray<PasskeyColumn<T>>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: Expression;
+  readonly decodeMethodPolicy: (row: Readonly<Partial<T["select"]>>) => PasskeyMethodPolicy;
+  readonly guards?: ReadonlyArray<PasskeyPolicyGuard<Expression>>;
+}
+export type PasskeyFlowState = "Pending" | "Claimed" | "Verified" | "Rejected" | "Ambiguous" | "RegistrationAccepted" | "ProvisioningPending";
+export interface PasskeyFlowInsert {
+  readonly ceremony: PasskeyCeremony;
+  readonly policy: PasskeyMethodPolicy;
+  readonly marker: string;
+}
+export interface PasskeyFlowTable<T extends TableModel> {
+  readonly table: T["table"];
+  readonly moduleId: PasskeyColumn<T>;
+  readonly flowId: PasskeyColumn<T>;
+  readonly commandId: PasskeyColumn<T>;
+  readonly purpose: PasskeyColumn<T>;
+  readonly state: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly generation: PasskeyColumn<T>;
+  readonly snapshot: PasskeyColumn<T>;
+  readonly policySnapshot: PasskeyColumn<T>;
+  readonly requestBindingVerifier: PasskeyColumn<T>;
+  readonly requestBindingExpiresAt: PasskeyColumn<T>;
+  readonly issuedAt: PasskeyColumn<T>;
+  readonly expiresAt: PasskeyColumn<T>;
+  readonly retentionUntil: PasskeyColumn<T>;
+  readonly claimId: PasskeyColumn<T>;
+  readonly claimedAt: PasskeyColumn<T>;
+  readonly claimExpiresAt: PasskeyColumn<T>;
+  readonly credentialSnapshot: PasskeyColumn<T>;
+  /** Core SubjectId scope text, not a consumer's native subject ID. */
+  readonly subjectScope: PasskeyColumn<T>;
+  readonly targetScope: PasskeyColumn<T>;
+  readonly states: Readonly<Record<PasskeyFlowState, unknown>>;
+  readonly encodeInsert: (input: PasskeyFlowInsert) => T["insert"];
+}
+export interface PasskeyAdmissionTable<T extends TableModel> {
+  readonly table: T["table"];
+  readonly authorityScope: PasskeyColumn<T>;
+  readonly moduleId: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly ownerMarker: PasskeyColumn<T>;
+  /** One physical clock sample, reused by every charge of this decision. */
+  readonly admittedAt: PasskeyColumn<T>;
+}
+export type PasskeyChargeKind = "global" | "subject" | "target";
+export interface PasskeyChargeInsert {
+  readonly moduleId: string;
+  readonly flowId: string;
+  readonly purpose: PasskeyCeremony["purpose"];
+  readonly kind: PasskeyChargeKind;
+  readonly scope: string;
+  readonly originalWindowMillis: number;
+  readonly marker: string;
+}
+/** Charge scope is canonical core identity text; this subject-free descriptor
+ * can count all purposes without decoding any unrelated native subject. */
+export interface PasskeyChargeTable<T extends TableModel> {
+  readonly table: T["table"];
+  readonly moduleId: PasskeyColumn<T>;
+  readonly flowId: PasskeyColumn<T>;
+  readonly purpose: PasskeyColumn<T>;
+  readonly kind: PasskeyColumn<T>;
+  readonly scope: PasskeyColumn<T>;
+  readonly originalWindowMillis: PasskeyColumn<T>;
+  readonly admittedAt: PasskeyColumn<T>;
+  readonly retainUntil: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly ownerMarker: PasskeyColumn<T>;
+  readonly encodeInsert: (input: PasskeyChargeInsert) => T["insert"];
+}
+export declare const requiredPasskeyPersistenceConstraints: {
+  readonly flow: readonly ["moduleId", "flowId"];
+  readonly command: readonly ["moduleId", "commandId"];
+  readonly admission: readonly ["authorityScope", "moduleId"];
+  readonly charge: readonly ["moduleId", "flowId", "kind"];
+};
+export interface PasskeyCeremonyMapping<Module extends TableModel, Flow extends TableModel, Admission extends TableModel, Charge extends TableModel, Expression extends SqlExpression = SqlExpression> {
+  readonly moduleId: string;
+  readonly authorityScope: string;
+  readonly module: PasskeyModuleTable<Module, Expression>;
+  readonly flow: PasskeyFlowTable<Flow>;
+  readonly admission: PasskeyAdmissionTable<Admission>;
+  readonly charge: PasskeyChargeTable<Charge>;
+  readonly clock: PasskeyClock<Expression>;
+  readonly constraints: typeof requiredPasskeyPersistenceConstraints;
+}
+export interface PasskeyPersistenceMapping<Read, Module extends TableModel, Flow extends TableModel, Admission extends TableModel, Charge extends TableModel, N, Expression extends SqlExpression = SqlExpression, Credential extends TableModel = TableModel> extends PasskeyCeremonyMapping<Module, Flow, Admission, Charge, Expression> {
+  readonly read: Read & {
+    readonly subjectIds: PasskeySubjectIdCodec<N>;
+  };
+  readonly telemetry: {
+    readonly lastUsedAt: PasskeyColumn<Credential>;
+    readonly encodeBackupState: (value: boolean) => unknown;
+  };
+}
+export interface PasskeyEnrollmentContextMapping<Read, Module extends TableModel, N, Expression extends SqlExpression = SqlExpression> {
+  readonly moduleId: string;
+  readonly read: Read & {
+    readonly subjectIds: PasskeySubjectIdCodec<N>;
+  };
+  readonly module: PasskeyModuleTable<Module, Expression>;
+}
+export interface D1PasskeyMapping {
+  readonly d1: {
+    readonly primary: true;
+  };
+}
+//#endregion
+//# sourceMappingURL=passkey-model.d.mts.map

package/dist/internal/models/passkey-model.mjs

@@ -0,0 +1,34 @@
+import { Effect, Layer } from "effect";
+import { PasskeyCredentials, PasskeyEnrollmentContext, PasskeyPersistence } from "@yielded/auth/Passkey";
+//#region src/internal/models/passkey-model.ts
+const passkeyCredentialsLayer = (services) => Layer.effect(PasskeyCredentials, Effect.map(services, (value) => value.passkeyCredentials));
+const passkeyPersistenceLayer = (services) => Layer.effect(PasskeyPersistence, Effect.map(services, (value) => value.passkeyPersistence));
+const passkeyEnrollmentContextLayer = (services) => Layer.effect(PasskeyEnrollmentContext, Effect.map(services, (value) => value.passkeyEnrollmentContext));
+const requiredPasskeyCredentialConstraints = {
+	credentialId: ["credentialId"],
+	factor: ["subjectId", "credentialId"],
+	credentialOwnership: ["credentialKey"],
+	handleOwnership: ["handleKey"],
+	boundSubjectHandle: ["rpId", "subjectId"]
+};
+/** A stable additional policy row, acquired before RP/credential locks. The
+* factory checks column names without erasing the consumer table at its input. */
+const PasskeyPolicyGuardTypeId = Symbol("effect-auth/drizzle/PasskeyPolicyGuard");
+const passkeyPolicyGuard = (input) => ({
+	...input,
+	[PasskeyPolicyGuardTypeId]: true
+});
+const requiredPasskeyPersistenceConstraints = {
+	flow: ["moduleId", "flowId"],
+	command: ["moduleId", "commandId"],
+	admission: ["authorityScope", "moduleId"],
+	charge: [
+		"moduleId",
+		"flowId",
+		"kind"
+	]
+};
+//#endregion
+export { passkeyCredentialsLayer, passkeyEnrollmentContextLayer, passkeyPersistenceLayer, passkeyPolicyGuard, requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints };
+
+//# sourceMappingURL=passkey-model.mjs.map

package/dist/internal/models/passkey-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-model.mjs","names":[],"sources":["../../../src/internal/models/passkey-model.ts"],"sourcesContent":["import {\n  type PasskeyCeremony,\n  type PasskeyCredential,\n  type PasskeyMethodPolicy,\n  PasskeyCredentials,\n  PasskeyEnrollmentContext,\n  PasskeyPersistence,\n} from \"@yielded/auth/Passkey\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport { Effect, Layer } from \"effect\";\n\nimport type { TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type { PersistenceMappingError } from \"./common\";\n\nexport type PasskeyColumn<T extends Table> = T[\"column\"];\n\nexport type PasskeyMappingSource<M, RSetup = never> =\n  | M\n  | Effect.Effect<M, PersistenceMappingError, RSetup>;\n\nexport interface PasskeyCredentialServices {\n  readonly passkeyCredentials: PasskeyCredentials[\"Service\"];\n}\n\nexport interface PasskeyPersistenceServices {\n  readonly passkeyPersistence: PasskeyPersistence[\"Service\"];\n}\n\nexport interface PasskeyEnrollmentContextServices {\n  readonly passkeyEnrollmentContext: PasskeyEnrollmentContext[\"Service\"];\n}\n\nexport const passkeyCredentialsLayer = <E, R>(\n  services: Effect.Effect<PasskeyCredentialServices, E, R>,\n): Layer.Layer<PasskeyCredentials, E, R> =>\n  Layer.effect(\n    PasskeyCredentials,\n    Effect.map(services, (value) => value.passkeyCredentials),\n  );\n\nexport const passkeyPersistenceLayer = <E, R>(\n  services: Effect.Effect<PasskeyPersistenceServices, E, R>,\n): Layer.Layer<PasskeyPersistence, E, R> =>\n  Layer.effect(\n    PasskeyPersistence,\n    Effect.map(services, (value) => value.passkeyPersistence),\n  );\n\nexport const passkeyEnrollmentContextLayer = <E, R>(\n  services: Effect.Effect<PasskeyEnrollmentContextServices, E, R>,\n): Layer.Layer<PasskeyEnrollmentContext, E, R> =>\n  Layer.effect(\n    PasskeyEnrollmentContext,\n    Effect.map(services, (value) => value.passkeyEnrollmentContext),\n  );\n\n/** Native IDs roundtrip exactly; protocol IDs and authentication references are\n * different identities. These callbacks never suspend inside an owner. */\nexport interface PasskeySubjectIdCodec<N> {\n  readonly toNative: (id: SubjectId) => N;\n  readonly toSubject: (id: N) => SubjectId;\n  readonly equals: (left: N, right: N) => boolean;\n}\n\nexport interface PasskeyClock<Expression extends SqlExpression = SqlExpression> {\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => number;\n  readonly engineNowMillis: Expression;\n  readonly toMillis: (expression: Expression) => Expression;\n  readonly fromMillis: (expression: Expression) => Expression;\n}\n\nexport interface PasskeySubjectReadTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly id: PasskeyColumn<T>;\n  readonly status: PasskeyColumn<T>;\n  readonly securityRevision: PasskeyColumn<T>;\n  readonly decodeId: (row: Readonly<Partial<T[\"select\"]>>) => N;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\nexport interface PasskeyFactorReadTable<\n  T extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly subjectId: PasskeyColumn<T>;\n  readonly credentialId: PasskeyColumn<T>;\n  readonly revision: PasskeyColumn<T>;\n  readonly status: PasskeyColumn<T>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\n/** decode uses only these declared columns. Counter columns are native integral\n * numbers; BS may use a consumer enum. Name/creation metadata is not required. */\nexport interface PasskeyCredentialReadTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly credentialId: PasskeyColumn<T>;\n  readonly subjectId: PasskeyColumn<T>;\n  readonly rpId: PasskeyColumn<T>;\n  readonly protocolCredentialId: PasskeyColumn<T>;\n  readonly credentialKey: PasskeyColumn<T>;\n  readonly handleKey: PasskeyColumn<T>;\n  readonly userHandle: PasskeyColumn<T>;\n  readonly publicKey: PasskeyColumn<T>;\n  readonly algorithm: PasskeyColumn<T>;\n  readonly profile: PasskeyColumn<T>;\n  readonly credentialRevision: PasskeyColumn<T>;\n  readonly status: PasskeyColumn<T>;\n  readonly primarySignIn: PasskeyColumn<T>;\n  readonly enrollmentUserVerified: PasskeyColumn<T>;\n  readonly backupEligible: PasskeyColumn<T>;\n  readonly backupState: PasskeyColumn<T>;\n  readonly counter: PasskeyColumn<T>;\n  readonly maximumCounter: PasskeyColumn<T>;\n  readonly decode: (\n    row: Readonly<Partial<T[\"select\"]>>,\n  ) => Omit<PasskeyCredential, \"revision\" | \"active\">;\n  readonly decodeSubjectId: (row: Readonly<Partial<T[\"select\"]>>) => N;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n}\n\nexport interface PasskeyCredentialOwnershipTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly credentialKey: PasskeyColumn<T>;\n  readonly rpId: PasskeyColumn<T>;\n  readonly protocolCredentialId: PasskeyColumn<T>;\n  readonly subjectId: PasskeyColumn<T>;\n  readonly credentialId: PasskeyColumn<T>;\n  readonly state: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly reservationId: PasskeyColumn<T>;\n  readonly ownedCondition: Expression;\n  readonly isOwnedState: (value: unknown) => boolean;\n  readonly decodeSubjectId: (row: Readonly<Partial<T[\"select\"]>>) => N;\n}\n\n/** Reservations do not manufacture a subject; bound handles are RP-global. */\nexport interface PasskeyHandleReadTable<T extends Table> {\n  readonly table: T[\"table\"];\n  readonly handleKey: PasskeyColumn<T>;\n  readonly rpId: PasskeyColumn<T>;\n  readonly userHandle: PasskeyColumn<T>;\n  readonly state: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly reservationId: PasskeyColumn<T>;\n}\n\nexport interface PasskeyHandleReservationTable<\n  T extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> extends PasskeyHandleReadTable<T> {\n  readonly reservedCondition: Expression;\n  readonly isReservedState: (value: unknown) => boolean;\n}\n\nexport interface PasskeyHandleOwnershipTable<\n  T extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> extends PasskeyHandleReadTable<T> {\n  readonly subjectId: PasskeyColumn<T>;\n  readonly ownedCondition: Expression;\n  readonly isOwnedState: (value: unknown) => boolean;\n  readonly decodeSubjectId: (row: Readonly<Partial<T[\"select\"]>>) => N;\n}\n\nexport const requiredPasskeyCredentialConstraints = {\n  credentialId: [\"credentialId\"],\n  factor: [\"subjectId\", \"credentialId\"],\n  credentialOwnership: [\"credentialKey\"],\n  handleOwnership: [\"handleKey\"],\n  boundSubjectHandle: [\"rpId\", \"subjectId\"],\n} as const;\n\nexport interface PasskeyCredentialMapping<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  Ownership extends Table,\n  Handle extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly subject: PasskeySubjectReadTable<S, N, Expression>;\n  readonly credential: PasskeyCredentialReadTable<C, N, Expression>;\n  readonly authority: PasskeyFactorReadTable<F, Expression>;\n  readonly credentialOwnership: PasskeyCredentialOwnershipTable<Ownership, N, Expression>;\n  readonly handleOwnership: PasskeyHandleOwnershipTable<Handle, N, Expression>;\n  readonly subjectIds: PasskeySubjectIdCodec<N>;\n  readonly constraints: typeof requiredPasskeyCredentialConstraints;\n}\n\n/** A stable additional policy row, acquired before RP/credential locks. The\n * factory checks column names without erasing the consumer table at its input. */\nconst PasskeyPolicyGuardTypeId: unique symbol = Symbol(\"effect-auth/drizzle/PasskeyPolicyGuard\");\n\nexport interface PasskeyPolicyGuard<Expression extends SqlExpression = SqlExpression> {\n  readonly [PasskeyPolicyGuardTypeId]: true;\n  readonly scope: string;\n  readonly table: object;\n  readonly columns: ReadonlyArray<string>;\n  readonly where: (moduleId: string) => Expression;\n  readonly condition: (moduleId: string) => Expression;\n}\n\nexport const passkeyPolicyGuard = <\n  T extends Table,\n  Expression extends SqlExpression = SqlExpression,\n>(input: {\n  readonly scope: string;\n  readonly table: T[\"table\"];\n  readonly columns: ReadonlyArray<PasskeyColumn<T>>;\n  readonly where: (moduleId: string) => Expression;\n  readonly condition: (moduleId: string) => Expression;\n}): PasskeyPolicyGuard<Expression> => ({ ...input, [PasskeyPolicyGuardTypeId]: true });\n\nexport interface PasskeyModuleTable<\n  T extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly moduleId: PasskeyColumn<T>;\n  readonly status: PasskeyColumn<T>;\n  readonly policyRevision: PasskeyColumn<T>;\n  /** All physical fields used by decodeMethodPolicy, including policyRevision. */\n  readonly policyColumns: ReadonlyArray<PasskeyColumn<T>>;\n  readonly isActiveStatus: (value: unknown) => boolean;\n  readonly activeCondition: Expression;\n  readonly decodeMethodPolicy: (row: Readonly<Partial<T[\"select\"]>>) => PasskeyMethodPolicy;\n  readonly guards?: ReadonlyArray<PasskeyPolicyGuard<Expression>>;\n}\n\nexport type PasskeyFlowState =\n  | \"Pending\"\n  | \"Claimed\"\n  | \"Verified\"\n  | \"Rejected\"\n  | \"Ambiguous\"\n  | \"RegistrationAccepted\"\n  | \"ProvisioningPending\";\n\nexport interface PasskeyFlowInsert {\n  readonly ceremony: PasskeyCeremony;\n  readonly policy: PasskeyMethodPolicy;\n  readonly marker: string;\n}\n\nexport interface PasskeyFlowTable<T extends Table> {\n  readonly table: T[\"table\"];\n  readonly moduleId: PasskeyColumn<T>;\n  readonly flowId: PasskeyColumn<T>;\n  readonly commandId: PasskeyColumn<T>;\n  readonly purpose: PasskeyColumn<T>;\n  readonly state: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly generation: PasskeyColumn<T>;\n  readonly snapshot: PasskeyColumn<T>;\n  readonly policySnapshot: PasskeyColumn<T>;\n  readonly requestBindingVerifier: PasskeyColumn<T>;\n  readonly requestBindingExpiresAt: PasskeyColumn<T>;\n  readonly issuedAt: PasskeyColumn<T>;\n  readonly expiresAt: PasskeyColumn<T>;\n  readonly retentionUntil: PasskeyColumn<T>;\n  readonly claimId: PasskeyColumn<T>;\n  readonly claimedAt: PasskeyColumn<T>;\n  readonly claimExpiresAt: PasskeyColumn<T>;\n  readonly credentialSnapshot: PasskeyColumn<T>;\n  /** Core SubjectId scope text, not a consumer's native subject ID. */\n  readonly subjectScope: PasskeyColumn<T>;\n  readonly targetScope: PasskeyColumn<T>;\n  readonly states: Readonly<Record<PasskeyFlowState, unknown>>;\n  readonly encodeInsert: (input: PasskeyFlowInsert) => T[\"insert\"];\n}\n\nexport interface PasskeyAdmissionTable<T extends Table> {\n  readonly table: T[\"table\"];\n  readonly authorityScope: PasskeyColumn<T>;\n  readonly moduleId: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly ownerMarker: PasskeyColumn<T>;\n  /** One physical clock sample, reused by every charge of this decision. */\n  readonly admittedAt: PasskeyColumn<T>;\n}\n\nexport type PasskeyChargeKind = \"global\" | \"subject\" | \"target\";\n\nexport interface PasskeyChargeInsert {\n  readonly moduleId: string;\n  readonly flowId: string;\n  readonly purpose: PasskeyCeremony[\"purpose\"];\n  readonly kind: PasskeyChargeKind;\n  readonly scope: string;\n  readonly originalWindowMillis: number;\n  readonly marker: string;\n}\n\n/** Charge scope is canonical core identity text; this subject-free descriptor\n * can count all purposes without decoding any unrelated native subject. */\nexport interface PasskeyChargeTable<T extends Table> {\n  readonly table: T[\"table\"];\n  readonly moduleId: PasskeyColumn<T>;\n  readonly flowId: PasskeyColumn<T>;\n  readonly purpose: PasskeyColumn<T>;\n  readonly kind: PasskeyColumn<T>;\n  readonly scope: PasskeyColumn<T>;\n  readonly originalWindowMillis: PasskeyColumn<T>;\n  readonly admittedAt: PasskeyColumn<T>;\n  readonly retainUntil: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly ownerMarker: PasskeyColumn<T>;\n  readonly encodeInsert: (input: PasskeyChargeInsert) => T[\"insert\"];\n}\n\nexport const requiredPasskeyPersistenceConstraints = {\n  flow: [\"moduleId\", \"flowId\"],\n  command: [\"moduleId\", \"commandId\"],\n  admission: [\"authorityScope\", \"moduleId\"],\n  charge: [\"moduleId\", \"flowId\", \"kind\"],\n} as const;\n\nexport interface PasskeyCeremonyMapping<\n  Module extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly moduleId: string;\n  readonly authorityScope: string;\n  readonly module: PasskeyModuleTable<Module, Expression>;\n  readonly flow: PasskeyFlowTable<Flow>;\n  readonly admission: PasskeyAdmissionTable<Admission>;\n  readonly charge: PasskeyChargeTable<Charge>;\n  readonly clock: PasskeyClock<Expression>;\n  readonly constraints: typeof requiredPasskeyPersistenceConstraints;\n}\n\nexport interface PasskeyPersistenceMapping<\n  Read,\n  Module extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n  Credential extends Table = Table,\n> extends PasskeyCeremonyMapping<Module, Flow, Admission, Charge, Expression> {\n  readonly read: Read & {\n    readonly subjectIds: PasskeySubjectIdCodec<N>;\n  };\n  readonly telemetry: {\n    readonly lastUsedAt: PasskeyColumn<Credential>;\n    readonly encodeBackupState: (value: boolean) => unknown;\n  };\n}\n\nexport interface PasskeyEnrollmentContextMapping<\n  Read,\n  Module extends Table,\n  N,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly moduleId: string;\n  readonly read: Read & {\n    readonly subjectIds: PasskeySubjectIdCodec<N>;\n  };\n  readonly module: PasskeyModuleTable<Module, Expression>;\n}\n\nexport interface D1PasskeyMapping {\n  readonly d1: {\n    readonly primary: true;\n  };\n}\n"],"mappings":";;;AAgCA,MAAa,2BACX,aAEA,MAAM,OACJ,oBACA,OAAO,IAAI,WAAW,UAAU,MAAM,kBAAkB,CAC1D;AAEF,MAAa,2BACX,aAEA,MAAM,OACJ,oBACA,OAAO,IAAI,WAAW,UAAU,MAAM,kBAAkB,CAC1D;AAEF,MAAa,iCACX,aAEA,MAAM,OACJ,0BACA,OAAO,IAAI,WAAW,UAAU,MAAM,wBAAwB,CAChE;AAgIF,MAAa,uCAAuC;CAClD,cAAc,CAAC,cAAc;CAC7B,QAAQ,CAAC,aAAa,cAAc;CACpC,qBAAqB,CAAC,eAAe;CACrC,iBAAiB,CAAC,WAAW;CAC7B,oBAAoB,CAAC,QAAQ,WAAW;AAC1C;;;AAsBA,MAAM,2BAA0C,OAAO,wCAAwC;AAW/F,MAAa,sBAGX,WAMqC;CAAE,GAAG;EAAQ,2BAA2B;AAAK;AAmGpF,MAAa,wCAAwC;CACnD,MAAM,CAAC,YAAY,QAAQ;CAC3B,SAAS,CAAC,YAAY,WAAW;CACjC,WAAW,CAAC,kBAAkB,UAAU;CACxC,QAAQ;EAAC;EAAY;EAAU;CAAM;AACvC"}

package/dist/internal/models/passkey-registration-ceremony-model.d.mts

@@ -0,0 +1,49 @@
+import { SqlExpression, TableModel } from "../query-operations.mjs";
+import { PasskeyCeremonyMapping, PasskeyChargeTable, PasskeyColumn, PasskeyFlowTable, PasskeyHandleReservationTable, PasskeyPersistenceServices } from "./passkey-model.mjs";
+//#region src/internal/models/passkey-registration-ceremony-model.d.ts
+export interface PasskeyRegistrationCeremonyCapabilities {
+  readonly purposes: readonly ["registration"];
+  readonly issue: "registration-authority";
+  readonly assertionSettlement: false;
+}
+export interface PasskeyRegistrationCeremonyServices extends PasskeyPersistenceServices {
+  readonly capabilities: PasskeyRegistrationCeremonyCapabilities;
+}
+/** Read-only custody supplied by a separate registration issuance authority.
+ * No application payload codec, subject codec or provisioning callback runs here. */
+export interface PasskeyRegistrationIntentReadTable<T extends TableModel, Expression extends SqlExpression = SqlExpression> {
+  readonly table: T["table"];
+  readonly moduleId: PasskeyColumn<T>;
+  readonly flowId: PasskeyColumn<T>;
+  readonly commandId: PasskeyColumn<T>;
+  readonly state: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly fingerprint: PasskeyColumn<T>;
+  readonly handleKey: PasskeyColumn<T>;
+  readonly reservationId: PasskeyColumn<T>;
+  readonly ceremonySnapshot: PasskeyColumn<T>;
+  /** Already validated by the issuing authority; compare opaque bytes only. */
+  readonly applicationSnapshot: PasskeyColumn<T>;
+  readonly pendingCondition: Expression;
+  readonly isPendingState: (value: unknown) => boolean;
+  /** Any unresolved initial intent or provisioning job; cleanup never releases it. */
+  readonly custodyCondition: Expression;
+}
+export declare const requiredPasskeyRegistrationCeremonyConstraints: {
+  readonly flow: readonly ["moduleId", "flowId"];
+  readonly command: readonly ["moduleId", "commandId"];
+  readonly admission: readonly ["authorityScope", "moduleId"];
+  readonly charge: readonly ["moduleId", "flowId", "kind"];
+  readonly intentFlow: readonly ["moduleId", "flowId"];
+  readonly intentCommand: readonly ["moduleId", "commandId"];
+  readonly handle: readonly ["handleKey"];
+};
+export interface PasskeyRegistrationCeremonyMapping<Module extends TableModel, Flow extends TableModel, Admission extends TableModel, Charge extends TableModel, Intent extends TableModel, Handle extends TableModel, Expression extends SqlExpression = SqlExpression> extends Omit<PasskeyCeremonyMapping<Module, Flow, Admission, Charge, Expression>, "constraints" | "flow" | "charge"> {
+  readonly flow: Omit<PasskeyFlowTable<Flow>, "encodeInsert">;
+  readonly charge: Omit<PasskeyChargeTable<Charge>, "encodeInsert">;
+  readonly intent: PasskeyRegistrationIntentReadTable<Intent, Expression>;
+  readonly handle: PasskeyHandleReservationTable<Handle, Expression>;
+  readonly constraints: typeof requiredPasskeyRegistrationCeremonyConstraints;
+}
+//#endregion
+//# sourceMappingURL=passkey-registration-ceremony-model.d.mts.map

package/dist/internal/models/passkey-registration-ceremony-model.mjs

@@ -0,0 +1,18 @@
+//#region src/internal/models/passkey-registration-ceremony-model.ts
+const requiredPasskeyRegistrationCeremonyConstraints = {
+	flow: ["moduleId", "flowId"],
+	command: ["moduleId", "commandId"],
+	admission: ["authorityScope", "moduleId"],
+	charge: [
+		"moduleId",
+		"flowId",
+		"kind"
+	],
+	intentFlow: ["moduleId", "flowId"],
+	intentCommand: ["moduleId", "commandId"],
+	handle: ["handleKey"]
+};
+//#endregion
+export { requiredPasskeyRegistrationCeremonyConstraints };
+
+//# sourceMappingURL=passkey-registration-ceremony-model.mjs.map

package/dist/internal/models/passkey-registration-ceremony-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-registration-ceremony-model.mjs","names":[],"sources":["../../../src/internal/models/passkey-registration-ceremony-model.ts"],"sourcesContent":["import type { TableModel as Table, SqlExpression } from \"../query-operations\";\nimport type {\n  PasskeyCeremonyMapping,\n  PasskeyChargeTable,\n  PasskeyColumn,\n  PasskeyFlowTable,\n  PasskeyHandleReservationTable,\n  PasskeyPersistenceServices,\n} from \"./passkey-model\";\n\nexport interface PasskeyRegistrationCeremonyCapabilities {\n  readonly purposes: readonly [\"registration\"];\n  readonly issue: \"registration-authority\";\n  readonly assertionSettlement: false;\n}\n\nexport interface PasskeyRegistrationCeremonyServices extends PasskeyPersistenceServices {\n  readonly capabilities: PasskeyRegistrationCeremonyCapabilities;\n}\n\n/** Read-only custody supplied by a separate registration issuance authority.\n * No application payload codec, subject codec or provisioning callback runs here. */\nexport interface PasskeyRegistrationIntentReadTable<\n  T extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> {\n  readonly table: T[\"table\"];\n  readonly moduleId: PasskeyColumn<T>;\n  readonly flowId: PasskeyColumn<T>;\n  readonly commandId: PasskeyColumn<T>;\n  readonly state: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly fingerprint: PasskeyColumn<T>;\n  readonly handleKey: PasskeyColumn<T>;\n  readonly reservationId: PasskeyColumn<T>;\n  readonly ceremonySnapshot: PasskeyColumn<T>;\n  /** Already validated by the issuing authority; compare opaque bytes only. */\n  readonly applicationSnapshot: PasskeyColumn<T>;\n  readonly pendingCondition: Expression;\n  readonly isPendingState: (value: unknown) => boolean;\n  /** Any unresolved initial intent or provisioning job; cleanup never releases it. */\n  readonly custodyCondition: Expression;\n}\n\nexport const requiredPasskeyRegistrationCeremonyConstraints = {\n  flow: [\"moduleId\", \"flowId\"],\n  command: [\"moduleId\", \"commandId\"],\n  admission: [\"authorityScope\", \"moduleId\"],\n  charge: [\"moduleId\", \"flowId\", \"kind\"],\n  intentFlow: [\"moduleId\", \"flowId\"],\n  intentCommand: [\"moduleId\", \"commandId\"],\n  handle: [\"handleKey\"],\n} as const;\n\nexport interface PasskeyRegistrationCeremonyMapping<\n  Module extends Table,\n  Flow extends Table,\n  Admission extends Table,\n  Charge extends Table,\n  Intent extends Table,\n  Handle extends Table,\n  Expression extends SqlExpression = SqlExpression,\n> extends Omit<\n  PasskeyCeremonyMapping<Module, Flow, Admission, Charge, Expression>,\n  \"constraints\" | \"flow\" | \"charge\"\n> {\n  readonly flow: Omit<PasskeyFlowTable<Flow>, \"encodeInsert\">;\n  readonly charge: Omit<PasskeyChargeTable<Charge>, \"encodeInsert\">;\n  readonly intent: PasskeyRegistrationIntentReadTable<Intent, Expression>;\n  readonly handle: PasskeyHandleReservationTable<Handle, Expression>;\n  readonly constraints: typeof requiredPasskeyRegistrationCeremonyConstraints;\n}\n"],"mappings":";AA4CA,MAAa,iDAAiD;CAC5D,MAAM,CAAC,YAAY,QAAQ;CAC3B,SAAS,CAAC,YAAY,WAAW;CACjC,WAAW,CAAC,kBAAkB,UAAU;CACxC,QAAQ;EAAC;EAAY;EAAU;CAAM;CACrC,YAAY,CAAC,YAAY,QAAQ;CACjC,eAAe,CAAC,YAAY,WAAW;CACvC,QAAQ,CAAC,WAAW;AACtB"}