@yielded/auth-persistence 0.1.0-beta.11 → 0.1.0-beta.12

package/dist/internal/models/email-model.d.mts

@@ -4,8 +4,8 @@ import { SubjectIdCodec } from "./common.mjs";
 import { Effect } from "effect";
 import { TokenDigest } from "@yielded/auth/Schema";
 import { AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
-import { EmailAction, EmailRegistrationDecision } from "@yielded/auth/Email";
 import { ProofBinding, ProofContinuationId, ProofPurpose } from "@yielded/auth/Proofs";
+import { EmailAction, EmailRegistrationDecision } from "@yielded/auth/Email";
 import { LoginIdentifier } from "@yielded/auth/Identity";
 //#region src/internal/models/email-model.d.ts
 type ColumnKey<T extends TableModel> = T["column"];

package/dist/internal/oauth-server.mjs

@@ -26,7 +26,7 @@ const OAuthServerPersistence = {
 			pg: () => true,
 			orElse: () => false
 		})) return yield* Unavailable.make({});
-		const standalone = requireStandalone(() => Unavailable.make({}), sql);
+		const standalone = requireStandalone(() => Unavailable.make({}), sql.transactionService);
 		const failure = (effect) => effect.pipe(Effect.mapError(() => Unavailable.make({})));
 		return Persistence.of({
 			get: Effect.fn("OAuthServerPersistence.get")(function* (namespace, id) {

package/dist/internal/oauth-server.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-server.mjs","names":[],"sources":["../../src/internal/oauth-server.ts"],"sourcesContent":["import { Persistence, Record, Unavailable } from \"@yielded/auth/OAuthServer\";\nimport { Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { requireStandalone } from \"./standalone\";\n\nconst codec = Schema.fromJsonString(Record);\n\nconst Row = Schema.Struct({\n  payload: Schema.String,\n  version: Schema.String,\n  revoked: Schema.Literals([0, 1]),\n});\n\n/** SQLite (including D1) and PostgreSQL. Apply once through application migrations.\n * Expired records may be deleted when expires_at_millis <= the current time.\n * Revocation has its own monotonic column so it cannot lose a race with rotation.\n */\nconst migration = `CREATE TABLE yielded_oauth_server (\n  namespace TEXT NOT NULL,\n  grant_id TEXT NOT NULL,\n  version TEXT NOT NULL,\n  revoked INTEGER NOT NULL DEFAULT 0,\n  expires_at_millis BIGINT NOT NULL,\n  payload TEXT NOT NULL,\n  PRIMARY KEY (namespace, grant_id)\n)`;\n\nconst layer = Layer.effect(\n  Persistence,\n  Effect.gen(function* () {\n    const sql = yield* SqlClient.SqlClient;\n\n    if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))\n      return yield* Unavailable.make({});\n    const standalone = requireStandalone(() => Unavailable.make({}), sql);\n\n    const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n      effect.pipe(Effect.mapError(() => Unavailable.make({})));\n\n    return Persistence.of({\n      get: Effect.fn(\"OAuthServerPersistence.get\")(function* (namespace, id) {\n        yield* standalone;\n\n        const rows =\n          yield* sql`SELECT payload, version, revoked FROM yielded_oauth_server WHERE namespace = ${namespace} AND grant_id = ${id}`;\n\n        if (rows.length === 0) return undefined;\n        if (rows.length !== 1) return yield* Unavailable.make({});\n        const row = yield* Schema.decodeUnknownEffect(Row)(rows[0]);\n        const record = yield* Schema.decodeEffect(codec)(row.payload);\n\n        if (record.version !== row.version) return yield* Unavailable.make({});\n\n        return row.revoked === 1 ? { ...record, status: \"Revoked\" as const } : record;\n      }, failure),\n      insert: Effect.fn(\"OAuthServerPersistence.insert\")(function* (namespace, id, record) {\n        yield* standalone;\n        const payload = yield* Schema.encodeEffect(codec)(record);\n\n        const rows =\n          yield* sql`INSERT INTO yielded_oauth_server (namespace, grant_id, version, revoked, expires_at_millis, payload) VALUES (${namespace}, ${id}, ${record.version}, ${record.status === \"Revoked\" ? 1 : 0}, ${record.expiresAtMillis}, ${payload}) ON CONFLICT (namespace, grant_id) DO NOTHING RETURNING version`;\n\n        return rows.length === 1;\n      }, failure),\n      compareAndSet: Effect.fn(\"OAuthServerPersistence.compareAndSet\")(function* (\n        namespace,\n        id,\n        version,\n        record,\n      ) {\n        yield* standalone;\n        if (version === record.version) return yield* Unavailable.make({});\n        const payload = yield* Schema.encodeEffect(codec)(record);\n\n        const rows =\n          yield* sql`UPDATE yielded_oauth_server SET version = ${record.version}, revoked = ${record.status === \"Revoked\" ? 1 : 0}, expires_at_millis = ${record.expiresAtMillis}, payload = ${payload} WHERE namespace = ${namespace} AND grant_id = ${id} AND version = ${version} AND revoked = 0 RETURNING version`;\n\n        return rows.length === 1;\n      }, failure),\n      revoke: Effect.fn(\"OAuthServerPersistence.revoke\")(function* (namespace, id) {\n        yield* standalone;\n        yield* sql`UPDATE yielded_oauth_server SET revoked = 1 WHERE namespace = ${namespace} AND grant_id = ${id}`;\n      }, failure),\n    });\n  }),\n);\n\nexport const OAuthServerPersistence = { migration, layer };\n"],"mappings":";;;;;AAMA,MAAM,QAAQ,OAAO,eAAe,MAAM;AAE1C,MAAM,MAAM,OAAO,OAAO;CACxB,SAAS,OAAO;CAChB,SAAS,OAAO;CAChB,SAAS,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AA4ED,MAAa,yBAAyB;CAAE;;;;;;;;;CAAW,OA5DrC,MAAM,OAClB,aACA,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,UAAU;EAE7B,IAAI,CAAC,IAAI,gBAAgB;GAAE,cAAc;GAAM,UAAU;GAAM,cAAc;EAAM,CAAC,GAClF,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;EACnC,MAAM,aAAa,wBAAwB,YAAY,KAAK,CAAC,CAAC,GAAG,GAAG;EAEpE,MAAM,WAAoB,WACxB,OAAO,KAAK,OAAO,eAAe,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC;EAEzD,OAAO,YAAY,GAAG;GACpB,KAAK,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,WAAW,IAAI;IACrE,OAAO;IAEP,MAAM,OACJ,OAAO,GAAG,gFAAgF,UAAU,kBAAkB;IAExH,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IACxD,MAAM,MAAM,OAAO,OAAO,oBAAoB,GAAG,CAAC,CAAC,KAAK,EAAE;IAC1D,MAAM,SAAS,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,IAAI,OAAO;IAE5D,IAAI,OAAO,YAAY,IAAI,SAAS,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IAErE,OAAO,IAAI,YAAY,IAAI;KAAE,GAAG;KAAQ,QAAQ;IAAmB,IAAI;GACzE,GAAG,OAAO;GACV,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,WAAW,IAAI,QAAQ;IACnF,OAAO;IACP,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;IAKxD,QAAO,OAFE,GAAG,gHAAgH,UAAU,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAI,OAAO,WAAW,YAAY,IAAI,EAAE,IAAI,OAAO,gBAAgB,IAAI,QAAQ,kEAAA,CAEnO,WAAW;GACzB,GAAG,OAAO;GACV,eAAe,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/D,WACA,IACA,SACA,QACA;IACA,OAAO;IACP,IAAI,YAAY,OAAO,SAAS,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IACjE,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;IAKxD,QAAO,OAFE,GAAG,6CAA6C,OAAO,QAAQ,cAAc,OAAO,WAAW,YAAY,IAAI,EAAE,wBAAwB,OAAO,gBAAgB,cAAc,QAAQ,qBAAqB,UAAU,kBAAkB,GAAG,iBAAiB,QAAQ,oCAAA,CAEhQ,WAAW;GACzB,GAAG,OAAO;GACV,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,WAAW,IAAI;IAC3E,OAAO;IACP,OAAO,GAAG,iEAAiE,UAAU,kBAAkB;GACzG,GAAG,OAAO;EACZ,CAAC;CACH,CAAC,CAGgD;AAAM"}
+{"version":3,"file":"oauth-server.mjs","names":[],"sources":["../../src/internal/oauth-server.ts"],"sourcesContent":["import { Persistence, Record, Unavailable } from \"@yielded/auth/OAuthServer\";\nimport { Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { requireStandalone } from \"./standalone\";\n\nconst codec = Schema.fromJsonString(Record);\n\nconst Row = Schema.Struct({\n  payload: Schema.String,\n  version: Schema.String,\n  revoked: Schema.Literals([0, 1]),\n});\n\n/** SQLite (including D1) and PostgreSQL. Apply once through application migrations.\n * Expired records may be deleted when expires_at_millis <= the current time.\n * Revocation has its own monotonic column so it cannot lose a race with rotation.\n */\nconst migration = `CREATE TABLE yielded_oauth_server (\n  namespace TEXT NOT NULL,\n  grant_id TEXT NOT NULL,\n  version TEXT NOT NULL,\n  revoked INTEGER NOT NULL DEFAULT 0,\n  expires_at_millis BIGINT NOT NULL,\n  payload TEXT NOT NULL,\n  PRIMARY KEY (namespace, grant_id)\n)`;\n\nconst layer = Layer.effect(\n  Persistence,\n  Effect.gen(function* () {\n    const sql = yield* SqlClient.SqlClient;\n\n    if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))\n      return yield* Unavailable.make({});\n    const standalone = requireStandalone(() => Unavailable.make({}), sql.transactionService);\n\n    const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n      effect.pipe(Effect.mapError(() => Unavailable.make({})));\n\n    return Persistence.of({\n      get: Effect.fn(\"OAuthServerPersistence.get\")(function* (namespace, id) {\n        yield* standalone;\n\n        const rows =\n          yield* sql`SELECT payload, version, revoked FROM yielded_oauth_server WHERE namespace = ${namespace} AND grant_id = ${id}`;\n\n        if (rows.length === 0) return undefined;\n        if (rows.length !== 1) return yield* Unavailable.make({});\n        const row = yield* Schema.decodeUnknownEffect(Row)(rows[0]);\n        const record = yield* Schema.decodeEffect(codec)(row.payload);\n\n        if (record.version !== row.version) return yield* Unavailable.make({});\n\n        return row.revoked === 1 ? { ...record, status: \"Revoked\" as const } : record;\n      }, failure),\n      insert: Effect.fn(\"OAuthServerPersistence.insert\")(function* (namespace, id, record) {\n        yield* standalone;\n        const payload = yield* Schema.encodeEffect(codec)(record);\n\n        const rows =\n          yield* sql`INSERT INTO yielded_oauth_server (namespace, grant_id, version, revoked, expires_at_millis, payload) VALUES (${namespace}, ${id}, ${record.version}, ${record.status === \"Revoked\" ? 1 : 0}, ${record.expiresAtMillis}, ${payload}) ON CONFLICT (namespace, grant_id) DO NOTHING RETURNING version`;\n\n        return rows.length === 1;\n      }, failure),\n      compareAndSet: Effect.fn(\"OAuthServerPersistence.compareAndSet\")(function* (\n        namespace,\n        id,\n        version,\n        record,\n      ) {\n        yield* standalone;\n        if (version === record.version) return yield* Unavailable.make({});\n        const payload = yield* Schema.encodeEffect(codec)(record);\n\n        const rows =\n          yield* sql`UPDATE yielded_oauth_server SET version = ${record.version}, revoked = ${record.status === \"Revoked\" ? 1 : 0}, expires_at_millis = ${record.expiresAtMillis}, payload = ${payload} WHERE namespace = ${namespace} AND grant_id = ${id} AND version = ${version} AND revoked = 0 RETURNING version`;\n\n        return rows.length === 1;\n      }, failure),\n      revoke: Effect.fn(\"OAuthServerPersistence.revoke\")(function* (namespace, id) {\n        yield* standalone;\n        yield* sql`UPDATE yielded_oauth_server SET revoked = 1 WHERE namespace = ${namespace} AND grant_id = ${id}`;\n      }, failure),\n    });\n  }),\n);\n\nexport const OAuthServerPersistence = { migration, layer };\n"],"mappings":";;;;;AAMA,MAAM,QAAQ,OAAO,eAAe,MAAM;AAE1C,MAAM,MAAM,OAAO,OAAO;CACxB,SAAS,OAAO;CAChB,SAAS,OAAO;CAChB,SAAS,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AA4ED,MAAa,yBAAyB;CAAE;;;;;;;;;CAAW,OA5DrC,MAAM,OAClB,aACA,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,UAAU;EAE7B,IAAI,CAAC,IAAI,gBAAgB;GAAE,cAAc;GAAM,UAAU;GAAM,cAAc;EAAM,CAAC,GAClF,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;EACnC,MAAM,aAAa,wBAAwB,YAAY,KAAK,CAAC,CAAC,GAAG,IAAI,kBAAkB;EAEvF,MAAM,WAAoB,WACxB,OAAO,KAAK,OAAO,eAAe,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC;EAEzD,OAAO,YAAY,GAAG;GACpB,KAAK,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAAW,WAAW,IAAI;IACrE,OAAO;IAEP,MAAM,OACJ,OAAO,GAAG,gFAAgF,UAAU,kBAAkB;IAExH,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IACxD,MAAM,MAAM,OAAO,OAAO,oBAAoB,GAAG,CAAC,CAAC,KAAK,EAAE;IAC1D,MAAM,SAAS,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,IAAI,OAAO;IAE5D,IAAI,OAAO,YAAY,IAAI,SAAS,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IAErE,OAAO,IAAI,YAAY,IAAI;KAAE,GAAG;KAAQ,QAAQ;IAAmB,IAAI;GACzE,GAAG,OAAO;GACV,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,WAAW,IAAI,QAAQ;IACnF,OAAO;IACP,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;IAKxD,QAAO,OAFE,GAAG,gHAAgH,UAAU,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAI,OAAO,WAAW,YAAY,IAAI,EAAE,IAAI,OAAO,gBAAgB,IAAI,QAAQ,kEAAA,CAEnO,WAAW;GACzB,GAAG,OAAO;GACV,eAAe,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC/D,WACA,IACA,SACA,QACA;IACA,OAAO;IACP,IAAI,YAAY,OAAO,SAAS,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IACjE,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;IAKxD,QAAO,OAFE,GAAG,6CAA6C,OAAO,QAAQ,cAAc,OAAO,WAAW,YAAY,IAAI,EAAE,wBAAwB,OAAO,gBAAgB,cAAc,QAAQ,qBAAqB,UAAU,kBAAkB,GAAG,iBAAiB,QAAQ,oCAAA,CAEhQ,WAAW;GACzB,GAAG,OAAO;GACV,QAAQ,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAAW,WAAW,IAAI;IAC3E,OAAO;IACP,OAAO,GAAG,iEAAiE,UAAU,kBAAkB;GACzG,GAAG,OAAO;EACZ,CAAC;CACH,CAAC,CAGgD;AAAM"}

package/dist/internal/passkey/target.mjs

@@ -11,18 +11,19 @@ const makePasskeyTargetKernel = (credentials, flow, registrationCeremony, state,
 	const { captureMapping, nonce, unavailable, validateMapping } = state;
 	const invariant = state.invariant;
 	const { coordinateTransactionOwner, makeTransactionExecution, sqlClientTransactionStandaloneGuard } = execution;
-	const sqlClientPasskeyStandaloneGuard = (database) => sqlClientTransactionStandaloneGuard(unavailable, database);
+	const sqlClientPasskeyStandaloneGuard = (transactionService) => sqlClientTransactionStandaloneGuard(unavailable, transactionService);
 	const emptyHooks = {
 		before: () => Effect.void,
 		after: () => Effect.succeed([])
 	};
-	const makePasskeyExecution = (database, hooks, configuration) => {
-		const execution = makeTransactionExecution(CurrentPasskeyTransaction, database, configuration, unavailable, nonce);
+	const makePasskeyExecution = Effect.fnUntraced(function* (configuration) {
+		const hooks = yield* LifecycleHooks;
+		const execution = yield* makeTransactionExecution(CurrentPasskeyTransaction, configuration, unavailable, nonce);
 		return {
 			...execution,
 			run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
 		};
-	};
+	});
 	const issueInput = Schema.Struct({
 		ceremony: PasskeyCeremony,
 		policy: PasskeyMethodPolicy
@@ -148,17 +149,25 @@ const makePasskeyTargetKernel = (credentials, flow, registrationCeremony, state,
 		},
 		catch: () => PasskeyConfigurationError.make({})
 	}));
-	const makeTargetPasskeyCredentials = (database, source, configuration) => Effect.map(capturedMapping(source, "read", configuration), (mapping) => ({ passkeyCredentials: credentialService(mapping, makePasskeyExecution(database, emptyHooks, configuration)) }));
-	const makeTargetPasskeyEnrollmentContext = (database, source, configuration) => Effect.map(capturedMapping(source, "context", configuration), (mapping) => ({ passkeyEnrollmentContext: enrollmentService(mapping, makePasskeyExecution(database, emptyHooks, configuration)) }));
-	const makeTargetPasskeyPersistence = (database, source, configuration) => Effect.gen(function* () {
+	const makeTargetPasskeyCredentials = (source, configuration) => Effect.gen(function* () {
+		const mapping = yield* capturedMapping(source, "read", configuration);
+		const execution = yield* makePasskeyExecution(configuration).pipe(Effect.provideService(LifecycleHooks, emptyHooks));
+		return { passkeyCredentials: credentialService(mapping, execution) };
+	});
+	const makeTargetPasskeyEnrollmentContext = (source, configuration) => Effect.gen(function* () {
+		const mapping = yield* capturedMapping(source, "context", configuration);
+		const execution = yield* makePasskeyExecution(configuration).pipe(Effect.provideService(LifecycleHooks, emptyHooks));
+		return { passkeyEnrollmentContext: enrollmentService(mapping, execution) };
+	});
+	const makeTargetPasskeyPersistence = (source, configuration) => Effect.gen(function* () {
 		const mapping = yield* capturedMapping(source, "assertion", configuration);
-		const hooks = yield* LifecycleHooks;
-		return { passkeyPersistence: makePasskeyPersistence(mapping, makePasskeyExecution(database, hooks, configuration), configuration) };
+		const execution = yield* makePasskeyExecution(configuration);
+		return { passkeyPersistence: makePasskeyPersistence(mapping, execution, configuration) };
 	});
-	const makeTargetPasskeyRegistration = (database, source, configuration) => Effect.gen(function* () {
+	const makeTargetPasskeyRegistration = (source, configuration) => Effect.gen(function* () {
 		const mapping = yield* capturedMapping(source, "registration", configuration);
-		const hooks = yield* LifecycleHooks;
-		return registrationServices(mapping, makePasskeyExecution(database, hooks, configuration), configuration);
+		const execution = yield* makePasskeyExecution(configuration);
+		return registrationServices(mapping, execution, configuration);
 	});
 	const coordinateTargetPasskey = (database, source, configuration, owner) => Effect.flatMap(capturedMapping(source, "assertion", configuration), (mapping) => Effect.flatMap(LifecycleHooks, (hooks) => coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, Effect.void, unavailable, nonce, (execution) => ({ passkeyPersistence: makePasskeyPersistence(mapping, {
 		...execution,

package/dist/internal/passkey/target.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"target.mjs","names":[],"sources":["../../../src/internal/passkey/target.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport { type PreparedCommit, LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  PasskeyConfigurationError,\n  type PasskeyUnavailable,\n  type PasskeyCredentials,\n  type PasskeyEnrollmentContext,\n  type PasskeyPersistence,\n  type PreparePasskeyCommit,\n  PasskeyAccess,\n  PasskeyAssertionVerified,\n  PasskeyCeremony,\n  PasskeyClaim,\n  PasskeyClaimDecision,\n  PasskeyCleanupResult,\n  PasskeyCredential,\n  PasskeyEnrollmentSnapshot,\n  PasskeyEvidence,\n  PasskeyInstant,\n  PasskeyIssueDecision,\n  PasskeyModuleId,\n  PasskeyProfile,\n  PasskeyProtocolCredentialId,\n  PasskeySettlement,\n  PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport { SubjectId } from \"@yielded/auth/Schema\";\nimport { Effect, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"../mapping-error\";\nimport type {\n  PasskeyCredentialServices,\n  PasskeyEnrollmentContextServices,\n  PasskeyMappingSource,\n  PasskeyPersistenceServices,\n} from \"../models/passkey-model\";\nimport type { PasskeyRegistrationCeremonyServices } from \"../models/passkey-registration-ceremony-model\";\nimport type {\n  TransactionCoordinatorError,\n  TransactionExecution,\n  TransactionTargetConfiguration,\n  makeTransactionExecutionKernel,\n} from \"../transaction-execution-kernel\";\nimport type { makePasskeyCredentialsKernel } from \"./credentials\";\nimport type { makePasskeyFlowKernel } from \"./flow\";\nimport type { makePasskeyRegistrationCeremonyKernel } from \"./registration-ceremony\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport type PasskeyTargetConfiguration = TransactionTargetConfiguration<PasskeyUnavailable>;\n\nexport type PasskeyCoordinatorError<E> =\n  | TransactionCoordinatorError<E, PasskeyUnavailable>\n  | PasskeyConfigurationError\n  | PersistenceMappingError;\n\nexport type PasskeyExecution = TransactionExecution<\n  PasskeyUnavailable,\n  CurrentPasskeyTransaction,\n  never\n>;\n\nexport const makePasskeyTargetKernel = (\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"captureEnrollmentContext\" | \"lookupCredential\"\n  >,\n  flow: Pick<\n    ReturnType<typeof makePasskeyFlowKernel>,\n    | \"assertionPurposes\"\n    | \"claimAssertion\"\n    | \"cleanupCeremonies\"\n    | \"contextAssertion\"\n    | \"issueAssertion\"\n    | \"settleAssertion\"\n  >,\n  registrationCeremony: Pick<\n    ReturnType<typeof makePasskeyRegistrationCeremonyKernel>,\n    \"claimRegistration\" | \"contextRegistration\" | \"settleRegistration\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    \"captureMapping\" | \"invariant\" | \"nonce\" | \"unavailable\" | \"validateMapping\"\n  >,\n  execution: Pick<\n    ReturnType<typeof makeTransactionExecutionKernel>,\n    | \"coordinateTransactionOwner\"\n    | \"makeTransactionExecution\"\n    | \"sqlClientTransactionStandaloneGuard\"\n  >,\n) => {\n  const { captureEnrollmentContext, lookupCredential } = credentials;\n\n  const {\n    assertionPurposes,\n    claimAssertion,\n    cleanupCeremonies,\n    contextAssertion,\n    issueAssertion,\n    settleAssertion,\n  } = flow;\n\n  const { claimRegistration, contextRegistration, settleRegistration } = registrationCeremony;\n  const { captureMapping, nonce, unavailable, validateMapping } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    coordinateTransactionOwner,\n    makeTransactionExecution,\n    sqlClientTransactionStandaloneGuard,\n  } = execution;\n\n  const sqlClientPasskeyStandaloneGuard = (\n    database: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n  ) => sqlClientTransactionStandaloneGuard(unavailable, database);\n\n  const emptyHooks: LifecycleHooks[\"Service\"] = {\n    before: () => Effect.void,\n    after: () => Effect.succeed([]),\n  };\n\n  const makePasskeyExecution = (\n    database: Parameters<typeof makeTransactionExecution>[1],\n    hooks: LifecycleHooks[\"Service\"],\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyExecution => {\n    const execution = makeTransactionExecution(\n      CurrentPasskeyTransaction,\n      database,\n      configuration,\n      unavailable,\n      nonce,\n    );\n\n    return {\n      ...execution,\n      run: (operation, mutation) =>\n        execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    };\n  };\n\n  const issueInput = Schema.Struct({ ceremony: PasskeyCeremony, policy: PasskeyMethodPolicy });\n\n  const claimInput = Schema.Struct({\n    access: PasskeyAccess,\n    policy: PasskeyMethodPolicy,\n    ceremony: PasskeyCeremony,\n    claimId: PasskeyClaim.fields.claimId,\n    credential: Schema.optionalKey(PasskeyCredential),\n  });\n\n  const settleInput = Schema.Struct({\n    claim: PasskeyClaim,\n    nowMillis: PasskeyInstant,\n    outcome: Schema.Union([\n      Schema.TaggedStruct(\"Rejected\", {}),\n      Schema.TaggedStruct(\"Ambiguous\", {}),\n      Schema.TaggedStruct(\"Assertion\", {\n        credential: PasskeyCredential,\n        assertion: PasskeyAssertionVerified,\n        evidence: PasskeyEvidence,\n      }),\n    ]),\n  });\n\n  const cleanupInput = Schema.Struct({\n    moduleId: PasskeyModuleId,\n    nowMillis: PasskeyInstant,\n    limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n  });\n\n  const lookupInput = Schema.Struct({\n    rpId: PasskeyProfile.fields.rpId,\n    protocolCredentialId: PasskeyProtocolCredentialId,\n  });\n\n  const contextInput = Schema.Struct({\n    moduleId: PasskeyModuleId,\n    rpId: PasskeyProfile.fields.rpId,\n    subjectId: SubjectId,\n  });\n\n  const inputs = {\n    issue: issueInput,\n    context: PasskeyAccess,\n    claim: claimInput,\n    settle: settleInput,\n    cleanup: cleanupInput,\n  };\n\n  const capturedService = <S>(\n    service: S,\n    schemas: Record<string, Schema.Codec<any, any, never, never>>,\n    execute: PasskeyExecution,\n  ): S =>\n    Object.freeze(\n      Object.fromEntries(\n        Object.entries(\n          service as Record<string, (...args: any[]) => Effect.Effect<any, PasskeyUnavailable>>,\n        ).map(([name, method]) => [\n          name,\n          (original: any, prepare?: any) =>\n            Effect.suspend(() => {\n              invariant(execute.active());\n              const input = snapshotPasskeySync(schemas[name]!, original);\n\n              return method(input, prepare);\n            }).pipe(\n              Effect.onExit((exit) =>\n                Effect.sync(() => {\n                  if (exit._tag === \"Failure\") execute.poison();\n                }),\n              ),\n              Effect.catchDefect(() => Effect.fail(unavailable())),\n            ),\n        ]),\n      ),\n    ) as S;\n\n  const prepareValue = <Value, A>(\n    value: Value,\n    prepare: PreparePasskeyCommit<Value, A>,\n  ): Effect.Effect<PreparedCommit<A>, never, CurrentPasskeyTransaction> =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      Effect.sync(() => {\n        owner.guards.push(owner.journal.prepare(undefined));\n        const receipt = prepare(value, owner.journal);\n\n        invariant(\n          receipt !== null &&\n            typeof receipt === \"object\" &&\n            receipt._tag === \"PreparedCommit\" &&\n            typeof receipt.read === \"object\" &&\n            Effect.isEffect(receipt.read),\n        );\n        owner.guards.push(receipt);\n\n        return receipt;\n      }),\n    );\n\n  const requirePurpose = (purpose: string, registration: boolean, enrollment = false) =>\n    invariant(\n      enrollment\n        ? purpose === \"enrollment\"\n        : registration\n          ? purpose === \"registration\"\n          : assertionPurposes.some((supported) => supported === purpose),\n    );\n\n  /** Context is advisory. Retain observations and final predicates without taking\n   * later-ranked locks before a subsequent mutation acquires its full lock set. */\n  const observationalContext = <A, E, R>(operation: Effect.Effect<A, E, R>) =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      operation.pipe(\n        Effect.provideService(CurrentPasskeyTransaction, {\n          ...owner,\n          read: (table, where, options) => owner.read(table, where, { ...options, lock: false }),\n        }),\n      ),\n    );\n\n  const makePasskeyPersistence = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n    registration = false,\n    enrollment = false,\n  ): PasskeyPersistence[\"Service\"] =>\n    capturedService<PasskeyPersistence[\"Service\"]>(\n      {\n        issue: (input, prepare) =>\n          Effect.suspend(() => {\n            invariant(!registration && !enrollment);\n            requirePurpose(input.ceremony.purpose, false);\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* issueAssertion(mapping, input.ceremony, input.policy);\n\n                return yield* prepareValue(\n                  snapshotPasskeySync(PasskeyIssueDecision, value),\n                  prepare,\n                );\n              }),\n            );\n          }),\n        context: (access) =>\n          Effect.suspend(() => {\n            requirePurpose(access.purpose, registration, enrollment);\n\n            return execute.run(\n              observationalContext(\n                registration\n                  ? contextRegistration(mapping, access)\n                  : contextAssertion(mapping, access),\n              ),\n              false,\n            );\n          }),\n        claim: (input, prepare) =>\n          Effect.suspend(() => {\n            requirePurpose(input.access.purpose, registration, enrollment);\n            requirePurpose(input.ceremony.purpose, registration, enrollment);\n            invariant((!registration && !enrollment) || input.credential === undefined);\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* registration\n                  ? claimRegistration(mapping, input)\n                  : claimAssertion(mapping, input);\n\n                return yield* prepareValue(\n                  snapshotPasskeySync(PasskeyClaimDecision, value),\n                  prepare,\n                );\n              }),\n            );\n          }),\n        settle: (input, prepare) =>\n          Effect.suspend(() => {\n            requirePurpose(input.claim.ceremony.purpose, registration, enrollment);\n            invariant((!registration && !enrollment) || input.outcome._tag !== \"Assertion\");\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* registration\n                  ? settleRegistration(\n                      mapping,\n                      input.claim,\n                      input.outcome._tag as \"Rejected\" | \"Ambiguous\",\n                    )\n                  : settleAssertion(mapping, input.claim, input.outcome, configuration.dialect);\n\n                return yield* prepareValue(snapshotPasskeySync(PasskeySettlement, value), prepare);\n              }),\n            );\n          }),\n        cleanup: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const value = yield* cleanupCeremonies(\n                mapping,\n                input,\n                registration ? [\"registration\"] : enrollment ? [\"enrollment\"] : assertionPurposes,\n              );\n\n              return yield* prepareValue(snapshotPasskeySync(PasskeyCleanupResult, value), prepare);\n            }),\n          ),\n      },\n      inputs,\n      execute,\n    );\n\n  const credentialService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyCredentials[\"Service\"] =>\n    capturedService<PasskeyCredentials[\"Service\"]>(\n      {\n        lookup: (input) =>\n          execute.run(lookupCredential(mapping, input.rpId, input.protocolCredentialId), false),\n      },\n      { lookup: lookupInput },\n      execute,\n    );\n\n  const enrollmentService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyEnrollmentContext[\"Service\"] =>\n    capturedService<PasskeyEnrollmentContext[\"Service\"]>(\n      {\n        capture: (input) =>\n          execute.run(\n            Effect.map(captureEnrollmentContext(mapping, input), (value) =>\n              value === undefined\n                ? undefined\n                : snapshotPasskeySync(PasskeyEnrollmentSnapshot, value),\n            ),\n            false,\n          ),\n      },\n      { capture: contextInput },\n      execute,\n    );\n\n  const registrationServices = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyRegistrationCeremonyServices => ({\n    capabilities: Object.freeze({\n      purposes: Object.freeze([\"registration\"] as const),\n      issue: \"registration-authority\",\n      assertionSettlement: false,\n    }),\n    passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true),\n  });\n\n  const capturedMapping = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    kind: \"read\" | \"context\" | \"assertion\" | \"registration\",\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<M, PasskeyConfigurationError | PersistenceMappingError, RSetup> =>\n    Effect.flatMap(Effect.isEffect(source) ? source : Effect.succeed(source), (mapping) =>\n      Effect.try({\n        try: () => {\n          const captured = captureMapping(mapping);\n\n          validateMapping(captured, kind);\n          if (configuration.mode === \"batch\") invariant((captured as any).d1?.primary === true);\n\n          return captured;\n        },\n        catch: () => PasskeyConfigurationError.make({}),\n      }),\n    );\n\n  const makeTargetPasskeyCredentials = <M, RSetup>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyCredentialServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup\n  > =>\n    Effect.map(capturedMapping(source, \"read\", configuration), (mapping) => ({\n      passkeyCredentials: credentialService(\n        mapping,\n        makePasskeyExecution(database, emptyHooks, configuration),\n      ),\n    }));\n\n  const makeTargetPasskeyEnrollmentContext = <M, RSetup>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyEnrollmentContextServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup\n  > =>\n    Effect.map(capturedMapping(source, \"context\", configuration), (mapping) => ({\n      passkeyEnrollmentContext: enrollmentService(\n        mapping,\n        makePasskeyExecution(database, emptyHooks, configuration),\n      ),\n    }));\n\n  const makeTargetPasskeyPersistence = <M, RSetup>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyPersistenceServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | LifecycleHooks\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"assertion\", configuration);\n      const hooks = yield* LifecycleHooks;\n\n      return {\n        passkeyPersistence: makePasskeyPersistence(\n          mapping,\n          makePasskeyExecution(database, hooks, configuration),\n          configuration,\n        ),\n      };\n    });\n\n  const makeTargetPasskeyRegistration = <M, RSetup>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyRegistrationCeremonyServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | LifecycleHooks\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"registration\", configuration);\n      const hooks = yield* LifecycleHooks;\n\n      return registrationServices(\n        mapping,\n        makePasskeyExecution(database, hooks, configuration),\n        configuration,\n      );\n    });\n\n  const coordinateTargetPasskey = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: PasskeyPersistenceServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n    Effect.flatMap(capturedMapping(source, \"assertion\", configuration), (mapping) =>\n      Effect.flatMap(LifecycleHooks, (hooks) =>\n        coordinateTransactionOwner(\n          database,\n          CurrentPasskeyTransaction,\n          configuration,\n          Effect.void,\n          unavailable,\n          nonce,\n          (execution) => ({\n            passkeyPersistence: makePasskeyPersistence(\n              mapping,\n              {\n                ...execution,\n                run: (operation, mutation) =>\n                  execution\n                    .run(operation, mutation)\n                    .pipe(Effect.provideService(LifecycleHooks, hooks)),\n              },\n              configuration,\n            ),\n          }),\n          owner,\n        ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      ),\n    );\n\n  const coordinateTargetPasskeyRegistration = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: PasskeyRegistrationCeremonyServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n    Effect.flatMap(capturedMapping(source, \"registration\", configuration), (mapping) =>\n      Effect.flatMap(LifecycleHooks, (hooks) =>\n        coordinateTransactionOwner(\n          database,\n          CurrentPasskeyTransaction,\n          configuration,\n          Effect.void,\n          unavailable,\n          nonce,\n          (execution) =>\n            registrationServices(\n              mapping,\n              {\n                ...execution,\n                run: (operation, mutation) =>\n                  execution\n                    .run(operation, mutation)\n                    .pipe(Effect.provideService(LifecycleHooks, hooks)),\n              },\n              configuration,\n            ),\n          owner,\n        ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      ),\n    );\n\n  return {\n    sqlClientPasskeyStandaloneGuard,\n    makePasskeyExecution,\n    capturedService,\n    prepareValue,\n    observationalContext,\n    makePasskeyPersistence,\n    capturedMapping,\n    makeTargetPasskeyCredentials,\n    makeTargetPasskeyEnrollmentContext,\n    makeTargetPasskeyPersistence,\n    makeTargetPasskeyRegistration,\n    coordinateTargetPasskey,\n    coordinateTargetPasskeyRegistration,\n  };\n};\n"],"mappings":";;;;;;AAiEA,MAAa,2BACX,aAIA,MASA,sBAIA,OAIA,cAMG;CACH,MAAM,EAAE,0BAA0B,qBAAqB;CAEvD,MAAM,EACJ,mBACA,gBACA,mBACA,kBACA,gBACA,oBACE;CAEJ,MAAM,EAAE,mBAAmB,qBAAqB,uBAAuB;CACvE,MAAM,EAAE,gBAAgB,OAAO,aAAa,oBAAoB;CAChE,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,4BACA,0BACA,wCACE;CAEJ,MAAM,mCACJ,aACG,oCAAoC,aAAa,QAAQ;CAE9D,MAAM,aAAwC;EAC5C,cAAc,OAAO;EACrB,aAAa,OAAO,QAAQ,CAAC,CAAC;CAChC;CAEA,MAAM,wBACJ,UACA,OACA,kBACqB;EACrB,MAAM,YAAY,yBAChB,2BACA,UACA,eACA,aACA,KACF;EAEA,OAAO;GACL,GAAG;GACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACxF;CACF;CAEA,MAAM,aAAa,OAAO,OAAO;EAAE,UAAU;EAAiB,QAAQ;CAAoB,CAAC;CAE3F,MAAM,aAAa,OAAO,OAAO;EAC/B,QAAQ;EACR,QAAQ;EACR,UAAU;EACV,SAAS,aAAa,OAAO;EAC7B,YAAY,OAAO,YAAY,iBAAiB;CAClD,CAAC;CAED,MAAM,cAAc,OAAO,OAAO;EAChC,OAAO;EACP,WAAW;EACX,SAAS,OAAO,MAAM;GACpB,OAAO,aAAa,YAAY,CAAC,CAAC;GAClC,OAAO,aAAa,aAAa,CAAC,CAAC;GACnC,OAAO,aAAa,aAAa;IAC/B,YAAY;IACZ,WAAW;IACX,UAAU;GACZ,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,eAAe,OAAO,OAAO;EACjC,UAAU;EACV,WAAW;EACX,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAK,CAAC,CAAC;CACzE,CAAC;CAED,MAAM,cAAc,OAAO,OAAO;EAChC,MAAM,eAAe,OAAO;EAC5B,sBAAsB;CACxB,CAAC;CAED,MAAM,eAAe,OAAO,OAAO;EACjC,UAAU;EACV,MAAM,eAAe,OAAO;EAC5B,WAAW;CACb,CAAC;CAED,MAAM,SAAS;EACb,OAAO;EACP,SAAS;EACT,OAAO;EACP,QAAQ;EACR,SAAS;CACX;CAEA,MAAM,mBACJ,SACA,SACA,YAEA,OAAO,OACL,OAAO,YACL,OAAO,QACL,OACF,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CACxB,OACC,UAAe,YACd,OAAO,cAAc;EACnB,UAAU,QAAQ,OAAO,CAAC;EAG1B,OAAO,OAFO,oBAAoB,QAAQ,OAAQ,QAEhC,GAAG,OAAO;CAC9B,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;EAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;CAC9C,CAAC,CACH,GACA,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD,CACJ,CAAC,CACH,CACF;CAEF,MAAM,gBACJ,OACA,YAEA,OAAO,QAAQ,4BAA4B,UACzC,OAAO,WAAW;EAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;EAClD,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO;EAE5C,UACE,YAAY,QACV,OAAO,YAAY,YACnB,QAAQ,SAAS,oBACjB,OAAO,QAAQ,SAAS,YACxB,OAAO,SAAS,QAAQ,IAAI,CAChC;EACA,MAAM,OAAO,KAAK,OAAO;EAEzB,OAAO;CACT,CAAC,CACH;CAEF,MAAM,kBAAkB,SAAiB,cAAuB,aAAa,UAC3E,UACE,aACI,YAAY,eACZ,eACE,YAAY,iBACZ,kBAAkB,MAAM,cAAc,cAAc,OAAO,CACnE;;;CAIF,MAAM,wBAAiC,cACrC,OAAO,QAAQ,4BAA4B,UACzC,UAAU,KACR,OAAO,eAAe,2BAA2B;EAC/C,GAAG;EACH,OAAO,OAAO,OAAO,YAAY,MAAM,KAAK,OAAO,OAAO;GAAE,GAAG;GAAS,MAAM;EAAM,CAAC;CACvF,CAAC,CACH,CACF;CAEF,MAAM,0BACJ,SACA,SACA,eACA,eAAe,OACf,aAAa,UAEb,gBACE;EACE,QAAQ,OAAO,YACb,OAAO,cAAc;GACnB,UAAU,CAAC,gBAAgB,CAAC,UAAU;GACtC,eAAe,MAAM,SAAS,SAAS,KAAK;GAE5C,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,MAAM;IAEzE,OAAO,OAAO,aACZ,oBAAoB,sBAAsB,KAAK,GAC/C,OACF;GACF,CAAC,CACH;EACF,CAAC;EACH,UAAU,WACR,OAAO,cAAc;GACnB,eAAe,OAAO,SAAS,cAAc,UAAU;GAEvD,OAAO,QAAQ,IACb,qBACE,eACI,oBAAoB,SAAS,MAAM,IACnC,iBAAiB,SAAS,MAAM,CACtC,GACA,KACF;EACF,CAAC;EACH,QAAQ,OAAO,YACb,OAAO,cAAc;GACnB,eAAe,MAAM,OAAO,SAAS,cAAc,UAAU;GAC7D,eAAe,MAAM,SAAS,SAAS,cAAc,UAAU;GAC/D,UAAW,CAAC,gBAAgB,CAAC,cAAe,MAAM,eAAe,KAAA,CAAS;GAE1E,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eACjB,kBAAkB,SAAS,KAAK,IAChC,eAAe,SAAS,KAAK;IAEjC,OAAO,OAAO,aACZ,oBAAoB,sBAAsB,KAAK,GAC/C,OACF;GACF,CAAC,CACH;EACF,CAAC;EACH,SAAS,OAAO,YACd,OAAO,cAAc;GACnB,eAAe,MAAM,MAAM,SAAS,SAAS,cAAc,UAAU;GACrE,UAAW,CAAC,gBAAgB,CAAC,cAAe,MAAM,QAAQ,SAAS,WAAW;GAE9E,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eACjB,mBACE,SACA,MAAM,OACN,MAAM,QAAQ,IAChB,IACA,gBAAgB,SAAS,MAAM,OAAO,MAAM,SAAS,cAAc,OAAO;IAE9E,OAAO,OAAO,aAAa,oBAAoB,mBAAmB,KAAK,GAAG,OAAO;GACnF,CAAC,CACH;EACF,CAAC;EACH,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,kBACnB,SACA,OACA,eAAe,CAAC,cAAc,IAAI,aAAa,CAAC,YAAY,IAAI,iBAClE;GAEA,OAAO,OAAO,aAAa,oBAAoB,sBAAsB,KAAK,GAAG,OAAO;EACtF,CAAC,CACH;CACJ,GACA,QACA,OACF;CAEF,MAAM,qBACJ,SACA,YAEA,gBACE,EACE,SAAS,UACP,QAAQ,IAAI,iBAAiB,SAAS,MAAM,MAAM,MAAM,oBAAoB,GAAG,KAAK,EACxF,GACA,EAAE,QAAQ,YAAY,GACtB,OACF;CAEF,MAAM,qBACJ,SACA,YAEA,gBACE,EACE,UAAU,UACR,QAAQ,IACN,OAAO,IAAI,yBAAyB,SAAS,KAAK,IAAI,UACpD,UAAU,KAAA,IACN,KAAA,IACA,oBAAoB,2BAA2B,KAAK,CAC1D,GACA,KACF,EACJ,GACA,EAAE,SAAS,aAAa,GACxB,OACF;CAEF,MAAM,wBACJ,SACA,SACA,mBACyC;EACzC,cAAc,OAAO,OAAO;GAC1B,UAAU,OAAO,OAAO,CAAC,cAAc,CAAU;GACjD,OAAO;GACP,qBAAqB;EACvB,CAAC;EACD,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,IAAI;CAClF;CAEA,MAAM,mBACJ,QACA,MACA,kBAEA,OAAO,QAAQ,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM,IAAI,YACzE,OAAO,IAAI;EACT,WAAW;GACT,MAAM,WAAW,eAAe,OAAO;GAEvC,gBAAgB,UAAU,IAAI;GAC9B,IAAI,cAAc,SAAS,SAAS,UAAW,SAAiB,IAAI,YAAY,IAAI;GAEpF,OAAO;EACT;EACA,aAAa,0BAA0B,KAAK,CAAC,CAAC;CAChD,CAAC,CACH;CAEF,MAAM,gCACJ,UACA,QACA,kBAMA,OAAO,IAAI,gBAAgB,QAAQ,QAAQ,aAAa,IAAI,aAAa,EACvE,oBAAoB,kBAClB,SACA,qBAAqB,UAAU,YAAY,aAAa,CAC1D,EACF,EAAE;CAEJ,MAAM,sCACJ,UACA,QACA,kBAMA,OAAO,IAAI,gBAAgB,QAAQ,WAAW,aAAa,IAAI,aAAa,EAC1E,0BAA0B,kBACxB,SACA,qBAAqB,UAAU,YAAY,aAAa,CAC1D,EACF,EAAE;CAEJ,MAAM,gCACJ,UACA,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,aAAa,aAAa;EACzE,MAAM,QAAQ,OAAO;EAErB,OAAO,EACL,oBAAoB,uBAClB,SACA,qBAAqB,UAAU,OAAO,aAAa,GACnD,aACF,EACF;CACF,CAAC;CAEH,MAAM,iCACJ,UACA,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,gBAAgB,aAAa;EAC5E,MAAM,QAAQ,OAAO;EAErB,OAAO,qBACL,SACA,qBAAqB,UAAU,OAAO,aAAa,GACnD,aACF;CACF,CAAC;CAEH,MAAM,2BACJ,UACA,QACA,eACA,UAMA,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,aAAa,IAAI,YACnE,OAAO,QAAQ,iBAAiB,UAC9B,2BACE,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,eAAe,EACd,oBAAoB,uBAClB,SACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,UACG,IAAI,WAAW,QAAQ,CAAC,CACxB,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxD,GACA,aACF,EACF,IACA,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD,CACF;CAEF,MAAM,uCACJ,UACA,QACA,eACA,UAMA,OAAO,QAAQ,gBAAgB,QAAQ,gBAAgB,aAAa,IAAI,YACtE,OAAO,QAAQ,iBAAiB,UAC9B,2BACE,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,cACC,qBACE,SACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,UACG,IAAI,WAAW,QAAQ,CAAC,CACxB,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxD,GACA,aACF,GACF,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD,CACF;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}
+{"version":3,"file":"target.mjs","names":[],"sources":["../../../src/internal/passkey/target.ts"],"sourcesContent":["import { type PreparedCommit, LifecycleHooks } from \"@yielded/auth/Hooks\";\n/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\nimport {\n  PasskeyConfigurationError,\n  type PasskeyUnavailable,\n  type PasskeyCredentials,\n  type PasskeyEnrollmentContext,\n  type PasskeyPersistence,\n  type PreparePasskeyCommit,\n  PasskeyAccess,\n  PasskeyAssertionVerified,\n  PasskeyCeremony,\n  PasskeyClaim,\n  PasskeyClaimDecision,\n  PasskeyCleanupResult,\n  PasskeyCredential,\n  PasskeyEnrollmentSnapshot,\n  PasskeyEvidence,\n  PasskeyInstant,\n  PasskeyIssueDecision,\n  PasskeyModuleId,\n  PasskeyProfile,\n  PasskeyProtocolCredentialId,\n  PasskeySettlement,\n  PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport { SubjectId } from \"@yielded/auth/Schema\";\nimport { Effect, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"../mapping-error\";\nimport type {\n  PasskeyCredentialServices,\n  PasskeyEnrollmentContextServices,\n  PasskeyMappingSource,\n  PasskeyPersistenceServices,\n} from \"../models/passkey-model\";\nimport type { PasskeyRegistrationCeremonyServices } from \"../models/passkey-registration-ceremony-model\";\nimport type {\n  TransactionCoordinatorError,\n  TransactionExecution,\n  TransactionTargetConfiguration,\n  makeTransactionExecutionKernel,\n} from \"../transaction-execution-kernel\";\nimport type { NativeDatabase } from \"../transaction-kernel\";\nimport type { makePasskeyCredentialsKernel } from \"./credentials\";\nimport type { makePasskeyFlowKernel } from \"./flow\";\nimport type { makePasskeyRegistrationCeremonyKernel } from \"./registration-ceremony\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport type PasskeyTargetConfiguration = TransactionTargetConfiguration<PasskeyUnavailable>;\n\nexport type PasskeyCoordinatorError<E> =\n  | TransactionCoordinatorError<E, PasskeyUnavailable>\n  | PasskeyConfigurationError\n  | PersistenceMappingError;\n\nexport type PasskeyExecution = TransactionExecution<\n  PasskeyUnavailable,\n  CurrentPasskeyTransaction,\n  never\n>;\n\nexport const makePasskeyTargetKernel = (\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"captureEnrollmentContext\" | \"lookupCredential\"\n  >,\n  flow: Pick<\n    ReturnType<typeof makePasskeyFlowKernel>,\n    | \"assertionPurposes\"\n    | \"claimAssertion\"\n    | \"cleanupCeremonies\"\n    | \"contextAssertion\"\n    | \"issueAssertion\"\n    | \"settleAssertion\"\n  >,\n  registrationCeremony: Pick<\n    ReturnType<typeof makePasskeyRegistrationCeremonyKernel>,\n    \"claimRegistration\" | \"contextRegistration\" | \"settleRegistration\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    \"captureMapping\" | \"invariant\" | \"nonce\" | \"unavailable\" | \"validateMapping\"\n  >,\n  execution: Pick<\n    ReturnType<typeof makeTransactionExecutionKernel>,\n    | \"coordinateTransactionOwner\"\n    | \"makeTransactionExecution\"\n    | \"sqlClientTransactionStandaloneGuard\"\n  >,\n) => {\n  const { captureEnrollmentContext, lookupCredential } = credentials;\n\n  const {\n    assertionPurposes,\n    claimAssertion,\n    cleanupCeremonies,\n    contextAssertion,\n    issueAssertion,\n    settleAssertion,\n  } = flow;\n\n  const { claimRegistration, contextRegistration, settleRegistration } = registrationCeremony;\n  const { captureMapping, nonce, unavailable, validateMapping } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    coordinateTransactionOwner,\n    makeTransactionExecution,\n    sqlClientTransactionStandaloneGuard,\n  } = execution;\n\n  const sqlClientPasskeyStandaloneGuard = (\n    transactionService: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n  ) => sqlClientTransactionStandaloneGuard(unavailable, transactionService);\n\n  const emptyHooks: LifecycleHooks[\"Service\"] = {\n    before: () => Effect.void,\n    after: () => Effect.succeed([]),\n  };\n\n  const makePasskeyExecution = Effect.fnUntraced(function* (\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.fn.Return<PasskeyExecution, never, LifecycleHooks | NativeDatabase> {\n    const hooks = yield* LifecycleHooks;\n\n    const execution = yield* makeTransactionExecution(\n      CurrentPasskeyTransaction,\n      configuration,\n      unavailable,\n      nonce,\n    );\n\n    return {\n      ...execution,\n      run: (operation, mutation) =>\n        execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    };\n  });\n\n  const issueInput = Schema.Struct({ ceremony: PasskeyCeremony, policy: PasskeyMethodPolicy });\n\n  const claimInput = Schema.Struct({\n    access: PasskeyAccess,\n    policy: PasskeyMethodPolicy,\n    ceremony: PasskeyCeremony,\n    claimId: PasskeyClaim.fields.claimId,\n    credential: Schema.optionalKey(PasskeyCredential),\n  });\n\n  const settleInput = Schema.Struct({\n    claim: PasskeyClaim,\n    nowMillis: PasskeyInstant,\n    outcome: Schema.Union([\n      Schema.TaggedStruct(\"Rejected\", {}),\n      Schema.TaggedStruct(\"Ambiguous\", {}),\n      Schema.TaggedStruct(\"Assertion\", {\n        credential: PasskeyCredential,\n        assertion: PasskeyAssertionVerified,\n        evidence: PasskeyEvidence,\n      }),\n    ]),\n  });\n\n  const cleanupInput = Schema.Struct({\n    moduleId: PasskeyModuleId,\n    nowMillis: PasskeyInstant,\n    limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n  });\n\n  const lookupInput = Schema.Struct({\n    rpId: PasskeyProfile.fields.rpId,\n    protocolCredentialId: PasskeyProtocolCredentialId,\n  });\n\n  const contextInput = Schema.Struct({\n    moduleId: PasskeyModuleId,\n    rpId: PasskeyProfile.fields.rpId,\n    subjectId: SubjectId,\n  });\n\n  const inputs = {\n    issue: issueInput,\n    context: PasskeyAccess,\n    claim: claimInput,\n    settle: settleInput,\n    cleanup: cleanupInput,\n  };\n\n  const capturedService = <S>(\n    service: S,\n    schemas: Record<string, Schema.Codec<any, any, never, never>>,\n    execute: PasskeyExecution,\n  ): S =>\n    Object.freeze(\n      Object.fromEntries(\n        Object.entries(\n          service as Record<string, (...args: any[]) => Effect.Effect<any, PasskeyUnavailable>>,\n        ).map(([name, method]) => [\n          name,\n          (original: any, prepare?: any) =>\n            Effect.suspend(() => {\n              invariant(execute.active());\n              const input = snapshotPasskeySync(schemas[name]!, original);\n\n              return method(input, prepare);\n            }).pipe(\n              Effect.onExit((exit) =>\n                Effect.sync(() => {\n                  if (exit._tag === \"Failure\") execute.poison();\n                }),\n              ),\n              Effect.catchDefect(() => Effect.fail(unavailable())),\n            ),\n        ]),\n      ),\n    ) as S;\n\n  const prepareValue = <Value, A>(\n    value: Value,\n    prepare: PreparePasskeyCommit<Value, A>,\n  ): Effect.Effect<PreparedCommit<A>, never, CurrentPasskeyTransaction> =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      Effect.sync(() => {\n        owner.guards.push(owner.journal.prepare(undefined));\n        const receipt = prepare(value, owner.journal);\n\n        invariant(\n          receipt !== null &&\n            typeof receipt === \"object\" &&\n            receipt._tag === \"PreparedCommit\" &&\n            typeof receipt.read === \"object\" &&\n            Effect.isEffect(receipt.read),\n        );\n        owner.guards.push(receipt);\n\n        return receipt;\n      }),\n    );\n\n  const requirePurpose = (purpose: string, registration: boolean, enrollment = false) =>\n    invariant(\n      enrollment\n        ? purpose === \"enrollment\"\n        : registration\n          ? purpose === \"registration\"\n          : assertionPurposes.some((supported) => supported === purpose),\n    );\n\n  /** Context is advisory. Retain observations and final predicates without taking\n   * later-ranked locks before a subsequent mutation acquires its full lock set. */\n  const observationalContext = <A, E, R>(operation: Effect.Effect<A, E, R>) =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      operation.pipe(\n        Effect.provideService(CurrentPasskeyTransaction, {\n          ...owner,\n          read: (table, where, options) => owner.read(table, where, { ...options, lock: false }),\n        }),\n      ),\n    );\n\n  const makePasskeyPersistence = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n    registration = false,\n    enrollment = false,\n  ): PasskeyPersistence[\"Service\"] =>\n    capturedService<PasskeyPersistence[\"Service\"]>(\n      {\n        issue: (input, prepare) =>\n          Effect.suspend(() => {\n            invariant(!registration && !enrollment);\n            requirePurpose(input.ceremony.purpose, false);\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* issueAssertion(mapping, input.ceremony, input.policy);\n\n                return yield* prepareValue(\n                  snapshotPasskeySync(PasskeyIssueDecision, value),\n                  prepare,\n                );\n              }),\n            );\n          }),\n        context: (access) =>\n          Effect.suspend(() => {\n            requirePurpose(access.purpose, registration, enrollment);\n\n            return execute.run(\n              observationalContext(\n                registration\n                  ? contextRegistration(mapping, access)\n                  : contextAssertion(mapping, access),\n              ),\n              false,\n            );\n          }),\n        claim: (input, prepare) =>\n          Effect.suspend(() => {\n            requirePurpose(input.access.purpose, registration, enrollment);\n            requirePurpose(input.ceremony.purpose, registration, enrollment);\n            invariant((!registration && !enrollment) || input.credential === undefined);\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* registration\n                  ? claimRegistration(mapping, input)\n                  : claimAssertion(mapping, input);\n\n                return yield* prepareValue(\n                  snapshotPasskeySync(PasskeyClaimDecision, value),\n                  prepare,\n                );\n              }),\n            );\n          }),\n        settle: (input, prepare) =>\n          Effect.suspend(() => {\n            requirePurpose(input.claim.ceremony.purpose, registration, enrollment);\n            invariant((!registration && !enrollment) || input.outcome._tag !== \"Assertion\");\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* registration\n                  ? settleRegistration(\n                      mapping,\n                      input.claim,\n                      input.outcome._tag as \"Rejected\" | \"Ambiguous\",\n                    )\n                  : settleAssertion(mapping, input.claim, input.outcome, configuration.dialect);\n\n                return yield* prepareValue(snapshotPasskeySync(PasskeySettlement, value), prepare);\n              }),\n            );\n          }),\n        cleanup: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const value = yield* cleanupCeremonies(\n                mapping,\n                input,\n                registration ? [\"registration\"] : enrollment ? [\"enrollment\"] : assertionPurposes,\n              );\n\n              return yield* prepareValue(snapshotPasskeySync(PasskeyCleanupResult, value), prepare);\n            }),\n          ),\n      },\n      inputs,\n      execute,\n    );\n\n  const credentialService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyCredentials[\"Service\"] =>\n    capturedService<PasskeyCredentials[\"Service\"]>(\n      {\n        lookup: (input) =>\n          execute.run(lookupCredential(mapping, input.rpId, input.protocolCredentialId), false),\n      },\n      { lookup: lookupInput },\n      execute,\n    );\n\n  const enrollmentService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyEnrollmentContext[\"Service\"] =>\n    capturedService<PasskeyEnrollmentContext[\"Service\"]>(\n      {\n        capture: (input) =>\n          execute.run(\n            Effect.map(captureEnrollmentContext(mapping, input), (value) =>\n              value === undefined\n                ? undefined\n                : snapshotPasskeySync(PasskeyEnrollmentSnapshot, value),\n            ),\n            false,\n          ),\n      },\n      { capture: contextInput },\n      execute,\n    );\n\n  const registrationServices = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyRegistrationCeremonyServices => ({\n    capabilities: Object.freeze({\n      purposes: Object.freeze([\"registration\"] as const),\n      issue: \"registration-authority\",\n      assertionSettlement: false,\n    }),\n    passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true),\n  });\n\n  const capturedMapping = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    kind: \"read\" | \"context\" | \"assertion\" | \"registration\",\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<M, PasskeyConfigurationError | PersistenceMappingError, RSetup> =>\n    Effect.flatMap(Effect.isEffect(source) ? source : Effect.succeed(source), (mapping) =>\n      Effect.try({\n        try: () => {\n          const captured = captureMapping(mapping);\n\n          validateMapping(captured, kind);\n          if (configuration.mode === \"batch\") invariant((captured as any).d1?.primary === true);\n\n          return captured;\n        },\n        catch: () => PasskeyConfigurationError.make({}),\n      }),\n    );\n\n  const makeTargetPasskeyCredentials = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyCredentialServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | NativeDatabase\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"read\", configuration);\n\n      const execution = yield* makePasskeyExecution(configuration).pipe(\n        Effect.provideService(LifecycleHooks, emptyHooks),\n      );\n\n      return { passkeyCredentials: credentialService(mapping, execution) };\n    });\n\n  const makeTargetPasskeyEnrollmentContext = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyEnrollmentContextServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | NativeDatabase\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"context\", configuration);\n\n      const execution = yield* makePasskeyExecution(configuration).pipe(\n        Effect.provideService(LifecycleHooks, emptyHooks),\n      );\n\n      return { passkeyEnrollmentContext: enrollmentService(mapping, execution) };\n    });\n\n  const makeTargetPasskeyPersistence = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyPersistenceServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | LifecycleHooks | NativeDatabase\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"assertion\", configuration);\n      const execution = yield* makePasskeyExecution(configuration);\n\n      return {\n        passkeyPersistence: makePasskeyPersistence(mapping, execution, configuration),\n      };\n    });\n\n  const makeTargetPasskeyRegistration = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyRegistrationCeremonyServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | LifecycleHooks | NativeDatabase\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"registration\", configuration);\n      const execution = yield* makePasskeyExecution(configuration);\n\n      return registrationServices(mapping, execution, configuration);\n    });\n\n  const coordinateTargetPasskey = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: PasskeyPersistenceServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n    Effect.flatMap(capturedMapping(source, \"assertion\", configuration), (mapping) =>\n      Effect.flatMap(LifecycleHooks, (hooks) =>\n        coordinateTransactionOwner(\n          database,\n          CurrentPasskeyTransaction,\n          configuration,\n          Effect.void,\n          unavailable,\n          nonce,\n          (execution) => ({\n            passkeyPersistence: makePasskeyPersistence(\n              mapping,\n              {\n                ...execution,\n                run: (operation, mutation) =>\n                  execution\n                    .run(operation, mutation)\n                    .pipe(Effect.provideService(LifecycleHooks, hooks)),\n              },\n              configuration,\n            ),\n          }),\n          owner,\n        ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      ),\n    );\n\n  const coordinateTargetPasskeyRegistration = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: PasskeyRegistrationCeremonyServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n    Effect.flatMap(capturedMapping(source, \"registration\", configuration), (mapping) =>\n      Effect.flatMap(LifecycleHooks, (hooks) =>\n        coordinateTransactionOwner(\n          database,\n          CurrentPasskeyTransaction,\n          configuration,\n          Effect.void,\n          unavailable,\n          nonce,\n          (execution) =>\n            registrationServices(\n              mapping,\n              {\n                ...execution,\n                run: (operation, mutation) =>\n                  execution\n                    .run(operation, mutation)\n                    .pipe(Effect.provideService(LifecycleHooks, hooks)),\n              },\n              configuration,\n            ),\n          owner,\n        ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      ),\n    );\n\n  return {\n    sqlClientPasskeyStandaloneGuard,\n    makePasskeyExecution,\n    capturedService,\n    prepareValue,\n    observationalContext,\n    makePasskeyPersistence,\n    capturedMapping,\n    makeTargetPasskeyCredentials,\n    makeTargetPasskeyEnrollmentContext,\n    makeTargetPasskeyPersistence,\n    makeTargetPasskeyRegistration,\n    coordinateTargetPasskey,\n    coordinateTargetPasskeyRegistration,\n  };\n};\n"],"mappings":";;;;;;AAiEA,MAAa,2BACX,aAIA,MASA,sBAIA,OAIA,cAMG;CACH,MAAM,EAAE,0BAA0B,qBAAqB;CAEvD,MAAM,EACJ,mBACA,gBACA,mBACA,kBACA,gBACA,oBACE;CAEJ,MAAM,EAAE,mBAAmB,qBAAqB,uBAAuB;CACvE,MAAM,EAAE,gBAAgB,OAAO,aAAa,oBAAoB;CAChE,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,4BACA,0BACA,wCACE;CAEJ,MAAM,mCACJ,uBACG,oCAAoC,aAAa,kBAAkB;CAExE,MAAM,aAAwC;EAC5C,cAAc,OAAO;EACrB,aAAa,OAAO,QAAQ,CAAC,CAAC;CAChC;CAEA,MAAM,uBAAuB,OAAO,WAAW,WAC7C,eAC4E;EAC5E,MAAM,QAAQ,OAAO;EAErB,MAAM,YAAY,OAAO,yBACvB,2BACA,eACA,aACA,KACF;EAEA,OAAO;GACL,GAAG;GACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACxF;CACF,CAAC;CAED,MAAM,aAAa,OAAO,OAAO;EAAE,UAAU;EAAiB,QAAQ;CAAoB,CAAC;CAE3F,MAAM,aAAa,OAAO,OAAO;EAC/B,QAAQ;EACR,QAAQ;EACR,UAAU;EACV,SAAS,aAAa,OAAO;EAC7B,YAAY,OAAO,YAAY,iBAAiB;CAClD,CAAC;CAED,MAAM,cAAc,OAAO,OAAO;EAChC,OAAO;EACP,WAAW;EACX,SAAS,OAAO,MAAM;GACpB,OAAO,aAAa,YAAY,CAAC,CAAC;GAClC,OAAO,aAAa,aAAa,CAAC,CAAC;GACnC,OAAO,aAAa,aAAa;IAC/B,YAAY;IACZ,WAAW;IACX,UAAU;GACZ,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,eAAe,OAAO,OAAO;EACjC,UAAU;EACV,WAAW;EACX,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAK,CAAC,CAAC;CACzE,CAAC;CAED,MAAM,cAAc,OAAO,OAAO;EAChC,MAAM,eAAe,OAAO;EAC5B,sBAAsB;CACxB,CAAC;CAED,MAAM,eAAe,OAAO,OAAO;EACjC,UAAU;EACV,MAAM,eAAe,OAAO;EAC5B,WAAW;CACb,CAAC;CAED,MAAM,SAAS;EACb,OAAO;EACP,SAAS;EACT,OAAO;EACP,QAAQ;EACR,SAAS;CACX;CAEA,MAAM,mBACJ,SACA,SACA,YAEA,OAAO,OACL,OAAO,YACL,OAAO,QACL,OACF,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CACxB,OACC,UAAe,YACd,OAAO,cAAc;EACnB,UAAU,QAAQ,OAAO,CAAC;EAG1B,OAAO,OAFO,oBAAoB,QAAQ,OAAQ,QAEhC,GAAG,OAAO;CAC9B,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;EAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;CAC9C,CAAC,CACH,GACA,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD,CACJ,CAAC,CACH,CACF;CAEF,MAAM,gBACJ,OACA,YAEA,OAAO,QAAQ,4BAA4B,UACzC,OAAO,WAAW;EAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;EAClD,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO;EAE5C,UACE,YAAY,QACV,OAAO,YAAY,YACnB,QAAQ,SAAS,oBACjB,OAAO,QAAQ,SAAS,YACxB,OAAO,SAAS,QAAQ,IAAI,CAChC;EACA,MAAM,OAAO,KAAK,OAAO;EAEzB,OAAO;CACT,CAAC,CACH;CAEF,MAAM,kBAAkB,SAAiB,cAAuB,aAAa,UAC3E,UACE,aACI,YAAY,eACZ,eACE,YAAY,iBACZ,kBAAkB,MAAM,cAAc,cAAc,OAAO,CACnE;;;CAIF,MAAM,wBAAiC,cACrC,OAAO,QAAQ,4BAA4B,UACzC,UAAU,KACR,OAAO,eAAe,2BAA2B;EAC/C,GAAG;EACH,OAAO,OAAO,OAAO,YAAY,MAAM,KAAK,OAAO,OAAO;GAAE,GAAG;GAAS,MAAM;EAAM,CAAC;CACvF,CAAC,CACH,CACF;CAEF,MAAM,0BACJ,SACA,SACA,eACA,eAAe,OACf,aAAa,UAEb,gBACE;EACE,QAAQ,OAAO,YACb,OAAO,cAAc;GACnB,UAAU,CAAC,gBAAgB,CAAC,UAAU;GACtC,eAAe,MAAM,SAAS,SAAS,KAAK;GAE5C,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,MAAM;IAEzE,OAAO,OAAO,aACZ,oBAAoB,sBAAsB,KAAK,GAC/C,OACF;GACF,CAAC,CACH;EACF,CAAC;EACH,UAAU,WACR,OAAO,cAAc;GACnB,eAAe,OAAO,SAAS,cAAc,UAAU;GAEvD,OAAO,QAAQ,IACb,qBACE,eACI,oBAAoB,SAAS,MAAM,IACnC,iBAAiB,SAAS,MAAM,CACtC,GACA,KACF;EACF,CAAC;EACH,QAAQ,OAAO,YACb,OAAO,cAAc;GACnB,eAAe,MAAM,OAAO,SAAS,cAAc,UAAU;GAC7D,eAAe,MAAM,SAAS,SAAS,cAAc,UAAU;GAC/D,UAAW,CAAC,gBAAgB,CAAC,cAAe,MAAM,eAAe,KAAA,CAAS;GAE1E,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eACjB,kBAAkB,SAAS,KAAK,IAChC,eAAe,SAAS,KAAK;IAEjC,OAAO,OAAO,aACZ,oBAAoB,sBAAsB,KAAK,GAC/C,OACF;GACF,CAAC,CACH;EACF,CAAC;EACH,SAAS,OAAO,YACd,OAAO,cAAc;GACnB,eAAe,MAAM,MAAM,SAAS,SAAS,cAAc,UAAU;GACrE,UAAW,CAAC,gBAAgB,CAAC,cAAe,MAAM,QAAQ,SAAS,WAAW;GAE9E,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eACjB,mBACE,SACA,MAAM,OACN,MAAM,QAAQ,IAChB,IACA,gBAAgB,SAAS,MAAM,OAAO,MAAM,SAAS,cAAc,OAAO;IAE9E,OAAO,OAAO,aAAa,oBAAoB,mBAAmB,KAAK,GAAG,OAAO;GACnF,CAAC,CACH;EACF,CAAC;EACH,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,kBACnB,SACA,OACA,eAAe,CAAC,cAAc,IAAI,aAAa,CAAC,YAAY,IAAI,iBAClE;GAEA,OAAO,OAAO,aAAa,oBAAoB,sBAAsB,KAAK,GAAG,OAAO;EACtF,CAAC,CACH;CACJ,GACA,QACA,OACF;CAEF,MAAM,qBACJ,SACA,YAEA,gBACE,EACE,SAAS,UACP,QAAQ,IAAI,iBAAiB,SAAS,MAAM,MAAM,MAAM,oBAAoB,GAAG,KAAK,EACxF,GACA,EAAE,QAAQ,YAAY,GACtB,OACF;CAEF,MAAM,qBACJ,SACA,YAEA,gBACE,EACE,UAAU,UACR,QAAQ,IACN,OAAO,IAAI,yBAAyB,SAAS,KAAK,IAAI,UACpD,UAAU,KAAA,IACN,KAAA,IACA,oBAAoB,2BAA2B,KAAK,CAC1D,GACA,KACF,EACJ,GACA,EAAE,SAAS,aAAa,GACxB,OACF;CAEF,MAAM,wBACJ,SACA,SACA,mBACyC;EACzC,cAAc,OAAO,OAAO;GAC1B,UAAU,OAAO,OAAO,CAAC,cAAc,CAAU;GACjD,OAAO;GACP,qBAAqB;EACvB,CAAC;EACD,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,IAAI;CAClF;CAEA,MAAM,mBACJ,QACA,MACA,kBAEA,OAAO,QAAQ,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM,IAAI,YACzE,OAAO,IAAI;EACT,WAAW;GACT,MAAM,WAAW,eAAe,OAAO;GAEvC,gBAAgB,UAAU,IAAI;GAC9B,IAAI,cAAc,SAAS,SAAS,UAAW,SAAiB,IAAI,YAAY,IAAI;GAEpF,OAAO;EACT;EACA,aAAa,0BAA0B,KAAK,CAAC,CAAC;CAChD,CAAC,CACH;CAEF,MAAM,gCACJ,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,QAAQ,aAAa;EAEpE,MAAM,YAAY,OAAO,qBAAqB,aAAa,CAAC,CAAC,KAC3D,OAAO,eAAe,gBAAgB,UAAU,CAClD;EAEA,OAAO,EAAE,oBAAoB,kBAAkB,SAAS,SAAS,EAAE;CACrE,CAAC;CAEH,MAAM,sCACJ,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,WAAW,aAAa;EAEvE,MAAM,YAAY,OAAO,qBAAqB,aAAa,CAAC,CAAC,KAC3D,OAAO,eAAe,gBAAgB,UAAU,CAClD;EAEA,OAAO,EAAE,0BAA0B,kBAAkB,SAAS,SAAS,EAAE;CAC3E,CAAC;CAEH,MAAM,gCACJ,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,aAAa,aAAa;EACzE,MAAM,YAAY,OAAO,qBAAqB,aAAa;EAE3D,OAAO,EACL,oBAAoB,uBAAuB,SAAS,WAAW,aAAa,EAC9E;CACF,CAAC;CAEH,MAAM,iCACJ,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,gBAAgB,aAAa;EAC5E,MAAM,YAAY,OAAO,qBAAqB,aAAa;EAE3D,OAAO,qBAAqB,SAAS,WAAW,aAAa;CAC/D,CAAC;CAEH,MAAM,2BACJ,UACA,QACA,eACA,UAMA,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,aAAa,IAAI,YACnE,OAAO,QAAQ,iBAAiB,UAC9B,2BACE,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,eAAe,EACd,oBAAoB,uBAClB,SACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,UACG,IAAI,WAAW,QAAQ,CAAC,CACxB,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxD,GACA,aACF,EACF,IACA,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD,CACF;CAEF,MAAM,uCACJ,UACA,QACA,eACA,UAMA,OAAO,QAAQ,gBAAgB,QAAQ,gBAAgB,aAAa,IAAI,YACtE,OAAO,QAAQ,iBAAiB,UAC9B,2BACE,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,cACC,qBACE,SACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,UACG,IAAI,WAAW,QAAQ,CAAC,CACxB,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxD,GACA,aACF,GACF,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD,CACF;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/internal/passkey/write-target.mjs

@@ -152,15 +152,15 @@ const makePasskeyWriteTargetKernel = (operations, enrollment, management, regist
 		passkeyRegistrationAuthority: registrationService(mapping, execute),
 		passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true)
 	});
-	const makeTargetPasskeyManagement = (database, source, configuration) => Effect.gen(function* () {
+	const makeTargetPasskeyManagement = (source, configuration) => Effect.gen(function* () {
 		const mapping = yield* writeMapping(source, configuration, false);
-		const hooks = yield* LifecycleHooks;
-		return managementServices(mapping, makePasskeyExecution(database, hooks, configuration), configuration);
+		const execution = yield* makePasskeyExecution(configuration);
+		return managementServices(mapping, execution, configuration);
 	});
-	const makeTargetPasskeyRegistrationWriter = (database, source, configuration) => Effect.gen(function* () {
+	const makeTargetPasskeyRegistrationWriter = (source, configuration) => Effect.gen(function* () {
 		const mapping = yield* writeMapping(source, configuration, true);
-		const hooks = yield* LifecycleHooks;
-		return registrationServices(mapping, makePasskeyExecution(database, hooks, configuration), configuration);
+		const execution = yield* makePasskeyExecution(configuration);
+		return registrationServices(mapping, execution, configuration);
 	});
 	const coordinateTargetPasskeyManagement = (database, source, configuration, body) => Effect.gen(function* () {
 		const mapping = yield* writeMapping(source, configuration, false);

package/dist/internal/passkey/write-target.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"write-target.mjs","names":[],"sources":["../../../src/internal/passkey/write-target.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  PasskeyConfigurationError,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport * as M from \"@yielded/auth/Passkey\";\nimport { SubjectId } from \"@yielded/auth/Schema\";\nimport { SessionInvalidationWindow } from \"@yielded/auth/Sessions\";\nimport { Effect, Layer, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PasskeyMappingSource } from \"../models/passkey-model\";\nimport type {\n  PasskeyManagementServices,\n  PasskeyRegistrationServices,\n  PasskeyRegistrationWriter,\n} from \"../models/passkey-write-model\";\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionExecutionKernel } from \"../transaction-execution-kernel\";\nimport type { makePasskeyEnrollmentKernel } from \"./enrollment\";\nimport type { makePasskeyManagementKernel } from \"./management\";\nimport type { makePasskeyRegistrationWriteKernel } from \"./registration-write\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\nimport type {\n  PasskeyExecution,\n  PasskeyCoordinatorError,\n  PasskeyTargetConfiguration,\n  makePasskeyTargetKernel,\n} from \"./target\";\n\nexport const makePasskeyWriteTargetKernel = (\n  operations: QueryOperations,\n  enrollment: Pick<\n    ReturnType<typeof makePasskeyEnrollmentKernel>,\n    \"completeEnrollment\" | \"issueEnrollment\"\n  >,\n  management: Pick<\n    ReturnType<typeof makePasskeyManagementKernel>,\n    \"inspectRemove\" | \"listCredentials\" | \"removeCredential\" | \"renameCredential\"\n  >,\n  registrationWrite: Pick<\n    ReturnType<typeof makePasskeyRegistrationWriteKernel>,\n    \"completeRegistration\" | \"inspectRegistration\" | \"issueRegistration\"\n  >,\n  state: Pick<ReturnType<typeof makePasskeyStateKernel>, \"invariant\" | \"nonce\" | \"unavailable\">,\n  target: Pick<\n    ReturnType<typeof makePasskeyTargetKernel>,\n    | \"capturedMapping\"\n    | \"capturedService\"\n    | \"makePasskeyExecution\"\n    | \"makePasskeyPersistence\"\n    | \"observationalContext\"\n    | \"prepareValue\"\n  >,\n  execution: Pick<ReturnType<typeof makeTransactionExecutionKernel>, \"coordinateTransactionOwner\">,\n) => {\n  const { getTableColumns } = operations;\n  const { completeEnrollment, issueEnrollment } = enrollment;\n  const { inspectRemove, listCredentials, removeCredential, renameCredential } = management;\n  const { completeRegistration, inspectRegistration, issueRegistration } = registrationWrite;\n  const { nonce, unavailable } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    capturedMapping,\n    capturedService,\n    makePasskeyExecution,\n    makePasskeyPersistence,\n    observationalContext,\n    prepareValue,\n  } = target;\n\n  const { coordinateTransactionOwner } = execution;\n\n  const passkeyManagementPersistenceLayer = <E, R>(\n    services: Effect.Effect<PasskeyManagementServices, E, R>,\n  ) =>\n    Layer.effect(\n      PasskeyManagementPersistence,\n      Effect.map(services, (value) => value.passkeyManagementPersistence),\n    );\n\n  const issueSchema = Schema.Struct({\n    ceremony: M.PasskeyCeremony,\n    policy: PasskeyMethodPolicy,\n    management: PasskeyManagementPolicy,\n    authorization: M.PasskeyActionAuthorization,\n  });\n\n  const completeSchema = Schema.Struct({\n    claim: M.PasskeyClaim,\n    verified: M.PasskeyRegistrationVerified,\n    authorization: M.PasskeyActionAuthorization,\n    management: PasskeyManagementPolicy,\n    nowMillis: M.PasskeyInstant,\n  });\n\n  const metadata = { moduleId: M.PasskeyModuleId, subjectId: SubjectId };\n\n  const identity = {\n    ...metadata,\n    commandId: M.PasskeyCommandId,\n    credentialId: M.PasskeyCredentialId,\n  };\n\n  const retention = { nowMillis: M.PasskeyInstant, retentionUntilMillis: M.PasskeyInstant };\n\n  const managementSchemas = {\n    list: Schema.Struct({\n      ...metadata,\n      cursor: Schema.optionalKey(M.PasskeyCredentialId),\n      limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 64 })),\n    }),\n    issueEnrollment: issueSchema,\n    completeEnrollment: completeSchema,\n    inspectRemove: Schema.Struct(identity),\n    rename: Schema.Struct({ ...identity, ...retention, name: M.PasskeyLabel }),\n    remove: Schema.Struct({\n      moduleId: M.PasskeyModuleId,\n      commandId: M.PasskeyCommandId,\n      credential: M.PasskeyCredential,\n      authorization: M.PasskeyActionAuthorization,\n      management: PasskeyManagementPolicy,\n      invalidation: SessionInvalidationWindow,\n      ...retention,\n    }),\n  };\n\n  const enrolled = Schema.Union([\n    Schema.TaggedStruct(\"Enrolled\", { credential: M.PasskeyCredentialSummary }),\n    Schema.TaggedStruct(\"Rejected\", {}),\n  ]);\n\n  const renamed = Schema.Union([\n    Schema.TaggedStruct(\"Renamed\", {\n      credential: M.PasskeyCredentialSummary,\n      replayed: Schema.Boolean,\n    }),\n    Schema.TaggedStruct(\"Rejected\", {}),\n  ]);\n\n  const removed = Schema.Union([\n    Schema.TaggedStruct(\"Removed\", { result: M.PasskeyRemoved }),\n    Schema.TaggedStruct(\"Rejected\", {}),\n    Schema.TaggedStruct(\"LastSignInMethod\", {}),\n  ]);\n\n  const registrationDecision = Schema.Union([\n    M.PasskeyRegistrationResult,\n    Schema.TaggedStruct(\"Rejected\", {}),\n  ]);\n\n  const managementService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyManagementPersistence[\"Service\"] =>\n    capturedService<PasskeyManagementPersistence[\"Service\"]>(\n      {\n        list: (input) => execute.run(observationalContext(listCredentials(mapping, input)), false),\n        inspectRemove: (input) =>\n          execute.run(observationalContext(inspectRemove(mapping, input)), false),\n        issueEnrollment: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(M.PasskeyIssueDecision, yield* issueEnrollment(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n        completeEnrollment: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(enrolled, yield* completeEnrollment(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n        rename: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(renamed, yield* renameCredential(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n        remove: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(removed, yield* removeCredential(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n      },\n      managementSchemas,\n      execute,\n    );\n\n  const registrationService = <R>(\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyRegistrationWriter<R> =>\n    capturedService<PasskeyRegistrationWriter<R>>(\n      {\n        inspect: (registration) =>\n          execute.run(observationalContext(inspectRegistration(mapping, registration)), false),\n        issueRegistration: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(\n                  M.PasskeyIssueDecision,\n                  yield* issueRegistration(mapping, input),\n                ),\n                prepare,\n              );\n            }),\n          ),\n        completeRegistration: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(\n                  registrationDecision,\n                  yield* completeRegistration(mapping, input),\n                ),\n                prepare,\n              );\n            }),\n          ),\n      },\n      {\n        inspect: Schema.toType(mapping.registration.schema),\n        issueRegistration: Schema.Struct({\n          ceremony: M.PasskeyCeremony,\n          policy: PasskeyMethodPolicy,\n          registration: Schema.toType(mapping.registration.schema),\n        }),\n        completeRegistration: Schema.Struct({\n          claim: M.PasskeyClaim,\n          verified: M.PasskeyRegistrationVerified,\n          nowMillis: M.PasskeyInstant,\n        }),\n      },\n      execute,\n    );\n\n  const descriptor = (table: any) => {\n    const columns = getTableColumns(table.table);\n\n    for (const [field, name] of Object.entries(table))\n      if (typeof name === \"string\" && !field.endsWith(\"State\"))\n        invariant(columns[name] !== undefined);\n  };\n\n  const writeMapping = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    registration: boolean,\n  ) =>\n    Effect.flatMap(capturedMapping(source, \"assertion\", configuration), (mapping) =>\n      Effect.try({\n        try: () => {\n          const m = mapping as any;\n\n          for (const name of [m.write.credential.name, m.write.credential.createdAt])\n            invariant(getTableColumns(m.read.credential.table)[name] !== undefined);\n          for (const name of m.write.policy.subjectColumns)\n            invariant(getTableColumns(m.read.subject.table)[name] !== undefined);\n          invariant(\n            m.write.credential.activeStatus !== m.write.credential.removedStatus &&\n              m.write.authority.activeStatus !== m.write.authority.removedStatus &&\n              m.write.credentialOwnership.ownedState !== m.write.credentialOwnership.removedState,\n          );\n          invariant(\n            m.read.credential.isActiveStatus(m.write.credential.activeStatus) &&\n              !m.read.credential.isActiveStatus(m.write.credential.removedStatus) &&\n              m.read.authority.isActiveStatus(m.write.authority.activeStatus) &&\n              !m.read.authority.isActiveStatus(m.write.authority.removedStatus) &&\n              m.read.credentialOwnership.isOwnedState(m.write.credentialOwnership.ownedState) &&\n              !m.read.credentialOwnership.isOwnedState(m.write.credentialOwnership.removedState) &&\n              m.read.handleOwnership.isOwnedState(m.write.handleOwnership.ownedState),\n          );\n          if (registration) {\n            descriptor(m.intent);\n            descriptor(m.handle);\n            invariant(m.handle.table === m.read.handleOwnership.table);\n            invariant(\n              m.handle.reservedState !== m.write.handleOwnership.ownedState &&\n                m.intent.pendingState !== m.intent.acceptedState &&\n                m.intent.rejectedState !== m.intent.pendingState &&\n                m.intent.rejectedState !== m.intent.acceptedState,\n            );\n            invariant(\n              m.registrationConstraints.intentFlow.join(\"/\") === \"moduleId/flowId\" &&\n                m.registrationConstraints.intentCommand.join(\"/\") === \"moduleId/commandId\" &&\n                m.registrationConstraints.handle.join(\"/\") === \"handleKey\",\n            );\n          } else {\n            descriptor(m.command);\n            invariant(m.managementConstraints.command.join(\"/\") === \"moduleId/commandId\");\n            snapshotPasskeySync(SessionInvalidationWindow, m.invalidation.window);\n            invariant(\n              m.invalidation.window.trigger === \"credential-change\" &&\n                m.invalidation.mutations.length <= 32,\n            );\n          }\n\n          return mapping;\n        },\n        catch: () => PasskeyConfigurationError.make({}),\n      }),\n    );\n\n  const managementServices = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyManagementServices => ({\n    passkeyManagementPersistence: managementService(mapping, execute),\n    passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, false, true),\n  });\n\n  const registrationServices = <R>(\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyRegistrationServices<R> => ({\n    passkeyRegistrationAuthority: registrationService<R>(mapping, execute),\n    passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true),\n  });\n\n  const makeTargetPasskeyManagement = <M, RSetup>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ) =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, false);\n      const hooks = yield* LifecycleHooks;\n\n      return managementServices(\n        mapping,\n        makePasskeyExecution(database, hooks, configuration),\n        configuration,\n      );\n    });\n\n  const makeTargetPasskeyRegistrationWriter = <M, R, RSetup>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ) =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, true);\n      const hooks = yield* LifecycleHooks;\n\n      return registrationServices<R>(\n        mapping,\n        makePasskeyExecution(database, hooks, configuration),\n        configuration,\n      );\n    });\n\n  const coordinateTargetPasskeyManagement = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    body: (\n      transaction: Transaction,\n      services: PasskeyManagementServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, false);\n      const hooks = yield* LifecycleHooks;\n\n      return yield* coordinateTransactionOwner(\n        database,\n        CurrentPasskeyTransaction,\n        configuration,\n        Effect.void,\n        unavailable,\n        nonce,\n        (execute) =>\n          managementServices(\n            mapping,\n            {\n              ...execute,\n              run: (operation, mutation) =>\n                execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n            },\n            configuration,\n          ),\n        body,\n      ).pipe(Effect.provideService(LifecycleHooks, hooks));\n    });\n\n  const coordinateTargetPasskeyRegistrationWriter = <M, Value, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    body: (\n      transaction: Transaction,\n      services: PasskeyRegistrationServices<Value>,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, true);\n      const hooks = yield* LifecycleHooks;\n\n      return yield* coordinateTransactionOwner(\n        database,\n        CurrentPasskeyTransaction,\n        configuration,\n        Effect.void,\n        unavailable,\n        nonce,\n        (execute) =>\n          registrationServices<Value>(\n            mapping,\n            {\n              ...execute,\n              run: (operation, mutation) =>\n                execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n            },\n            configuration,\n          ),\n        body,\n      ).pipe(Effect.provideService(LifecycleHooks, hooks));\n    });\n\n  return {\n    passkeyManagementPersistenceLayer,\n    makeTargetPasskeyManagement,\n    makeTargetPasskeyRegistrationWriter,\n    coordinateTargetPasskeyManagement,\n    coordinateTargetPasskeyRegistrationWriter,\n  };\n};\n"],"mappings":";;;;;;;;AAoCA,MAAa,gCACX,YACA,YAIA,YAIA,mBAIA,OACA,QASA,cACG;CACH,MAAM,EAAE,oBAAoB;CAC5B,MAAM,EAAE,oBAAoB,oBAAoB;CAChD,MAAM,EAAE,eAAe,iBAAiB,kBAAkB,qBAAqB;CAC/E,MAAM,EAAE,sBAAsB,qBAAqB,sBAAsB;CACzE,MAAM,EAAE,OAAO,gBAAgB;CAC/B,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,iBACA,iBACA,sBACA,wBACA,sBACA,iBACE;CAEJ,MAAM,EAAE,+BAA+B;CAEvC,MAAM,qCACJ,aAEA,MAAM,OACJ,8BACA,OAAO,IAAI,WAAW,UAAU,MAAM,4BAA4B,CACpE;CAEF,MAAM,cAAc,OAAO,OAAO;EAChC,UAAU,EAAE;EACZ,QAAQ;EACR,YAAY;EACZ,eAAe,EAAE;CACnB,CAAC;CAED,MAAM,iBAAiB,OAAO,OAAO;EACnC,OAAO,EAAE;EACT,UAAU,EAAE;EACZ,eAAe,EAAE;EACjB,YAAY;EACZ,WAAW,EAAE;CACf,CAAC;CAED,MAAM,WAAW;EAAE,UAAU,EAAE;EAAiB,WAAW;CAAU;CAErE,MAAM,WAAW;EACf,GAAG;EACH,WAAW,EAAE;EACb,cAAc,EAAE;CAClB;CAEA,MAAM,YAAY;EAAE,WAAW,EAAE;EAAgB,sBAAsB,EAAE;CAAe;CAExF,MAAM,oBAAoB;EACxB,MAAM,OAAO,OAAO;GAClB,GAAG;GACH,QAAQ,OAAO,YAAY,EAAE,mBAAmB;GAChD,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;IAAE,SAAS;IAAG,SAAS;GAAG,CAAC,CAAC;EACvE,CAAC;EACD,iBAAiB;EACjB,oBAAoB;EACpB,eAAe,OAAO,OAAO,QAAQ;EACrC,QAAQ,OAAO,OAAO;GAAE,GAAG;GAAU,GAAG;GAAW,MAAM,EAAE;EAAa,CAAC;EACzE,QAAQ,OAAO,OAAO;GACpB,UAAU,EAAE;GACZ,WAAW,EAAE;GACb,YAAY,EAAE;GACd,eAAe,EAAE;GACjB,YAAY;GACZ,cAAc;GACd,GAAG;EACL,CAAC;CACH;CAEA,MAAM,WAAW,OAAO,MAAM,CAC5B,OAAO,aAAa,YAAY,EAAE,YAAY,EAAE,yBAAyB,CAAC,GAC1E,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;CAED,MAAM,UAAU,OAAO,MAAM,CAC3B,OAAO,aAAa,WAAW;EAC7B,YAAY,EAAE;EACd,UAAU,OAAO;CACnB,CAAC,GACD,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;CAED,MAAM,UAAU,OAAO,MAAM;EAC3B,OAAO,aAAa,WAAW,EAAE,QAAQ,EAAE,eAAe,CAAC;EAC3D,OAAO,aAAa,YAAY,CAAC,CAAC;EAClC,OAAO,aAAa,oBAAoB,CAAC,CAAC;CAC5C,CAAC;CAED,MAAM,uBAAuB,OAAO,MAAM,CACxC,EAAE,2BACF,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;CAED,MAAM,qBACJ,SACA,YAEA,gBACE;EACE,OAAO,UAAU,QAAQ,IAAI,qBAAqB,gBAAgB,SAAS,KAAK,CAAC,GAAG,KAAK;EACzF,gBAAgB,UACd,QAAQ,IAAI,qBAAqB,cAAc,SAAS,KAAK,CAAC,GAAG,KAAK;EACxE,kBAAkB,OAAO,YACvB,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,EAAE,sBAAsB,OAAO,gBAAgB,SAAS,KAAK,CAAC,GAClF,OACF;EACF,CAAC,CACH;EACF,qBAAqB,OAAO,YAC1B,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,UAAU,OAAO,mBAAmB,SAAS,KAAK,CAAC,GACvE,OACF;EACF,CAAC,CACH;EACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,SAAS,OAAO,iBAAiB,SAAS,KAAK,CAAC,GACpE,OACF;EACF,CAAC,CACH;EACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,SAAS,OAAO,iBAAiB,SAAS,KAAK,CAAC,GACpE,OACF;EACF,CAAC,CACH;CACJ,GACA,mBACA,OACF;CAEF,MAAM,uBACJ,SACA,YAEA,gBACE;EACE,UAAU,iBACR,QAAQ,IAAI,qBAAqB,oBAAoB,SAAS,YAAY,CAAC,GAAG,KAAK;EACrF,oBAAoB,OAAO,YACzB,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBACE,EAAE,sBACF,OAAO,kBAAkB,SAAS,KAAK,CACzC,GACA,OACF;EACF,CAAC,CACH;EACF,uBAAuB,OAAO,YAC5B,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBACE,sBACA,OAAO,qBAAqB,SAAS,KAAK,CAC5C,GACA,OACF;EACF,CAAC,CACH;CACJ,GACA;EACE,SAAS,OAAO,OAAO,QAAQ,aAAa,MAAM;EAClD,mBAAmB,OAAO,OAAO;GAC/B,UAAU,EAAE;GACZ,QAAQ;GACR,cAAc,OAAO,OAAO,QAAQ,aAAa,MAAM;EACzD,CAAC;EACD,sBAAsB,OAAO,OAAO;GAClC,OAAO,EAAE;GACT,UAAU,EAAE;GACZ,WAAW,EAAE;EACf,CAAC;CACH,GACA,OACF;CAEF,MAAM,cAAc,UAAe;EACjC,MAAM,UAAU,gBAAgB,MAAM,KAAK;EAE3C,KAAK,MAAM,CAAC,OAAO,SAAS,OAAO,QAAQ,KAAK,GAC9C,IAAI,OAAO,SAAS,YAAY,CAAC,MAAM,SAAS,OAAO,GACrD,UAAU,QAAQ,UAAU,KAAA,CAAS;CAC3C;CAEA,MAAM,gBACJ,QACA,eACA,iBAEA,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,aAAa,IAAI,YACnE,OAAO,IAAI;EACT,WAAW;GACT,MAAM,IAAI;GAEV,KAAK,MAAM,QAAQ,CAAC,EAAE,MAAM,WAAW,MAAM,EAAE,MAAM,WAAW,SAAS,GACvE,UAAU,gBAAgB,EAAE,KAAK,WAAW,KAAK,CAAC,CAAC,UAAU,KAAA,CAAS;GACxE,KAAK,MAAM,QAAQ,EAAE,MAAM,OAAO,gBAChC,UAAU,gBAAgB,EAAE,KAAK,QAAQ,KAAK,CAAC,CAAC,UAAU,KAAA,CAAS;GACrE,UACE,EAAE,MAAM,WAAW,iBAAiB,EAAE,MAAM,WAAW,iBACrD,EAAE,MAAM,UAAU,iBAAiB,EAAE,MAAM,UAAU,iBACrD,EAAE,MAAM,oBAAoB,eAAe,EAAE,MAAM,oBAAoB,YAC3E;GACA,UACE,EAAE,KAAK,WAAW,eAAe,EAAE,MAAM,WAAW,YAAY,KAC9D,CAAC,EAAE,KAAK,WAAW,eAAe,EAAE,MAAM,WAAW,aAAa,KAClE,EAAE,KAAK,UAAU,eAAe,EAAE,MAAM,UAAU,YAAY,KAC9D,CAAC,EAAE,KAAK,UAAU,eAAe,EAAE,MAAM,UAAU,aAAa,KAChE,EAAE,KAAK,oBAAoB,aAAa,EAAE,MAAM,oBAAoB,UAAU,KAC9E,CAAC,EAAE,KAAK,oBAAoB,aAAa,EAAE,MAAM,oBAAoB,YAAY,KACjF,EAAE,KAAK,gBAAgB,aAAa,EAAE,MAAM,gBAAgB,UAAU,CAC1E;GACA,IAAI,cAAc;IAChB,WAAW,EAAE,MAAM;IACnB,WAAW,EAAE,MAAM;IACnB,UAAU,EAAE,OAAO,UAAU,EAAE,KAAK,gBAAgB,KAAK;IACzD,UACE,EAAE,OAAO,kBAAkB,EAAE,MAAM,gBAAgB,cACjD,EAAE,OAAO,iBAAiB,EAAE,OAAO,iBACnC,EAAE,OAAO,kBAAkB,EAAE,OAAO,gBACpC,EAAE,OAAO,kBAAkB,EAAE,OAAO,aACxC;IACA,UACE,EAAE,wBAAwB,WAAW,KAAK,GAAG,MAAM,qBACjD,EAAE,wBAAwB,cAAc,KAAK,GAAG,MAAM,wBACtD,EAAE,wBAAwB,OAAO,KAAK,GAAG,MAAM,WACnD;GACF,OAAO;IACL,WAAW,EAAE,OAAO;IACpB,UAAU,EAAE,sBAAsB,QAAQ,KAAK,GAAG,MAAM,oBAAoB;IAC5E,oBAAoB,2BAA2B,EAAE,aAAa,MAAM;IACpE,UACE,EAAE,aAAa,OAAO,YAAY,uBAChC,EAAE,aAAa,UAAU,UAAU,EACvC;GACF;GAEA,OAAO;EACT;EACA,aAAa,0BAA0B,KAAK,CAAC,CAAC;CAChD,CAAC,CACH;CAEF,MAAM,sBACJ,SACA,SACA,mBAC+B;EAC/B,8BAA8B,kBAAkB,SAAS,OAAO;EAChE,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,OAAO,IAAI;CACzF;CAEA,MAAM,wBACJ,SACA,SACA,mBACoC;EACpC,8BAA8B,oBAAuB,SAAS,OAAO;EACrE,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,IAAI;CAClF;CAEA,MAAM,+BACJ,UACA,QACA,kBAEA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,KAAK;EAChE,MAAM,QAAQ,OAAO;EAErB,OAAO,mBACL,SACA,qBAAqB,UAAU,OAAO,aAAa,GACnD,aACF;CACF,CAAC;CAEH,MAAM,uCACJ,UACA,QACA,kBAEA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,IAAI;EAC/D,MAAM,QAAQ,OAAO;EAErB,OAAO,qBACL,SACA,qBAAqB,UAAU,OAAO,aAAa,GACnD,aACF;CACF,CAAC;CAEH,MAAM,qCACJ,UACA,QACA,eACA,SAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,KAAK;EAChE,MAAM,QAAQ,OAAO;EAErB,OAAO,OAAO,2BACZ,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,YACC,mBACE,SACA;GACE,GAAG;GACH,MAAM,WAAW,aACf,QAAQ,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtF,GACA,aACF,GACF,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACrD,CAAC;CAEH,MAAM,6CACJ,UACA,QACA,eACA,SAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,IAAI;EAC/D,MAAM,QAAQ,OAAO;EAErB,OAAO,OAAO,2BACZ,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,YACC,qBACE,SACA;GACE,GAAG;GACH,MAAM,WAAW,aACf,QAAQ,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtF,GACA,aACF,GACF,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACrD,CAAC;CAEH,OAAO;EACL;EACA;EACA;EACA;EACA;CACF;AACF"}
+{"version":3,"file":"write-target.mjs","names":[],"sources":["../../../src/internal/passkey/write-target.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  PasskeyConfigurationError,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport * as M from \"@yielded/auth/Passkey\";\nimport { SubjectId } from \"@yielded/auth/Schema\";\nimport { SessionInvalidationWindow } from \"@yielded/auth/Sessions\";\nimport { Effect, Layer, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PasskeyMappingSource } from \"../models/passkey-model\";\nimport type {\n  PasskeyManagementServices,\n  PasskeyRegistrationServices,\n  PasskeyRegistrationWriter,\n} from \"../models/passkey-write-model\";\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionExecutionKernel } from \"../transaction-execution-kernel\";\nimport type { makePasskeyEnrollmentKernel } from \"./enrollment\";\nimport type { makePasskeyManagementKernel } from \"./management\";\nimport type { makePasskeyRegistrationWriteKernel } from \"./registration-write\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\nimport type {\n  PasskeyExecution,\n  PasskeyCoordinatorError,\n  PasskeyTargetConfiguration,\n  makePasskeyTargetKernel,\n} from \"./target\";\n\nexport const makePasskeyWriteTargetKernel = (\n  operations: QueryOperations,\n  enrollment: Pick<\n    ReturnType<typeof makePasskeyEnrollmentKernel>,\n    \"completeEnrollment\" | \"issueEnrollment\"\n  >,\n  management: Pick<\n    ReturnType<typeof makePasskeyManagementKernel>,\n    \"inspectRemove\" | \"listCredentials\" | \"removeCredential\" | \"renameCredential\"\n  >,\n  registrationWrite: Pick<\n    ReturnType<typeof makePasskeyRegistrationWriteKernel>,\n    \"completeRegistration\" | \"inspectRegistration\" | \"issueRegistration\"\n  >,\n  state: Pick<ReturnType<typeof makePasskeyStateKernel>, \"invariant\" | \"nonce\" | \"unavailable\">,\n  target: Pick<\n    ReturnType<typeof makePasskeyTargetKernel>,\n    | \"capturedMapping\"\n    | \"capturedService\"\n    | \"makePasskeyExecution\"\n    | \"makePasskeyPersistence\"\n    | \"observationalContext\"\n    | \"prepareValue\"\n  >,\n  execution: Pick<ReturnType<typeof makeTransactionExecutionKernel>, \"coordinateTransactionOwner\">,\n) => {\n  const { getTableColumns } = operations;\n  const { completeEnrollment, issueEnrollment } = enrollment;\n  const { inspectRemove, listCredentials, removeCredential, renameCredential } = management;\n  const { completeRegistration, inspectRegistration, issueRegistration } = registrationWrite;\n  const { nonce, unavailable } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    capturedMapping,\n    capturedService,\n    makePasskeyExecution,\n    makePasskeyPersistence,\n    observationalContext,\n    prepareValue,\n  } = target;\n\n  const { coordinateTransactionOwner } = execution;\n\n  const passkeyManagementPersistenceLayer = <E, R>(\n    services: Effect.Effect<PasskeyManagementServices, E, R>,\n  ) =>\n    Layer.effect(\n      PasskeyManagementPersistence,\n      Effect.map(services, (value) => value.passkeyManagementPersistence),\n    );\n\n  const issueSchema = Schema.Struct({\n    ceremony: M.PasskeyCeremony,\n    policy: PasskeyMethodPolicy,\n    management: PasskeyManagementPolicy,\n    authorization: M.PasskeyActionAuthorization,\n  });\n\n  const completeSchema = Schema.Struct({\n    claim: M.PasskeyClaim,\n    verified: M.PasskeyRegistrationVerified,\n    authorization: M.PasskeyActionAuthorization,\n    management: PasskeyManagementPolicy,\n    nowMillis: M.PasskeyInstant,\n  });\n\n  const metadata = { moduleId: M.PasskeyModuleId, subjectId: SubjectId };\n\n  const identity = {\n    ...metadata,\n    commandId: M.PasskeyCommandId,\n    credentialId: M.PasskeyCredentialId,\n  };\n\n  const retention = { nowMillis: M.PasskeyInstant, retentionUntilMillis: M.PasskeyInstant };\n\n  const managementSchemas = {\n    list: Schema.Struct({\n      ...metadata,\n      cursor: Schema.optionalKey(M.PasskeyCredentialId),\n      limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 64 })),\n    }),\n    issueEnrollment: issueSchema,\n    completeEnrollment: completeSchema,\n    inspectRemove: Schema.Struct(identity),\n    rename: Schema.Struct({ ...identity, ...retention, name: M.PasskeyLabel }),\n    remove: Schema.Struct({\n      moduleId: M.PasskeyModuleId,\n      commandId: M.PasskeyCommandId,\n      credential: M.PasskeyCredential,\n      authorization: M.PasskeyActionAuthorization,\n      management: PasskeyManagementPolicy,\n      invalidation: SessionInvalidationWindow,\n      ...retention,\n    }),\n  };\n\n  const enrolled = Schema.Union([\n    Schema.TaggedStruct(\"Enrolled\", { credential: M.PasskeyCredentialSummary }),\n    Schema.TaggedStruct(\"Rejected\", {}),\n  ]);\n\n  const renamed = Schema.Union([\n    Schema.TaggedStruct(\"Renamed\", {\n      credential: M.PasskeyCredentialSummary,\n      replayed: Schema.Boolean,\n    }),\n    Schema.TaggedStruct(\"Rejected\", {}),\n  ]);\n\n  const removed = Schema.Union([\n    Schema.TaggedStruct(\"Removed\", { result: M.PasskeyRemoved }),\n    Schema.TaggedStruct(\"Rejected\", {}),\n    Schema.TaggedStruct(\"LastSignInMethod\", {}),\n  ]);\n\n  const registrationDecision = Schema.Union([\n    M.PasskeyRegistrationResult,\n    Schema.TaggedStruct(\"Rejected\", {}),\n  ]);\n\n  const managementService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyManagementPersistence[\"Service\"] =>\n    capturedService<PasskeyManagementPersistence[\"Service\"]>(\n      {\n        list: (input) => execute.run(observationalContext(listCredentials(mapping, input)), false),\n        inspectRemove: (input) =>\n          execute.run(observationalContext(inspectRemove(mapping, input)), false),\n        issueEnrollment: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(M.PasskeyIssueDecision, yield* issueEnrollment(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n        completeEnrollment: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(enrolled, yield* completeEnrollment(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n        rename: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(renamed, yield* renameCredential(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n        remove: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(removed, yield* removeCredential(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n      },\n      managementSchemas,\n      execute,\n    );\n\n  const registrationService = <R>(\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyRegistrationWriter<R> =>\n    capturedService<PasskeyRegistrationWriter<R>>(\n      {\n        inspect: (registration) =>\n          execute.run(observationalContext(inspectRegistration(mapping, registration)), false),\n        issueRegistration: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(\n                  M.PasskeyIssueDecision,\n                  yield* issueRegistration(mapping, input),\n                ),\n                prepare,\n              );\n            }),\n          ),\n        completeRegistration: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(\n                  registrationDecision,\n                  yield* completeRegistration(mapping, input),\n                ),\n                prepare,\n              );\n            }),\n          ),\n      },\n      {\n        inspect: Schema.toType(mapping.registration.schema),\n        issueRegistration: Schema.Struct({\n          ceremony: M.PasskeyCeremony,\n          policy: PasskeyMethodPolicy,\n          registration: Schema.toType(mapping.registration.schema),\n        }),\n        completeRegistration: Schema.Struct({\n          claim: M.PasskeyClaim,\n          verified: M.PasskeyRegistrationVerified,\n          nowMillis: M.PasskeyInstant,\n        }),\n      },\n      execute,\n    );\n\n  const descriptor = (table: any) => {\n    const columns = getTableColumns(table.table);\n\n    for (const [field, name] of Object.entries(table))\n      if (typeof name === \"string\" && !field.endsWith(\"State\"))\n        invariant(columns[name] !== undefined);\n  };\n\n  const writeMapping = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    registration: boolean,\n  ) =>\n    Effect.flatMap(capturedMapping(source, \"assertion\", configuration), (mapping) =>\n      Effect.try({\n        try: () => {\n          const m = mapping as any;\n\n          for (const name of [m.write.credential.name, m.write.credential.createdAt])\n            invariant(getTableColumns(m.read.credential.table)[name] !== undefined);\n          for (const name of m.write.policy.subjectColumns)\n            invariant(getTableColumns(m.read.subject.table)[name] !== undefined);\n          invariant(\n            m.write.credential.activeStatus !== m.write.credential.removedStatus &&\n              m.write.authority.activeStatus !== m.write.authority.removedStatus &&\n              m.write.credentialOwnership.ownedState !== m.write.credentialOwnership.removedState,\n          );\n          invariant(\n            m.read.credential.isActiveStatus(m.write.credential.activeStatus) &&\n              !m.read.credential.isActiveStatus(m.write.credential.removedStatus) &&\n              m.read.authority.isActiveStatus(m.write.authority.activeStatus) &&\n              !m.read.authority.isActiveStatus(m.write.authority.removedStatus) &&\n              m.read.credentialOwnership.isOwnedState(m.write.credentialOwnership.ownedState) &&\n              !m.read.credentialOwnership.isOwnedState(m.write.credentialOwnership.removedState) &&\n              m.read.handleOwnership.isOwnedState(m.write.handleOwnership.ownedState),\n          );\n          if (registration) {\n            descriptor(m.intent);\n            descriptor(m.handle);\n            invariant(m.handle.table === m.read.handleOwnership.table);\n            invariant(\n              m.handle.reservedState !== m.write.handleOwnership.ownedState &&\n                m.intent.pendingState !== m.intent.acceptedState &&\n                m.intent.rejectedState !== m.intent.pendingState &&\n                m.intent.rejectedState !== m.intent.acceptedState,\n            );\n            invariant(\n              m.registrationConstraints.intentFlow.join(\"/\") === \"moduleId/flowId\" &&\n                m.registrationConstraints.intentCommand.join(\"/\") === \"moduleId/commandId\" &&\n                m.registrationConstraints.handle.join(\"/\") === \"handleKey\",\n            );\n          } else {\n            descriptor(m.command);\n            invariant(m.managementConstraints.command.join(\"/\") === \"moduleId/commandId\");\n            snapshotPasskeySync(SessionInvalidationWindow, m.invalidation.window);\n            invariant(\n              m.invalidation.window.trigger === \"credential-change\" &&\n                m.invalidation.mutations.length <= 32,\n            );\n          }\n\n          return mapping;\n        },\n        catch: () => PasskeyConfigurationError.make({}),\n      }),\n    );\n\n  const managementServices = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyManagementServices => ({\n    passkeyManagementPersistence: managementService(mapping, execute),\n    passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, false, true),\n  });\n\n  const registrationServices = <R>(\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyRegistrationServices<R> => ({\n    passkeyRegistrationAuthority: registrationService<R>(mapping, execute),\n    passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true),\n  });\n\n  const makeTargetPasskeyManagement = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ) =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, false);\n      const execution = yield* makePasskeyExecution(configuration);\n\n      return managementServices(mapping, execution, configuration);\n    });\n\n  const makeTargetPasskeyRegistrationWriter = <M, R, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ) =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, true);\n      const execution = yield* makePasskeyExecution(configuration);\n\n      return registrationServices<R>(mapping, execution, configuration);\n    });\n\n  const coordinateTargetPasskeyManagement = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    body: (\n      transaction: Transaction,\n      services: PasskeyManagementServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, false);\n      const hooks = yield* LifecycleHooks;\n\n      return yield* coordinateTransactionOwner(\n        database,\n        CurrentPasskeyTransaction,\n        configuration,\n        Effect.void,\n        unavailable,\n        nonce,\n        (execute) =>\n          managementServices(\n            mapping,\n            {\n              ...execute,\n              run: (operation, mutation) =>\n                execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n            },\n            configuration,\n          ),\n        body,\n      ).pipe(Effect.provideService(LifecycleHooks, hooks));\n    });\n\n  const coordinateTargetPasskeyRegistrationWriter = <M, Value, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    body: (\n      transaction: Transaction,\n      services: PasskeyRegistrationServices<Value>,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, true);\n      const hooks = yield* LifecycleHooks;\n\n      return yield* coordinateTransactionOwner(\n        database,\n        CurrentPasskeyTransaction,\n        configuration,\n        Effect.void,\n        unavailable,\n        nonce,\n        (execute) =>\n          registrationServices<Value>(\n            mapping,\n            {\n              ...execute,\n              run: (operation, mutation) =>\n                execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n            },\n            configuration,\n          ),\n        body,\n      ).pipe(Effect.provideService(LifecycleHooks, hooks));\n    });\n\n  return {\n    passkeyManagementPersistenceLayer,\n    makeTargetPasskeyManagement,\n    makeTargetPasskeyRegistrationWriter,\n    coordinateTargetPasskeyManagement,\n    coordinateTargetPasskeyRegistrationWriter,\n  };\n};\n"],"mappings":";;;;;;;;AAoCA,MAAa,gCACX,YACA,YAIA,YAIA,mBAIA,OACA,QASA,cACG;CACH,MAAM,EAAE,oBAAoB;CAC5B,MAAM,EAAE,oBAAoB,oBAAoB;CAChD,MAAM,EAAE,eAAe,iBAAiB,kBAAkB,qBAAqB;CAC/E,MAAM,EAAE,sBAAsB,qBAAqB,sBAAsB;CACzE,MAAM,EAAE,OAAO,gBAAgB;CAC/B,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,iBACA,iBACA,sBACA,wBACA,sBACA,iBACE;CAEJ,MAAM,EAAE,+BAA+B;CAEvC,MAAM,qCACJ,aAEA,MAAM,OACJ,8BACA,OAAO,IAAI,WAAW,UAAU,MAAM,4BAA4B,CACpE;CAEF,MAAM,cAAc,OAAO,OAAO;EAChC,UAAU,EAAE;EACZ,QAAQ;EACR,YAAY;EACZ,eAAe,EAAE;CACnB,CAAC;CAED,MAAM,iBAAiB,OAAO,OAAO;EACnC,OAAO,EAAE;EACT,UAAU,EAAE;EACZ,eAAe,EAAE;EACjB,YAAY;EACZ,WAAW,EAAE;CACf,CAAC;CAED,MAAM,WAAW;EAAE,UAAU,EAAE;EAAiB,WAAW;CAAU;CAErE,MAAM,WAAW;EACf,GAAG;EACH,WAAW,EAAE;EACb,cAAc,EAAE;CAClB;CAEA,MAAM,YAAY;EAAE,WAAW,EAAE;EAAgB,sBAAsB,EAAE;CAAe;CAExF,MAAM,oBAAoB;EACxB,MAAM,OAAO,OAAO;GAClB,GAAG;GACH,QAAQ,OAAO,YAAY,EAAE,mBAAmB;GAChD,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;IAAE,SAAS;IAAG,SAAS;GAAG,CAAC,CAAC;EACvE,CAAC;EACD,iBAAiB;EACjB,oBAAoB;EACpB,eAAe,OAAO,OAAO,QAAQ;EACrC,QAAQ,OAAO,OAAO;GAAE,GAAG;GAAU,GAAG;GAAW,MAAM,EAAE;EAAa,CAAC;EACzE,QAAQ,OAAO,OAAO;GACpB,UAAU,EAAE;GACZ,WAAW,EAAE;GACb,YAAY,EAAE;GACd,eAAe,EAAE;GACjB,YAAY;GACZ,cAAc;GACd,GAAG;EACL,CAAC;CACH;CAEA,MAAM,WAAW,OAAO,MAAM,CAC5B,OAAO,aAAa,YAAY,EAAE,YAAY,EAAE,yBAAyB,CAAC,GAC1E,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;CAED,MAAM,UAAU,OAAO,MAAM,CAC3B,OAAO,aAAa,WAAW;EAC7B,YAAY,EAAE;EACd,UAAU,OAAO;CACnB,CAAC,GACD,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;CAED,MAAM,UAAU,OAAO,MAAM;EAC3B,OAAO,aAAa,WAAW,EAAE,QAAQ,EAAE,eAAe,CAAC;EAC3D,OAAO,aAAa,YAAY,CAAC,CAAC;EAClC,OAAO,aAAa,oBAAoB,CAAC,CAAC;CAC5C,CAAC;CAED,MAAM,uBAAuB,OAAO,MAAM,CACxC,EAAE,2BACF,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;CAED,MAAM,qBACJ,SACA,YAEA,gBACE;EACE,OAAO,UAAU,QAAQ,IAAI,qBAAqB,gBAAgB,SAAS,KAAK,CAAC,GAAG,KAAK;EACzF,gBAAgB,UACd,QAAQ,IAAI,qBAAqB,cAAc,SAAS,KAAK,CAAC,GAAG,KAAK;EACxE,kBAAkB,OAAO,YACvB,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,EAAE,sBAAsB,OAAO,gBAAgB,SAAS,KAAK,CAAC,GAClF,OACF;EACF,CAAC,CACH;EACF,qBAAqB,OAAO,YAC1B,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,UAAU,OAAO,mBAAmB,SAAS,KAAK,CAAC,GACvE,OACF;EACF,CAAC,CACH;EACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,SAAS,OAAO,iBAAiB,SAAS,KAAK,CAAC,GACpE,OACF;EACF,CAAC,CACH;EACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,SAAS,OAAO,iBAAiB,SAAS,KAAK,CAAC,GACpE,OACF;EACF,CAAC,CACH;CACJ,GACA,mBACA,OACF;CAEF,MAAM,uBACJ,SACA,YAEA,gBACE;EACE,UAAU,iBACR,QAAQ,IAAI,qBAAqB,oBAAoB,SAAS,YAAY,CAAC,GAAG,KAAK;EACrF,oBAAoB,OAAO,YACzB,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBACE,EAAE,sBACF,OAAO,kBAAkB,SAAS,KAAK,CACzC,GACA,OACF;EACF,CAAC,CACH;EACF,uBAAuB,OAAO,YAC5B,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBACE,sBACA,OAAO,qBAAqB,SAAS,KAAK,CAC5C,GACA,OACF;EACF,CAAC,CACH;CACJ,GACA;EACE,SAAS,OAAO,OAAO,QAAQ,aAAa,MAAM;EAClD,mBAAmB,OAAO,OAAO;GAC/B,UAAU,EAAE;GACZ,QAAQ;GACR,cAAc,OAAO,OAAO,QAAQ,aAAa,MAAM;EACzD,CAAC;EACD,sBAAsB,OAAO,OAAO;GAClC,OAAO,EAAE;GACT,UAAU,EAAE;GACZ,WAAW,EAAE;EACf,CAAC;CACH,GACA,OACF;CAEF,MAAM,cAAc,UAAe;EACjC,MAAM,UAAU,gBAAgB,MAAM,KAAK;EAE3C,KAAK,MAAM,CAAC,OAAO,SAAS,OAAO,QAAQ,KAAK,GAC9C,IAAI,OAAO,SAAS,YAAY,CAAC,MAAM,SAAS,OAAO,GACrD,UAAU,QAAQ,UAAU,KAAA,CAAS;CAC3C;CAEA,MAAM,gBACJ,QACA,eACA,iBAEA,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,aAAa,IAAI,YACnE,OAAO,IAAI;EACT,WAAW;GACT,MAAM,IAAI;GAEV,KAAK,MAAM,QAAQ,CAAC,EAAE,MAAM,WAAW,MAAM,EAAE,MAAM,WAAW,SAAS,GACvE,UAAU,gBAAgB,EAAE,KAAK,WAAW,KAAK,CAAC,CAAC,UAAU,KAAA,CAAS;GACxE,KAAK,MAAM,QAAQ,EAAE,MAAM,OAAO,gBAChC,UAAU,gBAAgB,EAAE,KAAK,QAAQ,KAAK,CAAC,CAAC,UAAU,KAAA,CAAS;GACrE,UACE,EAAE,MAAM,WAAW,iBAAiB,EAAE,MAAM,WAAW,iBACrD,EAAE,MAAM,UAAU,iBAAiB,EAAE,MAAM,UAAU,iBACrD,EAAE,MAAM,oBAAoB,eAAe,EAAE,MAAM,oBAAoB,YAC3E;GACA,UACE,EAAE,KAAK,WAAW,eAAe,EAAE,MAAM,WAAW,YAAY,KAC9D,CAAC,EAAE,KAAK,WAAW,eAAe,EAAE,MAAM,WAAW,aAAa,KAClE,EAAE,KAAK,UAAU,eAAe,EAAE,MAAM,UAAU,YAAY,KAC9D,CAAC,EAAE,KAAK,UAAU,eAAe,EAAE,MAAM,UAAU,aAAa,KAChE,EAAE,KAAK,oBAAoB,aAAa,EAAE,MAAM,oBAAoB,UAAU,KAC9E,CAAC,EAAE,KAAK,oBAAoB,aAAa,EAAE,MAAM,oBAAoB,YAAY,KACjF,EAAE,KAAK,gBAAgB,aAAa,EAAE,MAAM,gBAAgB,UAAU,CAC1E;GACA,IAAI,cAAc;IAChB,WAAW,EAAE,MAAM;IACnB,WAAW,EAAE,MAAM;IACnB,UAAU,EAAE,OAAO,UAAU,EAAE,KAAK,gBAAgB,KAAK;IACzD,UACE,EAAE,OAAO,kBAAkB,EAAE,MAAM,gBAAgB,cACjD,EAAE,OAAO,iBAAiB,EAAE,OAAO,iBACnC,EAAE,OAAO,kBAAkB,EAAE,OAAO,gBACpC,EAAE,OAAO,kBAAkB,EAAE,OAAO,aACxC;IACA,UACE,EAAE,wBAAwB,WAAW,KAAK,GAAG,MAAM,qBACjD,EAAE,wBAAwB,cAAc,KAAK,GAAG,MAAM,wBACtD,EAAE,wBAAwB,OAAO,KAAK,GAAG,MAAM,WACnD;GACF,OAAO;IACL,WAAW,EAAE,OAAO;IACpB,UAAU,EAAE,sBAAsB,QAAQ,KAAK,GAAG,MAAM,oBAAoB;IAC5E,oBAAoB,2BAA2B,EAAE,aAAa,MAAM;IACpE,UACE,EAAE,aAAa,OAAO,YAAY,uBAChC,EAAE,aAAa,UAAU,UAAU,EACvC;GACF;GAEA,OAAO;EACT;EACA,aAAa,0BAA0B,KAAK,CAAC,CAAC;CAChD,CAAC,CACH;CAEF,MAAM,sBACJ,SACA,SACA,mBAC+B;EAC/B,8BAA8B,kBAAkB,SAAS,OAAO;EAChE,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,OAAO,IAAI;CACzF;CAEA,MAAM,wBACJ,SACA,SACA,mBACoC;EACpC,8BAA8B,oBAAuB,SAAS,OAAO;EACrE,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,IAAI;CAClF;CAEA,MAAM,+BACJ,QACA,kBAEA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,KAAK;EAChE,MAAM,YAAY,OAAO,qBAAqB,aAAa;EAE3D,OAAO,mBAAmB,SAAS,WAAW,aAAa;CAC7D,CAAC;CAEH,MAAM,uCACJ,QACA,kBAEA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,IAAI;EAC/D,MAAM,YAAY,OAAO,qBAAqB,aAAa;EAE3D,OAAO,qBAAwB,SAAS,WAAW,aAAa;CAClE,CAAC;CAEH,MAAM,qCACJ,UACA,QACA,eACA,SAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,KAAK;EAChE,MAAM,QAAQ,OAAO;EAErB,OAAO,OAAO,2BACZ,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,YACC,mBACE,SACA;GACE,GAAG;GACH,MAAM,WAAW,aACf,QAAQ,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtF,GACA,aACF,GACF,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACrD,CAAC;CAEH,MAAM,6CACJ,UACA,QACA,eACA,SAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,IAAI;EAC/D,MAAM,QAAQ,OAAO;EAErB,OAAO,OAAO,2BACZ,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,YACC,qBACE,SACA;GACE,GAAG;GACH,MAAM,WAAW,aACf,QAAQ,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtF,GACA,aACF,GACF,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACrD,CAAC;CAEH,OAAO;EACL;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/internal/passkey-kernel.d.mts

@@ -3,11 +3,10 @@ import { PersistenceMappingError } from "./mapping-error.mjs";
 import { PasskeyChargeKind, PasskeyCredentialServices, PasskeyEnrollmentContextServices, PasskeyMappingSource, PasskeyPersistenceServices } from "./models/passkey-model.mjs";
 import { PasskeyRegistrationCeremonyServices } from "./models/passkey-registration-ceremony-model.mjs";
 import { PasskeyManagementServices, PasskeyRegistrationServices } from "./models/passkey-write-model.mjs";
-import { Row, TransactionNativeDatabase, TransactionOwner } from "./transaction-kernel.mjs";
+import { NativeDatabase, Row } from "./transaction-kernel.mjs";
 import { CurrentPasskeyTransaction } from "./passkey/state.mjs";
 import { SubjectRead } from "./passkey/credentials.mjs";
 import { FlowRead } from "./passkey/flow.mjs";
-import { TransactionBound, TransactionExecution, TransactionTargetConfiguration } from "./transaction-execution-kernel.mjs";
 import { PasskeyCoordinatorError, PasskeyExecution, PasskeyTargetConfiguration } from "./passkey/target.mjs";
 import { WriteSubject } from "./passkey/write-state.mjs";
 //#region src/internal/passkey-kernel.d.ts
@@ -4348,19 +4347,17 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
     }, outcome: "Ambiguous" | "Rejected") => import("effect/Effect").Effect<"Ambiguous" | "Rejected" | "Verified", import("@yielded/auth/Passkey").PasskeyUnavailable, CurrentPasskeyTransaction>;
   };
   target: {
-    sqlClientPasskeyStandaloneGuard: (database: Parameters<<Failure>(unavailable: () => Failure, database: {
-      readonly $client: Pick<import("effect/sql/SqlClient").SqlClient, "transactionService">;
-    }) => import("effect/Effect").Effect<void, Failure, never>>[1]) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, never>;
-    makePasskeyExecution: (database: Parameters<<Failure, OwnerId>(ownerTag: import("effect/Context").Key<OwnerId, TransactionOwner<Failure>>, database: TransactionNativeDatabase, configuration: TransactionTargetConfiguration<Failure>, unavailable: () => Failure, nonce: () => string, bound?: TransactionBound<Failure>) => TransactionExecution<Failure, OwnerId>>[1], hooks: import("@yielded/auth/Hooks").LifecycleHooks["Service"], configuration: PasskeyTargetConfiguration) => PasskeyExecution;
+    sqlClientPasskeyStandaloneGuard: (transactionService: Parameters<<Failure>(unavailable: () => Failure, transactionService: import("effect/sql/SqlClient").SqlClient["transactionService"] | undefined) => import("effect/Effect").Effect<void, Failure, never>>[1]) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, never>;
+    makePasskeyExecution: (configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyExecution, never, import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
     capturedService: <S>(service: S, schemas: Record<string, import("effect/Schema").Codec<any, any, never, never>>, execute: PasskeyExecution) => S;
     prepareValue: <Value, A>(value: Value, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<Value, A>) => import("effect/Effect").Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, never, CurrentPasskeyTransaction>;
     observationalContext: <A, E, R>(operation: import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, E, CurrentPasskeyTransaction | Exclude<R, CurrentPasskeyTransaction>>;
     makePasskeyPersistence: (mapping: any, execute: PasskeyExecution, configuration: PasskeyTargetConfiguration, registration?: boolean, enrollment?: boolean) => import("@yielded/auth/Passkey").PasskeyPersistence["Service"];
     capturedMapping: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, kind: "read" | "context" | "assertion" | "registration", configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<M, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup>;
-    makeTargetPasskeyCredentials: <M, RSetup>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyCredentialServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup>;
-    makeTargetPasskeyEnrollmentContext: <M, RSetup>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyEnrollmentContextServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup>;
-    makeTargetPasskeyPersistence: <M, RSetup>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyPersistenceServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks>;
-    makeTargetPasskeyRegistration: <M, RSetup>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyRegistrationCeremonyServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks>;
+    makeTargetPasskeyCredentials: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyCredentialServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | NativeDatabase>;
+    makeTargetPasskeyEnrollmentContext: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyEnrollmentContextServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | NativeDatabase>;
+    makeTargetPasskeyPersistence: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyPersistenceServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    makeTargetPasskeyRegistration: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyRegistrationCeremonyServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
     coordinateTargetPasskey: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, owner: (transaction: Transaction, services: PasskeyPersistenceServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks>;
     coordinateTargetPasskeyRegistration: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, owner: (transaction: Transaction, services: PasskeyRegistrationCeremonyServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks>;
   };
@@ -5582,8 +5579,8 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
   };
   writeTarget: {
     passkeyManagementPersistenceLayer: <E, R>(services: import("effect/Effect").Effect<PasskeyManagementServices, E, R>) => import("effect/Layer").Layer<import("@yielded/auth/Passkey").PasskeyManagementPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
-    makeTargetPasskeyManagement: <M, RSetup>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyManagementServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks>;
-    makeTargetPasskeyRegistrationWriter: <M, R, RSetup>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyRegistrationServices<R>, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks>;
+    makeTargetPasskeyManagement: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyManagementServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    makeTargetPasskeyRegistrationWriter: <M, R, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyRegistrationServices<R>, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
     coordinateTargetPasskeyManagement: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, body: (transaction: Transaction, services: PasskeyManagementServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks>;
     coordinateTargetPasskeyRegistrationWriter: <M, Value, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, body: (transaction: Transaction, services: PasskeyRegistrationServices<Value>, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks>;
   };

package/dist/internal/passkeys.mjs

@@ -4,6 +4,7 @@ import { requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstra
 import { requiredPasskeyManagementConstraints } from "./models/passkey-write-model.mjs";
 import { requireStandalone } from "./standalone.mjs";
 import { makePasskeyKernel } from "./passkey-kernel.mjs";
+import { CurrentProofSql } from "./proof-kernel.mjs";
 import { storageTables } from "./storage-tables.mjs";
 import { Context, Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql";
@@ -271,7 +272,7 @@ const makeComposedPasskeys = (operations) => {
 			table
 		};
 	};
-	return Effect.fn("AuthPersistence.passkeys")(function* ({ database, storage, namespace, dialect, features, passwordModules }) {
+	return Effect.fn("AuthPersistence.passkeys")(function* ({ storage, namespace, dialect, features, passwordModules }) {
 		const client = yield* SqlClient.SqlClient;
 		const policies = yield* Effect.forEach(features, (feature) => Effect.map(feature.policy, (policy) => ({
 			feature,
@@ -285,9 +286,9 @@ const makeComposedPasskeys = (operations) => {
 			mode: "interactive",
 			dialect,
 			locking: dialect === "pg",
-			standaloneGuard: () => requireStandalone(unavailable, client)
+			standaloneGuard: () => requireStandalone(unavailable, client.transactionService)
 		};
-		const native = database;
+		const native = yield* CurrentProofSql;
 		yield* client.withTransaction(Effect.gen(function* () {
 			if (dialect === "pg") yield* client`select pg_advisory_xact_lock(hashtext(${`${namespace}/passkeys`}))`;
 			for (const { feature, policy } of policies) {
@@ -326,7 +327,7 @@ const makeComposedPasskeys = (operations) => {
 				}).onConflictDoNothing();
 			}
 		}));
-		const credential = yield* makeTargetPasskeyCredentials(database, m.read, configuration);
+		const credential = yield* makeTargetPasskeyCredentials(m.read, configuration);
 		const persistence = /* @__PURE__ */ new Map();
 		const managers = /* @__PURE__ */ new Map();
 		const enrollment = /* @__PURE__ */ new Map();
@@ -335,11 +336,11 @@ const makeComposedPasskeys = (operations) => {
 				try: () => m.management(feature),
 				catch: () => configurationError(`Invalid passkey management mapping for ${feature.moduleId}`)
 			});
-			const services = yield* makeTargetPasskeyManagement(database, mapping, configuration);
+			const services = yield* makeTargetPasskeyManagement(mapping, configuration);
 			persistence.set(feature.moduleId, services.passkeyPersistence);
 			managers.set(feature.moduleId, services.passkeyManagementPersistence);
-			enrollment.set(feature.moduleId, (yield* makeTargetPasskeyEnrollmentContext(database, mapping, configuration)).passkeyEnrollmentContext);
-		} else persistence.set(feature.moduleId, (yield* makeTargetPasskeyPersistence(database, m.base(feature), configuration)).passkeyPersistence);
+			enrollment.set(feature.moduleId, (yield* makeTargetPasskeyEnrollmentContext(mapping, configuration)).passkeyEnrollmentContext);
+		} else persistence.set(feature.moduleId, (yield* makeTargetPasskeyPersistence(m.base(feature), configuration)).passkeyPersistence);
 		const service = (services, moduleId) => {
 			const value = services.get(moduleId);
 			return value === void 0 ? Effect.fail(unavailable()) : Effect.succeed(value);