npm - @yielded/auth-persistence - Versions diffs - 0.1.0-beta.11 → 0.1.0-beta.13 - Mend

@yielded/auth-persistence 0.1.0-beta.11 → 0.1.0-beta.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (69) hide show

package/README.md +6 -1
package/dist/Adapter.d.mts +2 -2
package/dist/Adapter.mjs +4 -4
package/dist/internal/PasswordPreparedPostconditions.d.mts +1 -1
package/dist/internal/configuration.d.mts +1 -1
package/dist/internal/email-kernel.d.mts +5 -5
package/dist/internal/email-kernel.mjs +8 -6
package/dist/internal/email-kernel.mjs.map +1 -1
package/dist/internal/models/email-model.d.mts +1 -1
package/dist/internal/oauth-server.mjs +1 -1
package/dist/internal/oauth-server.mjs.map +1 -1
package/dist/internal/passkey/target.mjs +21 -12
package/dist/internal/passkey/target.mjs.map +1 -1
package/dist/internal/passkey/write-target.mjs +6 -6
package/dist/internal/passkey/write-target.mjs.map +1 -1
package/dist/internal/passkey-kernel.d.mts +9 -12
package/dist/internal/passkeys.mjs +8 -7
package/dist/internal/passkeys.mjs.map +1 -1
package/dist/internal/password-kernel.d.mts +3 -3
package/dist/internal/password-kernel.mjs +5 -4
package/dist/internal/password-kernel.mjs.map +1 -1
package/dist/internal/persistence.d.mts +3 -2
package/dist/internal/persistence.mjs +22 -26
package/dist/internal/persistence.mjs.map +1 -1
package/dist/internal/phone-kernel.mjs +6 -3
package/dist/internal/phone-kernel.mjs.map +1 -1
package/dist/internal/proof-kernel.d.mts +2 -2
package/dist/internal/proof-kernel.mjs +2 -1
package/dist/internal/proof-kernel.mjs.map +1 -1
package/dist/internal/registration.mjs +6 -1
package/dist/internal/registration.mjs.map +1 -1
package/dist/internal/session-kernel.d.mts +19 -9
package/dist/internal/session-kernel.mjs +155 -147
package/dist/internal/session-kernel.mjs.map +1 -1
package/dist/internal/sql-persistence.mjs +2 -3
package/dist/internal/sql-persistence.mjs.map +1 -1
package/dist/internal/sql-query.mjs +4 -2
package/dist/internal/sql-query.mjs.map +1 -1
package/dist/internal/standalone.d.mts +2 -4
package/dist/internal/standalone.mjs +2 -2
package/dist/internal/standalone.mjs.map +1 -1
package/dist/internal/storage-mapping.mjs +2 -2
package/dist/internal/storage-validation.mjs +4 -2
package/dist/internal/storage-validation.mjs.map +1 -1
package/dist/internal/transaction-execution-kernel.d.mts +6 -7
package/dist/internal/transaction-execution-kernel.mjs +9 -7
package/dist/internal/transaction-execution-kernel.mjs.map +1 -1
package/dist/internal/transaction-kernel.d.mts +7 -3
package/dist/internal/transaction-kernel.mjs +5 -2
package/dist/internal/transaction-kernel.mjs.map +1 -1
package/package.json +1 -1
package/src/Adapter.ts +6 -1
package/src/internal/email-kernel.ts +30 -35
package/src/internal/oauth-server.ts +1 -1
package/src/internal/passkey/target.ts +36 -43
package/src/internal/passkey/write-target.ts +4 -14
package/src/internal/passkeys.ts +4 -9
package/src/internal/password-kernel.ts +11 -12
package/src/internal/persistence.ts +77 -68
package/src/internal/phone-kernel.ts +21 -4
package/src/internal/proof-kernel.ts +2 -2
package/src/internal/registration.ts +22 -7
package/src/internal/session-kernel.ts +1122 -1139
package/src/internal/sql-persistence.ts +1 -1
package/src/internal/sql-query.ts +5 -3
package/src/internal/standalone.ts +5 -7
package/src/internal/storage-validation.ts +20 -16
package/src/internal/transaction-execution-kernel.ts +17 -15
package/src/internal/transaction-kernel.ts +7 -1

package/dist/internal/passkeys.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"passkeys.mjs","names":[],"sources":["../../src/internal/passkeys.ts"],"sourcesContent":["import { digest } from \"@yielded/auth-crypto\";\nimport {\n PasskeyCredentials,\n PasskeyCredential,\n PasskeyEnrollmentContext,\n PasskeyManagementPersistence,\n PasskeyManagementPolicy,\n PasskeyMethodPolicy,\n PasskeyPersistence,\n PasskeyProfile,\n PasskeyRequirement,\n PasskeyUnavailable,\n} from \"@yielded/auth/Passkey\";\nimport { Context, Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport {\n PersistenceConfigurationError,\n type MappingInput,\n type PasskeyFeature,\n} from \"./configuration\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n requiredPasskeyCredentialConstraints,\n requiredPasskeyPersistenceConstraints,\n type PasskeyCredentialMapping,\n type PasskeyPersistenceMapping,\n} from \"./models/passkey-model\";\nimport {\n requiredPasskeyManagementConstraints,\n type PasskeyManagementMapping,\n} from \"./models/passkey-write-model\";\nimport { makePasskeyKernel } from \"./passkey-kernel\";\nimport type { PasskeyTargetConfiguration } from \"./passkey/target\";\nimport type { Backend } from \"./persistence\";\nimport type { ProofSqlDatabase } from \"./proof-kernel\";\nimport type { SqlExpression as SQL, QueryOperations, TableModel } from \"./query-operations\";\nimport { requireStandalone } from \"./standalone\";\nimport { storageTables, type StorageRole } from \"./storage-tables\";\n\nconst profileJson = Schema.fromJsonString(PasskeyProfile);\nconst policyJson = Schema.fromJsonString(PasskeyMethodPolicy);\n\nconst seedJson = Schema.fromJsonString(\n Schema.Struct({\n policy: PasskeyMethodPolicy,\n management: Schema.optionalKey(PasskeyManagementPolicy),\n }),\n);\n\nconst ModuleRow = Schema.Struct({\n active: Schema.Boolean,\n policy: Schema.String,\n policyRevision: Schema.String,\n});\n\nconst credentialData = PasskeyCredential.mapFields(\n ({ revision: _revision, active: _active, ...fields }) => fields,\n);\n\nconst unavailable = () => PasskeyUnavailable.make({});\nconst configurationError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\ntype ReadMapping = PasskeyCredentialMapping<\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n unknown\n>;\ntype BaseMapping = PasskeyPersistenceMapping<\n ReadMapping,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n unknown\n>;\ntype ManagementMapping = PasskeyManagementMapping<\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n unknown\n>;\n\n/** Share the same passkey algorithms across raw SQL and Drizzle compilers. /\nexport const makeComposedPasskeys = (\n operations: QueryOperations,\n): Backend<object, never>[\"passkeys\"] => {\n const { and, eq, getTableColumns, inArray, or, sql } = operations;\n const { target, writeTarget } = makePasskeyKernel(operations);\n\n const {\n makeTargetPasskeyCredentials,\n makeTargetPasskeyEnrollmentContext,\n makeTargetPasskeyPersistence,\n } = target;\n\n const { makeTargetPasskeyManagement } = writeTarget;\n\n const mappings = (\n storage: MappingInput,\n namespace: string,\n dialect: \"pg\" \| \"sqlite\",\n passwordModules: ReadonlyArray<string>,\n signInProfiles: ReadonlyArray<PasskeyProfile>,\n ) => {\n const table = (role: StorageRole) => {\n const value = storage.tables[role];\n\n if (value === undefined) throw configurationError(`Missing ${role} mapping`);\n\n // Backend validation owns the foreign table shape. Row values are decoded below.\n return value;\n };\n\n const mapped = <Role extends StorageRole>(role: Role) => ({\n table: table(role),\n ...(Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key])) as {\n readonly [Key in keyof (typeof storageTables)[Role][\"columns\"]]: Key;\n }),\n });\n\n const column = (role: StorageRole, key: string) => getTableColumns(table(role))[key];\n const s = storage.subjects;\n const subject = s.table;\n const sc = getTableColumns(subject);\n const active = (value: unknown) => value === true;\n const owned = (value: unknown) => value === \"owned\";\n\n const read: ReadMapping = {\n subject: {\n table: subject,\n id: s.id,\n status: s.status,\n securityRevision: s.securityRevision,\n decodeId: (row) => row[s.id],\n isActiveStatus: (value) => Object.is(value, s.activeValue),\n activeCondition: eq(sc[s.status], s.activeValue),\n },\n credential: {\n ...mapped(\"passkeyCredentials\"),\n status: \"active\",\n decode: (row) =>\n Schema.decodeUnknownSync(credentialData)({\n ...row,\n profile: Schema.decodeUnknownSync(profileJson)(row.profile),\n }),\n decodeSubjectId: (row) => row.subjectId,\n isActiveStatus: active,\n activeCondition: eq(column(\"passkeyCredentials\", \"active\"), true),\n },\n authority: {\n ...mapped(\"credentials\"),\n status: \"active\",\n isActiveStatus: active,\n activeCondition: eq(column(\"credentials\", \"active\"), true),\n },\n credentialOwnership: {\n ...mapped(\"passkeyOwnership\"),\n isOwnedState: owned,\n ownedCondition: eq(column(\"passkeyOwnership\", \"state\"), \"owned\"),\n decodeSubjectId: (row) => row.subjectId,\n },\n handleOwnership: {\n ...mapped(\"passkeyHandles\"),\n isOwnedState: owned,\n ownedCondition: eq(column(\"passkeyHandles\", \"state\"), \"owned\"),\n decodeSubjectId: (row) => row.subjectId,\n },\n subjectIds: { toNative: s.toNativeSync, toSubject: s.toSubjectSync, equals: Object.is },\n constraints: requiredPasskeyCredentialConstraints,\n };\n\n const base = (feature: PasskeyFeature): BaseMapping => ({\n moduleId: feature.moduleId,\n authorityScope: namespace,\n read,\n module: {\n ...mapped(\"passkeyModules\"),\n status: \"active\",\n policyColumns: [\"policy\", \"policyRevision\"],\n isActiveStatus: active,\n activeCondition: eq(column(\"passkeyModules\", \"active\"), true),\n decodeMethodPolicy: (row) => Schema.decodeUnknownSync(policyJson)(row.policy),\n },\n flow: {\n ...mapped(\"passkeyFlows\"),\n states: {\n Pending: \"Pending\",\n Claimed: \"Claimed\",\n Verified: \"Verified\",\n Rejected: \"Rejected\",\n Ambiguous: \"Ambiguous\",\n RegistrationAccepted: \"RegistrationAccepted\",\n ProvisioningPending: \"ProvisioningPending\",\n },\n encodeInsert: () => ({}),\n },\n admission: mapped(\"passkeyAdmissions\"),\n charge: { ...mapped(\"passkeyCharges\"), encodeInsert: () => ({}) },\n clock: {\n encodeInstant: storage.encodeInstant,\n decodeInstant: storage.decodeInstantSync,\n engineNowMillis:\n dialect === \"pg\"\n ? sql`cast(extract(epoch from clock_timestamp()) 1000 as bigint)`\n : sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`,\n toMillis: (expression) => expression,\n fromMillis: (expression) => expression,\n },\n telemetry: { lastUsedAt: \"lastUsedAt\", encodeBackupState: (value) => value },\n constraints: requiredPasskeyPersistenceConstraints,\n });\n\n const management = (feature: PasskeyFeature): ManagementMapping => {\n const policy = feature.managementPolicy;\n\n if (policy === undefined)\n throw configurationError(`Missing passkey management policy for ${feature.moduleId}`);\n const c = getTableColumns(table(\"passkeyCredentials\"));\n const f = getTableColumns(table(\"credentials\"));\n\n const metadata = (subjectId: unknown) =>\n sql`exists(select 1 from ${subject} where ${sc[s.id]} = ${subjectId} and ${sc[s.status]} = ${s.activeValue})`;\n\n return {\n ...base(feature),\n write: {\n credential: {\n name: \"name\",\n createdAt: \"createdAt\",\n encodeInsert: ({ credential, subjectId, summary, marker }) => ({\n credentialId: credential.credentialId,\n subjectId,\n rpId: credential.rpId,\n protocolCredentialId: credential.protocolCredentialId,\n userHandle: credential.userHandle,\n credentialKey: \"\",\n handleKey: \"\",\n publicKey: credential.publicKey,\n algorithm: credential.algorithm,\n profile: Schema.encodeSync(profileJson)(credential.profile),\n credentialRevision: marker,\n active: true,\n primarySignIn: credential.primarySignIn,\n enrollmentUserVerified: credential.enrollmentUserVerified,\n backupEligible: credential.backupEligible,\n backupState: credential.backupState,\n counter: credential.counter,\n maximumCounter: credential.maximumCounter,\n name: summary.name,\n createdAt: storage.encodeInstant(summary.createdAtMillis),\n }),\n encodePrimarySignIn: (value) => value,\n encodeEnrollmentUserVerified: (value) => value,\n encodeBackupEligible: (value) => value,\n activeStatus: true,\n removedStatus: false,\n },\n authority: {\n encodeInsert: ({ subjectId, credential, marker }) => ({\n subjectId,\n credentialId: credential.credentialId,\n revision: marker,\n active: true,\n }),\n activeStatus: true,\n removedStatus: false,\n },\n credentialOwnership: {\n encodeInsert: ({ credential, marker }) => ({\n credentialKey: \"\",\n rpId: credential.rpId,\n protocolCredentialId: credential.protocolCredentialId,\n state: \"owned\",\n version: marker,\n }),\n ownedState: \"owned\",\n removedState: \"removed\",\n },\n handleOwnership: {\n encodeInsert: ({ subjectId, rpId, userHandle, marker }) => ({\n subjectId,\n rpId,\n userHandle,\n handleKey: \"\",\n state: \"owned\",\n version: marker,\n }),\n ownedState: \"owned\",\n },\n policy: {\n subjectColumns: Object.keys(sc),\n management: () => policy,\n requirement: s.actionRequirements,\n metadata,\n action: metadata,\n remainingSignIn: (subjectId, excluded, row) =>\n Effect.gen(function* () {\n const requirement = yield* Schema.decodeUnknownEffect(PasskeyRequirement)(\n yield* s.requirements(row),\n );\n\n const alternatives: SQL[] = [];\n\n // Only retain complete sign-in paths enabled by this Auth definition.\n // More involved combinations require an explicit application's predicate.\n if (\n requirement.alternatives.some(\n (alternative) =>\n alternative.minimumCredentials === 1 &&\n alternative.factors.every((factor) => factor === \"possession\"),\n )\n ) {\n const profiles = signInProfiles.map((profile) =>\n Schema.encodeSync(profileJson)(profile),\n );\n\n alternatives.push(sql`exists(\n select 1 from ${table(\"passkeyCredentials\")} join ${table(\"credentials\")}\n on ${f.credentialId} = ${c.credentialId} and ${f.subjectId} = ${c.subjectId}\n and ${f.revision} = ${c.credentialRevision} and ${f.active} = ${true}\n where ${c.subjectId} = ${subjectId} and ${c.credentialId} <> ${excluded}\n and ${c.active} = ${true} and ${c.primarySignIn} = ${true}\n and ${c.enrollmentUserVerified} = ${true} and ${inArray(c.profile, profiles)}\n )`);\n }\n if (\n passwordModules.length > 0 &&\n requirement.alternatives.some(\n (alternative) =>\n alternative.minimumCredentials === 1 &&\n !alternative.userVerified &&\n !alternative.phishingResistant &&\n alternative.factors.every((factor) => factor === \"knowledge\"),\n )\n ) {\n const p = getTableColumns(table(\"passwords\"));\n const i = getTableColumns(table(\"identifiers\"));\n\n alternatives.push(sql`exists(\n select 1 from ${table(\"passwords\")} join ${table(\"credentials\")}\n on ${f.credentialId} = ${p.credentialId} and ${f.subjectId} = ${p.subjectId}\n and ${f.revision} = ${p.credentialRevision} and ${f.active} = ${true}\n join ${table(\"identifiers\")} on ${i.subjectId} = ${p.subjectId}\n and ${i.active} = ${true} and ${i.namespace} = 'email'\n where ${p.subjectId} = ${subjectId} and ${p.credentialId} <> ${excluded}\n and ${inArray(p.moduleId, passwordModules)}\n )`);\n }\n\n return or(...alternatives) ?? sql`false`;\n }).pipe(\n Effect.mapError((cause) =>\n PersistenceMappingError.make({ operation: \"mapping\", cause }),\n ),\n ),\n },\n },\n command: { ...mapped(\"passkeyCommands\"), encodeInsert: (input) => ({ ...input }) },\n managementConstraints: requiredPasskeyManagementConstraints,\n invalidation: {\n window: {\n trigger: \"credential-change\",\n existingSessions: \"immediate\",\n maximumExposureMillis: 0,\n oldAuthenticationEvidence: \"rejected\",\n },\n mutations: [],\n postcondition: ({ subjectId, securityRevision }) =>\n sql`exists(select 1 from ${subject} where ${sc[s.id]} = ${subjectId} and ${sc[s.securityRevision]} = ${securityRevision})`,\n },\n };\n };\n\n return { read, base, management, table };\n };\n\n const make: Backend<object, never>[\"passkeys\"] = Effect.fn(\"AuthPersistence.passkeys\")(\n function* ({ database, storage, namespace, dialect, features, passwordModules }) {\n const client = yield* SqlClient.SqlClient;\n\n const policies = yield* Effect.forEach(features, (feature) =>\n Effect.map(feature.policy, (policy) => ({ feature, policy })),\n );\n\n const m = yield* Effect.try({\n try: () =>\n mappings(\n storage,\n namespace,\n dialect,\n passwordModules,\n policies.flatMap(({ feature, policy }) => (feature.management ? [] : policy.profiles)),\n ),\n catch: () => configurationError(\"Invalid passkey table mappings\"),\n });\n\n const configuration: PasskeyTargetConfiguration = {\n mode: \"interactive\",\n dialect,\n locking: dialect === \"pg\",\n standaloneGuard: () => requireStandalone(unavailable, client),\n };\n\n // The backend has already checked the native query builder; schemas check stored values.\n const native = database as ProofSqlDatabase;\n\n yield* client.withTransaction(\n Effect.gen(function* () {\n if (dialect === \"pg\")\n yield* client`select pg_advisory_xact_lock(hashtext(${`${namespace}/passkeys`}))`;\n for (const { feature, policy } of policies) {\n const encoded = yield* Schema.encodeEffect(policyJson)(policy);\n\n const policyRevision = digest(\n yield* Schema.encodeEffect(seedJson)({\n policy,\n ...(feature.managementPolicy === undefined\n ? {}\n : { management: feature.managementPolicy }),\n }),\n );\n\n const module = m.table(\"passkeyModules\");\n const columns = getTableColumns(module);\n\n yield* native\n .insert(module)\n .values({ moduleId: feature.moduleId, active: true, policy: encoded, policyRevision })\n .onConflictDoNothing();\n\n const rows = yield* native\n .select()\n .from(module)\n .where(eq(columns.moduleId, feature.moduleId));\n\n const row = yield* Schema.decodeUnknownEffect(ModuleRow)(rows[0]);\n\n if (!row.active)\n return yield* configurationError(`Passkey module ${feature.moduleId} is disabled`);\n if (row.policyRevision !== policyRevision) {\n const previous = yield* Schema.decodeEffect(policyJson)(row.policy);\n\n if (policy.generation <= previous.generation)\n return yield* configurationError(\n `Increase the passkey policy generation to change ${feature.moduleId}`,\n );\n yield* native\n .update(module)\n .set({ policy: encoded, policyRevision })\n .where(\n and(\n eq(columns.moduleId, feature.moduleId),\n eq(columns.policyRevision, row.policyRevision),\n eq(columns.active, true),\n ),\n );\n\n const updated = yield* native\n .select()\n .from(module)\n .where(eq(columns.moduleId, feature.moduleId));\n\n const applied = yield* Schema.decodeUnknownEffect(ModuleRow)(updated[0]);\n\n if (!applied.active \|\| applied.policyRevision !== policyRevision)\n return yield* configurationError(\n `Passkey policy changed while configuring ${feature.moduleId}`,\n );\n }\n yield* native\n .insert(m.table(\"passkeyAdmissions\"))\n .values({\n authorityScope: namespace,\n moduleId: feature.moduleId,\n version: policyRevision,\n ownerMarker: policyRevision,\n })\n .onConflictDoNothing();\n }\n }),\n );\n\n const credential = yield* makeTargetPasskeyCredentials<ReadMapping, never>(\n database,\n m.read,\n configuration,\n );\n\n const persistence = new Map<string, PasskeyPersistence[\"Service\"]>();\n const managers = new Map<string, PasskeyManagementPersistence[\"Service\"]>();\n const enrollment = new Map<string, PasskeyEnrollmentContext[\"Service\"]>();\n\n for (const feature of features) {\n if (feature.management) {\n const mapping = yield* Effect.try({\n try: () => m.management(feature),\n catch: () =>\n configurationError(`Invalid passkey management mapping for ${feature.moduleId}`),\n });\n\n const services = yield* makeTargetPasskeyManagement<ManagementMapping, never>(\n database,\n mapping,\n configuration,\n );\n\n persistence.set(feature.moduleId, services.passkeyPersistence);\n managers.set(feature.moduleId, services.passkeyManagementPersistence);\n enrollment.set(\n feature.moduleId,\n (yield* makeTargetPasskeyEnrollmentContext<ManagementMapping, never>(\n database,\n mapping,\n configuration,\n )).passkeyEnrollmentContext,\n );\n } else {\n persistence.set(\n feature.moduleId,\n (yield* makeTargetPasskeyPersistence<BaseMapping, never>(\n database,\n m.base(feature),\n configuration,\n )).passkeyPersistence,\n );\n }\n }\n\n const service = <A>(services: ReadonlyMap<string, A>, moduleId: string) => {\n const value = services.get(moduleId);\n\n return value === undefined ? Effect.fail(unavailable()) : Effect.succeed(value);\n };\n\n let context: Context.Context<never> = Context.make(\n PasskeyCredentials,\n credential.passkeyCredentials,\n ).pipe(\n Context.add(PasskeyPersistence, {\n issue: (input, prepare) =>\n Effect.flatMap(service(persistence, input.ceremony.moduleId), (s) =>\n s.issue(input, prepare),\n ),\n context: (input) =>\n Effect.flatMap(service(persistence, input.moduleId), (s) => s.context(input)),\n claim: (input, prepare) =>\n Effect.flatMap(service(persistence, input.ceremony.moduleId), (s) =>\n s.claim(input, prepare),\n ),\n settle: (input, prepare) =>\n Effect.flatMap(service(persistence, input.claim.ceremony.moduleId), (s) =>\n s.settle(input, prepare),\n ),\n cleanup: (input, prepare) =>\n Effect.flatMap(service(persistence, input.moduleId), (s) => s.cleanup(input, prepare)),\n }),\n );\n\n if (managers.size > 0)\n context = context.pipe(\n Context.add(PasskeyEnrollmentContext, {\n capture: (input) =>\n Effect.flatMap(service(enrollment, input.moduleId), (s) => s.capture(input)),\n }),\n Context.add(PasskeyManagementPersistence, {\n issueEnrollment: (input, prepare) =>\n Effect.flatMap(service(managers, input.ceremony.moduleId), (s) =>\n s.issueEnrollment(input, prepare),\n ),\n completeEnrollment: (input, prepare) =>\n Effect.flatMap(service(managers, input.claim.ceremony.moduleId), (s) =>\n s.completeEnrollment(input, prepare),\n ),\n list: (input) =>\n Effect.flatMap(service(managers, input.moduleId), (s) => s.list(input)),\n inspectRemove: (input) =>\n Effect.flatMap(service(managers, input.moduleId), (s) => s.inspectRemove(input)),\n rename: (input, prepare) =>\n Effect.flatMap(service(managers, input.moduleId), (s) => s.rename(input, prepare)),\n remove: (input, prepare) =>\n Effect.flatMap(service(managers, input.moduleId), (s) => s.remove(input, prepare)),\n }),\n );\n\n return context;\n },\n Effect.mapError((error) =>\n Schema.is(PersistenceConfigurationError)(error)\n ? error\n : configurationError(\"Unable to configure passkey persistence\"),\n ),\n );\n\n return make;\n};\n"],"mappings":";;;;;;;;;;;;AAwCA,MAAM,cAAc,OAAO,eAAe,cAAc;AACxD,MAAM,aAAa,OAAO,eAAe,mBAAmB;AAE5D,MAAM,WAAW,OAAO,eACtB,OAAO,OAAO;CACZ,QAAQ;CACR,YAAY,OAAO,YAAY,uBAAuB;AACxD,CAAC,CACH;AAEA,MAAM,YAAY,OAAO,OAAO;CAC9B,QAAQ,OAAO;CACf,QAAQ,OAAO;CACf,gBAAgB,OAAO;AACzB,CAAC;AAED,MAAM,iBAAiB,kBAAkB,WACtC,EAAE,UAAU,WAAW,QAAQ,SAAS,GAAG,aAAa,MAC3D;AAEA,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;AACpD,MAAM,sBAAsB,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;;AAiC5F,MAAa,wBACX,eACuC;CACvC,MAAM,EAAE,KAAK,IAAI,iBAAiB,SAAS,IAAI,QAAQ;CACvD,MAAM,EAAE,QAAQ,gBAAgB,kBAAkB,UAAU;CAE5D,MAAM,EACJ,8BACA,oCACA,iCACE;CAEJ,MAAM,EAAE,gCAAgC;CAExC,MAAM,YACJ,SACA,WACA,SACA,iBACA,mBACG;EACH,MAAM,SAAS,SAAsB;GACnC,MAAM,QAAQ,QAAQ,OAAO;GAE7B,IAAI,UAAU,KAAA,GAAW,MAAM,mBAAmB,WAAW,KAAK,SAAS;GAG3E,OAAO;EACT;EAEA,MAAM,UAAoC,UAAgB;GACxD,OAAO,MAAM,IAAI;GACjB,GAAI,OAAO,YAAY,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;EAG1F;EAEA,MAAM,UAAU,MAAmB,QAAgB,gBAAgB,MAAM,IAAI,CAAC,CAAC,CAAC;EAChF,MAAM,IAAI,QAAQ;EAClB,MAAM,UAAU,EAAE;EAClB,MAAM,KAAK,gBAAgB,OAAO;EAClC,MAAM,UAAU,UAAmB,UAAU;EAC7C,MAAM,SAAS,UAAmB,UAAU;EAE5C,MAAM,OAAoB;GACxB,SAAS;IACP,OAAO;IACP,IAAI,EAAE;IACN,QAAQ,EAAE;IACV,kBAAkB,EAAE;IACpB,WAAW,QAAQ,IAAI,EAAE;IACzB,iBAAiB,UAAU,OAAO,GAAG,OAAO,EAAE,WAAW;IACzD,iBAAiB,GAAG,GAAG,EAAE,SAAS,EAAE,WAAW;GACjD;GACA,YAAY;IACV,GAAG,OAAO,oBAAoB;IAC9B,QAAQ;IACR,SAAS,QACP,OAAO,kBAAkB,cAAc,CAAC,CAAC;KACvC,GAAG;KACH,SAAS,OAAO,kBAAkB,WAAW,CAAC,CAAC,IAAI,OAAO;IAC5D,CAAC;IACH,kBAAkB,QAAQ,IAAI;IAC9B,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,sBAAsB,QAAQ,GAAG,IAAI;GAClE;GACA,WAAW;IACT,GAAG,OAAO,aAAa;IACvB,QAAQ;IACR,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,eAAe,QAAQ,GAAG,IAAI;GAC3D;GACA,qBAAqB;IACnB,GAAG,OAAO,kBAAkB;IAC5B,cAAc;IACd,gBAAgB,GAAG,OAAO,oBAAoB,OAAO,GAAG,OAAO;IAC/D,kBAAkB,QAAQ,IAAI;GAChC;GACA,iBAAiB;IACf,GAAG,OAAO,gBAAgB;IAC1B,cAAc;IACd,gBAAgB,GAAG,OAAO,kBAAkB,OAAO,GAAG,OAAO;IAC7D,kBAAkB,QAAQ,IAAI;GAChC;GACA,YAAY;IAAE,UAAU,EAAE;IAAc,WAAW,EAAE;IAAe,QAAQ,OAAO;GAAG;GACtF,aAAa;EACf;EAEA,MAAM,QAAQ,aAA0C;GACtD,UAAU,QAAQ;GAClB,gBAAgB;GAChB;GACA,QAAQ;IACN,GAAG,OAAO,gBAAgB;IAC1B,QAAQ;IACR,eAAe,CAAC,UAAU,gBAAgB;IAC1C,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,kBAAkB,QAAQ,GAAG,IAAI;IAC5D,qBAAqB,QAAQ,OAAO,kBAAkB,UAAU,CAAC,CAAC,IAAI,MAAM;GAC9E;GACA,MAAM;IACJ,GAAG,OAAO,cAAc;IACxB,QAAQ;KACN,SAAS;KACT,SAAS;KACT,UAAU;KACV,UAAU;KACV,WAAW;KACX,sBAAsB;KACtB,qBAAqB;IACvB;IACA,qBAAqB,CAAC;GACxB;GACA,WAAW,OAAO,mBAAmB;GACrC,QAAQ;IAAE,GAAG,OAAO,gBAAgB;IAAG,qBAAqB,CAAC;GAAG;GAChE,OAAO;IACL,eAAe,QAAQ;IACvB,eAAe,QAAQ;IACvB,iBACE,YAAY,OACR,GAAG,iEACH,GAAG;IACT,WAAW,eAAe;IAC1B,aAAa,eAAe;GAC9B;GACA,WAAW;IAAE,YAAY;IAAc,oBAAoB,UAAU;GAAM;GAC3E,aAAa;EACf;EAEA,MAAM,cAAc,YAA+C;GACjE,MAAM,SAAS,QAAQ;GAEvB,IAAI,WAAW,KAAA,GACb,MAAM,mBAAmB,yCAAyC,QAAQ,UAAU;GACtF,MAAM,IAAI,gBAAgB,MAAM,oBAAoB,CAAC;GACrD,MAAM,IAAI,gBAAgB,MAAM,aAAa,CAAC;GAE9C,MAAM,YAAY,cAChB,GAAG,wBAAwB,QAAQ,SAAS,GAAG,EAAE,IAAI,KAAK,UAAU,OAAO,GAAG,EAAE,QAAQ,KAAK,EAAE,YAAY;GAE7G,OAAO;IACL,GAAG,KAAK,OAAO;IACf,OAAO;KACL,YAAY;MACV,MAAM;MACN,WAAW;MACX,eAAe,EAAE,YAAY,WAAW,SAAS,cAAc;OAC7D,cAAc,WAAW;OACzB;OACA,MAAM,WAAW;OACjB,sBAAsB,WAAW;OACjC,YAAY,WAAW;OACvB,eAAe;OACf,WAAW;OACX,WAAW,WAAW;OACtB,WAAW,WAAW;OACtB,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC,WAAW,OAAO;OAC1D,oBAAoB;OACpB,QAAQ;OACR,eAAe,WAAW;OAC1B,wBAAwB,WAAW;OACnC,gBAAgB,WAAW;OAC3B,aAAa,WAAW;OACxB,SAAS,WAAW;OACpB,gBAAgB,WAAW;OAC3B,MAAM,QAAQ;OACd,WAAW,QAAQ,cAAc,QAAQ,eAAe;MAC1D;MACA,sBAAsB,UAAU;MAChC,+BAA+B,UAAU;MACzC,uBAAuB,UAAU;MACjC,cAAc;MACd,eAAe;KACjB;KACA,WAAW;MACT,eAAe,EAAE,WAAW,YAAY,cAAc;OACpD;OACA,cAAc,WAAW;OACzB,UAAU;OACV,QAAQ;MACV;MACA,cAAc;MACd,eAAe;KACjB;KACA,qBAAqB;MACnB,eAAe,EAAE,YAAY,cAAc;OACzC,eAAe;OACf,MAAM,WAAW;OACjB,sBAAsB,WAAW;OACjC,OAAO;OACP,SAAS;MACX;MACA,YAAY;MACZ,cAAc;KAChB;KACA,iBAAiB;MACf,eAAe,EAAE,WAAW,MAAM,YAAY,cAAc;OAC1D;OACA;OACA;OACA,WAAW;OACX,OAAO;OACP,SAAS;MACX;MACA,YAAY;KACd;KACA,QAAQ;MACN,gBAAgB,OAAO,KAAK,EAAE;MAC9B,kBAAkB;MAClB,aAAa,EAAE;MACf;MACA,QAAQ;MACR,kBAAkB,WAAW,UAAU,QACrC,OAAO,IAAI,aAAa;OACtB,MAAM,cAAc,OAAO,OAAO,oBAAoB,kBAAkB,CAAC,CACvE,OAAO,EAAE,aAAa,GAAG,CAC3B;OAEA,MAAM,eAAsB,CAAC;OAI7B,IACE,YAAY,aAAa,MACtB,gBACC,YAAY,uBAAuB,KACnC,YAAY,QAAQ,OAAO,WAAW,WAAW,YAAY,CACjE,GACA;QACA,MAAM,WAAW,eAAe,KAAK,YACnC,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,CACxC;QAEA,aAAa,KAAK,GAAG;kCACL,MAAM,oBAAoB,EAAE,QAAQ,MAAM,aAAa,EAAE;uBACpE,EAAE,aAAa,KAAK,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,EAAE,UAAU;0BACpE,EAAE,SAAS,KAAK,EAAE,mBAAmB,OAAO,EAAE,OAAO,KAAK,KAAK;0BAC/D,EAAE,UAAU,KAAK,UAAU,OAAO,EAAE,aAAa,MAAM,SAAS;0BAChE,EAAE,OAAO,KAAK,KAAK,OAAO,EAAE,cAAc,KAAK,KAAK;0BACpD,EAAE,uBAAuB,KAAK,KAAK,OAAO,QAAQ,EAAE,SAAS,QAAQ,EAAE;kBAC/E;OACF;OACA,IACE,gBAAgB,SAAS,KACzB,YAAY,aAAa,MACtB,gBACC,YAAY,uBAAuB,KACnC,CAAC,YAAY,gBACb,CAAC,YAAY,qBACb,YAAY,QAAQ,OAAO,WAAW,WAAW,WAAW,CAChE,GACA;QACA,MAAM,IAAI,gBAAgB,MAAM,WAAW,CAAC;QAC5C,MAAM,IAAI,gBAAgB,MAAM,aAAa,CAAC;QAE9C,aAAa,KAAK,GAAG;kCACL,MAAM,WAAW,EAAE,QAAQ,MAAM,aAAa,EAAE;uBAC3D,EAAE,aAAa,KAAK,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,EAAE,UAAU;0BACpE,EAAE,SAAS,KAAK,EAAE,mBAAmB,OAAO,EAAE,OAAO,KAAK,KAAK;yBAChE,MAAM,aAAa,EAAE,MAAM,EAAE,UAAU,KAAK,EAAE,UAAU;0BACvD,EAAE,OAAO,KAAK,KAAK,OAAO,EAAE,UAAU;0BACtC,EAAE,UAAU,KAAK,UAAU,OAAO,EAAE,aAAa,MAAM,SAAS;0BAChE,QAAQ,EAAE,UAAU,eAAe,EAAE;kBAC7C;OACF;OAEA,OAAO,GAAG,GAAG,YAAY,KAAK,GAAG;MACnC,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,wBAAwB,KAAK;OAAE,WAAW;OAAW;MAAM,CAAC,CAC9D,CACF;KACJ;IACF;IACA,SAAS;KAAE,GAAG,OAAO,iBAAiB;KAAG,eAAe,WAAW,EAAE,GAAG,MAAM;IAAG;IACjF,uBAAuB;IACvB,cAAc;KACZ,QAAQ;MACN,SAAS;MACT,kBAAkB;MAClB,uBAAuB;MACvB,2BAA2B;KAC7B;KACA,WAAW,CAAC;KACZ,gBAAgB,EAAE,WAAW,uBAC3B,GAAG,wBAAwB,QAAQ,SAAS,GAAG,EAAE,IAAI,KAAK,UAAU,OAAO,GAAG,EAAE,kBAAkB,KAAK,iBAAiB;IAC5H;GACF;EACF;EAEA,OAAO;GAAE;GAAM;GAAM;GAAY;EAAM;CACzC;CA2NA,OAzNiD,OAAO,GAAG,0BAA0B,CAAC,CACpF,WAAW,EAAE,UAAU,SAAS,WAAW,SAAS,UAAU,mBAAmB;EAC/E,MAAM,SAAS,OAAO,UAAU;EAEhC,MAAM,WAAW,OAAO,OAAO,QAAQ,WAAW,YAChD,OAAO,IAAI,QAAQ,SAAS,YAAY;GAAE;GAAS;EAAO,EAAE,CAC9D;EAEA,MAAM,IAAI,OAAO,OAAO,IAAI;GAC1B,WACE,SACE,SACA,WACA,SACA,iBACA,SAAS,SAAS,EAAE,SAAS,aAAc,QAAQ,aAAa,CAAC,IAAI,OAAO,QAAS,CACvF;GACF,aAAa,mBAAmB,gCAAgC;EAClE,CAAC;EAED,MAAM,gBAA4C;GAChD,MAAM;GACN;GACA,SAAS,YAAY;GACrB,uBAAuB,kBAAkB,aAAa,MAAM;EAC9D;EAGA,MAAM,SAAS;EAEf,OAAO,OAAO,gBACZ,OAAO,IAAI,aAAa;GACtB,IAAI,YAAY,MACd,OAAO,MAAM,yCAAyC,GAAG,UAAU,WAAW;GAChF,KAAK,MAAM,EAAE,SAAS,YAAY,UAAU;IAC1C,MAAM,UAAU,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,MAAM;IAE7D,MAAM,iBAAiB,OACrB,OAAO,OAAO,aAAa,QAAQ,CAAC,CAAC;KACnC;KACA,GAAI,QAAQ,qBAAqB,KAAA,IAC7B,CAAC,IACD,EAAE,YAAY,QAAQ,iBAAiB;IAC7C,CAAC,CACH;IAEA,MAAM,SAAS,EAAE,MAAM,gBAAgB;IACvC,MAAM,UAAU,gBAAgB,MAAM;IAEtC,OAAO,OACJ,OAAO,MAAM,CAAC,CACd,OAAO;KAAE,UAAU,QAAQ;KAAU,QAAQ;KAAM,QAAQ;KAAS;IAAe,CAAC,CAAC,CACrF,oBAAoB;IAEvB,MAAM,OAAO,OAAO,OACjB,OAAO,CAAC,CACR,KAAK,MAAM,CAAC,CACZ,MAAM,GAAG,QAAQ,UAAU,QAAQ,QAAQ,CAAC;IAE/C,MAAM,MAAM,OAAO,OAAO,oBAAoB,SAAS,CAAC,CAAC,KAAK,EAAE;IAEhE,IAAI,CAAC,IAAI,QACP,OAAO,OAAO,mBAAmB,kBAAkB,QAAQ,SAAS,aAAa;IACnF,IAAI,IAAI,mBAAmB,gBAAgB;KACzC,MAAM,WAAW,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,IAAI,MAAM;KAElE,IAAI,OAAO,cAAc,SAAS,YAChC,OAAO,OAAO,mBACZ,oDAAoD,QAAQ,UAC9D;KACF,OAAO,OACJ,OAAO,MAAM,CAAC,CACd,IAAI;MAAE,QAAQ;MAAS;KAAe,CAAC,CAAC,CACxC,MACC,IACE,GAAG,QAAQ,UAAU,QAAQ,QAAQ,GACrC,GAAG,QAAQ,gBAAgB,IAAI,cAAc,GAC7C,GAAG,QAAQ,QAAQ,IAAI,CACzB,CACF;KAEF,MAAM,UAAU,OAAO,OACpB,OAAO,CAAC,CACR,KAAK,MAAM,CAAC,CACZ,MAAM,GAAG,QAAQ,UAAU,QAAQ,QAAQ,CAAC;KAE/C,MAAM,UAAU,OAAO,OAAO,oBAAoB,SAAS,CAAC,CAAC,QAAQ,EAAE;KAEvE,IAAI,CAAC,QAAQ,UAAU,QAAQ,mBAAmB,gBAChD,OAAO,OAAO,mBACZ,4CAA4C,QAAQ,UACtD;IACJ;IACA,OAAO,OACJ,OAAO,EAAE,MAAM,mBAAmB,CAAC,CAAC,CACpC,OAAO;KACN,gBAAgB;KAChB,UAAU,QAAQ;KAClB,SAAS;KACT,aAAa;IACf,CAAC,CAAC,CACD,oBAAoB;GACzB;EACF,CAAC,CACH;EAEA,MAAM,aAAa,OAAO,6BACxB,UACA,EAAE,MACF,aACF;EAEA,MAAM,8BAAc,IAAI,IAA2C;EACnE,MAAM,2BAAW,IAAI,IAAqD;EAC1E,MAAM,6BAAa,IAAI,IAAiD;EAExE,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,YAAY;GACtB,MAAM,UAAU,OAAO,OAAO,IAAI;IAChC,WAAW,EAAE,WAAW,OAAO;IAC/B,aACE,mBAAmB,0CAA0C,QAAQ,UAAU;GACnF,CAAC;GAED,MAAM,WAAW,OAAO,4BACtB,UACA,SACA,aACF;GAEA,YAAY,IAAI,QAAQ,UAAU,SAAS,kBAAkB;GAC7D,SAAS,IAAI,QAAQ,UAAU,SAAS,4BAA4B;GACpE,WAAW,IACT,QAAQ,WACP,OAAO,mCACN,UACA,SACA,aACF,EAAA,CAAG,wBACL;EACF,OACE,YAAY,IACV,QAAQ,WACP,OAAO,6BACN,UACA,EAAE,KAAK,OAAO,GACd,aACF,EAAA,CAAG,kBACL;EAIJ,MAAM,WAAc,UAAkC,aAAqB;GACzE,MAAM,QAAQ,SAAS,IAAI,QAAQ;GAEnC,OAAO,UAAU,KAAA,IAAY,OAAO,KAAK,YAAY,CAAC,IAAI,OAAO,QAAQ,KAAK;EAChF;EAEA,IAAI,UAAkC,QAAQ,KAC5C,oBACA,WAAW,kBACb,CAAC,CAAC,KACA,QAAQ,IAAI,oBAAoB;GAC9B,QAAQ,OAAO,YACb,OAAO,QAAQ,QAAQ,aAAa,MAAM,SAAS,QAAQ,IAAI,MAC7D,EAAE,MAAM,OAAO,OAAO,CACxB;GACF,UAAU,UACR,OAAO,QAAQ,QAAQ,aAAa,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,KAAK,CAAC;GAC9E,QAAQ,OAAO,YACb,OAAO,QAAQ,QAAQ,aAAa,MAAM,SAAS,QAAQ,IAAI,MAC7D,EAAE,MAAM,OAAO,OAAO,CACxB;GACF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,aAAa,MAAM,MAAM,SAAS,QAAQ,IAAI,MACnE,EAAE,OAAO,OAAO,OAAO,CACzB;GACF,UAAU,OAAO,YACf,OAAO,QAAQ,QAAQ,aAAa,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;EACzF,CAAC,CACH;EAEA,IAAI,SAAS,OAAO,GAClB,UAAU,QAAQ,KAChB,QAAQ,IAAI,0BAA0B,EACpC,UAAU,UACR,OAAO,QAAQ,QAAQ,YAAY,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,KAAK,CAAC,EAC/E,CAAC,GACD,QAAQ,IAAI,8BAA8B;GACxC,kBAAkB,OAAO,YACvB,OAAO,QAAQ,QAAQ,UAAU,MAAM,SAAS,QAAQ,IAAI,MAC1D,EAAE,gBAAgB,OAAO,OAAO,CAClC;GACF,qBAAqB,OAAO,YAC1B,OAAO,QAAQ,QAAQ,UAAU,MAAM,MAAM,SAAS,QAAQ,IAAI,MAChE,EAAE,mBAAmB,OAAO,OAAO,CACrC;GACF,OAAO,UACL,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,KAAK,KAAK,CAAC;GACxE,gBAAgB,UACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,cAAc,KAAK,CAAC;GACjF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;GACnF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;EACrF,CAAC,CACH;EAEF,OAAO;CACT,GACA,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,mBAAmB,yCAAyC,CAClE,CAGQ;AACZ"}
1	+ {"version":3,"file":"passkeys.mjs","names":[],"sources":["../../src/internal/passkeys.ts"],"sourcesContent":["import { digest } from \"@yielded/auth-crypto\";\nimport {\n PasskeyCredentials,\n PasskeyCredential,\n PasskeyEnrollmentContext,\n PasskeyManagementPersistence,\n PasskeyManagementPolicy,\n PasskeyMethodPolicy,\n PasskeyPersistence,\n PasskeyProfile,\n PasskeyRequirement,\n PasskeyUnavailable,\n} from \"@yielded/auth/Passkey\";\nimport { Context, Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport {\n PersistenceConfigurationError,\n type MappingInput,\n type PasskeyFeature,\n} from \"./configuration\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n requiredPasskeyCredentialConstraints,\n requiredPasskeyPersistenceConstraints,\n type PasskeyCredentialMapping,\n type PasskeyPersistenceMapping,\n} from \"./models/passkey-model\";\nimport {\n requiredPasskeyManagementConstraints,\n type PasskeyManagementMapping,\n} from \"./models/passkey-write-model\";\nimport { makePasskeyKernel } from \"./passkey-kernel\";\nimport type { PasskeyTargetConfiguration } from \"./passkey/target\";\nimport type { Backend } from \"./persistence\";\nimport { CurrentProofSql } from \"./proof-kernel\";\nimport type { SqlExpression as SQL, QueryOperations, TableModel } from \"./query-operations\";\nimport { requireStandalone } from \"./standalone\";\nimport { storageTables, type StorageRole } from \"./storage-tables\";\n\nconst profileJson = Schema.fromJsonString(PasskeyProfile);\nconst policyJson = Schema.fromJsonString(PasskeyMethodPolicy);\n\nconst seedJson = Schema.fromJsonString(\n Schema.Struct({\n policy: PasskeyMethodPolicy,\n management: Schema.optionalKey(PasskeyManagementPolicy),\n }),\n);\n\nconst ModuleRow = Schema.Struct({\n active: Schema.Boolean,\n policy: Schema.String,\n policyRevision: Schema.String,\n});\n\nconst credentialData = PasskeyCredential.mapFields(\n ({ revision: _revision, active: _active, ...fields }) => fields,\n);\n\nconst unavailable = () => PasskeyUnavailable.make({});\nconst configurationError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\ntype ReadMapping = PasskeyCredentialMapping<\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n unknown\n>;\ntype BaseMapping = PasskeyPersistenceMapping<\n ReadMapping,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n unknown\n>;\ntype ManagementMapping = PasskeyManagementMapping<\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n TableModel,\n unknown\n>;\n\n/** Share the same passkey algorithms across raw SQL and Drizzle compilers. /\nexport const makeComposedPasskeys = (\n operations: QueryOperations,\n): Backend<object, never>[\"passkeys\"] => {\n const { and, eq, getTableColumns, inArray, or, sql } = operations;\n const { target, writeTarget } = makePasskeyKernel(operations);\n\n const {\n makeTargetPasskeyCredentials,\n makeTargetPasskeyEnrollmentContext,\n makeTargetPasskeyPersistence,\n } = target;\n\n const { makeTargetPasskeyManagement } = writeTarget;\n\n const mappings = (\n storage: MappingInput,\n namespace: string,\n dialect: \"pg\" \| \"sqlite\",\n passwordModules: ReadonlyArray<string>,\n signInProfiles: ReadonlyArray<PasskeyProfile>,\n ) => {\n const table = (role: StorageRole) => {\n const value = storage.tables[role];\n\n if (value === undefined) throw configurationError(`Missing ${role} mapping`);\n\n // Backend validation owns the foreign table shape. Row values are decoded below.\n return value;\n };\n\n const mapped = <Role extends StorageRole>(role: Role) => ({\n table: table(role),\n ...(Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key])) as {\n readonly [Key in keyof (typeof storageTables)[Role][\"columns\"]]: Key;\n }),\n });\n\n const column = (role: StorageRole, key: string) => getTableColumns(table(role))[key];\n const s = storage.subjects;\n const subject = s.table;\n const sc = getTableColumns(subject);\n const active = (value: unknown) => value === true;\n const owned = (value: unknown) => value === \"owned\";\n\n const read: ReadMapping = {\n subject: {\n table: subject,\n id: s.id,\n status: s.status,\n securityRevision: s.securityRevision,\n decodeId: (row) => row[s.id],\n isActiveStatus: (value) => Object.is(value, s.activeValue),\n activeCondition: eq(sc[s.status], s.activeValue),\n },\n credential: {\n ...mapped(\"passkeyCredentials\"),\n status: \"active\",\n decode: (row) =>\n Schema.decodeUnknownSync(credentialData)({\n ...row,\n profile: Schema.decodeUnknownSync(profileJson)(row.profile),\n }),\n decodeSubjectId: (row) => row.subjectId,\n isActiveStatus: active,\n activeCondition: eq(column(\"passkeyCredentials\", \"active\"), true),\n },\n authority: {\n ...mapped(\"credentials\"),\n status: \"active\",\n isActiveStatus: active,\n activeCondition: eq(column(\"credentials\", \"active\"), true),\n },\n credentialOwnership: {\n ...mapped(\"passkeyOwnership\"),\n isOwnedState: owned,\n ownedCondition: eq(column(\"passkeyOwnership\", \"state\"), \"owned\"),\n decodeSubjectId: (row) => row.subjectId,\n },\n handleOwnership: {\n ...mapped(\"passkeyHandles\"),\n isOwnedState: owned,\n ownedCondition: eq(column(\"passkeyHandles\", \"state\"), \"owned\"),\n decodeSubjectId: (row) => row.subjectId,\n },\n subjectIds: { toNative: s.toNativeSync, toSubject: s.toSubjectSync, equals: Object.is },\n constraints: requiredPasskeyCredentialConstraints,\n };\n\n const base = (feature: PasskeyFeature): BaseMapping => ({\n moduleId: feature.moduleId,\n authorityScope: namespace,\n read,\n module: {\n ...mapped(\"passkeyModules\"),\n status: \"active\",\n policyColumns: [\"policy\", \"policyRevision\"],\n isActiveStatus: active,\n activeCondition: eq(column(\"passkeyModules\", \"active\"), true),\n decodeMethodPolicy: (row) => Schema.decodeUnknownSync(policyJson)(row.policy),\n },\n flow: {\n ...mapped(\"passkeyFlows\"),\n states: {\n Pending: \"Pending\",\n Claimed: \"Claimed\",\n Verified: \"Verified\",\n Rejected: \"Rejected\",\n Ambiguous: \"Ambiguous\",\n RegistrationAccepted: \"RegistrationAccepted\",\n ProvisioningPending: \"ProvisioningPending\",\n },\n encodeInsert: () => ({}),\n },\n admission: mapped(\"passkeyAdmissions\"),\n charge: { ...mapped(\"passkeyCharges\"), encodeInsert: () => ({}) },\n clock: {\n encodeInstant: storage.encodeInstant,\n decodeInstant: storage.decodeInstantSync,\n engineNowMillis:\n dialect === \"pg\"\n ? sql`cast(extract(epoch from clock_timestamp()) 1000 as bigint)`\n : sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`,\n toMillis: (expression) => expression,\n fromMillis: (expression) => expression,\n },\n telemetry: { lastUsedAt: \"lastUsedAt\", encodeBackupState: (value) => value },\n constraints: requiredPasskeyPersistenceConstraints,\n });\n\n const management = (feature: PasskeyFeature): ManagementMapping => {\n const policy = feature.managementPolicy;\n\n if (policy === undefined)\n throw configurationError(`Missing passkey management policy for ${feature.moduleId}`);\n const c = getTableColumns(table(\"passkeyCredentials\"));\n const f = getTableColumns(table(\"credentials\"));\n\n const metadata = (subjectId: unknown) =>\n sql`exists(select 1 from ${subject} where ${sc[s.id]} = ${subjectId} and ${sc[s.status]} = ${s.activeValue})`;\n\n return {\n ...base(feature),\n write: {\n credential: {\n name: \"name\",\n createdAt: \"createdAt\",\n encodeInsert: ({ credential, subjectId, summary, marker }) => ({\n credentialId: credential.credentialId,\n subjectId,\n rpId: credential.rpId,\n protocolCredentialId: credential.protocolCredentialId,\n userHandle: credential.userHandle,\n credentialKey: \"\",\n handleKey: \"\",\n publicKey: credential.publicKey,\n algorithm: credential.algorithm,\n profile: Schema.encodeSync(profileJson)(credential.profile),\n credentialRevision: marker,\n active: true,\n primarySignIn: credential.primarySignIn,\n enrollmentUserVerified: credential.enrollmentUserVerified,\n backupEligible: credential.backupEligible,\n backupState: credential.backupState,\n counter: credential.counter,\n maximumCounter: credential.maximumCounter,\n name: summary.name,\n createdAt: storage.encodeInstant(summary.createdAtMillis),\n }),\n encodePrimarySignIn: (value) => value,\n encodeEnrollmentUserVerified: (value) => value,\n encodeBackupEligible: (value) => value,\n activeStatus: true,\n removedStatus: false,\n },\n authority: {\n encodeInsert: ({ subjectId, credential, marker }) => ({\n subjectId,\n credentialId: credential.credentialId,\n revision: marker,\n active: true,\n }),\n activeStatus: true,\n removedStatus: false,\n },\n credentialOwnership: {\n encodeInsert: ({ credential, marker }) => ({\n credentialKey: \"\",\n rpId: credential.rpId,\n protocolCredentialId: credential.protocolCredentialId,\n state: \"owned\",\n version: marker,\n }),\n ownedState: \"owned\",\n removedState: \"removed\",\n },\n handleOwnership: {\n encodeInsert: ({ subjectId, rpId, userHandle, marker }) => ({\n subjectId,\n rpId,\n userHandle,\n handleKey: \"\",\n state: \"owned\",\n version: marker,\n }),\n ownedState: \"owned\",\n },\n policy: {\n subjectColumns: Object.keys(sc),\n management: () => policy,\n requirement: s.actionRequirements,\n metadata,\n action: metadata,\n remainingSignIn: (subjectId, excluded, row) =>\n Effect.gen(function* () {\n const requirement = yield* Schema.decodeUnknownEffect(PasskeyRequirement)(\n yield* s.requirements(row),\n );\n\n const alternatives: SQL[] = [];\n\n // Only retain complete sign-in paths enabled by this Auth definition.\n // More involved combinations require an explicit application's predicate.\n if (\n requirement.alternatives.some(\n (alternative) =>\n alternative.minimumCredentials === 1 &&\n alternative.factors.every((factor) => factor === \"possession\"),\n )\n ) {\n const profiles = signInProfiles.map((profile) =>\n Schema.encodeSync(profileJson)(profile),\n );\n\n alternatives.push(sql`exists(\n select 1 from ${table(\"passkeyCredentials\")} join ${table(\"credentials\")}\n on ${f.credentialId} = ${c.credentialId} and ${f.subjectId} = ${c.subjectId}\n and ${f.revision} = ${c.credentialRevision} and ${f.active} = ${true}\n where ${c.subjectId} = ${subjectId} and ${c.credentialId} <> ${excluded}\n and ${c.active} = ${true} and ${c.primarySignIn} = ${true}\n and ${c.enrollmentUserVerified} = ${true} and ${inArray(c.profile, profiles)}\n )`);\n }\n if (\n passwordModules.length > 0 &&\n requirement.alternatives.some(\n (alternative) =>\n alternative.minimumCredentials === 1 &&\n !alternative.userVerified &&\n !alternative.phishingResistant &&\n alternative.factors.every((factor) => factor === \"knowledge\"),\n )\n ) {\n const p = getTableColumns(table(\"passwords\"));\n const i = getTableColumns(table(\"identifiers\"));\n\n alternatives.push(sql`exists(\n select 1 from ${table(\"passwords\")} join ${table(\"credentials\")}\n on ${f.credentialId} = ${p.credentialId} and ${f.subjectId} = ${p.subjectId}\n and ${f.revision} = ${p.credentialRevision} and ${f.active} = ${true}\n join ${table(\"identifiers\")} on ${i.subjectId} = ${p.subjectId}\n and ${i.active} = ${true} and ${i.namespace} = 'email'\n where ${p.subjectId} = ${subjectId} and ${p.credentialId} <> ${excluded}\n and ${inArray(p.moduleId, passwordModules)}\n )`);\n }\n\n return or(...alternatives) ?? sql`false`;\n }).pipe(\n Effect.mapError((cause) =>\n PersistenceMappingError.make({ operation: \"mapping\", cause }),\n ),\n ),\n },\n },\n command: { ...mapped(\"passkeyCommands\"), encodeInsert: (input) => ({ ...input }) },\n managementConstraints: requiredPasskeyManagementConstraints,\n invalidation: {\n window: {\n trigger: \"credential-change\",\n existingSessions: \"immediate\",\n maximumExposureMillis: 0,\n oldAuthenticationEvidence: \"rejected\",\n },\n mutations: [],\n postcondition: ({ subjectId, securityRevision }) =>\n sql`exists(select 1 from ${subject} where ${sc[s.id]} = ${subjectId} and ${sc[s.securityRevision]} = ${securityRevision})`,\n },\n };\n };\n\n return { read, base, management, table };\n };\n\n const make: Backend<object, never>[\"passkeys\"] = Effect.fn(\"AuthPersistence.passkeys\")(\n function* ({ storage, namespace, dialect, features, passwordModules }) {\n const client = yield* SqlClient.SqlClient;\n\n const policies = yield* Effect.forEach(features, (feature) =>\n Effect.map(feature.policy, (policy) => ({ feature, policy })),\n );\n\n const m = yield* Effect.try({\n try: () =>\n mappings(\n storage,\n namespace,\n dialect,\n passwordModules,\n policies.flatMap(({ feature, policy }) => (feature.management ? [] : policy.profiles)),\n ),\n catch: () => configurationError(\"Invalid passkey table mappings\"),\n });\n\n const configuration: PasskeyTargetConfiguration = {\n mode: \"interactive\",\n dialect,\n locking: dialect === \"pg\",\n standaloneGuard: () => requireStandalone(unavailable, client.transactionService),\n };\n\n const native = yield* CurrentProofSql;\n\n yield* client.withTransaction(\n Effect.gen(function* () {\n if (dialect === \"pg\")\n yield* client`select pg_advisory_xact_lock(hashtext(${`${namespace}/passkeys`}))`;\n for (const { feature, policy } of policies) {\n const encoded = yield* Schema.encodeEffect(policyJson)(policy);\n\n const policyRevision = digest(\n yield* Schema.encodeEffect(seedJson)({\n policy,\n ...(feature.managementPolicy === undefined\n ? {}\n : { management: feature.managementPolicy }),\n }),\n );\n\n const module = m.table(\"passkeyModules\");\n const columns = getTableColumns(module);\n\n yield* native\n .insert(module)\n .values({ moduleId: feature.moduleId, active: true, policy: encoded, policyRevision })\n .onConflictDoNothing();\n\n const rows = yield* native\n .select()\n .from(module)\n .where(eq(columns.moduleId, feature.moduleId));\n\n const row = yield* Schema.decodeUnknownEffect(ModuleRow)(rows[0]);\n\n if (!row.active)\n return yield* configurationError(`Passkey module ${feature.moduleId} is disabled`);\n if (row.policyRevision !== policyRevision) {\n const previous = yield* Schema.decodeEffect(policyJson)(row.policy);\n\n if (policy.generation <= previous.generation)\n return yield* configurationError(\n `Increase the passkey policy generation to change ${feature.moduleId}`,\n );\n yield* native\n .update(module)\n .set({ policy: encoded, policyRevision })\n .where(\n and(\n eq(columns.moduleId, feature.moduleId),\n eq(columns.policyRevision, row.policyRevision),\n eq(columns.active, true),\n ),\n );\n\n const updated = yield* native\n .select()\n .from(module)\n .where(eq(columns.moduleId, feature.moduleId));\n\n const applied = yield* Schema.decodeUnknownEffect(ModuleRow)(updated[0]);\n\n if (!applied.active \|\| applied.policyRevision !== policyRevision)\n return yield* configurationError(\n `Passkey policy changed while configuring ${feature.moduleId}`,\n );\n }\n yield* native\n .insert(m.table(\"passkeyAdmissions\"))\n .values({\n authorityScope: namespace,\n moduleId: feature.moduleId,\n version: policyRevision,\n ownerMarker: policyRevision,\n })\n .onConflictDoNothing();\n }\n }),\n );\n\n const credential = yield* makeTargetPasskeyCredentials<ReadMapping, never>(\n m.read,\n configuration,\n );\n\n const persistence = new Map<string, PasskeyPersistence[\"Service\"]>();\n const managers = new Map<string, PasskeyManagementPersistence[\"Service\"]>();\n const enrollment = new Map<string, PasskeyEnrollmentContext[\"Service\"]>();\n\n for (const feature of features) {\n if (feature.management) {\n const mapping = yield* Effect.try({\n try: () => m.management(feature),\n catch: () =>\n configurationError(`Invalid passkey management mapping for ${feature.moduleId}`),\n });\n\n const services = yield* makeTargetPasskeyManagement<ManagementMapping, never>(\n mapping,\n configuration,\n );\n\n persistence.set(feature.moduleId, services.passkeyPersistence);\n managers.set(feature.moduleId, services.passkeyManagementPersistence);\n enrollment.set(\n feature.moduleId,\n (yield* makeTargetPasskeyEnrollmentContext<ManagementMapping, never>(\n mapping,\n configuration,\n )).passkeyEnrollmentContext,\n );\n } else {\n persistence.set(\n feature.moduleId,\n (yield* makeTargetPasskeyPersistence<BaseMapping, never>(\n m.base(feature),\n configuration,\n )).passkeyPersistence,\n );\n }\n }\n\n const service = <A>(services: ReadonlyMap<string, A>, moduleId: string) => {\n const value = services.get(moduleId);\n\n return value === undefined ? Effect.fail(unavailable()) : Effect.succeed(value);\n };\n\n let context: Context.Context<never> = Context.make(\n PasskeyCredentials,\n credential.passkeyCredentials,\n ).pipe(\n Context.add(PasskeyPersistence, {\n issue: (input, prepare) =>\n Effect.flatMap(service(persistence, input.ceremony.moduleId), (s) =>\n s.issue(input, prepare),\n ),\n context: (input) =>\n Effect.flatMap(service(persistence, input.moduleId), (s) => s.context(input)),\n claim: (input, prepare) =>\n Effect.flatMap(service(persistence, input.ceremony.moduleId), (s) =>\n s.claim(input, prepare),\n ),\n settle: (input, prepare) =>\n Effect.flatMap(service(persistence, input.claim.ceremony.moduleId), (s) =>\n s.settle(input, prepare),\n ),\n cleanup: (input, prepare) =>\n Effect.flatMap(service(persistence, input.moduleId), (s) => s.cleanup(input, prepare)),\n }),\n );\n\n if (managers.size > 0)\n context = context.pipe(\n Context.add(PasskeyEnrollmentContext, {\n capture: (input) =>\n Effect.flatMap(service(enrollment, input.moduleId), (s) => s.capture(input)),\n }),\n Context.add(PasskeyManagementPersistence, {\n issueEnrollment: (input, prepare) =>\n Effect.flatMap(service(managers, input.ceremony.moduleId), (s) =>\n s.issueEnrollment(input, prepare),\n ),\n completeEnrollment: (input, prepare) =>\n Effect.flatMap(service(managers, input.claim.ceremony.moduleId), (s) =>\n s.completeEnrollment(input, prepare),\n ),\n list: (input) =>\n Effect.flatMap(service(managers, input.moduleId), (s) => s.list(input)),\n inspectRemove: (input) =>\n Effect.flatMap(service(managers, input.moduleId), (s) => s.inspectRemove(input)),\n rename: (input, prepare) =>\n Effect.flatMap(service(managers, input.moduleId), (s) => s.rename(input, prepare)),\n remove: (input, prepare) =>\n Effect.flatMap(service(managers, input.moduleId), (s) => s.remove(input, prepare)),\n }),\n );\n\n return context;\n },\n Effect.mapError((error) =>\n Schema.is(PersistenceConfigurationError)(error)\n ? error\n : configurationError(\"Unable to configure passkey persistence\"),\n ),\n );\n\n return make;\n};\n"],"mappings":";;;;;;;;;;;;;AAwCA,MAAM,cAAc,OAAO,eAAe,cAAc;AACxD,MAAM,aAAa,OAAO,eAAe,mBAAmB;AAE5D,MAAM,WAAW,OAAO,eACtB,OAAO,OAAO;CACZ,QAAQ;CACR,YAAY,OAAO,YAAY,uBAAuB;AACxD,CAAC,CACH;AAEA,MAAM,YAAY,OAAO,OAAO;CAC9B,QAAQ,OAAO;CACf,QAAQ,OAAO;CACf,gBAAgB,OAAO;AACzB,CAAC;AAED,MAAM,iBAAiB,kBAAkB,WACtC,EAAE,UAAU,WAAW,QAAQ,SAAS,GAAG,aAAa,MAC3D;AAEA,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;AACpD,MAAM,sBAAsB,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;;AAiC5F,MAAa,wBACX,eACuC;CACvC,MAAM,EAAE,KAAK,IAAI,iBAAiB,SAAS,IAAI,QAAQ;CACvD,MAAM,EAAE,QAAQ,gBAAgB,kBAAkB,UAAU;CAE5D,MAAM,EACJ,8BACA,oCACA,iCACE;CAEJ,MAAM,EAAE,gCAAgC;CAExC,MAAM,YACJ,SACA,WACA,SACA,iBACA,mBACG;EACH,MAAM,SAAS,SAAsB;GACnC,MAAM,QAAQ,QAAQ,OAAO;GAE7B,IAAI,UAAU,KAAA,GAAW,MAAM,mBAAmB,WAAW,KAAK,SAAS;GAG3E,OAAO;EACT;EAEA,MAAM,UAAoC,UAAgB;GACxD,OAAO,MAAM,IAAI;GACjB,GAAI,OAAO,YAAY,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;EAG1F;EAEA,MAAM,UAAU,MAAmB,QAAgB,gBAAgB,MAAM,IAAI,CAAC,CAAC,CAAC;EAChF,MAAM,IAAI,QAAQ;EAClB,MAAM,UAAU,EAAE;EAClB,MAAM,KAAK,gBAAgB,OAAO;EAClC,MAAM,UAAU,UAAmB,UAAU;EAC7C,MAAM,SAAS,UAAmB,UAAU;EAE5C,MAAM,OAAoB;GACxB,SAAS;IACP,OAAO;IACP,IAAI,EAAE;IACN,QAAQ,EAAE;IACV,kBAAkB,EAAE;IACpB,WAAW,QAAQ,IAAI,EAAE;IACzB,iBAAiB,UAAU,OAAO,GAAG,OAAO,EAAE,WAAW;IACzD,iBAAiB,GAAG,GAAG,EAAE,SAAS,EAAE,WAAW;GACjD;GACA,YAAY;IACV,GAAG,OAAO,oBAAoB;IAC9B,QAAQ;IACR,SAAS,QACP,OAAO,kBAAkB,cAAc,CAAC,CAAC;KACvC,GAAG;KACH,SAAS,OAAO,kBAAkB,WAAW,CAAC,CAAC,IAAI,OAAO;IAC5D,CAAC;IACH,kBAAkB,QAAQ,IAAI;IAC9B,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,sBAAsB,QAAQ,GAAG,IAAI;GAClE;GACA,WAAW;IACT,GAAG,OAAO,aAAa;IACvB,QAAQ;IACR,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,eAAe,QAAQ,GAAG,IAAI;GAC3D;GACA,qBAAqB;IACnB,GAAG,OAAO,kBAAkB;IAC5B,cAAc;IACd,gBAAgB,GAAG,OAAO,oBAAoB,OAAO,GAAG,OAAO;IAC/D,kBAAkB,QAAQ,IAAI;GAChC;GACA,iBAAiB;IACf,GAAG,OAAO,gBAAgB;IAC1B,cAAc;IACd,gBAAgB,GAAG,OAAO,kBAAkB,OAAO,GAAG,OAAO;IAC7D,kBAAkB,QAAQ,IAAI;GAChC;GACA,YAAY;IAAE,UAAU,EAAE;IAAc,WAAW,EAAE;IAAe,QAAQ,OAAO;GAAG;GACtF,aAAa;EACf;EAEA,MAAM,QAAQ,aAA0C;GACtD,UAAU,QAAQ;GAClB,gBAAgB;GAChB;GACA,QAAQ;IACN,GAAG,OAAO,gBAAgB;IAC1B,QAAQ;IACR,eAAe,CAAC,UAAU,gBAAgB;IAC1C,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,kBAAkB,QAAQ,GAAG,IAAI;IAC5D,qBAAqB,QAAQ,OAAO,kBAAkB,UAAU,CAAC,CAAC,IAAI,MAAM;GAC9E;GACA,MAAM;IACJ,GAAG,OAAO,cAAc;IACxB,QAAQ;KACN,SAAS;KACT,SAAS;KACT,UAAU;KACV,UAAU;KACV,WAAW;KACX,sBAAsB;KACtB,qBAAqB;IACvB;IACA,qBAAqB,CAAC;GACxB;GACA,WAAW,OAAO,mBAAmB;GACrC,QAAQ;IAAE,GAAG,OAAO,gBAAgB;IAAG,qBAAqB,CAAC;GAAG;GAChE,OAAO;IACL,eAAe,QAAQ;IACvB,eAAe,QAAQ;IACvB,iBACE,YAAY,OACR,GAAG,iEACH,GAAG;IACT,WAAW,eAAe;IAC1B,aAAa,eAAe;GAC9B;GACA,WAAW;IAAE,YAAY;IAAc,oBAAoB,UAAU;GAAM;GAC3E,aAAa;EACf;EAEA,MAAM,cAAc,YAA+C;GACjE,MAAM,SAAS,QAAQ;GAEvB,IAAI,WAAW,KAAA,GACb,MAAM,mBAAmB,yCAAyC,QAAQ,UAAU;GACtF,MAAM,IAAI,gBAAgB,MAAM,oBAAoB,CAAC;GACrD,MAAM,IAAI,gBAAgB,MAAM,aAAa,CAAC;GAE9C,MAAM,YAAY,cAChB,GAAG,wBAAwB,QAAQ,SAAS,GAAG,EAAE,IAAI,KAAK,UAAU,OAAO,GAAG,EAAE,QAAQ,KAAK,EAAE,YAAY;GAE7G,OAAO;IACL,GAAG,KAAK,OAAO;IACf,OAAO;KACL,YAAY;MACV,MAAM;MACN,WAAW;MACX,eAAe,EAAE,YAAY,WAAW,SAAS,cAAc;OAC7D,cAAc,WAAW;OACzB;OACA,MAAM,WAAW;OACjB,sBAAsB,WAAW;OACjC,YAAY,WAAW;OACvB,eAAe;OACf,WAAW;OACX,WAAW,WAAW;OACtB,WAAW,WAAW;OACtB,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC,WAAW,OAAO;OAC1D,oBAAoB;OACpB,QAAQ;OACR,eAAe,WAAW;OAC1B,wBAAwB,WAAW;OACnC,gBAAgB,WAAW;OAC3B,aAAa,WAAW;OACxB,SAAS,WAAW;OACpB,gBAAgB,WAAW;OAC3B,MAAM,QAAQ;OACd,WAAW,QAAQ,cAAc,QAAQ,eAAe;MAC1D;MACA,sBAAsB,UAAU;MAChC,+BAA+B,UAAU;MACzC,uBAAuB,UAAU;MACjC,cAAc;MACd,eAAe;KACjB;KACA,WAAW;MACT,eAAe,EAAE,WAAW,YAAY,cAAc;OACpD;OACA,cAAc,WAAW;OACzB,UAAU;OACV,QAAQ;MACV;MACA,cAAc;MACd,eAAe;KACjB;KACA,qBAAqB;MACnB,eAAe,EAAE,YAAY,cAAc;OACzC,eAAe;OACf,MAAM,WAAW;OACjB,sBAAsB,WAAW;OACjC,OAAO;OACP,SAAS;MACX;MACA,YAAY;MACZ,cAAc;KAChB;KACA,iBAAiB;MACf,eAAe,EAAE,WAAW,MAAM,YAAY,cAAc;OAC1D;OACA;OACA;OACA,WAAW;OACX,OAAO;OACP,SAAS;MACX;MACA,YAAY;KACd;KACA,QAAQ;MACN,gBAAgB,OAAO,KAAK,EAAE;MAC9B,kBAAkB;MAClB,aAAa,EAAE;MACf;MACA,QAAQ;MACR,kBAAkB,WAAW,UAAU,QACrC,OAAO,IAAI,aAAa;OACtB,MAAM,cAAc,OAAO,OAAO,oBAAoB,kBAAkB,CAAC,CACvE,OAAO,EAAE,aAAa,GAAG,CAC3B;OAEA,MAAM,eAAsB,CAAC;OAI7B,IACE,YAAY,aAAa,MACtB,gBACC,YAAY,uBAAuB,KACnC,YAAY,QAAQ,OAAO,WAAW,WAAW,YAAY,CACjE,GACA;QACA,MAAM,WAAW,eAAe,KAAK,YACnC,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,CACxC;QAEA,aAAa,KAAK,GAAG;kCACL,MAAM,oBAAoB,EAAE,QAAQ,MAAM,aAAa,EAAE;uBACpE,EAAE,aAAa,KAAK,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,EAAE,UAAU;0BACpE,EAAE,SAAS,KAAK,EAAE,mBAAmB,OAAO,EAAE,OAAO,KAAK,KAAK;0BAC/D,EAAE,UAAU,KAAK,UAAU,OAAO,EAAE,aAAa,MAAM,SAAS;0BAChE,EAAE,OAAO,KAAK,KAAK,OAAO,EAAE,cAAc,KAAK,KAAK;0BACpD,EAAE,uBAAuB,KAAK,KAAK,OAAO,QAAQ,EAAE,SAAS,QAAQ,EAAE;kBAC/E;OACF;OACA,IACE,gBAAgB,SAAS,KACzB,YAAY,aAAa,MACtB,gBACC,YAAY,uBAAuB,KACnC,CAAC,YAAY,gBACb,CAAC,YAAY,qBACb,YAAY,QAAQ,OAAO,WAAW,WAAW,WAAW,CAChE,GACA;QACA,MAAM,IAAI,gBAAgB,MAAM,WAAW,CAAC;QAC5C,MAAM,IAAI,gBAAgB,MAAM,aAAa,CAAC;QAE9C,aAAa,KAAK,GAAG;kCACL,MAAM,WAAW,EAAE,QAAQ,MAAM,aAAa,EAAE;uBAC3D,EAAE,aAAa,KAAK,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,EAAE,UAAU;0BACpE,EAAE,SAAS,KAAK,EAAE,mBAAmB,OAAO,EAAE,OAAO,KAAK,KAAK;yBAChE,MAAM,aAAa,EAAE,MAAM,EAAE,UAAU,KAAK,EAAE,UAAU;0BACvD,EAAE,OAAO,KAAK,KAAK,OAAO,EAAE,UAAU;0BACtC,EAAE,UAAU,KAAK,UAAU,OAAO,EAAE,aAAa,MAAM,SAAS;0BAChE,QAAQ,EAAE,UAAU,eAAe,EAAE;kBAC7C;OACF;OAEA,OAAO,GAAG,GAAG,YAAY,KAAK,GAAG;MACnC,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,wBAAwB,KAAK;OAAE,WAAW;OAAW;MAAM,CAAC,CAC9D,CACF;KACJ;IACF;IACA,SAAS;KAAE,GAAG,OAAO,iBAAiB;KAAG,eAAe,WAAW,EAAE,GAAG,MAAM;IAAG;IACjF,uBAAuB;IACvB,cAAc;KACZ,QAAQ;MACN,SAAS;MACT,kBAAkB;MAClB,uBAAuB;MACvB,2BAA2B;KAC7B;KACA,WAAW,CAAC;KACZ,gBAAgB,EAAE,WAAW,uBAC3B,GAAG,wBAAwB,QAAQ,SAAS,GAAG,EAAE,IAAI,KAAK,UAAU,OAAO,GAAG,EAAE,kBAAkB,KAAK,iBAAiB;IAC5H;GACF;EACF;EAEA,OAAO;GAAE;GAAM;GAAM;GAAY;EAAM;CACzC;CAsNA,OApNiD,OAAO,GAAG,0BAA0B,CAAC,CACpF,WAAW,EAAE,SAAS,WAAW,SAAS,UAAU,mBAAmB;EACrE,MAAM,SAAS,OAAO,UAAU;EAEhC,MAAM,WAAW,OAAO,OAAO,QAAQ,WAAW,YAChD,OAAO,IAAI,QAAQ,SAAS,YAAY;GAAE;GAAS;EAAO,EAAE,CAC9D;EAEA,MAAM,IAAI,OAAO,OAAO,IAAI;GAC1B,WACE,SACE,SACA,WACA,SACA,iBACA,SAAS,SAAS,EAAE,SAAS,aAAc,QAAQ,aAAa,CAAC,IAAI,OAAO,QAAS,CACvF;GACF,aAAa,mBAAmB,gCAAgC;EAClE,CAAC;EAED,MAAM,gBAA4C;GAChD,MAAM;GACN;GACA,SAAS,YAAY;GACrB,uBAAuB,kBAAkB,aAAa,OAAO,kBAAkB;EACjF;EAEA,MAAM,SAAS,OAAO;EAEtB,OAAO,OAAO,gBACZ,OAAO,IAAI,aAAa;GACtB,IAAI,YAAY,MACd,OAAO,MAAM,yCAAyC,GAAG,UAAU,WAAW;GAChF,KAAK,MAAM,EAAE,SAAS,YAAY,UAAU;IAC1C,MAAM,UAAU,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,MAAM;IAE7D,MAAM,iBAAiB,OACrB,OAAO,OAAO,aAAa,QAAQ,CAAC,CAAC;KACnC;KACA,GAAI,QAAQ,qBAAqB,KAAA,IAC7B,CAAC,IACD,EAAE,YAAY,QAAQ,iBAAiB;IAC7C,CAAC,CACH;IAEA,MAAM,SAAS,EAAE,MAAM,gBAAgB;IACvC,MAAM,UAAU,gBAAgB,MAAM;IAEtC,OAAO,OACJ,OAAO,MAAM,CAAC,CACd,OAAO;KAAE,UAAU,QAAQ;KAAU,QAAQ;KAAM,QAAQ;KAAS;IAAe,CAAC,CAAC,CACrF,oBAAoB;IAEvB,MAAM,OAAO,OAAO,OACjB,OAAO,CAAC,CACR,KAAK,MAAM,CAAC,CACZ,MAAM,GAAG,QAAQ,UAAU,QAAQ,QAAQ,CAAC;IAE/C,MAAM,MAAM,OAAO,OAAO,oBAAoB,SAAS,CAAC,CAAC,KAAK,EAAE;IAEhE,IAAI,CAAC,IAAI,QACP,OAAO,OAAO,mBAAmB,kBAAkB,QAAQ,SAAS,aAAa;IACnF,IAAI,IAAI,mBAAmB,gBAAgB;KACzC,MAAM,WAAW,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,IAAI,MAAM;KAElE,IAAI,OAAO,cAAc,SAAS,YAChC,OAAO,OAAO,mBACZ,oDAAoD,QAAQ,UAC9D;KACF,OAAO,OACJ,OAAO,MAAM,CAAC,CACd,IAAI;MAAE,QAAQ;MAAS;KAAe,CAAC,CAAC,CACxC,MACC,IACE,GAAG,QAAQ,UAAU,QAAQ,QAAQ,GACrC,GAAG,QAAQ,gBAAgB,IAAI,cAAc,GAC7C,GAAG,QAAQ,QAAQ,IAAI,CACzB,CACF;KAEF,MAAM,UAAU,OAAO,OACpB,OAAO,CAAC,CACR,KAAK,MAAM,CAAC,CACZ,MAAM,GAAG,QAAQ,UAAU,QAAQ,QAAQ,CAAC;KAE/C,MAAM,UAAU,OAAO,OAAO,oBAAoB,SAAS,CAAC,CAAC,QAAQ,EAAE;KAEvE,IAAI,CAAC,QAAQ,UAAU,QAAQ,mBAAmB,gBAChD,OAAO,OAAO,mBACZ,4CAA4C,QAAQ,UACtD;IACJ;IACA,OAAO,OACJ,OAAO,EAAE,MAAM,mBAAmB,CAAC,CAAC,CACpC,OAAO;KACN,gBAAgB;KAChB,UAAU,QAAQ;KAClB,SAAS;KACT,aAAa;IACf,CAAC,CAAC,CACD,oBAAoB;GACzB;EACF,CAAC,CACH;EAEA,MAAM,aAAa,OAAO,6BACxB,EAAE,MACF,aACF;EAEA,MAAM,8BAAc,IAAI,IAA2C;EACnE,MAAM,2BAAW,IAAI,IAAqD;EAC1E,MAAM,6BAAa,IAAI,IAAiD;EAExE,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,YAAY;GACtB,MAAM,UAAU,OAAO,OAAO,IAAI;IAChC,WAAW,EAAE,WAAW,OAAO;IAC/B,aACE,mBAAmB,0CAA0C,QAAQ,UAAU;GACnF,CAAC;GAED,MAAM,WAAW,OAAO,4BACtB,SACA,aACF;GAEA,YAAY,IAAI,QAAQ,UAAU,SAAS,kBAAkB;GAC7D,SAAS,IAAI,QAAQ,UAAU,SAAS,4BAA4B;GACpE,WAAW,IACT,QAAQ,WACP,OAAO,mCACN,SACA,aACF,EAAA,CAAG,wBACL;EACF,OACE,YAAY,IACV,QAAQ,WACP,OAAO,6BACN,EAAE,KAAK,OAAO,GACd,aACF,EAAA,CAAG,kBACL;EAIJ,MAAM,WAAc,UAAkC,aAAqB;GACzE,MAAM,QAAQ,SAAS,IAAI,QAAQ;GAEnC,OAAO,UAAU,KAAA,IAAY,OAAO,KAAK,YAAY,CAAC,IAAI,OAAO,QAAQ,KAAK;EAChF;EAEA,IAAI,UAAkC,QAAQ,KAC5C,oBACA,WAAW,kBACb,CAAC,CAAC,KACA,QAAQ,IAAI,oBAAoB;GAC9B,QAAQ,OAAO,YACb,OAAO,QAAQ,QAAQ,aAAa,MAAM,SAAS,QAAQ,IAAI,MAC7D,EAAE,MAAM,OAAO,OAAO,CACxB;GACF,UAAU,UACR,OAAO,QAAQ,QAAQ,aAAa,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,KAAK,CAAC;GAC9E,QAAQ,OAAO,YACb,OAAO,QAAQ,QAAQ,aAAa,MAAM,SAAS,QAAQ,IAAI,MAC7D,EAAE,MAAM,OAAO,OAAO,CACxB;GACF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,aAAa,MAAM,MAAM,SAAS,QAAQ,IAAI,MACnE,EAAE,OAAO,OAAO,OAAO,CACzB;GACF,UAAU,OAAO,YACf,OAAO,QAAQ,QAAQ,aAAa,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;EACzF,CAAC,CACH;EAEA,IAAI,SAAS,OAAO,GAClB,UAAU,QAAQ,KAChB,QAAQ,IAAI,0BAA0B,EACpC,UAAU,UACR,OAAO,QAAQ,QAAQ,YAAY,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,KAAK,CAAC,EAC/E,CAAC,GACD,QAAQ,IAAI,8BAA8B;GACxC,kBAAkB,OAAO,YACvB,OAAO,QAAQ,QAAQ,UAAU,MAAM,SAAS,QAAQ,IAAI,MAC1D,EAAE,gBAAgB,OAAO,OAAO,CAClC;GACF,qBAAqB,OAAO,YAC1B,OAAO,QAAQ,QAAQ,UAAU,MAAM,MAAM,SAAS,QAAQ,IAAI,MAChE,EAAE,mBAAmB,OAAO,OAAO,CACrC;GACF,OAAO,UACL,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,KAAK,KAAK,CAAC;GACxE,gBAAgB,UACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,cAAc,KAAK,CAAC;GACjF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;GACnF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;EACrF,CAAC,CACH;EAEF,OAAO;CACT,GACA,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,mBAAmB,yCAAyC,CAClE,CAGQ;AACZ"}

package/dist/internal/password-kernel.d.mts CHANGED Viewed

@@ -5,8 +5,8 @@ import { CurrentProofSql, ProofSqlConfiguration, makeProofKernel } from "./proof
 import { Context, DateTime, Effect, Option, Redacted } from "effect";
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, PreparedCommit } from "@yielded/auth/Hooks";
 import { AuthenticationEvidence, AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
-import { PasswordAttemptDecision, PasswordAttemptPolicy, PasswordCredentialSnapshot, PasswordMutationDecision, PasswordMutationInput, PasswordUnavailable } from "@yielded/auth/Password";
 import { ProofCompletionInput, ProofCompletionPlan } from "@yielded/auth/Proofs";
+import { PasswordAttemptDecision, PasswordAttemptPolicy, PasswordCredentialSnapshot, PasswordMutationDecision, PasswordMutationInput, PasswordUnavailable } from "@yielded/auth/Password";
 import { LoginIdentifier } from "@yielded/auth/Identity";
 import * as SqlError$1 from "effect/sql/SqlError";
 //#region src/internal/password-kernel.d.ts
@@ -47,7 +47,7 @@ export interface PasswordSqlConfiguration {
 }
 type Database = PasswordSqlDatabase;
 export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFragment, Column extends SqlColumn = SqlColumn>(operations: QueryOperations<Fragment, Column>, proofs: Pick<ReturnType<typeof makeProofKernel>, "completeProofPlanIn">) => {
-  makeSqlPasswordPersistence: (database: PasswordSqlDatabase, mapping: AnyPasswordPersistenceMapping<Fragment>, configuration: PasswordSqlConfiguration) => Effect.Effect<{
+  makeSqlPasswordPersistence: (mapping: AnyPasswordPersistenceMapping<Fragment>, configuration: PasswordSqlConfiguration) => Effect.Effect<{
     readonly admitAttempt: <A>(input: {
       readonly moduleId: string;
       readonly action: "sign-in" | "change";
@@ -87,7 +87,7 @@ export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFrag
       readonly removed: number;
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
-  }, never, LifecycleHooks>;
+  }, never, CurrentPasswordSql | LifecycleHooks>;
   passwordSqlKernel: {
     allocate: <A>(mode: PasswordSqlConfiguration["mode"], asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined, syncValue: (() => A) | undefined) => Effect.Effect<A, PasswordUnavailable | PersistenceMappingError>;
     allocateNextSecurityRevision: (mapping: AnyPasswordPersistenceMapping<Fragment>, mode: PasswordSqlConfiguration["mode"], current: SecurityRevision) => Effect.Effect<string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">, PasswordUnavailable | PersistenceMappingError, never>;

package/dist/internal/password-kernel.mjs CHANGED Viewed

@@ -5,12 +5,12 @@ import { Cause, Context, DateTime, Effect, Option, Redacted, Schema } from "effe
 import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, coordinateCommit, hasCommitScope } from "@yielded/auth/Hooks";
 import { snapshotAuthenticationEvidence } from "@yielded/auth/Sessions";
 import { reportPersistenceFailure } from "@yielded/auth/Persistence";
-import { PasswordPersistence, PasswordUnavailable, snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision } from "@yielded/auth/Password";
 import { ProofUnavailable } from "@yielded/auth/Proofs";
+import { PasswordPersistence, PasswordUnavailable, snapshotPasswordCredential, snapshotPasswordRequirement, snapshotPasswordRevision } from "@yielded/auth/Password";
 //#region src/internal/password-kernel.ts
 var CurrentPasswordSql = class extends Context.Service()("effect-auth/CurrentPasswordSql") {};
 const makePasswordKernel = (operations, proofs) => {
-	const { and, eq, gte, inArray, lte, notExists, sql, column, updateValues } = operations;
+	const { and, eq, gt, gte, inArray, lte, notExists, sql, column, updateValues } = operations;
 	const { completeProofPlanIn } = proofs;
 	const unavailable = () => PasswordUnavailable.make({});
 	const translateFailure = (effect) => reportPersistenceFailure(effect, (error) => Schema.is(PasswordUnavailable)(error) || Schema.is(ProofUnavailable)(error) || Schema.is(HookConfigurationError)(error)).pipe(Effect.catchCause((cause) => Effect.failCause(Cause.map(cause, () => unavailable()))));
@@ -231,7 +231,7 @@ const makePasswordKernel = (operations, proofs) => {
 		const c = chargeColumns(mapping);
 		if ((yield* selectRows(database.select({ attemptId: c.attemptId }).from(mapping.charge.table).where(and(eq(c.moduleId, moduleId), eq(c.action, action), eq(c.scopeKind, entry.kind), eq(c.scopeKey, entry.key), gte(c.occurredAt, mapping.encodeInstant(now - entry.windowMillis)))).limit(entry.limit), true)).length >= entry.limit) return false;
 		const a = attemptColumns(mapping);
-		const pendingWhere = entry.kind === "action" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.state, "pending")) : entry.kind === "identifier" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.identifierNamespace, identifier.namespace), eq(a.identifierValue, identifier.value), eq(a.state, "pending")) : and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.subjectId, nativeSubjectId), eq(a.state, "pending"));
+		const pendingWhere = and(entry.kind === "action" ? and(eq(a.moduleId, moduleId), eq(a.action, action)) : entry.kind === "identifier" ? and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.identifierNamespace, identifier.namespace), eq(a.identifierValue, identifier.value)) : and(eq(a.moduleId, moduleId), eq(a.action, action), eq(a.subjectId, nativeSubjectId)), eq(a.state, "pending"), gt(a.retentionUntil, mapping.encodeInstant(now)));
 		return (yield* selectRows(database.select({ attemptId: a.attemptId }).from(mapping.attempt.table).where(pendingWhere).limit(policy.maximumPending), true)).length < policy.maximumPending;
 	});
 	const insertCharge = Effect.fn("Drizzle.insertCharge")(function* (mapping, moduleId, action, entry, attemptId, now) {
@@ -389,7 +389,8 @@ const makePasswordKernel = (operations, proofs) => {
 		if (inserted === void 0 || inserted[mapping.credential.credentialId] !== credentialId || inserted[mapping.credential.credentialRevision] !== credentialRevision || inserted[mapping.credential.verifierVersion] !== verifierVersion || inserted[mapping.credential.verifier] !== Redacted.value(input.replacement.verifier) || inserted[mapping.credential.normalization] !== input.replacement.normalization || authorityInserted === void 0 || subjectUpdated === void 0 || !(yield* mutationPostconditions(mapping, input, authority.nativeSubjectId, subjectUpdated, authorityInserted, commandNow ?? authority.now))) return yield* unavailable();
 		return true;
 	});
-	const makeSqlPasswordPersistence = Effect.fn("makeSqlPasswordPersistence")(function* (database, mapping, configuration) {
+	const makeSqlPasswordPersistence = Effect.fn("makeSqlPasswordPersistence")(function* (mapping, configuration) {
+		const database = yield* CurrentPasswordSql;
 		const hooks = yield* LifecycleHooks;
 		return PasswordPersistence.of({
 			admitAttempt: (input, prepare) => Effect.gen(function* () {