@yielded/auth-persistence 0.1.0-beta.10

package/dist/internal/passkey/credentials.mjs

@@ -0,0 +1,249 @@
+import { CurrentPasskeyTransaction } from "./state.mjs";
+import { Effect, Schema } from "effect";
+import { PasskeyCredential, PasskeyDescriptor, PasskeyRevision, PasskeyUserHandle, snapshotPasskeySync, validatePasskeyPolicy } from "@yielded/auth/Passkey";
+//#region src/internal/passkey/credentials.ts
+const makePasskeyCredentialsKernel = (operations, state, transactions) => {
+	const { asc, inArray, sql } = operations;
+	const { assertNow, col, copiedRow, credentialKey, equal, handleKey, mappedColumns, observeSemantic, matchesNativeRow, semanticCredentialColumns, unavailable } = state;
+	const invariant = state.invariant;
+	const { both } = transactions;
+	const readSubject = Effect.fn("passkey.readSubject")(function* (mapping, subjectId) {
+		const owner = yield* CurrentPasskeyTransaction;
+		const descriptor = mapping.subject;
+		const nativeId = mapping.subjectIds.toNative(subjectId);
+		invariant(mapping.subjectIds.toSubject(nativeId) === subjectId);
+		const row = (yield* owner.read(descriptor.table, equal(descriptor.table, { [descriptor.id]: nativeId }), {
+			limit: 1,
+			columns: [
+				descriptor.id,
+				descriptor.status,
+				descriptor.securityRevision
+			]
+		})).rows[0];
+		if (row === void 0 || !descriptor.isActiveStatus(row[descriptor.status])) return void 0;
+		invariant(mapping.subjectIds.equals(descriptor.decodeId(copiedRow(row)), nativeId));
+		const active = sql`exists(select 1 from ${descriptor.table} where ${both(owner.exact(descriptor.table, row), descriptor.activeCondition)})`;
+		if (!(yield* owner.check(active))) return void 0;
+		owner.postconditions.push(active);
+		return {
+			nativeId,
+			subjectId,
+			securityRevision: Schema.decodeUnknownSync(PasskeyRevision.fields.securityRevision)(row[descriptor.securityRevision])
+		};
+	});
+	const readModule = Effect.fn("passkey.readModule")(function* (mapping) {
+		const owner = yield* CurrentPasskeyTransaction;
+		const descriptor = mapping.module;
+		const columns = [.../* @__PURE__ */ new Set([
+			descriptor.moduleId,
+			descriptor.status,
+			descriptor.policyRevision,
+			...descriptor.policyColumns
+		])];
+		const row = (yield* owner.read(descriptor.table, equal(descriptor.table, { [descriptor.moduleId]: mapping.moduleId }), {
+			limit: 1,
+			columns
+		})).rows[0];
+		if (row === void 0 || !descriptor.isActiveStatus(row[descriptor.status])) return void 0;
+		invariant(row[descriptor.moduleId] === mapping.moduleId);
+		yield* assertNow(sql`exists(select 1 from ${descriptor.table} where ${both(owner.exact(descriptor.table, row), descriptor.activeCondition)})`);
+		return yield* validatePasskeyPolicy(descriptor.decodeMethodPolicy(copiedRow(row))).pipe(Effect.mapError(unavailable));
+	});
+	const readPolicyGuards = Effect.fn("passkey.readPolicyGuards")(function* (mapping) {
+		const owner = yield* CurrentPasskeyTransaction;
+		for (const guard of [...mapping.module.guards ?? []].sort((a, b) => a.scope < b.scope ? -1 : a.scope > b.scope ? 1 : 0)) {
+			const locked = yield* owner.read(guard.table, guard.where(mapping.moduleId), {
+				limit: 1,
+				columns: guard.columns
+			});
+			invariant(locked.rows.length === 1);
+			yield* assertNow(guard.condition(mapping.moduleId));
+		}
+	});
+	/** Advisory discovery never locks a tuple before its subject. All fields are
+	* reread under the common subject/tuple lock order by readCredential. */
+	const discoverSubject = Effect.fn("passkey.discoverSubject")(function* (mapping, rpId, protocolCredentialId) {
+		const owner = yield* CurrentPasskeyTransaction;
+		const descriptor = mapping.credentialOwnership;
+		const row = (yield* owner.read(descriptor.table, equal(descriptor.table, { [descriptor.credentialKey]: credentialKey(rpId, protocolCredentialId) }), {
+			lock: false,
+			observe: false,
+			limit: 1,
+			columns: mappedColumns(descriptor)
+		})).rows[0];
+		if (row === void 0) return void 0;
+		invariant(row[descriptor.rpId] === rpId && row[descriptor.protocolCredentialId] === protocolCredentialId);
+		if (!descriptor.isOwnedState(row[descriptor.state])) return void 0;
+		const native = descriptor.decodeSubjectId(copiedRow(row));
+		const subjectId = mapping.subjectIds.toSubject(native);
+		invariant(mapping.subjectIds.equals(mapping.subjectIds.toNative(subjectId), native));
+		return subjectId;
+	});
+	const readRevision = Effect.fn("passkey.readRevision")(function* (mapping, subject, ids) {
+		const owner = yield* CurrentPasskeyTransaction;
+		if (ids !== void 0) invariant(ids.length <= 64 && new Set(ids).size === ids.length);
+		const descriptor = mapping.authority;
+		const where = both(equal(descriptor.table, { [descriptor.subjectId]: subject.nativeId }), descriptor.activeCondition, ids === void 0 ? void 0 : ids.length === 0 ? sql`1 = 0` : inArray(col(descriptor.table, descriptor.credentialId), [...ids]));
+		const credentials = (yield* owner.read(descriptor.table, where, {
+			limit: 64,
+			columns: mappedColumns(descriptor),
+			orderBy: asc(col(descriptor.table, descriptor.credentialId))
+		})).rows.map((row) => {
+			invariant(descriptor.isActiveStatus(row[descriptor.status]));
+			return {
+				credentialId: row[descriptor.credentialId],
+				revision: row[descriptor.revision]
+			};
+		});
+		const revision = snapshotPasskeySync(PasskeyRevision, {
+			subjectId: subject.subjectId,
+			securityRevision: subject.securityRevision,
+			credentials
+		});
+		invariant(new Set(revision.credentials.map((item) => item.credentialId)).size === revision.credentials.length);
+		if (ids !== void 0 && (revision.credentials.length !== ids.length || !ids.every((id) => revision.credentials.some((item) => item.credentialId === id)))) return void 0;
+		return revision;
+	});
+	const readCredential = Effect.fn("passkey.readCredential")(function* (mapping, subject, rpId, protocolCredentialId, ids) {
+		const owner = yield* CurrentPasskeyTransaction;
+		const ownership = mapping.credentialOwnership;
+		const tupleKey = credentialKey(rpId, protocolCredentialId);
+		const tuple = (yield* owner.read(ownership.table, equal(ownership.table, { [ownership.credentialKey]: tupleKey }), {
+			limit: 1,
+			columns: mappedColumns(ownership)
+		})).rows[0];
+		if (tuple === void 0) return void 0;
+		invariant(tuple[ownership.rpId] === rpId && tuple[ownership.protocolCredentialId] === protocolCredentialId);
+		if (!ownership.isOwnedState(tuple[ownership.state])) return void 0;
+		if (!mapping.subjectIds.equals(ownership.decodeSubjectId(copiedRow(tuple)), subject.nativeId)) return void 0;
+		yield* assertNow(sql`exists(select 1 from ${ownership.table} where ${both(owner.exact(ownership.table, tuple), ownership.ownedCondition)})`);
+		const descriptor = mapping.credential;
+		const where = equal(descriptor.table, { [descriptor.credentialId]: tuple[ownership.credentialId] });
+		let row = (yield* owner.read(descriptor.table, where, {
+			limit: 1,
+			lock: false,
+			observe: false,
+			columns: mappedColumns(descriptor)
+		})).rows[0];
+		if (row === void 0) return void 0;
+		if (!descriptor.isActiveStatus(row[descriptor.status])) return void 0;
+		if (!mapping.subjectIds.equals(descriptor.decodeSubjectId(copiedRow(row)), subject.nativeId)) return void 0;
+		let decoded = descriptor.decode(copiedRow(row));
+		const handle = mapping.handleOwnership;
+		const expectedHandleKey = handleKey(rpId, decoded.userHandle);
+		const handleRow = (yield* owner.read(handle.table, equal(handle.table, { [handle.handleKey]: expectedHandleKey }), {
+			limit: 1,
+			columns: mappedColumns(handle)
+		})).rows[0];
+		invariant(row[descriptor.credentialKey] === tupleKey && row[descriptor.handleKey] === expectedHandleKey);
+		if (handleRow === void 0 || !handle.isOwnedState(handleRow[handle.state])) return void 0;
+		invariant(handleRow[handle.rpId] === rpId && handleRow[handle.userHandle] === decoded.userHandle);
+		if (!mapping.subjectIds.equals(handle.decodeSubjectId(copiedRow(handleRow)), subject.nativeId)) return void 0;
+		yield* assertNow(sql`exists(select 1 from ${handle.table} where ${both(owner.exact(handle.table, handleRow), handle.ownedCondition)})`);
+		const locked = (yield* owner.read(descriptor.table, where, {
+			limit: 1,
+			observe: false,
+			columns: mappedColumns(descriptor)
+		})).rows[0];
+		if (locked === void 0) return void 0;
+		invariant(matchesNativeRow(descriptor.table, locked, Object.fromEntries(semanticCredentialColumns(descriptor).map((column) => [column, row[column]]))));
+		row = locked;
+		decoded = descriptor.decode(copiedRow(row));
+		yield* observeSemantic(descriptor, where, row);
+		yield* assertNow(sql`exists(select 1 from ${descriptor.table} where ${both(owner.exact(descriptor.table, {
+			[descriptor.credentialId]: row[descriptor.credentialId],
+			[descriptor.credentialRevision]: row[descriptor.credentialRevision]
+		}), descriptor.activeCondition)})`);
+		const requested = ids === void 0 ? void 0 : [.../* @__PURE__ */ new Set([...ids, decoded.credentialId])].sort();
+		const revision = yield* readRevision(mapping, subject, requested);
+		if (revision === void 0) return void 0;
+		const credential = snapshotPasskeySync(PasskeyCredential, {
+			...decoded,
+			revision,
+			active: true
+		});
+		invariant(credential.rpId === rpId && credential.protocolCredentialId === protocolCredentialId);
+		invariant(credential.credentialId === row[descriptor.credentialId] && credential.credentialId === tuple[ownership.credentialId]);
+		invariant(credential.profile.rpId === rpId && credential.profile.algorithms.includes(credential.algorithm));
+		invariant(credential.counter === Number(row[descriptor.counter]) && credential.maximumCounter === Number(row[descriptor.maximumCounter]));
+		invariant(credential.maximumCounter >= credential.counter && (!credential.backupState || credential.backupEligible));
+		if (!revision.credentials.some((item) => item.credentialId === credential.credentialId && item.revision === row[descriptor.credentialRevision])) return void 0;
+		return {
+			credential,
+			row
+		};
+	});
+	return {
+		readSubject,
+		readModule,
+		readPolicyGuards,
+		discoverSubject,
+		readRevision,
+		readCredential,
+		lookupCredential: Effect.fn("passkey.lookupCredential")(function* (mapping, rpId, protocolCredentialId) {
+			const subjectId = yield* discoverSubject(mapping, rpId, protocolCredentialId);
+			if (subjectId === void 0) return void 0;
+			const subject = yield* readSubject(mapping, subjectId);
+			if (subject === void 0) return void 0;
+			return (yield* readCredential(mapping, subject, rpId, protocolCredentialId))?.credential;
+		}),
+		captureEnrollmentContext: Effect.fn("passkey.captureEnrollmentContext")(function* (mapping, input) {
+			const owner = yield* CurrentPasskeyTransaction;
+			if (input.moduleId !== mapping.moduleId) return void 0;
+			const policy = yield* readModule(mapping);
+			if (policy === void 0 || !policy.profiles.some((profile) => profile.rpId === input.rpId)) return void 0;
+			const subject = yield* readSubject(mapping.read, input.subjectId);
+			if (subject === void 0) return void 0;
+			yield* readPolicyGuards(mapping);
+			const handle = mapping.read.handleOwnership;
+			const handleRow = (yield* owner.read(handle.table, both(equal(handle.table, {
+				[handle.rpId]: input.rpId,
+				[handle.subjectId]: subject.nativeId
+			}), handle.ownedCondition), {
+				limit: 1,
+				columns: mappedColumns(handle)
+			})).rows[0];
+			let userHandle;
+			if (handleRow !== void 0) {
+				invariant(handle.isOwnedState(handleRow[handle.state]) && handleRow[handle.rpId] === input.rpId);
+				invariant(mapping.read.subjectIds.equals(handle.decodeSubjectId(copiedRow(handleRow)), subject.nativeId));
+				userHandle = Schema.decodeUnknownSync(PasskeyUserHandle)(handleRow[handle.userHandle]);
+				invariant(handleRow[handle.handleKey] === handleKey(input.rpId, userHandle));
+			}
+			const credential = mapping.read.credential;
+			const credentials = (yield* owner.read(credential.table, both(equal(credential.table, {
+				[credential.rpId]: input.rpId,
+				[credential.subjectId]: subject.nativeId
+			}), credential.activeCondition), {
+				limit: 64,
+				columns: [
+					credential.credentialId,
+					credential.rpId,
+					credential.protocolCredentialId,
+					credential.subjectId,
+					credential.credentialRevision,
+					credential.status
+				],
+				orderBy: asc(col(credential.table, credential.protocolCredentialId))
+			})).rows.map((row) => {
+				invariant(credential.isActiveStatus(row[credential.status]) && row[credential.rpId] === input.rpId);
+				return snapshotPasskeySync(PasskeyDescriptor, {
+					type: "public-key",
+					id: row[credential.protocolCredentialId]
+				});
+			});
+			invariant(new Set(credentials.map((item) => item.id)).size === credentials.length);
+			const revision = yield* readRevision(mapping.read, subject);
+			invariant(revision !== void 0);
+			return {
+				revision,
+				...userHandle === void 0 ? {} : { userHandle },
+				credentials
+			};
+		})
+	};
+};
+//#endregion
+export { makePasskeyCredentialsKernel };
+
+//# sourceMappingURL=credentials.mjs.map

package/dist/internal/passkey/credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.mjs","names":[],"sources":["../../../src/internal/passkey/credentials.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport {\n  PasskeyCredential,\n  PasskeyDescriptor,\n  PasskeyRevision,\n  PasskeyUserHandle,\n  validatePasskeyPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport { Effect, Schema } from \"effect\";\n\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport interface SubjectRead {\n  readonly nativeId: unknown;\n  readonly subjectId: SubjectId;\n  readonly securityRevision: typeof PasskeyRevision.Type.securityRevision;\n}\n\nexport interface CredentialRead {\n  readonly credential: PasskeyCredential;\n  readonly row: Record<string, unknown>;\n}\n\nexport const makePasskeyCredentialsKernel = (\n  operations: QueryOperations,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    | \"assertNow\"\n    | \"col\"\n    | \"copiedRow\"\n    | \"credentialKey\"\n    | \"equal\"\n    | \"handleKey\"\n    | \"invariant\"\n    | \"mappedColumns\"\n    | \"observeSemantic\"\n    | \"matchesNativeRow\"\n    | \"semanticCredentialColumns\"\n    | \"unavailable\"\n  >,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n  const { asc, inArray, sql } = operations;\n\n  const {\n    assertNow,\n    col,\n    copiedRow,\n    credentialKey,\n    equal,\n    handleKey,\n    mappedColumns,\n    observeSemantic,\n    matchesNativeRow,\n    semanticCredentialColumns,\n    unavailable,\n  } = state;\n\n  const invariant: (value: unknown) => asserts value = state.invariant;\n  const { both } = transactions;\n\n  const readSubject = Effect.fn(\"passkey.readSubject\")(function* (\n    mapping: any,\n    subjectId: SubjectId,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const descriptor = mapping.subject;\n    const nativeId = mapping.subjectIds.toNative(subjectId);\n\n    invariant(mapping.subjectIds.toSubject(nativeId) === subjectId);\n\n    const found = yield* owner.read(\n      descriptor.table,\n      equal(descriptor.table, { [descriptor.id]: nativeId }),\n      {\n        limit: 1,\n        columns: [descriptor.id, descriptor.status, descriptor.securityRevision],\n      },\n    );\n\n    const row = found.rows[0];\n\n    if (row === undefined || !descriptor.isActiveStatus(row[descriptor.status])) return undefined;\n    invariant(mapping.subjectIds.equals(descriptor.decodeId(copiedRow(row)), nativeId));\n\n    const active = sql`exists(select 1 from ${descriptor.table} where ${both(\n      owner.exact(descriptor.table, row),\n      descriptor.activeCondition,\n    )})`;\n\n    if (!(yield* owner.check(active))) return undefined;\n    owner.postconditions.push(active);\n\n    // oxlint-disable-next-line no-restricted-properties -- native SQL column values enter through this untyped driver boundary.\n    const securityRevision = Schema.decodeUnknownSync(PasskeyRevision.fields.securityRevision)(\n      row[descriptor.securityRevision],\n    );\n\n    return { nativeId, subjectId, securityRevision };\n  });\n\n  const readModule = Effect.fn(\"passkey.readModule\")(function* (mapping: any) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const descriptor = mapping.module;\n\n    const columns = [\n      ...new Set<string>([\n        descriptor.moduleId,\n        descriptor.status,\n        descriptor.policyRevision,\n        ...descriptor.policyColumns,\n      ]),\n    ];\n\n    const found = yield* owner.read(\n      descriptor.table,\n      equal(descriptor.table, { [descriptor.moduleId]: mapping.moduleId }),\n      {\n        limit: 1,\n        columns,\n      },\n    );\n\n    const row = found.rows[0];\n\n    if (row === undefined || !descriptor.isActiveStatus(row[descriptor.status])) return undefined;\n    invariant(row[descriptor.moduleId] === mapping.moduleId);\n    yield* assertNow(\n      sql`exists(select 1 from ${descriptor.table} where ${both(\n        owner.exact(descriptor.table, row),\n        descriptor.activeCondition,\n      )})`,\n    );\n\n    return yield* validatePasskeyPolicy(descriptor.decodeMethodPolicy(copiedRow(row))).pipe(\n      Effect.mapError(unavailable),\n    );\n  });\n\n  const readPolicyGuards = Effect.fn(\"passkey.readPolicyGuards\")(function* (mapping: any) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    for (const guard of [...(mapping.module.guards ?? [])].sort((a, b) =>\n      a.scope < b.scope ? -1 : a.scope > b.scope ? 1 : 0,\n    )) {\n      const locked = yield* owner.read(guard.table, guard.where(mapping.moduleId), {\n        limit: 1,\n        columns: guard.columns,\n      });\n\n      invariant(locked.rows.length === 1);\n      yield* assertNow(guard.condition(mapping.moduleId));\n    }\n  });\n\n  /** Advisory discovery never locks a tuple before its subject. All fields are\n   * reread under the common subject/tuple lock order by readCredential. */\n  const discoverSubject = Effect.fn(\"passkey.discoverSubject\")(function* (\n    mapping: any,\n    rpId: string,\n    protocolCredentialId: string,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const descriptor = mapping.credentialOwnership;\n\n    const found = yield* owner.read(\n      descriptor.table,\n      equal(descriptor.table, {\n        [descriptor.credentialKey]: credentialKey(rpId, protocolCredentialId),\n      }),\n      { lock: false, observe: false, limit: 1, columns: mappedColumns(descriptor) },\n    );\n\n    const row = found.rows[0];\n\n    if (row === undefined) return undefined;\n    invariant(\n      row[descriptor.rpId] === rpId &&\n        row[descriptor.protocolCredentialId] === protocolCredentialId,\n    );\n    if (!descriptor.isOwnedState(row[descriptor.state])) return undefined;\n    const native = descriptor.decodeSubjectId(copiedRow(row));\n    const subjectId = mapping.subjectIds.toSubject(native);\n\n    invariant(mapping.subjectIds.equals(mapping.subjectIds.toNative(subjectId), native));\n\n    return subjectId as SubjectId;\n  });\n\n  const readRevision = Effect.fn(\"passkey.readRevision\")(function* (\n    mapping: any,\n    subject: SubjectRead,\n    ids?: ReadonlyArray<string>,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    if (ids !== undefined) invariant(ids.length <= 64 && new Set(ids).size === ids.length);\n    const descriptor = mapping.authority;\n\n    const where = both(\n      equal(descriptor.table, { [descriptor.subjectId]: subject.nativeId }),\n      descriptor.activeCondition,\n      ids === undefined\n        ? undefined\n        : ids.length === 0\n          ? sql`1 = 0`\n          : inArray(col(descriptor.table, descriptor.credentialId), [...ids]),\n    );\n\n    const found = yield* owner.read(descriptor.table, where, {\n      limit: 64,\n      columns: mappedColumns(descriptor),\n      orderBy: asc(col(descriptor.table, descriptor.credentialId)),\n    });\n\n    const credentials = found.rows.map((row) => {\n      invariant(descriptor.isActiveStatus(row[descriptor.status]));\n\n      return {\n        credentialId: row[descriptor.credentialId],\n        revision: row[descriptor.revision],\n      };\n    });\n\n    const revision = snapshotPasskeySync(PasskeyRevision, {\n      subjectId: subject.subjectId,\n      securityRevision: subject.securityRevision,\n      credentials,\n    });\n\n    invariant(\n      new Set(revision.credentials.map((item) => item.credentialId)).size ===\n        revision.credentials.length,\n    );\n    if (\n      ids !== undefined &&\n      (revision.credentials.length !== ids.length ||\n        !ids.every((id) => revision.credentials.some((item) => item.credentialId === id)))\n    )\n      return undefined;\n\n    return revision;\n  });\n\n  const readCredential = Effect.fn(\"passkey.readCredential\")(function* (\n    mapping: any,\n    subject: SubjectRead,\n    rpId: string,\n    protocolCredentialId: string,\n    ids?: ReadonlyArray<string>,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const ownership = mapping.credentialOwnership;\n    const tupleKey = credentialKey(rpId, protocolCredentialId);\n\n    const tuple = (yield* owner.read(\n      ownership.table,\n      equal(ownership.table, { [ownership.credentialKey]: tupleKey }),\n      {\n        limit: 1,\n        columns: mappedColumns(ownership),\n      },\n    )).rows[0];\n\n    if (tuple === undefined) return undefined;\n    invariant(\n      tuple[ownership.rpId] === rpId &&\n        tuple[ownership.protocolCredentialId] === protocolCredentialId,\n    );\n    if (!ownership.isOwnedState(tuple[ownership.state])) return undefined;\n    if (!mapping.subjectIds.equals(ownership.decodeSubjectId(copiedRow(tuple)), subject.nativeId))\n      return undefined;\n    yield* assertNow(\n      sql`exists(select 1 from ${ownership.table} where ${both(owner.exact(ownership.table, tuple), ownership.ownedCondition)})`,\n    );\n    const descriptor = mapping.credential;\n\n    const where = equal(descriptor.table, {\n      [descriptor.credentialId]: tuple[ownership.credentialId],\n    });\n\n    let row = (yield* owner.read(descriptor.table, where, {\n      limit: 1,\n      lock: false,\n      observe: false,\n      columns: mappedColumns(descriptor),\n    })).rows[0];\n\n    if (row === undefined) return undefined;\n    if (!descriptor.isActiveStatus(row[descriptor.status])) return undefined;\n    if (!mapping.subjectIds.equals(descriptor.decodeSubjectId(copiedRow(row)), subject.nativeId))\n      return undefined;\n    let decoded = descriptor.decode(copiedRow(row));\n    const handle = mapping.handleOwnership;\n    const expectedHandleKey = handleKey(rpId, decoded.userHandle);\n\n    const handleRow = (yield* owner.read(\n      handle.table,\n      equal(handle.table, { [handle.handleKey]: expectedHandleKey }),\n      {\n        limit: 1,\n        columns: mappedColumns(handle),\n      },\n    )).rows[0];\n\n    invariant(\n      row[descriptor.credentialKey] === tupleKey && row[descriptor.handleKey] === expectedHandleKey,\n    );\n    if (handleRow === undefined || !handle.isOwnedState(handleRow[handle.state])) return undefined;\n    invariant(\n      handleRow[handle.rpId] === rpId && handleRow[handle.userHandle] === decoded.userHandle,\n    );\n    if (!mapping.subjectIds.equals(handle.decodeSubjectId(copiedRow(handleRow)), subject.nativeId))\n      return undefined;\n    yield* assertNow(\n      sql`exists(select 1 from ${handle.table} where ${both(owner.exact(handle.table, handleRow), handle.ownedCondition)})`,\n    );\n\n    const locked = (yield* owner.read(descriptor.table, where, {\n      limit: 1,\n      observe: false,\n      columns: mappedColumns(descriptor),\n    })).rows[0];\n\n    if (locked === undefined) return undefined;\n    invariant(\n      matchesNativeRow(\n        descriptor.table,\n        locked,\n        Object.fromEntries(\n          semanticCredentialColumns(descriptor).map((column) => [column, row![column]]),\n        ),\n      ),\n    );\n    row = locked;\n    decoded = descriptor.decode(copiedRow(row));\n    yield* observeSemantic(descriptor, where, row);\n    yield* assertNow(\n      sql`exists(select 1 from ${descriptor.table} where ${both(\n        owner.exact(descriptor.table, {\n          [descriptor.credentialId]: row[descriptor.credentialId],\n          [descriptor.credentialRevision]: row[descriptor.credentialRevision],\n        }),\n        descriptor.activeCondition,\n      )})`,\n    );\n\n    const requested =\n      ids === undefined ? undefined : [...new Set([...ids, decoded.credentialId])].sort();\n\n    const revision = yield* readRevision(mapping, subject, requested);\n\n    if (revision === undefined) return undefined;\n\n    const credential = snapshotPasskeySync(PasskeyCredential, {\n      ...decoded,\n      revision,\n      active: true,\n    });\n\n    invariant(credential.rpId === rpId && credential.protocolCredentialId === protocolCredentialId);\n    invariant(\n      credential.credentialId === row[descriptor.credentialId] &&\n        credential.credentialId === tuple[ownership.credentialId],\n    );\n    invariant(\n      credential.profile.rpId === rpId &&\n        credential.profile.algorithms.includes(credential.algorithm),\n    );\n    invariant(\n      credential.counter === Number(row[descriptor.counter]) &&\n        credential.maximumCounter === Number(row[descriptor.maximumCounter]),\n    );\n    invariant(\n      credential.maximumCounter >= credential.counter &&\n        (!credential.backupState || credential.backupEligible),\n    );\n    if (\n      !revision.credentials.some(\n        (item) =>\n          item.credentialId === credential.credentialId &&\n          item.revision === row[descriptor.credentialRevision],\n      )\n    )\n      return undefined;\n\n    return { credential, row };\n  });\n\n  const lookupCredential = Effect.fn(\"passkey.lookupCredential\")(function* (\n    mapping: any,\n    rpId: string,\n    protocolCredentialId: string,\n  ) {\n    const subjectId = yield* discoverSubject(mapping, rpId, protocolCredentialId);\n\n    if (subjectId === undefined) return undefined;\n    const subject = yield* readSubject(mapping, subjectId);\n\n    if (subject === undefined) return undefined;\n\n    return (yield* readCredential(mapping, subject, rpId, protocolCredentialId))?.credential;\n  });\n\n  const captureEnrollmentContext = Effect.fn(\"passkey.captureEnrollmentContext\")(function* (\n    mapping: any,\n    input: { readonly moduleId: string; readonly rpId: string; readonly subjectId: SubjectId },\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    if (input.moduleId !== mapping.moduleId) return undefined;\n    const policy = yield* readModule(mapping);\n\n    if (policy === undefined || !policy.profiles.some((profile) => profile.rpId === input.rpId))\n      return undefined;\n    const subject = yield* readSubject(mapping.read, input.subjectId);\n\n    if (subject === undefined) return undefined;\n    yield* readPolicyGuards(mapping);\n    const handle = mapping.read.handleOwnership;\n\n    const handles = yield* owner.read(\n      handle.table,\n      both(\n        equal(handle.table, {\n          [handle.rpId]: input.rpId,\n          [handle.subjectId]: subject.nativeId,\n        }),\n        handle.ownedCondition,\n      ),\n      { limit: 1, columns: mappedColumns(handle) },\n    );\n\n    const handleRow = handles.rows[0];\n    let userHandle: PasskeyUserHandle | undefined;\n\n    if (handleRow !== undefined) {\n      invariant(\n        handle.isOwnedState(handleRow[handle.state]) && handleRow[handle.rpId] === input.rpId,\n      );\n      invariant(\n        mapping.read.subjectIds.equals(\n          handle.decodeSubjectId(copiedRow(handleRow)),\n          subject.nativeId,\n        ),\n      );\n      // oxlint-disable-next-line no-restricted-properties -- native SQL column values enter through this untyped driver boundary.\n      userHandle = Schema.decodeUnknownSync(PasskeyUserHandle)(handleRow[handle.userHandle]);\n      invariant(handleRow[handle.handleKey] === handleKey(input.rpId, userHandle));\n    }\n    const credential = mapping.read.credential;\n\n    const found = yield* owner.read(\n      credential.table,\n      both(\n        equal(credential.table, {\n          [credential.rpId]: input.rpId,\n          [credential.subjectId]: subject.nativeId,\n        }),\n        credential.activeCondition,\n      ),\n      {\n        limit: 64,\n        columns: [\n          credential.credentialId,\n          credential.rpId,\n          credential.protocolCredentialId,\n          credential.subjectId,\n          credential.credentialRevision,\n          credential.status,\n        ],\n        orderBy: asc(col(credential.table, credential.protocolCredentialId)),\n      },\n    );\n\n    const credentials = found.rows.map((row) => {\n      invariant(\n        credential.isActiveStatus(row[credential.status]) && row[credential.rpId] === input.rpId,\n      );\n\n      return snapshotPasskeySync(PasskeyDescriptor, {\n        type: \"public-key\",\n        id: row[credential.protocolCredentialId],\n      });\n    });\n\n    invariant(new Set(credentials.map((item) => item.id)).size === credentials.length);\n    const revision = yield* readRevision(mapping.read, subject);\n\n    invariant(revision !== undefined);\n\n    return { revision, ...(userHandle === undefined ? {} : { userHandle }), credentials };\n  });\n\n  return {\n    readSubject,\n    readModule,\n    readPolicyGuards,\n    discoverSubject,\n    readRevision,\n    readCredential,\n    lookupCredential,\n    captureEnrollmentContext,\n  };\n};\n"],"mappings":";;;;AA6BA,MAAa,gCACX,YACA,OAeA,iBACG;CACH,MAAM,EAAE,KAAK,SAAS,QAAQ;CAE9B,MAAM,EACJ,WACA,KACA,WACA,eACA,OACA,WACA,eACA,iBACA,kBACA,2BACA,gBACE;CAEJ,MAAM,YAA+C,MAAM;CAC3D,MAAM,EAAE,SAAS;CAEjB,MAAM,cAAc,OAAO,GAAG,qBAAqB,CAAC,CAAC,WACnD,SACA,WACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,aAAa,QAAQ;EAC3B,MAAM,WAAW,QAAQ,WAAW,SAAS,SAAS;EAEtD,UAAU,QAAQ,WAAW,UAAU,QAAQ,MAAM,SAAS;EAW9D,MAAM,OAAM,OATS,MAAM,KACzB,WAAW,OACX,MAAM,WAAW,OAAO,GAAG,WAAW,KAAK,SAAS,CAAC,GACrD;GACE,OAAO;GACP,SAAS;IAAC,WAAW;IAAI,WAAW;IAAQ,WAAW;GAAgB;EACzE,CACF,EAAA,CAEkB,KAAK;EAEvB,IAAI,QAAQ,KAAA,KAAa,CAAC,WAAW,eAAe,IAAI,WAAW,OAAO,GAAG,OAAO,KAAA;EACpF,UAAU,QAAQ,WAAW,OAAO,WAAW,SAAS,UAAU,GAAG,CAAC,GAAG,QAAQ,CAAC;EAElF,MAAM,SAAS,GAAG,wBAAwB,WAAW,MAAM,SAAS,KAClE,MAAM,MAAM,WAAW,OAAO,GAAG,GACjC,WAAW,eACb,EAAE;EAEF,IAAI,EAAE,OAAO,MAAM,MAAM,MAAM,IAAI,OAAO,KAAA;EAC1C,MAAM,eAAe,KAAK,MAAM;EAOhC,OAAO;GAAE;GAAU;GAAW,kBAJL,OAAO,kBAAkB,gBAAgB,OAAO,gBAAgB,CAAC,CACxF,IAAI,WAAW,iBAG4B;EAAE;CACjD,CAAC;CAED,MAAM,aAAa,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAAW,SAAc;EAC1E,MAAM,QAAQ,OAAO;EACrB,MAAM,aAAa,QAAQ;EAE3B,MAAM,UAAU,CACd,mBAAG,IAAI,IAAY;GACjB,WAAW;GACX,WAAW;GACX,WAAW;GACX,GAAG,WAAW;EAChB,CAAC,CACH;EAWA,MAAM,OAAM,OATS,MAAM,KACzB,WAAW,OACX,MAAM,WAAW,OAAO,GAAG,WAAW,WAAW,QAAQ,SAAS,CAAC,GACnE;GACE,OAAO;GACP;EACF,CACF,EAAA,CAEkB,KAAK;EAEvB,IAAI,QAAQ,KAAA,KAAa,CAAC,WAAW,eAAe,IAAI,WAAW,OAAO,GAAG,OAAO,KAAA;EACpF,UAAU,IAAI,WAAW,cAAc,QAAQ,QAAQ;EACvD,OAAO,UACL,GAAG,wBAAwB,WAAW,MAAM,SAAS,KACnD,MAAM,MAAM,WAAW,OAAO,GAAG,GACjC,WAAW,eACb,EAAE,EACJ;EAEA,OAAO,OAAO,sBAAsB,WAAW,mBAAmB,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,KACjF,OAAO,SAAS,WAAW,CAC7B;CACF,CAAC;CAED,MAAM,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAAW,SAAc;EACtF,MAAM,QAAQ,OAAO;EAErB,KAAK,MAAM,SAAS,CAAC,GAAI,QAAQ,OAAO,UAAU,CAAC,CAAE,CAAC,CAAC,MAAM,GAAG,MAC9D,EAAE,QAAQ,EAAE,QAAQ,KAAK,EAAE,QAAQ,EAAE,QAAQ,IAAI,CACnD,GAAG;GACD,MAAM,SAAS,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,QAAQ,QAAQ,GAAG;IAC3E,OAAO;IACP,SAAS,MAAM;GACjB,CAAC;GAED,UAAU,OAAO,KAAK,WAAW,CAAC;GAClC,OAAO,UAAU,MAAM,UAAU,QAAQ,QAAQ,CAAC;EACpD;CACF,CAAC;;;CAID,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,MACA,sBACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,aAAa,QAAQ;EAU3B,MAAM,OAAM,OARS,MAAM,KACzB,WAAW,OACX,MAAM,WAAW,OAAO,GACrB,WAAW,gBAAgB,cAAc,MAAM,oBAAoB,EACtE,CAAC,GACD;GAAE,MAAM;GAAO,SAAS;GAAO,OAAO;GAAG,SAAS,cAAc,UAAU;EAAE,CAC9E,EAAA,CAEkB,KAAK;EAEvB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAC9B,UACE,IAAI,WAAW,UAAU,QACvB,IAAI,WAAW,0BAA0B,oBAC7C;EACA,IAAI,CAAC,WAAW,aAAa,IAAI,WAAW,MAAM,GAAG,OAAO,KAAA;EAC5D,MAAM,SAAS,WAAW,gBAAgB,UAAU,GAAG,CAAC;EACxD,MAAM,YAAY,QAAQ,WAAW,UAAU,MAAM;EAErD,UAAU,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS,SAAS,GAAG,MAAM,CAAC;EAEnF,OAAO;CACT,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,SACA,KACA;EACA,MAAM,QAAQ,OAAO;EAErB,IAAI,QAAQ,KAAA,GAAW,UAAU,IAAI,UAAU,MAAM,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,IAAI,MAAM;EACrF,MAAM,aAAa,QAAQ;EAE3B,MAAM,QAAQ,KACZ,MAAM,WAAW,OAAO,GAAG,WAAW,YAAY,QAAQ,SAAS,CAAC,GACpE,WAAW,iBACX,QAAQ,KAAA,IACJ,KAAA,IACA,IAAI,WAAW,IACb,GAAG,UACH,QAAQ,IAAI,WAAW,OAAO,WAAW,YAAY,GAAG,CAAC,GAAG,GAAG,CAAC,CACxE;EAQA,MAAM,eAAc,OANC,MAAM,KAAK,WAAW,OAAO,OAAO;GACvD,OAAO;GACP,SAAS,cAAc,UAAU;GACjC,SAAS,IAAI,IAAI,WAAW,OAAO,WAAW,YAAY,CAAC;EAC7D,CAAC,EAAA,CAEyB,KAAK,KAAK,QAAQ;GAC1C,UAAU,WAAW,eAAe,IAAI,WAAW,OAAO,CAAC;GAE3D,OAAO;IACL,cAAc,IAAI,WAAW;IAC7B,UAAU,IAAI,WAAW;GAC3B;EACF,CAAC;EAED,MAAM,WAAW,oBAAoB,iBAAiB;GACpD,WAAW,QAAQ;GACnB,kBAAkB,QAAQ;GAC1B;EACF,CAAC;EAED,UACE,IAAI,IAAI,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAC7D,SAAS,YAAY,MACzB;EACA,IACE,QAAQ,KAAA,MACP,SAAS,YAAY,WAAW,IAAI,UACnC,CAAC,IAAI,OAAO,OAAO,SAAS,YAAY,MAAM,SAAS,KAAK,iBAAiB,EAAE,CAAC,IAElF,OAAO,KAAA;EAET,OAAO;CACT,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,SACA,MACA,sBACA,KACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,YAAY,QAAQ;EAC1B,MAAM,WAAW,cAAc,MAAM,oBAAoB;EAEzD,MAAM,SAAS,OAAO,MAAM,KAC1B,UAAU,OACV,MAAM,UAAU,OAAO,GAAG,UAAU,gBAAgB,SAAS,CAAC,GAC9D;GACE,OAAO;GACP,SAAS,cAAc,SAAS;EAClC,CACF,EAAA,CAAG,KAAK;EAER,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,UACE,MAAM,UAAU,UAAU,QACxB,MAAM,UAAU,0BAA0B,oBAC9C;EACA,IAAI,CAAC,UAAU,aAAa,MAAM,UAAU,MAAM,GAAG,OAAO,KAAA;EAC5D,IAAI,CAAC,QAAQ,WAAW,OAAO,UAAU,gBAAgB,UAAU,KAAK,CAAC,GAAG,QAAQ,QAAQ,GAC1F,OAAO,KAAA;EACT,OAAO,UACL,GAAG,wBAAwB,UAAU,MAAM,SAAS,KAAK,MAAM,MAAM,UAAU,OAAO,KAAK,GAAG,UAAU,cAAc,EAAE,EAC1H;EACA,MAAM,aAAa,QAAQ;EAE3B,MAAM,QAAQ,MAAM,WAAW,OAAO,GACnC,WAAW,eAAe,MAAM,UAAU,cAC7C,CAAC;EAED,IAAI,OAAO,OAAO,MAAM,KAAK,WAAW,OAAO,OAAO;GACpD,OAAO;GACP,MAAM;GACN,SAAS;GACT,SAAS,cAAc,UAAU;EACnC,CAAC,EAAA,CAAG,KAAK;EAET,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAC9B,IAAI,CAAC,WAAW,eAAe,IAAI,WAAW,OAAO,GAAG,OAAO,KAAA;EAC/D,IAAI,CAAC,QAAQ,WAAW,OAAO,WAAW,gBAAgB,UAAU,GAAG,CAAC,GAAG,QAAQ,QAAQ,GACzF,OAAO,KAAA;EACT,IAAI,UAAU,WAAW,OAAO,UAAU,GAAG,CAAC;EAC9C,MAAM,SAAS,QAAQ;EACvB,MAAM,oBAAoB,UAAU,MAAM,QAAQ,UAAU;EAE5D,MAAM,aAAa,OAAO,MAAM,KAC9B,OAAO,OACP,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,kBAAkB,CAAC,GAC7D;GACE,OAAO;GACP,SAAS,cAAc,MAAM;EAC/B,CACF,EAAA,CAAG,KAAK;EAER,UACE,IAAI,WAAW,mBAAmB,YAAY,IAAI,WAAW,eAAe,iBAC9E;EACA,IAAI,cAAc,KAAA,KAAa,CAAC,OAAO,aAAa,UAAU,OAAO,MAAM,GAAG,OAAO,KAAA;EACrF,UACE,UAAU,OAAO,UAAU,QAAQ,UAAU,OAAO,gBAAgB,QAAQ,UAC9E;EACA,IAAI,CAAC,QAAQ,WAAW,OAAO,OAAO,gBAAgB,UAAU,SAAS,CAAC,GAAG,QAAQ,QAAQ,GAC3F,OAAO,KAAA;EACT,OAAO,UACL,GAAG,wBAAwB,OAAO,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,OAAO,SAAS,GAAG,OAAO,cAAc,EAAE,EACrH;EAEA,MAAM,UAAU,OAAO,MAAM,KAAK,WAAW,OAAO,OAAO;GACzD,OAAO;GACP,SAAS;GACT,SAAS,cAAc,UAAU;EACnC,CAAC,EAAA,CAAG,KAAK;EAET,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;EACjC,UACE,iBACE,WAAW,OACX,QACA,OAAO,YACL,0BAA0B,UAAU,CAAC,CAAC,KAAK,WAAW,CAAC,QAAQ,IAAK,OAAO,CAAC,CAC9E,CACF,CACF;EACA,MAAM;EACN,UAAU,WAAW,OAAO,UAAU,GAAG,CAAC;EAC1C,OAAO,gBAAgB,YAAY,OAAO,GAAG;EAC7C,OAAO,UACL,GAAG,wBAAwB,WAAW,MAAM,SAAS,KACnD,MAAM,MAAM,WAAW,OAAO;IAC3B,WAAW,eAAe,IAAI,WAAW;IACzC,WAAW,qBAAqB,IAAI,WAAW;EAClD,CAAC,GACD,WAAW,eACb,EAAE,EACJ;EAEA,MAAM,YACJ,QAAQ,KAAA,IAAY,KAAA,IAAY,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK;EAEpF,MAAM,WAAW,OAAO,aAAa,SAAS,SAAS,SAAS;EAEhE,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;EAEnC,MAAM,aAAa,oBAAoB,mBAAmB;GACxD,GAAG;GACH;GACA,QAAQ;EACV,CAAC;EAED,UAAU,WAAW,SAAS,QAAQ,WAAW,yBAAyB,oBAAoB;EAC9F,UACE,WAAW,iBAAiB,IAAI,WAAW,iBACzC,WAAW,iBAAiB,MAAM,UAAU,aAChD;EACA,UACE,WAAW,QAAQ,SAAS,QAC1B,WAAW,QAAQ,WAAW,SAAS,WAAW,SAAS,CAC/D;EACA,UACE,WAAW,YAAY,OAAO,IAAI,WAAW,QAAQ,KACnD,WAAW,mBAAmB,OAAO,IAAI,WAAW,eAAe,CACvE;EACA,UACE,WAAW,kBAAkB,WAAW,YACrC,CAAC,WAAW,eAAe,WAAW,eAC3C;EACA,IACE,CAAC,SAAS,YAAY,MACnB,SACC,KAAK,iBAAiB,WAAW,gBACjC,KAAK,aAAa,IAAI,WAAW,mBACrC,GAEA,OAAO,KAAA;EAET,OAAO;GAAE;GAAY;EAAI;CAC3B,CAAC;CA2GD,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA,kBAhHuB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,MACA,sBACA;GACA,MAAM,YAAY,OAAO,gBAAgB,SAAS,MAAM,oBAAoB;GAE5E,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;GACpC,MAAM,UAAU,OAAO,YAAY,SAAS,SAAS;GAErD,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;GAElC,QAAQ,OAAO,eAAe,SAAS,SAAS,MAAM,oBAAoB,EAAA,EAAI;EAChF,CAmGiB;EACf,0BAlG+B,OAAO,GAAG,kCAAkC,CAAC,CAAC,WAC7E,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GAErB,IAAI,MAAM,aAAa,QAAQ,UAAU,OAAO,KAAA;GAChD,MAAM,SAAS,OAAO,WAAW,OAAO;GAExC,IAAI,WAAW,KAAA,KAAa,CAAC,OAAO,SAAS,MAAM,YAAY,QAAQ,SAAS,MAAM,IAAI,GACxF,OAAO,KAAA;GACT,MAAM,UAAU,OAAO,YAAY,QAAQ,MAAM,MAAM,SAAS;GAEhE,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;GAClC,OAAO,iBAAiB,OAAO;GAC/B,MAAM,SAAS,QAAQ,KAAK;GAc5B,MAAM,aAAY,OAZK,MAAM,KAC3B,OAAO,OACP,KACE,MAAM,OAAO,OAAO;KACjB,OAAO,OAAO,MAAM;KACpB,OAAO,YAAY,QAAQ;GAC9B,CAAC,GACD,OAAO,cACT,GACA;IAAE,OAAO;IAAG,SAAS,cAAc,MAAM;GAAE,CAC7C,EAAA,CAE0B,KAAK;GAC/B,IAAI;GAEJ,IAAI,cAAc,KAAA,GAAW;IAC3B,UACE,OAAO,aAAa,UAAU,OAAO,MAAM,KAAK,UAAU,OAAO,UAAU,MAAM,IACnF;IACA,UACE,QAAQ,KAAK,WAAW,OACtB,OAAO,gBAAgB,UAAU,SAAS,CAAC,GAC3C,QAAQ,QACV,CACF;IAEA,aAAa,OAAO,kBAAkB,iBAAiB,CAAC,CAAC,UAAU,OAAO,WAAW;IACrF,UAAU,UAAU,OAAO,eAAe,UAAU,MAAM,MAAM,UAAU,CAAC;GAC7E;GACA,MAAM,aAAa,QAAQ,KAAK;GAyBhC,MAAM,eAAc,OAvBC,MAAM,KACzB,WAAW,OACX,KACE,MAAM,WAAW,OAAO;KACrB,WAAW,OAAO,MAAM;KACxB,WAAW,YAAY,QAAQ;GAClC,CAAC,GACD,WAAW,eACb,GACA;IACE,OAAO;IACP,SAAS;KACP,WAAW;KACX,WAAW;KACX,WAAW;KACX,WAAW;KACX,WAAW;KACX,WAAW;IACb;IACA,SAAS,IAAI,IAAI,WAAW,OAAO,WAAW,oBAAoB,CAAC;GACrE,CACF,EAAA,CAE0B,KAAK,KAAK,QAAQ;IAC1C,UACE,WAAW,eAAe,IAAI,WAAW,OAAO,KAAK,IAAI,WAAW,UAAU,MAAM,IACtF;IAEA,OAAO,oBAAoB,mBAAmB;KAC5C,MAAM;KACN,IAAI,IAAI,WAAW;IACrB,CAAC;GACH,CAAC;GAED,UAAU,IAAI,IAAI,YAAY,KAAK,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,YAAY,MAAM;GACjF,MAAM,WAAW,OAAO,aAAa,QAAQ,MAAM,OAAO;GAE1D,UAAU,aAAa,KAAA,CAAS;GAEhC,OAAO;IAAE;IAAU,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;IAAI;GAAY;EACtF,CAUyB;CACzB;AACF"}

package/dist/internal/passkey/enrollment.mjs

@@ -0,0 +1,138 @@
+import { CurrentPasskeyTransaction } from "./state.mjs";
+import { Effect } from "effect";
+import { PasskeyCeremony } from "@yielded/auth/Passkey";
+//#region src/internal/passkey/enrollment.ts
+const makePasskeyEnrollmentKernel = (operations, admission, credentials, flow, state, writeState, transactions) => {
+	const { sql } = operations;
+	const { lockAdmission, readCharges, guardChargeSet } = admission;
+	const { readModule, readPolicyGuards } = credentials;
+	const { compatiblePolicy, exactClaim, issueAssertion, liveCondition, readFlow, terminalFlow } = flow;
+	const { equal, handleKey, sameRevision, credentialKey: credentialKeyFor } = state;
+	const invariant = state.invariant;
+	const { authorizeAction, credentialRows, currentSubject, enrollmentDigest, digest, insertCredential, managementPolicy, validRegistration } = writeState;
+	const { both } = transactions;
+	const enrollmentHandle = Effect.fn("passkey.enrollmentHandle")(function* (mapping, subject, ceremony, create) {
+		const owner = yield* CurrentPasskeyTransaction;
+		invariant(ceremony.context._tag === "Enrollment");
+		const table = mapping.read.handleOwnership;
+		const where = equal(table.table, {
+			[table.rpId]: ceremony.profile.rpId,
+			[table.subjectId]: subject.nativeId
+		});
+		const found = yield* owner.read(table.table, where, { limit: 1 });
+		const row = found.rows[0];
+		const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
+		if (row !== void 0) return table.isOwnedState(row[table.state]) && row[table.handleKey] === hashed && row[table.userHandle] === ceremony.context.userHandle && mapping.read.subjectIds.equals(table.decodeSubjectId(row), subject.nativeId);
+		if (!create) return false;
+		const absent = yield* owner.read(table.table, equal(table.table, { [table.handleKey]: hashed }), { limit: 1 });
+		if (absent.rows.length !== 0) return false;
+		const inserted = yield* owner.insert(table.table, {
+			...mapping.write.handleOwnership.encodeInsert({
+				subjectId: subject.nativeId,
+				rpId: ceremony.profile.rpId,
+				userHandle: ceremony.context.userHandle,
+				marker: owner.marker
+			}),
+			[table.handleKey]: hashed,
+			[table.rpId]: ceremony.profile.rpId,
+			[table.userHandle]: ceremony.context.userHandle,
+			[table.subjectId]: subject.nativeId,
+			[table.state]: mapping.write.handleOwnership.ownedState,
+			[table.version]: owner.marker,
+			[table.reservationId]: null
+		}, { [table.handleKey]: hashed });
+		found.rows = inserted.rows;
+		absent.rows = inserted.rows;
+		return true;
+	});
+	const capCondition = (mapping, subject, maximum, addition) => {
+		const table = mapping.read.credential;
+		return sql`(select count(*) from ${table.table} where ${both(equal(table.table, { [table.subjectId]: subject.nativeId }), table.activeCondition)}) + ${addition} <= ${maximum}`;
+	};
+	return {
+		enrollmentHandle,
+		issueEnrollment: Effect.fn("passkey.issueEnrollment")(function* (mapping, input) {
+			const owner = yield* CurrentPasskeyTransaction;
+			const ceremony = input.ceremony;
+			if (ceremony.context._tag !== "Enrollment" || ceremony.purpose !== "enrollment" || ceremony.moduleId !== mapping.moduleId) return { _tag: "Rejected" };
+			const current = yield* readModule(mapping);
+			if (current === void 0 || !compatiblePolicy(ceremony, input.policy, current)) return { _tag: "Rejected" };
+			yield* lockAdmission(mapping);
+			const subject = yield* currentSubject(mapping, ceremony.context.revision.subjectId);
+			if (subject === void 0 || !sameRevision(subject.revision, ceremony.context.revision)) return { _tag: "Rejected" };
+			yield* readPolicyGuards(mapping);
+			const policy = managementPolicy(mapping, subject);
+			const maximum = Math.min(policy.maximumCredentials, input.management.maximumCredentials);
+			const ids = (yield* credentialRows(mapping, subject, ceremony.profile.rpId)).map((row) => row[mapping.read.credential.protocolCredentialId]);
+			if (ids.length !== ceremony.allowedCredentials.length || !ids.every((id) => ceremony.allowedCredentials.some((item) => item.id === id)) || !(yield* owner.check(capCondition(mapping, subject, maximum, 1)))) return { _tag: "Rejected" };
+			if (!(yield* authorizeAction(mapping, subject, input.authorization, {
+				action: "enroll-begin",
+				commandId: ceremony.commandId,
+				flowId: ceremony.flowId,
+				bindingDigest: enrollmentDigest(ceremony),
+				revision: ceremony.context.revision
+			}, {
+				...policy,
+				maximumEvidenceAgeMillis: Math.min(policy.maximumEvidenceAgeMillis, input.management.maximumEvidenceAgeMillis)
+			}))) return { _tag: "Rejected" };
+			invariant(digest(PasskeyCeremony.fields.context, ceremony.context) === digest(PasskeyCeremony.fields.context, {
+				...ceremony.context,
+				authorization: input.authorization
+			}));
+			const issued = yield* issueAssertion(mapping, ceremony, input.policy);
+			if (issued._tag !== "Issued") return issued;
+			invariant(yield* enrollmentHandle(mapping, subject, ceremony, true));
+			owner.postconditions.push(capCondition(mapping, subject, maximum, 1));
+			return issued;
+		}),
+		completeEnrollment: Effect.fn("passkey.completeEnrollment")(function* (mapping, input) {
+			const owner = yield* CurrentPasskeyTransaction;
+			const ceremony = input.claim.ceremony;
+			if (ceremony.context._tag !== "Enrollment" || ceremony.purpose !== "enrollment" || ceremony.moduleId !== mapping.moduleId) return { _tag: "Rejected" };
+			const current = yield* readModule(mapping);
+			if (current === void 0) return { _tag: "Rejected" };
+			yield* lockAdmission(mapping);
+			const subject = yield* currentSubject(mapping, ceremony.context.revision.subjectId);
+			yield* readPolicyGuards(mapping);
+			const read = yield* readFlow(mapping, ceremony.flowId);
+			if (read === void 0 || !exactClaim(read, input.claim)) return { _tag: "Rejected" };
+			const reject = Effect.gen(function* () {
+				yield* terminalFlow(mapping, read, "Rejected");
+				return { _tag: "Rejected" };
+			});
+			if (subject === void 0 || !sameRevision(subject.revision, ceremony.context.revision) || !compatiblePolicy(ceremony, read.policy, current) || !validRegistration(ceremony, input.verified) || !(yield* owner.check(liveCondition(mapping, ceremony, input.claim)))) return yield* reject;
+			const policy = managementPolicy(mapping, subject);
+			const maximum = Math.min(policy.maximumCredentials, input.management.maximumCredentials);
+			if (!(yield* owner.check(capCondition(mapping, subject, maximum, 1))) || !(yield* enrollmentHandle(mapping, subject, ceremony, false))) return yield* reject;
+			if (!(yield* authorizeAction(mapping, subject, input.authorization, {
+				action: "enroll-complete",
+				commandId: ceremony.commandId,
+				flowId: ceremony.flowId,
+				bindingDigest: digest(PasskeyCeremony, ceremony),
+				revision: ceremony.context.revision
+			}, {
+				...policy,
+				maximumEvidenceAgeMillis: Math.min(policy.maximumEvidenceAgeMillis, input.management.maximumEvidenceAgeMillis)
+			}, ceremony.context.authorization.requirement))) return yield* reject;
+			const tuple = mapping.read.credentialOwnership;
+			const key = credentialKeyFor(ceremony.profile.rpId, input.verified.protocolCredentialId);
+			if ((yield* owner.read(tuple.table, equal(tuple.table, { [tuple.credentialKey]: key }), {
+				limit: 1,
+				observe: false
+			})).rows.length !== 0) return yield* reject;
+			yield* readCharges(mapping, ceremony, read.policy, subject.subjectId);
+			yield* guardChargeSet(mapping, ceremony, subject.subjectId);
+			const safe = yield* insertCredential(mapping, subject, ceremony, input.verified, yield* owner.now(mapping.clock));
+			yield* terminalFlow(mapping, read, "Verified");
+			owner.postconditions.push(liveCondition(mapping, ceremony, input.claim), capCondition(mapping, subject, maximum, 0));
+			return {
+				_tag: "Enrolled",
+				credential: safe
+			};
+		})
+	};
+};
+//#endregion
+export { makePasskeyEnrollmentKernel };
+
+//# sourceMappingURL=enrollment.mjs.map

package/dist/internal/passkey/enrollment.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollment.mjs","names":["Ceremony"],"sources":["../../../src/internal/passkey/enrollment.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport {\n  type PasskeyCeremony,\n  PasskeyCeremony as Ceremony,\n  type PasskeyManagementPersistence,\n} from \"@yielded/auth/Passkey\";\nimport { Effect } from \"effect\";\n\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport type { makePasskeyAdmissionKernel } from \"./admission\";\nimport type { makePasskeyCredentialsKernel } from \"./credentials\";\nimport type { makePasskeyFlowKernel } from \"./flow\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\nimport type { WriteSubject, makePasskeyWriteStateKernel } from \"./write-state\";\n\ntype Issue = Parameters<PasskeyManagementPersistence[\"Service\"][\"issueEnrollment\"]>[0];\n\ntype Complete = Parameters<PasskeyManagementPersistence[\"Service\"][\"completeEnrollment\"]>[0];\n\nexport const makePasskeyEnrollmentKernel = (\n  operations: QueryOperations,\n  admission: Pick<\n    ReturnType<typeof makePasskeyAdmissionKernel>,\n    \"lockAdmission\" | \"readCharges\" | \"guardChargeSet\"\n  >,\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"readModule\" | \"readPolicyGuards\"\n  >,\n  flow: Pick<\n    ReturnType<typeof makePasskeyFlowKernel>,\n    | \"compatiblePolicy\"\n    | \"exactClaim\"\n    | \"issueAssertion\"\n    | \"liveCondition\"\n    | \"readFlow\"\n    | \"terminalFlow\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    \"equal\" | \"handleKey\" | \"invariant\" | \"sameRevision\" | \"credentialKey\"\n  >,\n  writeState: Pick<\n    ReturnType<typeof makePasskeyWriteStateKernel>,\n    | \"authorizeAction\"\n    | \"credentialRows\"\n    | \"currentSubject\"\n    | \"enrollmentDigest\"\n    | \"digest\"\n    | \"insertCredential\"\n    | \"managementPolicy\"\n    | \"validRegistration\"\n  >,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n  const { sql } = operations;\n  const { lockAdmission, readCharges, guardChargeSet } = admission;\n  const { readModule, readPolicyGuards } = credentials;\n\n  const { compatiblePolicy, exactClaim, issueAssertion, liveCondition, readFlow, terminalFlow } =\n    flow;\n\n  const { equal, handleKey, sameRevision, credentialKey: credentialKeyFor } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    authorizeAction,\n    credentialRows,\n    currentSubject,\n    enrollmentDigest,\n    digest,\n    insertCredential,\n    managementPolicy,\n    validRegistration,\n  } = writeState;\n\n  const { both } = transactions;\n\n  const enrollmentHandle = Effect.fn(\"passkey.enrollmentHandle\")(function* (\n    mapping: any,\n    subject: WriteSubject,\n    ceremony: PasskeyCeremony,\n    create: boolean,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    invariant(ceremony.context._tag === \"Enrollment\");\n    const table = mapping.read.handleOwnership;\n\n    const where = equal(table.table, {\n      [table.rpId]: ceremony.profile.rpId,\n      [table.subjectId]: subject.nativeId,\n    });\n\n    const found = yield* owner.read(table.table, where, { limit: 1 });\n    const row = found.rows[0];\n    const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);\n\n    if (row !== undefined)\n      return (\n        table.isOwnedState(row[table.state]) &&\n        row[table.handleKey] === hashed &&\n        row[table.userHandle] === ceremony.context.userHandle &&\n        mapping.read.subjectIds.equals(table.decodeSubjectId(row), subject.nativeId)\n      );\n    if (!create) return false;\n\n    const absent = yield* owner.read(\n      table.table,\n      equal(table.table, { [table.handleKey]: hashed }),\n      {\n        limit: 1,\n      },\n    );\n\n    if (absent.rows.length !== 0) return false;\n\n    const inserted = yield* owner.insert(\n      table.table,\n      {\n        ...mapping.write.handleOwnership.encodeInsert({\n          subjectId: subject.nativeId,\n          rpId: ceremony.profile.rpId,\n          userHandle: ceremony.context.userHandle,\n          marker: owner.marker,\n        }),\n        [table.handleKey]: hashed,\n        [table.rpId]: ceremony.profile.rpId,\n        [table.userHandle]: ceremony.context.userHandle,\n        [table.subjectId]: subject.nativeId,\n        [table.state]: mapping.write.handleOwnership.ownedState,\n        [table.version]: owner.marker,\n        [table.reservationId]: null,\n      },\n      { [table.handleKey]: hashed },\n    );\n\n    found.rows = inserted.rows;\n    absent.rows = inserted.rows;\n\n    return true;\n  });\n\n  const capCondition = (mapping: any, subject: WriteSubject, maximum: number, addition: number) => {\n    const table = mapping.read.credential;\n\n    return sql`(select count(*) from ${table.table} where ${both(equal(table.table, { [table.subjectId]: subject.nativeId }), table.activeCondition)}) + ${addition} <= ${maximum}`;\n  };\n\n  const issueEnrollment = Effect.fn(\"passkey.issueEnrollment\")(function* (\n    mapping: any,\n    input: Issue,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const ceremony = input.ceremony;\n\n    if (\n      ceremony.context._tag !== \"Enrollment\" ||\n      ceremony.purpose !== \"enrollment\" ||\n      ceremony.moduleId !== mapping.moduleId\n    )\n      return { _tag: \"Rejected\" } as const;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined || !compatiblePolicy(ceremony, input.policy, current))\n      return { _tag: \"Rejected\" } as const;\n    yield* lockAdmission(mapping);\n    const subject = yield* currentSubject(mapping, ceremony.context.revision.subjectId);\n\n    if (subject === undefined || !sameRevision(subject.revision, ceremony.context.revision))\n      return { _tag: \"Rejected\" } as const;\n    yield* readPolicyGuards(mapping);\n    const policy = managementPolicy(mapping, subject);\n    const maximum = Math.min(policy.maximumCredentials, input.management.maximumCredentials);\n    const rows = yield* credentialRows(mapping, subject, ceremony.profile.rpId);\n    const ids = rows.map((row) => row[mapping.read.credential.protocolCredentialId]);\n\n    if (\n      ids.length !== ceremony.allowedCredentials.length ||\n      !ids.every((id) => ceremony.allowedCredentials.some((item) => item.id === id)) ||\n      !(yield* owner.check(capCondition(mapping, subject, maximum, 1)))\n    )\n      return { _tag: \"Rejected\" } as const;\n    if (\n      !(yield* authorizeAction(\n        mapping,\n        subject,\n        input.authorization,\n        {\n          action: \"enroll-begin\",\n          commandId: ceremony.commandId,\n          flowId: ceremony.flowId,\n          bindingDigest: enrollmentDigest(ceremony),\n          revision: ceremony.context.revision,\n        },\n        {\n          ...policy,\n          maximumEvidenceAgeMillis: Math.min(\n            policy.maximumEvidenceAgeMillis,\n            input.management.maximumEvidenceAgeMillis,\n          ),\n        },\n      ))\n    )\n      return { _tag: \"Rejected\" } as const;\n    invariant(\n      digest(Ceremony.fields.context, ceremony.context) ===\n        digest(Ceremony.fields.context, {\n          ...ceremony.context,\n          authorization: input.authorization,\n        }),\n    );\n    const issued = yield* issueAssertion(mapping, ceremony, input.policy);\n\n    if (issued._tag !== \"Issued\") return issued;\n    invariant(yield* enrollmentHandle(mapping, subject, ceremony, true));\n    owner.postconditions.push(capCondition(mapping, subject, maximum, 1));\n\n    return issued;\n  });\n\n  const completeEnrollment = Effect.fn(\"passkey.completeEnrollment\")(function* (\n    mapping: any,\n    input: Complete,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const ceremony = input.claim.ceremony;\n\n    if (\n      ceremony.context._tag !== \"Enrollment\" ||\n      ceremony.purpose !== \"enrollment\" ||\n      ceremony.moduleId !== mapping.moduleId\n    )\n      return { _tag: \"Rejected\" } as const;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined) return { _tag: \"Rejected\" } as const;\n    yield* lockAdmission(mapping);\n    const subject = yield* currentSubject(mapping, ceremony.context.revision.subjectId);\n\n    yield* readPolicyGuards(mapping);\n    const read = yield* readFlow(mapping, ceremony.flowId);\n\n    if (read === undefined || !exactClaim(read, input.claim)) return { _tag: \"Rejected\" } as const;\n\n    const reject = Effect.gen(function* () {\n      yield* terminalFlow(mapping, read, \"Rejected\");\n\n      return { _tag: \"Rejected\" } as const;\n    });\n\n    if (\n      subject === undefined ||\n      !sameRevision(subject.revision, ceremony.context.revision) ||\n      !compatiblePolicy(ceremony, read.policy, current) ||\n      !validRegistration(ceremony, input.verified) ||\n      !(yield* owner.check(liveCondition(mapping, ceremony, input.claim)))\n    )\n      return yield* reject;\n    const policy = managementPolicy(mapping, subject);\n    const maximum = Math.min(policy.maximumCredentials, input.management.maximumCredentials);\n\n    if (\n      !(yield* owner.check(capCondition(mapping, subject, maximum, 1))) ||\n      !(yield* enrollmentHandle(mapping, subject, ceremony, false))\n    )\n      return yield* reject;\n    if (\n      !(yield* authorizeAction(\n        mapping,\n        subject,\n        input.authorization,\n        {\n          action: \"enroll-complete\",\n          commandId: ceremony.commandId,\n          flowId: ceremony.flowId,\n          bindingDigest: digest(Ceremony, ceremony),\n          revision: ceremony.context.revision,\n        },\n        {\n          ...policy,\n          maximumEvidenceAgeMillis: Math.min(\n            policy.maximumEvidenceAgeMillis,\n            input.management.maximumEvidenceAgeMillis,\n          ),\n        },\n        ceremony.context.authorization.requirement,\n      ))\n    )\n      return yield* reject;\n    const tuple = mapping.read.credentialOwnership;\n    // Credential ownership is RP-global, including retained registration custody.\n    const key = credentialKeyFor(ceremony.profile.rpId, input.verified.protocolCredentialId);\n\n    if (\n      (yield* owner.read(tuple.table, equal(tuple.table, { [tuple.credentialKey]: key }), {\n        limit: 1,\n        observe: false,\n      })).rows.length !== 0\n    )\n      return yield* reject;\n    yield* readCharges(mapping, ceremony, read.policy, subject.subjectId);\n    yield* guardChargeSet(mapping, ceremony, subject.subjectId);\n\n    const safe = yield* insertCredential(\n      mapping,\n      subject,\n      ceremony,\n      input.verified,\n      yield* owner.now(mapping.clock),\n    );\n\n    yield* terminalFlow(mapping, read, \"Verified\");\n    owner.postconditions.push(\n      liveCondition(mapping, ceremony, input.claim),\n      capCondition(mapping, subject, maximum, 0),\n    );\n\n    return { _tag: \"Enrolled\", credential: safe } as const;\n  });\n\n  return { enrollmentHandle, issueEnrollment, completeEnrollment };\n};\n"],"mappings":";;;;AAsBA,MAAa,+BACX,YACA,WAIA,aAIA,MASA,OAIA,YAWA,iBACG;CACH,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,eAAe,aAAa,mBAAmB;CACvD,MAAM,EAAE,YAAY,qBAAqB;CAEzC,MAAM,EAAE,kBAAkB,YAAY,gBAAgB,eAAe,UAAU,iBAC7E;CAEF,MAAM,EAAE,OAAO,WAAW,cAAc,eAAe,qBAAqB;CAC5E,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,iBACA,gBACA,gBACA,kBACA,QACA,kBACA,kBACA,sBACE;CAEJ,MAAM,EAAE,SAAS;CAEjB,MAAM,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,SACA,UACA,QACA;EACA,MAAM,QAAQ,OAAO;EAErB,UAAU,SAAS,QAAQ,SAAS,YAAY;EAChD,MAAM,QAAQ,QAAQ,KAAK;EAE3B,MAAM,QAAQ,MAAM,MAAM,OAAO;IAC9B,MAAM,OAAO,SAAS,QAAQ;IAC9B,MAAM,YAAY,QAAQ;EAC7B,CAAC;EAED,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM,OAAO,OAAO,EAAE,OAAO,EAAE,CAAC;EAChE,MAAM,MAAM,MAAM,KAAK;EACvB,MAAM,SAAS,UAAU,SAAS,QAAQ,MAAM,SAAS,QAAQ,UAAU;EAE3E,IAAI,QAAQ,KAAA,GACV,OACE,MAAM,aAAa,IAAI,MAAM,MAAM,KACnC,IAAI,MAAM,eAAe,UACzB,IAAI,MAAM,gBAAgB,SAAS,QAAQ,cAC3C,QAAQ,KAAK,WAAW,OAAO,MAAM,gBAAgB,GAAG,GAAG,QAAQ,QAAQ;EAE/E,IAAI,CAAC,QAAQ,OAAO;EAEpB,MAAM,SAAS,OAAO,MAAM,KAC1B,MAAM,OACN,MAAM,MAAM,OAAO,GAAG,MAAM,YAAY,OAAO,CAAC,GAChD,EACE,OAAO,EACT,CACF;EAEA,IAAI,OAAO,KAAK,WAAW,GAAG,OAAO;EAErC,MAAM,WAAW,OAAO,MAAM,OAC5B,MAAM,OACN;GACE,GAAG,QAAQ,MAAM,gBAAgB,aAAa;IAC5C,WAAW,QAAQ;IACnB,MAAM,SAAS,QAAQ;IACvB,YAAY,SAAS,QAAQ;IAC7B,QAAQ,MAAM;GAChB,CAAC;IACA,MAAM,YAAY;IAClB,MAAM,OAAO,SAAS,QAAQ;IAC9B,MAAM,aAAa,SAAS,QAAQ;IACpC,MAAM,YAAY,QAAQ;IAC1B,MAAM,QAAQ,QAAQ,MAAM,gBAAgB;IAC5C,MAAM,UAAU,MAAM;IACtB,MAAM,gBAAgB;EACzB,GACA,GAAG,MAAM,YAAY,OAAO,CAC9B;EAEA,MAAM,OAAO,SAAS;EACtB,OAAO,OAAO,SAAS;EAEvB,OAAO;CACT,CAAC;CAED,MAAM,gBAAgB,SAAc,SAAuB,SAAiB,aAAqB;EAC/F,MAAM,QAAQ,QAAQ,KAAK;EAE3B,OAAO,GAAG,yBAAyB,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,GAAG,MAAM,YAAY,QAAQ,SAAS,CAAC,GAAG,MAAM,eAAe,EAAE,MAAM,SAAS,MAAM;CACxK;CA8KA,OAAO;EAAE;EAAkB,iBA5KH,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,WAAW,MAAM;GAEvB,IACE,SAAS,QAAQ,SAAS,gBAC1B,SAAS,YAAY,gBACrB,SAAS,aAAa,QAAQ,UAE9B,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,UAAU,OAAO,WAAW,OAAO;GAEzC,IAAI,YAAY,KAAA,KAAa,CAAC,iBAAiB,UAAU,MAAM,QAAQ,OAAO,GAC5E,OAAO,EAAE,MAAM,WAAW;GAC5B,OAAO,cAAc,OAAO;GAC5B,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS,QAAQ,SAAS,SAAS;GAElF,IAAI,YAAY,KAAA,KAAa,CAAC,aAAa,QAAQ,UAAU,SAAS,QAAQ,QAAQ,GACpF,OAAO,EAAE,MAAM,WAAW;GAC5B,OAAO,iBAAiB,OAAO;GAC/B,MAAM,SAAS,iBAAiB,SAAS,OAAO;GAChD,MAAM,UAAU,KAAK,IAAI,OAAO,oBAAoB,MAAM,WAAW,kBAAkB;GAEvF,MAAM,OAAM,OADQ,eAAe,SAAS,SAAS,SAAS,QAAQ,IAAI,EAAA,CACzD,KAAK,QAAQ,IAAI,QAAQ,KAAK,WAAW,qBAAqB;GAE/E,IACE,IAAI,WAAW,SAAS,mBAAmB,UAC3C,CAAC,IAAI,OAAO,OAAO,SAAS,mBAAmB,MAAM,SAAS,KAAK,OAAO,EAAE,CAAC,KAC7E,EAAE,OAAO,MAAM,MAAM,aAAa,SAAS,SAAS,SAAS,CAAC,CAAC,IAE/D,OAAO,EAAE,MAAM,WAAW;GAC5B,IACE,EAAE,OAAO,gBACP,SACA,SACA,MAAM,eACN;IACE,QAAQ;IACR,WAAW,SAAS;IACpB,QAAQ,SAAS;IACjB,eAAe,iBAAiB,QAAQ;IACxC,UAAU,SAAS,QAAQ;GAC7B,GACA;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,CACF,IAEA,OAAO,EAAE,MAAM,WAAW;GAC5B,UACE,OAAOA,gBAAS,OAAO,SAAS,SAAS,OAAO,MAC9C,OAAOA,gBAAS,OAAO,SAAS;IAC9B,GAAG,SAAS;IACZ,eAAe,MAAM;GACvB,CAAC,CACL;GACA,MAAM,SAAS,OAAO,eAAe,SAAS,UAAU,MAAM,MAAM;GAEpE,IAAI,OAAO,SAAS,UAAU,OAAO;GACrC,UAAU,OAAO,iBAAiB,SAAS,SAAS,UAAU,IAAI,CAAC;GACnE,MAAM,eAAe,KAAK,aAAa,SAAS,SAAS,SAAS,CAAC,CAAC;GAEpE,OAAO;EACT,CAsGyC;EAAG,oBApGjB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACjE,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,WAAW,MAAM,MAAM;GAE7B,IACE,SAAS,QAAQ,SAAS,gBAC1B,SAAS,YAAY,gBACrB,SAAS,aAAa,QAAQ,UAE9B,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,UAAU,OAAO,WAAW,OAAO;GAEzC,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACrD,OAAO,cAAc,OAAO;GAC5B,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS,QAAQ,SAAS,SAAS;GAElF,OAAO,iBAAiB,OAAO;GAC/B,MAAM,OAAO,OAAO,SAAS,SAAS,SAAS,MAAM;GAErD,IAAI,SAAS,KAAA,KAAa,CAAC,WAAW,MAAM,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,WAAW;GAEpF,MAAM,SAAS,OAAO,IAAI,aAAa;IACrC,OAAO,aAAa,SAAS,MAAM,UAAU;IAE7C,OAAO,EAAE,MAAM,WAAW;GAC5B,CAAC;GAED,IACE,YAAY,KAAA,KACZ,CAAC,aAAa,QAAQ,UAAU,SAAS,QAAQ,QAAQ,KACzD,CAAC,iBAAiB,UAAU,KAAK,QAAQ,OAAO,KAChD,CAAC,kBAAkB,UAAU,MAAM,QAAQ,KAC3C,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,UAAU,MAAM,KAAK,CAAC,IAElE,OAAO,OAAO;GAChB,MAAM,SAAS,iBAAiB,SAAS,OAAO;GAChD,MAAM,UAAU,KAAK,IAAI,OAAO,oBAAoB,MAAM,WAAW,kBAAkB;GAEvF,IACE,EAAE,OAAO,MAAM,MAAM,aAAa,SAAS,SAAS,SAAS,CAAC,CAAC,MAC/D,EAAE,OAAO,iBAAiB,SAAS,SAAS,UAAU,KAAK,IAE3D,OAAO,OAAO;GAChB,IACE,EAAE,OAAO,gBACP,SACA,SACA,MAAM,eACN;IACE,QAAQ;IACR,WAAW,SAAS;IACpB,QAAQ,SAAS;IACjB,eAAe,OAAOA,iBAAU,QAAQ;IACxC,UAAU,SAAS,QAAQ;GAC7B,GACA;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,GACA,SAAS,QAAQ,cAAc,WACjC,IAEA,OAAO,OAAO;GAChB,MAAM,QAAQ,QAAQ,KAAK;GAE3B,MAAM,MAAM,iBAAiB,SAAS,QAAQ,MAAM,MAAM,SAAS,oBAAoB;GAEvF,KACG,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,OAAO,GAAG,MAAM,gBAAgB,IAAI,CAAC,GAAG;IAClF,OAAO;IACP,SAAS;GACX,CAAC,EAAA,CAAG,KAAK,WAAW,GAEpB,OAAO,OAAO;GAChB,OAAO,YAAY,SAAS,UAAU,KAAK,QAAQ,QAAQ,SAAS;GACpE,OAAO,eAAe,SAAS,UAAU,QAAQ,SAAS;GAE1D,MAAM,OAAO,OAAO,iBAClB,SACA,SACA,UACA,MAAM,UACN,OAAO,MAAM,IAAI,QAAQ,KAAK,CAChC;GAEA,OAAO,aAAa,SAAS,MAAM,UAAU;GAC7C,MAAM,eAAe,KACnB,cAAc,SAAS,UAAU,MAAM,KAAK,GAC5C,aAAa,SAAS,SAAS,SAAS,CAAC,CAC3C;GAEA,OAAO;IAAE,MAAM;IAAY,YAAY;GAAK;EAC9C,CAE6D;CAAE;AACjE"}

package/dist/internal/passkey/flow.d.mts

@@ -0,0 +1,21 @@
+import "../query-operations.mjs";
+import { PasskeyFlowState } from "../models/passkey-model.mjs";
+import "../transaction-kernel.mjs";
+import "./state.mjs";
+import "./credentials.mjs";
+import "./admission.mjs";
+import "./registration-custody.mjs";
+import { DateTime, Effect } from "effect";
+import { PasskeyAccess, PasskeyAssertionVerified, PasskeyCeremony, PasskeyClaim, PasskeyCredential, PasskeyEvidence, PasskeyMethodPolicy } from "@yielded/auth/Passkey";
+import { SubjectId } from "@yielded/auth/Schema";
+//#region src/internal/passkey/flow.d.ts
+export interface FlowRead {
+  readonly row: Record<string, any>;
+  readonly ceremony: PasskeyCeremony;
+  readonly policy: PasskeyMethodPolicy;
+  readonly state: PasskeyFlowState;
+  readonly claim?: PasskeyClaim;
+  readonly credential?: PasskeyCredential;
+}
+//#endregion
+//# sourceMappingURL=flow.d.mts.map