@yielded/auth-persistence 0.1.0-beta.14 → 0.1.0-beta.16

package/dist/internal/passkey/state.d.mts

@@ -1,5 +1,5 @@
-import "../query-operations.mjs";
 import { TransactionOwner } from "../transaction-kernel.mjs";
+import "../query-operations.mjs";
 import { Context, Effect } from "effect";
 import { PasskeyCeremony, PasskeyCredential, PasskeyRevision, PasskeyUnavailable } from "@yielded/auth/Passkey";
 //#region src/internal/passkey/state.d.ts

package/dist/internal/passkey/target.d.mts

@@ -1,7 +1,8 @@
 import { PersistenceMappingError } from "../mapping-error.mjs";
+import "../transaction-kernel.mjs";
+import "../query-operations.mjs";
 import "../models/passkey-model.mjs";
 import "../models/passkey-registration-ceremony-model.mjs";
-import "../transaction-kernel.mjs";
 import { CurrentPasskeyTransaction } from "./state.mjs";
 import "./credentials.mjs";
 import "./flow.mjs";

package/dist/internal/passkey/target.mjs

@@ -4,7 +4,7 @@ import { PasskeyAccess, PasskeyAssertionVerified, PasskeyCeremony, PasskeyClaim,
 import { SubjectId } from "@yielded/auth/Schema";
 import { LifecycleHooks } from "@yielded/auth/Hooks";
 //#region src/internal/passkey/target.ts
-const makePasskeyTargetKernel = (credentials, flow, registrationCeremony, state, execution) => {
+const makePasskeyTargetKernel = (credentials, flow, registrationCeremony, state, execution, operations) => {
 	const { captureEnrollmentContext, lookupCredential } = credentials;
 	const { assertionPurposes, claimAssertion, cleanupCeremonies, contextAssertion, issueAssertion, settleAssertion } = flow;
 	const { claimRegistration, contextRegistration, settleRegistration } = registrationCeremony;
@@ -16,8 +16,9 @@ const makePasskeyTargetKernel = (credentials, flow, registrationCeremony, state,
 		before: () => Effect.void,
 		after: () => Effect.succeed([])
 	};
-	const makePasskeyExecution = Effect.fnUntraced(function* (configuration) {
+	const makePasskeyExecution = Effect.fnUntraced(function* (configuration, mapping) {
 		const hooks = yield* LifecycleHooks;
+		yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(Effect.mapError(() => PasskeyConfigurationError.make({})));
 		const execution = yield* makeTransactionExecution(CurrentPasskeyTransaction, configuration, unavailable, nonce);
 		return {
 			...execution,
@@ -151,29 +152,29 @@ const makePasskeyTargetKernel = (credentials, flow, registrationCeremony, state,
 	}));
 	const makeTargetPasskeyCredentials = (source, configuration) => Effect.gen(function* () {
 		const mapping = yield* capturedMapping(source, "read", configuration);
-		const execution = yield* makePasskeyExecution(configuration).pipe(Effect.provideService(LifecycleHooks, emptyHooks));
+		const execution = yield* makePasskeyExecution(configuration, mapping).pipe(Effect.provideService(LifecycleHooks, emptyHooks));
 		return { passkeyCredentials: credentialService(mapping, execution) };
 	});
 	const makeTargetPasskeyEnrollmentContext = (source, configuration) => Effect.gen(function* () {
 		const mapping = yield* capturedMapping(source, "context", configuration);
-		const execution = yield* makePasskeyExecution(configuration).pipe(Effect.provideService(LifecycleHooks, emptyHooks));
+		const execution = yield* makePasskeyExecution(configuration, mapping).pipe(Effect.provideService(LifecycleHooks, emptyHooks));
 		return { passkeyEnrollmentContext: enrollmentService(mapping, execution) };
 	});
 	const makeTargetPasskeyPersistence = (source, configuration) => Effect.gen(function* () {
 		const mapping = yield* capturedMapping(source, "assertion", configuration);
-		const execution = yield* makePasskeyExecution(configuration);
+		const execution = yield* makePasskeyExecution(configuration, mapping);
 		return { passkeyPersistence: makePasskeyPersistence(mapping, execution, configuration) };
 	});
 	const makeTargetPasskeyRegistration = (source, configuration) => Effect.gen(function* () {
 		const mapping = yield* capturedMapping(source, "registration", configuration);
-		const execution = yield* makePasskeyExecution(configuration);
+		const execution = yield* makePasskeyExecution(configuration, mapping);
 		return registrationServices(mapping, execution, configuration);
 	});
-	const coordinateTargetPasskey = (database, source, configuration, owner) => Effect.flatMap(capturedMapping(source, "assertion", configuration), (mapping) => Effect.flatMap(LifecycleHooks, (hooks) => coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, Effect.void, unavailable, nonce, (execution) => ({ passkeyPersistence: makePasskeyPersistence(mapping, {
+	const coordinateTargetPasskey = (database, source, configuration, owner) => Effect.flatMap(capturedMapping(source, "assertion", configuration), (mapping) => Effect.flatMap(LifecycleHooks, (hooks) => coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, operations.validateStorage?.(mapping) ?? Effect.void, unavailable, nonce, (execution) => ({ passkeyPersistence: makePasskeyPersistence(mapping, {
 		...execution,
 		run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
 	}, configuration) }), owner).pipe(Effect.provideService(LifecycleHooks, hooks))));
-	const coordinateTargetPasskeyRegistration = (database, source, configuration, owner) => Effect.flatMap(capturedMapping(source, "registration", configuration), (mapping) => Effect.flatMap(LifecycleHooks, (hooks) => coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, Effect.void, unavailable, nonce, (execution) => registrationServices(mapping, {
+	const coordinateTargetPasskeyRegistration = (database, source, configuration, owner) => Effect.flatMap(capturedMapping(source, "registration", configuration), (mapping) => Effect.flatMap(LifecycleHooks, (hooks) => coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, operations.validateStorage?.(mapping) ?? Effect.void, unavailable, nonce, (execution) => registrationServices(mapping, {
 		...execution,
 		run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
 	}, configuration), owner).pipe(Effect.provideService(LifecycleHooks, hooks))));

package/dist/internal/passkey/target.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"target.mjs","names":[],"sources":["../../../src/internal/passkey/target.ts"],"sourcesContent":["import { type PreparedCommit, LifecycleHooks } from \"@yielded/auth/Hooks\";\n/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\nimport {\n  PasskeyConfigurationError,\n  type PasskeyUnavailable,\n  type PasskeyCredentials,\n  type PasskeyEnrollmentContext,\n  type PasskeyPersistence,\n  type PreparePasskeyCommit,\n  PasskeyAccess,\n  PasskeyAssertionVerified,\n  PasskeyCeremony,\n  PasskeyClaim,\n  PasskeyClaimDecision,\n  PasskeyCleanupResult,\n  PasskeyCredential,\n  PasskeyEnrollmentSnapshot,\n  PasskeyEvidence,\n  PasskeyInstant,\n  PasskeyIssueDecision,\n  PasskeyModuleId,\n  PasskeyProfile,\n  PasskeyProtocolCredentialId,\n  PasskeySettlement,\n  PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport { SubjectId } from \"@yielded/auth/Schema\";\nimport { Effect, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"../mapping-error\";\nimport type {\n  PasskeyCredentialServices,\n  PasskeyEnrollmentContextServices,\n  PasskeyMappingSource,\n  PasskeyPersistenceServices,\n} from \"../models/passkey-model\";\nimport type { PasskeyRegistrationCeremonyServices } from \"../models/passkey-registration-ceremony-model\";\nimport type {\n  TransactionCoordinatorError,\n  TransactionExecution,\n  TransactionTargetConfiguration,\n  makeTransactionExecutionKernel,\n} from \"../transaction-execution-kernel\";\nimport type { NativeDatabase } from \"../transaction-kernel\";\nimport type { makePasskeyCredentialsKernel } from \"./credentials\";\nimport type { makePasskeyFlowKernel } from \"./flow\";\nimport type { makePasskeyRegistrationCeremonyKernel } from \"./registration-ceremony\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport type PasskeyTargetConfiguration = TransactionTargetConfiguration<PasskeyUnavailable>;\n\nexport type PasskeyCoordinatorError<E> =\n  | TransactionCoordinatorError<E, PasskeyUnavailable>\n  | PasskeyConfigurationError\n  | PersistenceMappingError;\n\nexport type PasskeyExecution = TransactionExecution<\n  PasskeyUnavailable,\n  CurrentPasskeyTransaction,\n  never\n>;\n\nexport const makePasskeyTargetKernel = (\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"captureEnrollmentContext\" | \"lookupCredential\"\n  >,\n  flow: Pick<\n    ReturnType<typeof makePasskeyFlowKernel>,\n    | \"assertionPurposes\"\n    | \"claimAssertion\"\n    | \"cleanupCeremonies\"\n    | \"contextAssertion\"\n    | \"issueAssertion\"\n    | \"settleAssertion\"\n  >,\n  registrationCeremony: Pick<\n    ReturnType<typeof makePasskeyRegistrationCeremonyKernel>,\n    \"claimRegistration\" | \"contextRegistration\" | \"settleRegistration\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    \"captureMapping\" | \"invariant\" | \"nonce\" | \"unavailable\" | \"validateMapping\"\n  >,\n  execution: Pick<\n    ReturnType<typeof makeTransactionExecutionKernel>,\n    | \"coordinateTransactionOwner\"\n    | \"makeTransactionExecution\"\n    | \"sqlClientTransactionStandaloneGuard\"\n  >,\n) => {\n  const { captureEnrollmentContext, lookupCredential } = credentials;\n\n  const {\n    assertionPurposes,\n    claimAssertion,\n    cleanupCeremonies,\n    contextAssertion,\n    issueAssertion,\n    settleAssertion,\n  } = flow;\n\n  const { claimRegistration, contextRegistration, settleRegistration } = registrationCeremony;\n  const { captureMapping, nonce, unavailable, validateMapping } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    coordinateTransactionOwner,\n    makeTransactionExecution,\n    sqlClientTransactionStandaloneGuard,\n  } = execution;\n\n  const sqlClientPasskeyStandaloneGuard = (\n    transactionService: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n  ) => sqlClientTransactionStandaloneGuard(unavailable, transactionService);\n\n  const emptyHooks: LifecycleHooks[\"Service\"] = {\n    before: () => Effect.void,\n    after: () => Effect.succeed([]),\n  };\n\n  const makePasskeyExecution = Effect.fnUntraced(function* (\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.fn.Return<PasskeyExecution, never, LifecycleHooks | NativeDatabase> {\n    const hooks = yield* LifecycleHooks;\n\n    const execution = yield* makeTransactionExecution(\n      CurrentPasskeyTransaction,\n      configuration,\n      unavailable,\n      nonce,\n    );\n\n    return {\n      ...execution,\n      run: (operation, mutation) =>\n        execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    };\n  });\n\n  const issueInput = Schema.Struct({ ceremony: PasskeyCeremony, policy: PasskeyMethodPolicy });\n\n  const claimInput = Schema.Struct({\n    access: PasskeyAccess,\n    policy: PasskeyMethodPolicy,\n    ceremony: PasskeyCeremony,\n    claimId: PasskeyClaim.fields.claimId,\n    credential: Schema.optionalKey(PasskeyCredential),\n  });\n\n  const settleInput = Schema.Struct({\n    claim: PasskeyClaim,\n    nowMillis: PasskeyInstant,\n    outcome: Schema.Union([\n      Schema.TaggedStruct(\"Rejected\", {}),\n      Schema.TaggedStruct(\"Ambiguous\", {}),\n      Schema.TaggedStruct(\"Assertion\", {\n        credential: PasskeyCredential,\n        assertion: PasskeyAssertionVerified,\n        evidence: PasskeyEvidence,\n      }),\n    ]),\n  });\n\n  const cleanupInput = Schema.Struct({\n    moduleId: PasskeyModuleId,\n    nowMillis: PasskeyInstant,\n    limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n  });\n\n  const lookupInput = Schema.Struct({\n    rpId: PasskeyProfile.fields.rpId,\n    protocolCredentialId: PasskeyProtocolCredentialId,\n  });\n\n  const contextInput = Schema.Struct({\n    moduleId: PasskeyModuleId,\n    rpId: PasskeyProfile.fields.rpId,\n    subjectId: SubjectId,\n  });\n\n  const inputs = {\n    issue: issueInput,\n    context: PasskeyAccess,\n    claim: claimInput,\n    settle: settleInput,\n    cleanup: cleanupInput,\n  };\n\n  const capturedService = <S>(\n    service: S,\n    schemas: Record<string, Schema.Codec<any, any, never, never>>,\n    execute: PasskeyExecution,\n  ): S =>\n    Object.freeze(\n      Object.fromEntries(\n        Object.entries(\n          service as Record<string, (...args: any[]) => Effect.Effect<any, PasskeyUnavailable>>,\n        ).map(([name, method]) => [\n          name,\n          (original: any, prepare?: any) =>\n            Effect.suspend(() => {\n              invariant(execute.active());\n              const input = snapshotPasskeySync(schemas[name]!, original);\n\n              return method(input, prepare);\n            }).pipe(\n              Effect.onExit((exit) =>\n                Effect.sync(() => {\n                  if (exit._tag === \"Failure\") execute.poison();\n                }),\n              ),\n              Effect.catchDefect(() => Effect.fail(unavailable())),\n            ),\n        ]),\n      ),\n    ) as S;\n\n  const prepareValue = <Value, A>(\n    value: Value,\n    prepare: PreparePasskeyCommit<Value, A>,\n  ): Effect.Effect<PreparedCommit<A>, never, CurrentPasskeyTransaction> =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      Effect.sync(() => {\n        owner.guards.push(owner.journal.prepare(undefined));\n        const receipt = prepare(value, owner.journal);\n\n        invariant(\n          receipt !== null &&\n            typeof receipt === \"object\" &&\n            receipt._tag === \"PreparedCommit\" &&\n            typeof receipt.read === \"object\" &&\n            Effect.isEffect(receipt.read),\n        );\n        owner.guards.push(receipt);\n\n        return receipt;\n      }),\n    );\n\n  const requirePurpose = (purpose: string, registration: boolean, enrollment = false) =>\n    invariant(\n      enrollment\n        ? purpose === \"enrollment\"\n        : registration\n          ? purpose === \"registration\"\n          : assertionPurposes.some((supported) => supported === purpose),\n    );\n\n  /** Context is advisory. Retain observations and final predicates without taking\n   * later-ranked locks before a subsequent mutation acquires its full lock set. */\n  const observationalContext = <A, E, R>(operation: Effect.Effect<A, E, R>) =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      operation.pipe(\n        Effect.provideService(CurrentPasskeyTransaction, {\n          ...owner,\n          read: (table, where, options) => owner.read(table, where, { ...options, lock: false }),\n        }),\n      ),\n    );\n\n  const makePasskeyPersistence = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n    registration = false,\n    enrollment = false,\n  ): PasskeyPersistence[\"Service\"] =>\n    capturedService<PasskeyPersistence[\"Service\"]>(\n      {\n        issue: (input, prepare) =>\n          Effect.suspend(() => {\n            invariant(!registration && !enrollment);\n            requirePurpose(input.ceremony.purpose, false);\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* issueAssertion(mapping, input.ceremony, input.policy);\n\n                return yield* prepareValue(\n                  snapshotPasskeySync(PasskeyIssueDecision, value),\n                  prepare,\n                );\n              }),\n            );\n          }),\n        context: (access) =>\n          Effect.suspend(() => {\n            requirePurpose(access.purpose, registration, enrollment);\n\n            return execute.run(\n              observationalContext(\n                registration\n                  ? contextRegistration(mapping, access)\n                  : contextAssertion(mapping, access),\n              ),\n              false,\n            );\n          }),\n        claim: (input, prepare) =>\n          Effect.suspend(() => {\n            requirePurpose(input.access.purpose, registration, enrollment);\n            requirePurpose(input.ceremony.purpose, registration, enrollment);\n            invariant((!registration && !enrollment) || input.credential === undefined);\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* registration\n                  ? claimRegistration(mapping, input)\n                  : claimAssertion(mapping, input);\n\n                return yield* prepareValue(\n                  snapshotPasskeySync(PasskeyClaimDecision, value),\n                  prepare,\n                );\n              }),\n            );\n          }),\n        settle: (input, prepare) =>\n          Effect.suspend(() => {\n            requirePurpose(input.claim.ceremony.purpose, registration, enrollment);\n            invariant((!registration && !enrollment) || input.outcome._tag !== \"Assertion\");\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* registration\n                  ? settleRegistration(\n                      mapping,\n                      input.claim,\n                      input.outcome._tag as \"Rejected\" | \"Ambiguous\",\n                    )\n                  : settleAssertion(mapping, input.claim, input.outcome, configuration.dialect);\n\n                return yield* prepareValue(snapshotPasskeySync(PasskeySettlement, value), prepare);\n              }),\n            );\n          }),\n        cleanup: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const value = yield* cleanupCeremonies(\n                mapping,\n                input,\n                registration ? [\"registration\"] : enrollment ? [\"enrollment\"] : assertionPurposes,\n              );\n\n              return yield* prepareValue(snapshotPasskeySync(PasskeyCleanupResult, value), prepare);\n            }),\n          ),\n      },\n      inputs,\n      execute,\n    );\n\n  const credentialService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyCredentials[\"Service\"] =>\n    capturedService<PasskeyCredentials[\"Service\"]>(\n      {\n        lookup: (input) =>\n          execute.run(lookupCredential(mapping, input.rpId, input.protocolCredentialId), false),\n      },\n      { lookup: lookupInput },\n      execute,\n    );\n\n  const enrollmentService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyEnrollmentContext[\"Service\"] =>\n    capturedService<PasskeyEnrollmentContext[\"Service\"]>(\n      {\n        capture: (input) =>\n          execute.run(\n            Effect.map(captureEnrollmentContext(mapping, input), (value) =>\n              value === undefined\n                ? undefined\n                : snapshotPasskeySync(PasskeyEnrollmentSnapshot, value),\n            ),\n            false,\n          ),\n      },\n      { capture: contextInput },\n      execute,\n    );\n\n  const registrationServices = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyRegistrationCeremonyServices => ({\n    capabilities: Object.freeze({\n      purposes: Object.freeze([\"registration\"] as const),\n      issue: \"registration-authority\",\n      assertionSettlement: false,\n    }),\n    passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true),\n  });\n\n  const capturedMapping = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    kind: \"read\" | \"context\" | \"assertion\" | \"registration\",\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<M, PasskeyConfigurationError | PersistenceMappingError, RSetup> =>\n    Effect.flatMap(Effect.isEffect(source) ? source : Effect.succeed(source), (mapping) =>\n      Effect.try({\n        try: () => {\n          const captured = captureMapping(mapping);\n\n          validateMapping(captured, kind);\n          if (configuration.mode === \"batch\") invariant((captured as any).d1?.primary === true);\n\n          return captured;\n        },\n        catch: () => PasskeyConfigurationError.make({}),\n      }),\n    );\n\n  const makeTargetPasskeyCredentials = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyCredentialServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | NativeDatabase\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"read\", configuration);\n\n      const execution = yield* makePasskeyExecution(configuration).pipe(\n        Effect.provideService(LifecycleHooks, emptyHooks),\n      );\n\n      return { passkeyCredentials: credentialService(mapping, execution) };\n    });\n\n  const makeTargetPasskeyEnrollmentContext = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyEnrollmentContextServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | NativeDatabase\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"context\", configuration);\n\n      const execution = yield* makePasskeyExecution(configuration).pipe(\n        Effect.provideService(LifecycleHooks, emptyHooks),\n      );\n\n      return { passkeyEnrollmentContext: enrollmentService(mapping, execution) };\n    });\n\n  const makeTargetPasskeyPersistence = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyPersistenceServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | LifecycleHooks | NativeDatabase\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"assertion\", configuration);\n      const execution = yield* makePasskeyExecution(configuration);\n\n      return {\n        passkeyPersistence: makePasskeyPersistence(mapping, execution, configuration),\n      };\n    });\n\n  const makeTargetPasskeyRegistration = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyRegistrationCeremonyServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | LifecycleHooks | NativeDatabase\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"registration\", configuration);\n      const execution = yield* makePasskeyExecution(configuration);\n\n      return registrationServices(mapping, execution, configuration);\n    });\n\n  const coordinateTargetPasskey = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: PasskeyPersistenceServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n    Effect.flatMap(capturedMapping(source, \"assertion\", configuration), (mapping) =>\n      Effect.flatMap(LifecycleHooks, (hooks) =>\n        coordinateTransactionOwner(\n          database,\n          CurrentPasskeyTransaction,\n          configuration,\n          Effect.void,\n          unavailable,\n          nonce,\n          (execution) => ({\n            passkeyPersistence: makePasskeyPersistence(\n              mapping,\n              {\n                ...execution,\n                run: (operation, mutation) =>\n                  execution\n                    .run(operation, mutation)\n                    .pipe(Effect.provideService(LifecycleHooks, hooks)),\n              },\n              configuration,\n            ),\n          }),\n          owner,\n        ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      ),\n    );\n\n  const coordinateTargetPasskeyRegistration = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: PasskeyRegistrationCeremonyServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n    Effect.flatMap(capturedMapping(source, \"registration\", configuration), (mapping) =>\n      Effect.flatMap(LifecycleHooks, (hooks) =>\n        coordinateTransactionOwner(\n          database,\n          CurrentPasskeyTransaction,\n          configuration,\n          Effect.void,\n          unavailable,\n          nonce,\n          (execution) =>\n            registrationServices(\n              mapping,\n              {\n                ...execution,\n                run: (operation, mutation) =>\n                  execution\n                    .run(operation, mutation)\n                    .pipe(Effect.provideService(LifecycleHooks, hooks)),\n              },\n              configuration,\n            ),\n          owner,\n        ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      ),\n    );\n\n  return {\n    sqlClientPasskeyStandaloneGuard,\n    makePasskeyExecution,\n    capturedService,\n    prepareValue,\n    observationalContext,\n    makePasskeyPersistence,\n    capturedMapping,\n    makeTargetPasskeyCredentials,\n    makeTargetPasskeyEnrollmentContext,\n    makeTargetPasskeyPersistence,\n    makeTargetPasskeyRegistration,\n    coordinateTargetPasskey,\n    coordinateTargetPasskeyRegistration,\n  };\n};\n"],"mappings":";;;;;;AAiEA,MAAa,2BACX,aAIA,MASA,sBAIA,OAIA,cAMG;CACH,MAAM,EAAE,0BAA0B,qBAAqB;CAEvD,MAAM,EACJ,mBACA,gBACA,mBACA,kBACA,gBACA,oBACE;CAEJ,MAAM,EAAE,mBAAmB,qBAAqB,uBAAuB;CACvE,MAAM,EAAE,gBAAgB,OAAO,aAAa,oBAAoB;CAChE,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,4BACA,0BACA,wCACE;CAEJ,MAAM,mCACJ,uBACG,oCAAoC,aAAa,kBAAkB;CAExE,MAAM,aAAwC;EAC5C,cAAc,OAAO;EACrB,aAAa,OAAO,QAAQ,CAAC,CAAC;CAChC;CAEA,MAAM,uBAAuB,OAAO,WAAW,WAC7C,eAC4E;EAC5E,MAAM,QAAQ,OAAO;EAErB,MAAM,YAAY,OAAO,yBACvB,2BACA,eACA,aACA,KACF;EAEA,OAAO;GACL,GAAG;GACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACxF;CACF,CAAC;CAED,MAAM,aAAa,OAAO,OAAO;EAAE,UAAU;EAAiB,QAAQ;CAAoB,CAAC;CAE3F,MAAM,aAAa,OAAO,OAAO;EAC/B,QAAQ;EACR,QAAQ;EACR,UAAU;EACV,SAAS,aAAa,OAAO;EAC7B,YAAY,OAAO,YAAY,iBAAiB;CAClD,CAAC;CAED,MAAM,cAAc,OAAO,OAAO;EAChC,OAAO;EACP,WAAW;EACX,SAAS,OAAO,MAAM;GACpB,OAAO,aAAa,YAAY,CAAC,CAAC;GAClC,OAAO,aAAa,aAAa,CAAC,CAAC;GACnC,OAAO,aAAa,aAAa;IAC/B,YAAY;IACZ,WAAW;IACX,UAAU;GACZ,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,eAAe,OAAO,OAAO;EACjC,UAAU;EACV,WAAW;EACX,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAK,CAAC,CAAC;CACzE,CAAC;CAED,MAAM,cAAc,OAAO,OAAO;EAChC,MAAM,eAAe,OAAO;EAC5B,sBAAsB;CACxB,CAAC;CAED,MAAM,eAAe,OAAO,OAAO;EACjC,UAAU;EACV,MAAM,eAAe,OAAO;EAC5B,WAAW;CACb,CAAC;CAED,MAAM,SAAS;EACb,OAAO;EACP,SAAS;EACT,OAAO;EACP,QAAQ;EACR,SAAS;CACX;CAEA,MAAM,mBACJ,SACA,SACA,YAEA,OAAO,OACL,OAAO,YACL,OAAO,QACL,OACF,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CACxB,OACC,UAAe,YACd,OAAO,cAAc;EACnB,UAAU,QAAQ,OAAO,CAAC;EAG1B,OAAO,OAFO,oBAAoB,QAAQ,OAAQ,QAEhC,GAAG,OAAO;CAC9B,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;EAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;CAC9C,CAAC,CACH,GACA,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD,CACJ,CAAC,CACH,CACF;CAEF,MAAM,gBACJ,OACA,YAEA,OAAO,QAAQ,4BAA4B,UACzC,OAAO,WAAW;EAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;EAClD,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO;EAE5C,UACE,YAAY,QACV,OAAO,YAAY,YACnB,QAAQ,SAAS,oBACjB,OAAO,QAAQ,SAAS,YACxB,OAAO,SAAS,QAAQ,IAAI,CAChC;EACA,MAAM,OAAO,KAAK,OAAO;EAEzB,OAAO;CACT,CAAC,CACH;CAEF,MAAM,kBAAkB,SAAiB,cAAuB,aAAa,UAC3E,UACE,aACI,YAAY,eACZ,eACE,YAAY,iBACZ,kBAAkB,MAAM,cAAc,cAAc,OAAO,CACnE;;;CAIF,MAAM,wBAAiC,cACrC,OAAO,QAAQ,4BAA4B,UACzC,UAAU,KACR,OAAO,eAAe,2BAA2B;EAC/C,GAAG;EACH,OAAO,OAAO,OAAO,YAAY,MAAM,KAAK,OAAO,OAAO;GAAE,GAAG;GAAS,MAAM;EAAM,CAAC;CACvF,CAAC,CACH,CACF;CAEF,MAAM,0BACJ,SACA,SACA,eACA,eAAe,OACf,aAAa,UAEb,gBACE;EACE,QAAQ,OAAO,YACb,OAAO,cAAc;GACnB,UAAU,CAAC,gBAAgB,CAAC,UAAU;GACtC,eAAe,MAAM,SAAS,SAAS,KAAK;GAE5C,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,MAAM;IAEzE,OAAO,OAAO,aACZ,oBAAoB,sBAAsB,KAAK,GAC/C,OACF;GACF,CAAC,CACH;EACF,CAAC;EACH,UAAU,WACR,OAAO,cAAc;GACnB,eAAe,OAAO,SAAS,cAAc,UAAU;GAEvD,OAAO,QAAQ,IACb,qBACE,eACI,oBAAoB,SAAS,MAAM,IACnC,iBAAiB,SAAS,MAAM,CACtC,GACA,KACF;EACF,CAAC;EACH,QAAQ,OAAO,YACb,OAAO,cAAc;GACnB,eAAe,MAAM,OAAO,SAAS,cAAc,UAAU;GAC7D,eAAe,MAAM,SAAS,SAAS,cAAc,UAAU;GAC/D,UAAW,CAAC,gBAAgB,CAAC,cAAe,MAAM,eAAe,KAAA,CAAS;GAE1E,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eACjB,kBAAkB,SAAS,KAAK,IAChC,eAAe,SAAS,KAAK;IAEjC,OAAO,OAAO,aACZ,oBAAoB,sBAAsB,KAAK,GAC/C,OACF;GACF,CAAC,CACH;EACF,CAAC;EACH,SAAS,OAAO,YACd,OAAO,cAAc;GACnB,eAAe,MAAM,MAAM,SAAS,SAAS,cAAc,UAAU;GACrE,UAAW,CAAC,gBAAgB,CAAC,cAAe,MAAM,QAAQ,SAAS,WAAW;GAE9E,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eACjB,mBACE,SACA,MAAM,OACN,MAAM,QAAQ,IAChB,IACA,gBAAgB,SAAS,MAAM,OAAO,MAAM,SAAS,cAAc,OAAO;IAE9E,OAAO,OAAO,aAAa,oBAAoB,mBAAmB,KAAK,GAAG,OAAO;GACnF,CAAC,CACH;EACF,CAAC;EACH,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,kBACnB,SACA,OACA,eAAe,CAAC,cAAc,IAAI,aAAa,CAAC,YAAY,IAAI,iBAClE;GAEA,OAAO,OAAO,aAAa,oBAAoB,sBAAsB,KAAK,GAAG,OAAO;EACtF,CAAC,CACH;CACJ,GACA,QACA,OACF;CAEF,MAAM,qBACJ,SACA,YAEA,gBACE,EACE,SAAS,UACP,QAAQ,IAAI,iBAAiB,SAAS,MAAM,MAAM,MAAM,oBAAoB,GAAG,KAAK,EACxF,GACA,EAAE,QAAQ,YAAY,GACtB,OACF;CAEF,MAAM,qBACJ,SACA,YAEA,gBACE,EACE,UAAU,UACR,QAAQ,IACN,OAAO,IAAI,yBAAyB,SAAS,KAAK,IAAI,UACpD,UAAU,KAAA,IACN,KAAA,IACA,oBAAoB,2BAA2B,KAAK,CAC1D,GACA,KACF,EACJ,GACA,EAAE,SAAS,aAAa,GACxB,OACF;CAEF,MAAM,wBACJ,SACA,SACA,mBACyC;EACzC,cAAc,OAAO,OAAO;GAC1B,UAAU,OAAO,OAAO,CAAC,cAAc,CAAU;GACjD,OAAO;GACP,qBAAqB;EACvB,CAAC;EACD,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,IAAI;CAClF;CAEA,MAAM,mBACJ,QACA,MACA,kBAEA,OAAO,QAAQ,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM,IAAI,YACzE,OAAO,IAAI;EACT,WAAW;GACT,MAAM,WAAW,eAAe,OAAO;GAEvC,gBAAgB,UAAU,IAAI;GAC9B,IAAI,cAAc,SAAS,SAAS,UAAW,SAAiB,IAAI,YAAY,IAAI;GAEpF,OAAO;EACT;EACA,aAAa,0BAA0B,KAAK,CAAC,CAAC;CAChD,CAAC,CACH;CAEF,MAAM,gCACJ,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,QAAQ,aAAa;EAEpE,MAAM,YAAY,OAAO,qBAAqB,aAAa,CAAC,CAAC,KAC3D,OAAO,eAAe,gBAAgB,UAAU,CAClD;EAEA,OAAO,EAAE,oBAAoB,kBAAkB,SAAS,SAAS,EAAE;CACrE,CAAC;CAEH,MAAM,sCACJ,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,WAAW,aAAa;EAEvE,MAAM,YAAY,OAAO,qBAAqB,aAAa,CAAC,CAAC,KAC3D,OAAO,eAAe,gBAAgB,UAAU,CAClD;EAEA,OAAO,EAAE,0BAA0B,kBAAkB,SAAS,SAAS,EAAE;CAC3E,CAAC;CAEH,MAAM,gCACJ,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,aAAa,aAAa;EACzE,MAAM,YAAY,OAAO,qBAAqB,aAAa;EAE3D,OAAO,EACL,oBAAoB,uBAAuB,SAAS,WAAW,aAAa,EAC9E;CACF,CAAC;CAEH,MAAM,iCACJ,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,gBAAgB,aAAa;EAC5E,MAAM,YAAY,OAAO,qBAAqB,aAAa;EAE3D,OAAO,qBAAqB,SAAS,WAAW,aAAa;CAC/D,CAAC;CAEH,MAAM,2BACJ,UACA,QACA,eACA,UAMA,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,aAAa,IAAI,YACnE,OAAO,QAAQ,iBAAiB,UAC9B,2BACE,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,eAAe,EACd,oBAAoB,uBAClB,SACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,UACG,IAAI,WAAW,QAAQ,CAAC,CACxB,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxD,GACA,aACF,EACF,IACA,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD,CACF;CAEF,MAAM,uCACJ,UACA,QACA,eACA,UAMA,OAAO,QAAQ,gBAAgB,QAAQ,gBAAgB,aAAa,IAAI,YACtE,OAAO,QAAQ,iBAAiB,UAC9B,2BACE,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,cACC,qBACE,SACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,UACG,IAAI,WAAW,QAAQ,CAAC,CACxB,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxD,GACA,aACF,GACF,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD,CACF;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}
+{"version":3,"file":"target.mjs","names":[],"sources":["../../../src/internal/passkey/target.ts"],"sourcesContent":["import { type PreparedCommit, LifecycleHooks } from \"@yielded/auth/Hooks\";\n/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\nimport {\n  PasskeyConfigurationError,\n  type PasskeyUnavailable,\n  type PasskeyCredentials,\n  type PasskeyEnrollmentContext,\n  type PasskeyPersistence,\n  type PreparePasskeyCommit,\n  PasskeyAccess,\n  PasskeyAssertionVerified,\n  PasskeyCeremony,\n  PasskeyClaim,\n  PasskeyClaimDecision,\n  PasskeyCleanupResult,\n  PasskeyCredential,\n  PasskeyEnrollmentSnapshot,\n  PasskeyEvidence,\n  PasskeyInstant,\n  PasskeyIssueDecision,\n  PasskeyModuleId,\n  PasskeyProfile,\n  PasskeyProtocolCredentialId,\n  PasskeySettlement,\n  PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport { SubjectId } from \"@yielded/auth/Schema\";\nimport { Effect, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"../mapping-error\";\nimport type {\n  PasskeyCredentialServices,\n  PasskeyEnrollmentContextServices,\n  PasskeyMappingSource,\n  PasskeyPersistenceServices,\n} from \"../models/passkey-model\";\nimport type { PasskeyRegistrationCeremonyServices } from \"../models/passkey-registration-ceremony-model\";\nimport type { QueryOperations } from \"../query-operations\";\nimport type {\n  TransactionCoordinatorError,\n  TransactionExecution,\n  TransactionTargetConfiguration,\n  makeTransactionExecutionKernel,\n} from \"../transaction-execution-kernel\";\nimport type { NativeDatabase } from \"../transaction-kernel\";\nimport type { makePasskeyCredentialsKernel } from \"./credentials\";\nimport type { makePasskeyFlowKernel } from \"./flow\";\nimport type { makePasskeyRegistrationCeremonyKernel } from \"./registration-ceremony\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport type PasskeyTargetConfiguration = TransactionTargetConfiguration<PasskeyUnavailable>;\n\nexport type PasskeyCoordinatorError<E> =\n  | TransactionCoordinatorError<E, PasskeyUnavailable>\n  | PasskeyConfigurationError\n  | PersistenceMappingError;\n\nexport type PasskeyExecution = TransactionExecution<\n  PasskeyUnavailable,\n  CurrentPasskeyTransaction,\n  never\n>;\n\nexport const makePasskeyTargetKernel = (\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"captureEnrollmentContext\" | \"lookupCredential\"\n  >,\n  flow: Pick<\n    ReturnType<typeof makePasskeyFlowKernel>,\n    | \"assertionPurposes\"\n    | \"claimAssertion\"\n    | \"cleanupCeremonies\"\n    | \"contextAssertion\"\n    | \"issueAssertion\"\n    | \"settleAssertion\"\n  >,\n  registrationCeremony: Pick<\n    ReturnType<typeof makePasskeyRegistrationCeremonyKernel>,\n    \"claimRegistration\" | \"contextRegistration\" | \"settleRegistration\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    \"captureMapping\" | \"invariant\" | \"nonce\" | \"unavailable\" | \"validateMapping\"\n  >,\n  execution: Pick<\n    ReturnType<typeof makeTransactionExecutionKernel>,\n    | \"coordinateTransactionOwner\"\n    | \"makeTransactionExecution\"\n    | \"sqlClientTransactionStandaloneGuard\"\n  >,\n  operations: QueryOperations,\n) => {\n  const { captureEnrollmentContext, lookupCredential } = credentials;\n\n  const {\n    assertionPurposes,\n    claimAssertion,\n    cleanupCeremonies,\n    contextAssertion,\n    issueAssertion,\n    settleAssertion,\n  } = flow;\n\n  const { claimRegistration, contextRegistration, settleRegistration } = registrationCeremony;\n  const { captureMapping, nonce, unavailable, validateMapping } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    coordinateTransactionOwner,\n    makeTransactionExecution,\n    sqlClientTransactionStandaloneGuard,\n  } = execution;\n\n  const sqlClientPasskeyStandaloneGuard = (\n    transactionService: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n  ) => sqlClientTransactionStandaloneGuard(unavailable, transactionService);\n\n  const emptyHooks: LifecycleHooks[\"Service\"] = {\n    before: () => Effect.void,\n    after: () => Effect.succeed([]),\n  };\n\n  const makePasskeyExecution = Effect.fnUntraced(function* (\n    configuration: PasskeyTargetConfiguration,\n    mapping: unknown,\n  ): Effect.fn.Return<\n    PasskeyExecution,\n    PasskeyConfigurationError,\n    LifecycleHooks | NativeDatabase\n  > {\n    const hooks = yield* LifecycleHooks;\n\n    yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(\n      Effect.mapError(() => PasskeyConfigurationError.make({})),\n    );\n\n    const execution = yield* makeTransactionExecution(\n      CurrentPasskeyTransaction,\n      configuration,\n      unavailable,\n      nonce,\n    );\n\n    return {\n      ...execution,\n      run: (operation, mutation) =>\n        execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    };\n  });\n\n  const issueInput = Schema.Struct({ ceremony: PasskeyCeremony, policy: PasskeyMethodPolicy });\n\n  const claimInput = Schema.Struct({\n    access: PasskeyAccess,\n    policy: PasskeyMethodPolicy,\n    ceremony: PasskeyCeremony,\n    claimId: PasskeyClaim.fields.claimId,\n    credential: Schema.optionalKey(PasskeyCredential),\n  });\n\n  const settleInput = Schema.Struct({\n    claim: PasskeyClaim,\n    nowMillis: PasskeyInstant,\n    outcome: Schema.Union([\n      Schema.TaggedStruct(\"Rejected\", {}),\n      Schema.TaggedStruct(\"Ambiguous\", {}),\n      Schema.TaggedStruct(\"Assertion\", {\n        credential: PasskeyCredential,\n        assertion: PasskeyAssertionVerified,\n        evidence: PasskeyEvidence,\n      }),\n    ]),\n  });\n\n  const cleanupInput = Schema.Struct({\n    moduleId: PasskeyModuleId,\n    nowMillis: PasskeyInstant,\n    limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n  });\n\n  const lookupInput = Schema.Struct({\n    rpId: PasskeyProfile.fields.rpId,\n    protocolCredentialId: PasskeyProtocolCredentialId,\n  });\n\n  const contextInput = Schema.Struct({\n    moduleId: PasskeyModuleId,\n    rpId: PasskeyProfile.fields.rpId,\n    subjectId: SubjectId,\n  });\n\n  const inputs = {\n    issue: issueInput,\n    context: PasskeyAccess,\n    claim: claimInput,\n    settle: settleInput,\n    cleanup: cleanupInput,\n  };\n\n  const capturedService = <S>(\n    service: S,\n    schemas: Record<string, Schema.Codec<any, any, never, never>>,\n    execute: PasskeyExecution,\n  ): S =>\n    Object.freeze(\n      Object.fromEntries(\n        Object.entries(\n          service as Record<string, (...args: any[]) => Effect.Effect<any, PasskeyUnavailable>>,\n        ).map(([name, method]) => [\n          name,\n          (original: any, prepare?: any) =>\n            Effect.suspend(() => {\n              invariant(execute.active());\n              const input = snapshotPasskeySync(schemas[name]!, original);\n\n              return method(input, prepare);\n            }).pipe(\n              Effect.onExit((exit) =>\n                Effect.sync(() => {\n                  if (exit._tag === \"Failure\") execute.poison();\n                }),\n              ),\n              Effect.catchDefect(() => Effect.fail(unavailable())),\n            ),\n        ]),\n      ),\n    ) as S;\n\n  const prepareValue = <Value, A>(\n    value: Value,\n    prepare: PreparePasskeyCommit<Value, A>,\n  ): Effect.Effect<PreparedCommit<A>, never, CurrentPasskeyTransaction> =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      Effect.sync(() => {\n        owner.guards.push(owner.journal.prepare(undefined));\n        const receipt = prepare(value, owner.journal);\n\n        invariant(\n          receipt !== null &&\n            typeof receipt === \"object\" &&\n            receipt._tag === \"PreparedCommit\" &&\n            typeof receipt.read === \"object\" &&\n            Effect.isEffect(receipt.read),\n        );\n        owner.guards.push(receipt);\n\n        return receipt;\n      }),\n    );\n\n  const requirePurpose = (purpose: string, registration: boolean, enrollment = false) =>\n    invariant(\n      enrollment\n        ? purpose === \"enrollment\"\n        : registration\n          ? purpose === \"registration\"\n          : assertionPurposes.some((supported) => supported === purpose),\n    );\n\n  /** Context is advisory. Retain observations and final predicates without taking\n   * later-ranked locks before a subsequent mutation acquires its full lock set. */\n  const observationalContext = <A, E, R>(operation: Effect.Effect<A, E, R>) =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      operation.pipe(\n        Effect.provideService(CurrentPasskeyTransaction, {\n          ...owner,\n          read: (table, where, options) => owner.read(table, where, { ...options, lock: false }),\n        }),\n      ),\n    );\n\n  const makePasskeyPersistence = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n    registration = false,\n    enrollment = false,\n  ): PasskeyPersistence[\"Service\"] =>\n    capturedService<PasskeyPersistence[\"Service\"]>(\n      {\n        issue: (input, prepare) =>\n          Effect.suspend(() => {\n            invariant(!registration && !enrollment);\n            requirePurpose(input.ceremony.purpose, false);\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* issueAssertion(mapping, input.ceremony, input.policy);\n\n                return yield* prepareValue(\n                  snapshotPasskeySync(PasskeyIssueDecision, value),\n                  prepare,\n                );\n              }),\n            );\n          }),\n        context: (access) =>\n          Effect.suspend(() => {\n            requirePurpose(access.purpose, registration, enrollment);\n\n            return execute.run(\n              observationalContext(\n                registration\n                  ? contextRegistration(mapping, access)\n                  : contextAssertion(mapping, access),\n              ),\n              false,\n            );\n          }),\n        claim: (input, prepare) =>\n          Effect.suspend(() => {\n            requirePurpose(input.access.purpose, registration, enrollment);\n            requirePurpose(input.ceremony.purpose, registration, enrollment);\n            invariant((!registration && !enrollment) || input.credential === undefined);\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* registration\n                  ? claimRegistration(mapping, input)\n                  : claimAssertion(mapping, input);\n\n                return yield* prepareValue(\n                  snapshotPasskeySync(PasskeyClaimDecision, value),\n                  prepare,\n                );\n              }),\n            );\n          }),\n        settle: (input, prepare) =>\n          Effect.suspend(() => {\n            requirePurpose(input.claim.ceremony.purpose, registration, enrollment);\n            invariant((!registration && !enrollment) || input.outcome._tag !== \"Assertion\");\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* registration\n                  ? settleRegistration(\n                      mapping,\n                      input.claim,\n                      input.outcome._tag as \"Rejected\" | \"Ambiguous\",\n                    )\n                  : settleAssertion(mapping, input.claim, input.outcome, configuration.dialect);\n\n                return yield* prepareValue(snapshotPasskeySync(PasskeySettlement, value), prepare);\n              }),\n            );\n          }),\n        cleanup: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const value = yield* cleanupCeremonies(\n                mapping,\n                input,\n                registration ? [\"registration\"] : enrollment ? [\"enrollment\"] : assertionPurposes,\n              );\n\n              return yield* prepareValue(snapshotPasskeySync(PasskeyCleanupResult, value), prepare);\n            }),\n          ),\n      },\n      inputs,\n      execute,\n    );\n\n  const credentialService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyCredentials[\"Service\"] =>\n    capturedService<PasskeyCredentials[\"Service\"]>(\n      {\n        lookup: (input) =>\n          execute.run(lookupCredential(mapping, input.rpId, input.protocolCredentialId), false),\n      },\n      { lookup: lookupInput },\n      execute,\n    );\n\n  const enrollmentService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyEnrollmentContext[\"Service\"] =>\n    capturedService<PasskeyEnrollmentContext[\"Service\"]>(\n      {\n        capture: (input) =>\n          execute.run(\n            Effect.map(captureEnrollmentContext(mapping, input), (value) =>\n              value === undefined\n                ? undefined\n                : snapshotPasskeySync(PasskeyEnrollmentSnapshot, value),\n            ),\n            false,\n          ),\n      },\n      { capture: contextInput },\n      execute,\n    );\n\n  const registrationServices = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyRegistrationCeremonyServices => ({\n    capabilities: Object.freeze({\n      purposes: Object.freeze([\"registration\"] as const),\n      issue: \"registration-authority\",\n      assertionSettlement: false,\n    }),\n    passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true),\n  });\n\n  const capturedMapping = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    kind: \"read\" | \"context\" | \"assertion\" | \"registration\",\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<M, PasskeyConfigurationError | PersistenceMappingError, RSetup> =>\n    Effect.flatMap(Effect.isEffect(source) ? source : Effect.succeed(source), (mapping) =>\n      Effect.try({\n        try: () => {\n          const captured = captureMapping(mapping);\n\n          validateMapping(captured, kind);\n          if (configuration.mode === \"batch\") invariant((captured as any).d1?.primary === true);\n\n          return captured;\n        },\n        catch: () => PasskeyConfigurationError.make({}),\n      }),\n    );\n\n  const makeTargetPasskeyCredentials = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyCredentialServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | NativeDatabase\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"read\", configuration);\n\n      const execution = yield* makePasskeyExecution(configuration, mapping).pipe(\n        Effect.provideService(LifecycleHooks, emptyHooks),\n      );\n\n      return { passkeyCredentials: credentialService(mapping, execution) };\n    });\n\n  const makeTargetPasskeyEnrollmentContext = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyEnrollmentContextServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | NativeDatabase\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"context\", configuration);\n\n      const execution = yield* makePasskeyExecution(configuration, mapping).pipe(\n        Effect.provideService(LifecycleHooks, emptyHooks),\n      );\n\n      return { passkeyEnrollmentContext: enrollmentService(mapping, execution) };\n    });\n\n  const makeTargetPasskeyPersistence = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyPersistenceServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | LifecycleHooks | NativeDatabase\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"assertion\", configuration);\n      const execution = yield* makePasskeyExecution(configuration, mapping);\n\n      return {\n        passkeyPersistence: makePasskeyPersistence(mapping, execution, configuration),\n      };\n    });\n\n  const makeTargetPasskeyRegistration = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyRegistrationCeremonyServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | LifecycleHooks | NativeDatabase\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"registration\", configuration);\n      const execution = yield* makePasskeyExecution(configuration, mapping);\n\n      return registrationServices(mapping, execution, configuration);\n    });\n\n  const coordinateTargetPasskey = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: PasskeyPersistenceServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>\n    Effect.flatMap(capturedMapping(source, \"assertion\", configuration), (mapping) =>\n      Effect.flatMap(LifecycleHooks, (hooks) =>\n        coordinateTransactionOwner(\n          database,\n          CurrentPasskeyTransaction,\n          configuration,\n          operations.validateStorage?.(mapping) ?? Effect.void,\n          unavailable,\n          nonce,\n          (execution) => ({\n            passkeyPersistence: makePasskeyPersistence(\n              mapping,\n              {\n                ...execution,\n                run: (operation, mutation) =>\n                  execution\n                    .run(operation, mutation)\n                    .pipe(Effect.provideService(LifecycleHooks, hooks)),\n              },\n              configuration,\n            ),\n          }),\n          owner,\n        ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      ),\n    );\n\n  const coordinateTargetPasskeyRegistration = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: PasskeyRegistrationCeremonyServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>\n    Effect.flatMap(capturedMapping(source, \"registration\", configuration), (mapping) =>\n      Effect.flatMap(LifecycleHooks, (hooks) =>\n        coordinateTransactionOwner(\n          database,\n          CurrentPasskeyTransaction,\n          configuration,\n          operations.validateStorage?.(mapping) ?? Effect.void,\n          unavailable,\n          nonce,\n          (execution) =>\n            registrationServices(\n              mapping,\n              {\n                ...execution,\n                run: (operation, mutation) =>\n                  execution\n                    .run(operation, mutation)\n                    .pipe(Effect.provideService(LifecycleHooks, hooks)),\n              },\n              configuration,\n            ),\n          owner,\n        ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      ),\n    );\n\n  return {\n    sqlClientPasskeyStandaloneGuard,\n    makePasskeyExecution,\n    capturedService,\n    prepareValue,\n    observationalContext,\n    makePasskeyPersistence,\n    capturedMapping,\n    makeTargetPasskeyCredentials,\n    makeTargetPasskeyEnrollmentContext,\n    makeTargetPasskeyPersistence,\n    makeTargetPasskeyRegistration,\n    coordinateTargetPasskey,\n    coordinateTargetPasskeyRegistration,\n  };\n};\n"],"mappings":";;;;;;AAkEA,MAAa,2BACX,aAIA,MASA,sBAIA,OAIA,WAMA,eACG;CACH,MAAM,EAAE,0BAA0B,qBAAqB;CAEvD,MAAM,EACJ,mBACA,gBACA,mBACA,kBACA,gBACA,oBACE;CAEJ,MAAM,EAAE,mBAAmB,qBAAqB,uBAAuB;CACvE,MAAM,EAAE,gBAAgB,OAAO,aAAa,oBAAoB;CAChE,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,4BACA,0BACA,wCACE;CAEJ,MAAM,mCACJ,uBACG,oCAAoC,aAAa,kBAAkB;CAExE,MAAM,aAAwC;EAC5C,cAAc,OAAO;EACrB,aAAa,OAAO,QAAQ,CAAC,CAAC;CAChC;CAEA,MAAM,uBAAuB,OAAO,WAAW,WAC7C,eACA,SAKA;EACA,MAAM,QAAQ,OAAO;EAErB,QAAQ,WAAW,kBAAkB,OAAO,KAAK,OAAO,KAAA,CAAM,KAC5D,OAAO,eAAe,0BAA0B,KAAK,CAAC,CAAC,CAAC,CAC1D;EAEA,MAAM,YAAY,OAAO,yBACvB,2BACA,eACA,aACA,KACF;EAEA,OAAO;GACL,GAAG;GACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACxF;CACF,CAAC;CAED,MAAM,aAAa,OAAO,OAAO;EAAE,UAAU;EAAiB,QAAQ;CAAoB,CAAC;CAE3F,MAAM,aAAa,OAAO,OAAO;EAC/B,QAAQ;EACR,QAAQ;EACR,UAAU;EACV,SAAS,aAAa,OAAO;EAC7B,YAAY,OAAO,YAAY,iBAAiB;CAClD,CAAC;CAED,MAAM,cAAc,OAAO,OAAO;EAChC,OAAO;EACP,WAAW;EACX,SAAS,OAAO,MAAM;GACpB,OAAO,aAAa,YAAY,CAAC,CAAC;GAClC,OAAO,aAAa,aAAa,CAAC,CAAC;GACnC,OAAO,aAAa,aAAa;IAC/B,YAAY;IACZ,WAAW;IACX,UAAU;GACZ,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,eAAe,OAAO,OAAO;EACjC,UAAU;EACV,WAAW;EACX,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAK,CAAC,CAAC;CACzE,CAAC;CAED,MAAM,cAAc,OAAO,OAAO;EAChC,MAAM,eAAe,OAAO;EAC5B,sBAAsB;CACxB,CAAC;CAED,MAAM,eAAe,OAAO,OAAO;EACjC,UAAU;EACV,MAAM,eAAe,OAAO;EAC5B,WAAW;CACb,CAAC;CAED,MAAM,SAAS;EACb,OAAO;EACP,SAAS;EACT,OAAO;EACP,QAAQ;EACR,SAAS;CACX;CAEA,MAAM,mBACJ,SACA,SACA,YAEA,OAAO,OACL,OAAO,YACL,OAAO,QACL,OACF,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CACxB,OACC,UAAe,YACd,OAAO,cAAc;EACnB,UAAU,QAAQ,OAAO,CAAC;EAG1B,OAAO,OAFO,oBAAoB,QAAQ,OAAQ,QAEhC,GAAG,OAAO;CAC9B,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;EAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;CAC9C,CAAC,CACH,GACA,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD,CACJ,CAAC,CACH,CACF;CAEF,MAAM,gBACJ,OACA,YAEA,OAAO,QAAQ,4BAA4B,UACzC,OAAO,WAAW;EAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;EAClD,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO;EAE5C,UACE,YAAY,QACV,OAAO,YAAY,YACnB,QAAQ,SAAS,oBACjB,OAAO,QAAQ,SAAS,YACxB,OAAO,SAAS,QAAQ,IAAI,CAChC;EACA,MAAM,OAAO,KAAK,OAAO;EAEzB,OAAO;CACT,CAAC,CACH;CAEF,MAAM,kBAAkB,SAAiB,cAAuB,aAAa,UAC3E,UACE,aACI,YAAY,eACZ,eACE,YAAY,iBACZ,kBAAkB,MAAM,cAAc,cAAc,OAAO,CACnE;;;CAIF,MAAM,wBAAiC,cACrC,OAAO,QAAQ,4BAA4B,UACzC,UAAU,KACR,OAAO,eAAe,2BAA2B;EAC/C,GAAG;EACH,OAAO,OAAO,OAAO,YAAY,MAAM,KAAK,OAAO,OAAO;GAAE,GAAG;GAAS,MAAM;EAAM,CAAC;CACvF,CAAC,CACH,CACF;CAEF,MAAM,0BACJ,SACA,SACA,eACA,eAAe,OACf,aAAa,UAEb,gBACE;EACE,QAAQ,OAAO,YACb,OAAO,cAAc;GACnB,UAAU,CAAC,gBAAgB,CAAC,UAAU;GACtC,eAAe,MAAM,SAAS,SAAS,KAAK;GAE5C,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,MAAM;IAEzE,OAAO,OAAO,aACZ,oBAAoB,sBAAsB,KAAK,GAC/C,OACF;GACF,CAAC,CACH;EACF,CAAC;EACH,UAAU,WACR,OAAO,cAAc;GACnB,eAAe,OAAO,SAAS,cAAc,UAAU;GAEvD,OAAO,QAAQ,IACb,qBACE,eACI,oBAAoB,SAAS,MAAM,IACnC,iBAAiB,SAAS,MAAM,CACtC,GACA,KACF;EACF,CAAC;EACH,QAAQ,OAAO,YACb,OAAO,cAAc;GACnB,eAAe,MAAM,OAAO,SAAS,cAAc,UAAU;GAC7D,eAAe,MAAM,SAAS,SAAS,cAAc,UAAU;GAC/D,UAAW,CAAC,gBAAgB,CAAC,cAAe,MAAM,eAAe,KAAA,CAAS;GAE1E,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eACjB,kBAAkB,SAAS,KAAK,IAChC,eAAe,SAAS,KAAK;IAEjC,OAAO,OAAO,aACZ,oBAAoB,sBAAsB,KAAK,GAC/C,OACF;GACF,CAAC,CACH;EACF,CAAC;EACH,SAAS,OAAO,YACd,OAAO,cAAc;GACnB,eAAe,MAAM,MAAM,SAAS,SAAS,cAAc,UAAU;GACrE,UAAW,CAAC,gBAAgB,CAAC,cAAe,MAAM,QAAQ,SAAS,WAAW;GAE9E,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eACjB,mBACE,SACA,MAAM,OACN,MAAM,QAAQ,IAChB,IACA,gBAAgB,SAAS,MAAM,OAAO,MAAM,SAAS,cAAc,OAAO;IAE9E,OAAO,OAAO,aAAa,oBAAoB,mBAAmB,KAAK,GAAG,OAAO;GACnF,CAAC,CACH;EACF,CAAC;EACH,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,kBACnB,SACA,OACA,eAAe,CAAC,cAAc,IAAI,aAAa,CAAC,YAAY,IAAI,iBAClE;GAEA,OAAO,OAAO,aAAa,oBAAoB,sBAAsB,KAAK,GAAG,OAAO;EACtF,CAAC,CACH;CACJ,GACA,QACA,OACF;CAEF,MAAM,qBACJ,SACA,YAEA,gBACE,EACE,SAAS,UACP,QAAQ,IAAI,iBAAiB,SAAS,MAAM,MAAM,MAAM,oBAAoB,GAAG,KAAK,EACxF,GACA,EAAE,QAAQ,YAAY,GACtB,OACF;CAEF,MAAM,qBACJ,SACA,YAEA,gBACE,EACE,UAAU,UACR,QAAQ,IACN,OAAO,IAAI,yBAAyB,SAAS,KAAK,IAAI,UACpD,UAAU,KAAA,IACN,KAAA,IACA,oBAAoB,2BAA2B,KAAK,CAC1D,GACA,KACF,EACJ,GACA,EAAE,SAAS,aAAa,GACxB,OACF;CAEF,MAAM,wBACJ,SACA,SACA,mBACyC;EACzC,cAAc,OAAO,OAAO;GAC1B,UAAU,OAAO,OAAO,CAAC,cAAc,CAAU;GACjD,OAAO;GACP,qBAAqB;EACvB,CAAC;EACD,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,IAAI;CAClF;CAEA,MAAM,mBACJ,QACA,MACA,kBAEA,OAAO,QAAQ,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM,IAAI,YACzE,OAAO,IAAI;EACT,WAAW;GACT,MAAM,WAAW,eAAe,OAAO;GAEvC,gBAAgB,UAAU,IAAI;GAC9B,IAAI,cAAc,SAAS,SAAS,UAAW,SAAiB,IAAI,YAAY,IAAI;GAEpF,OAAO;EACT;EACA,aAAa,0BAA0B,KAAK,CAAC,CAAC;CAChD,CAAC,CACH;CAEF,MAAM,gCACJ,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,QAAQ,aAAa;EAEpE,MAAM,YAAY,OAAO,qBAAqB,eAAe,OAAO,CAAC,CAAC,KACpE,OAAO,eAAe,gBAAgB,UAAU,CAClD;EAEA,OAAO,EAAE,oBAAoB,kBAAkB,SAAS,SAAS,EAAE;CACrE,CAAC;CAEH,MAAM,sCACJ,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,WAAW,aAAa;EAEvE,MAAM,YAAY,OAAO,qBAAqB,eAAe,OAAO,CAAC,CAAC,KACpE,OAAO,eAAe,gBAAgB,UAAU,CAClD;EAEA,OAAO,EAAE,0BAA0B,kBAAkB,SAAS,SAAS,EAAE;CAC3E,CAAC;CAEH,MAAM,gCACJ,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,aAAa,aAAa;EACzE,MAAM,YAAY,OAAO,qBAAqB,eAAe,OAAO;EAEpE,OAAO,EACL,oBAAoB,uBAAuB,SAAS,WAAW,aAAa,EAC9E;CACF,CAAC;CAEH,MAAM,iCACJ,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,gBAAgB,aAAa;EAC5E,MAAM,YAAY,OAAO,qBAAqB,eAAe,OAAO;EAEpE,OAAO,qBAAqB,SAAS,WAAW,aAAa;CAC/D,CAAC;CAEH,MAAM,2BACJ,UACA,QACA,eACA,UAMA,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,aAAa,IAAI,YACnE,OAAO,QAAQ,iBAAiB,UAC9B,2BACE,UACA,2BACA,eACA,WAAW,kBAAkB,OAAO,KAAK,OAAO,MAChD,aACA,QACC,eAAe,EACd,oBAAoB,uBAClB,SACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,UACG,IAAI,WAAW,QAAQ,CAAC,CACxB,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxD,GACA,aACF,EACF,IACA,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD,CACF;CAEF,MAAM,uCACJ,UACA,QACA,eACA,UAMA,OAAO,QAAQ,gBAAgB,QAAQ,gBAAgB,aAAa,IAAI,YACtE,OAAO,QAAQ,iBAAiB,UAC9B,2BACE,UACA,2BACA,eACA,WAAW,kBAAkB,OAAO,KAAK,OAAO,MAChD,aACA,QACC,cACC,qBACE,SACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,UACG,IAAI,WAAW,QAAQ,CAAC,CACxB,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxD,GACA,aACF,GACF,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD,CACF;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/internal/passkey/write-state.d.mts

@@ -1,6 +1,6 @@
-import "../query-operations.mjs";
 import "../mapping-error.mjs";
 import "../transaction-kernel.mjs";
+import "../query-operations.mjs";
 import "./state.mjs";
 import { DateTime, Effect, Schema } from "effect";
 import { PasskeyActionAuthorization, PasskeyCeremony, PasskeyCredential, PasskeyManagementPolicy, PasskeyRevision } from "@yielded/auth/Passkey";

package/dist/internal/passkey/write-target.mjs

@@ -154,18 +154,18 @@ const makePasskeyWriteTargetKernel = (operations, enrollment, management, regist
 	});
 	const makeTargetPasskeyManagement = (source, configuration) => Effect.gen(function* () {
 		const mapping = yield* writeMapping(source, configuration, false);
-		const execution = yield* makePasskeyExecution(configuration);
+		const execution = yield* makePasskeyExecution(configuration, mapping);
 		return managementServices(mapping, execution, configuration);
 	});
 	const makeTargetPasskeyRegistrationWriter = (source, configuration) => Effect.gen(function* () {
 		const mapping = yield* writeMapping(source, configuration, true);
-		const execution = yield* makePasskeyExecution(configuration);
+		const execution = yield* makePasskeyExecution(configuration, mapping);
 		return registrationServices(mapping, execution, configuration);
 	});
 	const coordinateTargetPasskeyManagement = (database, source, configuration, body) => Effect.gen(function* () {
 		const mapping = yield* writeMapping(source, configuration, false);
 		const hooks = yield* LifecycleHooks;
-		return yield* coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, Effect.void, unavailable, nonce, (execute) => managementServices(mapping, {
+		return yield* coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, operations.validateStorage?.(mapping) ?? Effect.void, unavailable, nonce, (execute) => managementServices(mapping, {
 			...execute,
 			run: (operation, mutation) => execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
 		}, configuration), body).pipe(Effect.provideService(LifecycleHooks, hooks));
@@ -173,7 +173,7 @@ const makePasskeyWriteTargetKernel = (operations, enrollment, management, regist
 	const coordinateTargetPasskeyRegistrationWriter = (database, source, configuration, body) => Effect.gen(function* () {
 		const mapping = yield* writeMapping(source, configuration, true);
 		const hooks = yield* LifecycleHooks;
-		return yield* coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, Effect.void, unavailable, nonce, (execute) => registrationServices(mapping, {
+		return yield* coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, operations.validateStorage?.(mapping) ?? Effect.void, unavailable, nonce, (execute) => registrationServices(mapping, {
 			...execute,
 			run: (operation, mutation) => execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
 		}, configuration), body).pipe(Effect.provideService(LifecycleHooks, hooks));

package/dist/internal/passkey/write-target.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"write-target.mjs","names":[],"sources":["../../../src/internal/passkey/write-target.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  PasskeyConfigurationError,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport * as M from \"@yielded/auth/Passkey\";\nimport { SubjectId } from \"@yielded/auth/Schema\";\nimport { SessionInvalidationWindow } from \"@yielded/auth/Sessions\";\nimport { Effect, Layer, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PasskeyMappingSource } from \"../models/passkey-model\";\nimport type {\n  PasskeyManagementServices,\n  PasskeyRegistrationServices,\n  PasskeyRegistrationWriter,\n} from \"../models/passkey-write-model\";\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionExecutionKernel } from \"../transaction-execution-kernel\";\nimport type { makePasskeyEnrollmentKernel } from \"./enrollment\";\nimport type { makePasskeyManagementKernel } from \"./management\";\nimport type { makePasskeyRegistrationWriteKernel } from \"./registration-write\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\nimport type {\n  PasskeyExecution,\n  PasskeyCoordinatorError,\n  PasskeyTargetConfiguration,\n  makePasskeyTargetKernel,\n} from \"./target\";\n\nexport const makePasskeyWriteTargetKernel = (\n  operations: QueryOperations,\n  enrollment: Pick<\n    ReturnType<typeof makePasskeyEnrollmentKernel>,\n    \"completeEnrollment\" | \"issueEnrollment\"\n  >,\n  management: Pick<\n    ReturnType<typeof makePasskeyManagementKernel>,\n    \"inspectRemove\" | \"listCredentials\" | \"removeCredential\" | \"renameCredential\"\n  >,\n  registrationWrite: Pick<\n    ReturnType<typeof makePasskeyRegistrationWriteKernel>,\n    \"completeRegistration\" | \"inspectRegistration\" | \"issueRegistration\"\n  >,\n  state: Pick<ReturnType<typeof makePasskeyStateKernel>, \"invariant\" | \"nonce\" | \"unavailable\">,\n  target: Pick<\n    ReturnType<typeof makePasskeyTargetKernel>,\n    | \"capturedMapping\"\n    | \"capturedService\"\n    | \"makePasskeyExecution\"\n    | \"makePasskeyPersistence\"\n    | \"observationalContext\"\n    | \"prepareValue\"\n  >,\n  execution: Pick<ReturnType<typeof makeTransactionExecutionKernel>, \"coordinateTransactionOwner\">,\n) => {\n  const { getTableColumns } = operations;\n  const { completeEnrollment, issueEnrollment } = enrollment;\n  const { inspectRemove, listCredentials, removeCredential, renameCredential } = management;\n  const { completeRegistration, inspectRegistration, issueRegistration } = registrationWrite;\n  const { nonce, unavailable } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    capturedMapping,\n    capturedService,\n    makePasskeyExecution,\n    makePasskeyPersistence,\n    observationalContext,\n    prepareValue,\n  } = target;\n\n  const { coordinateTransactionOwner } = execution;\n\n  const passkeyManagementPersistenceLayer = <E, R>(\n    services: Effect.Effect<PasskeyManagementServices, E, R>,\n  ) =>\n    Layer.effect(\n      PasskeyManagementPersistence,\n      Effect.map(services, (value) => value.passkeyManagementPersistence),\n    );\n\n  const issueSchema = Schema.Struct({\n    ceremony: M.PasskeyCeremony,\n    policy: PasskeyMethodPolicy,\n    management: PasskeyManagementPolicy,\n    authorization: M.PasskeyActionAuthorization,\n  });\n\n  const completeSchema = Schema.Struct({\n    claim: M.PasskeyClaim,\n    verified: M.PasskeyRegistrationVerified,\n    authorization: M.PasskeyActionAuthorization,\n    management: PasskeyManagementPolicy,\n    nowMillis: M.PasskeyInstant,\n  });\n\n  const metadata = { moduleId: M.PasskeyModuleId, subjectId: SubjectId };\n\n  const identity = {\n    ...metadata,\n    commandId: M.PasskeyCommandId,\n    credentialId: M.PasskeyCredentialId,\n  };\n\n  const retention = { nowMillis: M.PasskeyInstant, retentionUntilMillis: M.PasskeyInstant };\n\n  const managementSchemas = {\n    list: Schema.Struct({\n      ...metadata,\n      cursor: Schema.optionalKey(M.PasskeyCredentialId),\n      limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 64 })),\n    }),\n    issueEnrollment: issueSchema,\n    completeEnrollment: completeSchema,\n    inspectRemove: Schema.Struct(identity),\n    rename: Schema.Struct({ ...identity, ...retention, name: M.PasskeyLabel }),\n    remove: Schema.Struct({\n      moduleId: M.PasskeyModuleId,\n      commandId: M.PasskeyCommandId,\n      credential: M.PasskeyCredential,\n      authorization: M.PasskeyActionAuthorization,\n      management: PasskeyManagementPolicy,\n      invalidation: SessionInvalidationWindow,\n      ...retention,\n    }),\n  };\n\n  const enrolled = Schema.Union([\n    Schema.TaggedStruct(\"Enrolled\", { credential: M.PasskeyCredentialSummary }),\n    Schema.TaggedStruct(\"Rejected\", {}),\n  ]);\n\n  const renamed = Schema.Union([\n    Schema.TaggedStruct(\"Renamed\", {\n      credential: M.PasskeyCredentialSummary,\n      replayed: Schema.Boolean,\n    }),\n    Schema.TaggedStruct(\"Rejected\", {}),\n  ]);\n\n  const removed = Schema.Union([\n    Schema.TaggedStruct(\"Removed\", { result: M.PasskeyRemoved }),\n    Schema.TaggedStruct(\"Rejected\", {}),\n    Schema.TaggedStruct(\"LastSignInMethod\", {}),\n  ]);\n\n  const registrationDecision = Schema.Union([\n    M.PasskeyRegistrationResult,\n    Schema.TaggedStruct(\"Rejected\", {}),\n  ]);\n\n  const managementService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyManagementPersistence[\"Service\"] =>\n    capturedService<PasskeyManagementPersistence[\"Service\"]>(\n      {\n        list: (input) => execute.run(observationalContext(listCredentials(mapping, input)), false),\n        inspectRemove: (input) =>\n          execute.run(observationalContext(inspectRemove(mapping, input)), false),\n        issueEnrollment: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(M.PasskeyIssueDecision, yield* issueEnrollment(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n        completeEnrollment: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(enrolled, yield* completeEnrollment(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n        rename: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(renamed, yield* renameCredential(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n        remove: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(removed, yield* removeCredential(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n      },\n      managementSchemas,\n      execute,\n    );\n\n  const registrationService = <R>(\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyRegistrationWriter<R> =>\n    capturedService<PasskeyRegistrationWriter<R>>(\n      {\n        inspect: (registration) =>\n          execute.run(observationalContext(inspectRegistration(mapping, registration)), false),\n        issueRegistration: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(\n                  M.PasskeyIssueDecision,\n                  yield* issueRegistration(mapping, input),\n                ),\n                prepare,\n              );\n            }),\n          ),\n        completeRegistration: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(\n                  registrationDecision,\n                  yield* completeRegistration(mapping, input),\n                ),\n                prepare,\n              );\n            }),\n          ),\n      },\n      {\n        inspect: Schema.toType(mapping.registration.schema),\n        issueRegistration: Schema.Struct({\n          ceremony: M.PasskeyCeremony,\n          policy: PasskeyMethodPolicy,\n          registration: Schema.toType(mapping.registration.schema),\n        }),\n        completeRegistration: Schema.Struct({\n          claim: M.PasskeyClaim,\n          verified: M.PasskeyRegistrationVerified,\n          nowMillis: M.PasskeyInstant,\n        }),\n      },\n      execute,\n    );\n\n  const descriptor = (table: any) => {\n    const columns = getTableColumns(table.table);\n\n    for (const [field, name] of Object.entries(table))\n      if (typeof name === \"string\" && !field.endsWith(\"State\"))\n        invariant(columns[name] !== undefined);\n  };\n\n  const writeMapping = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    registration: boolean,\n  ) =>\n    Effect.flatMap(capturedMapping(source, \"assertion\", configuration), (mapping) =>\n      Effect.try({\n        try: () => {\n          const m = mapping as any;\n\n          for (const name of [m.write.credential.name, m.write.credential.createdAt])\n            invariant(getTableColumns(m.read.credential.table)[name] !== undefined);\n          for (const name of m.write.policy.subjectColumns)\n            invariant(getTableColumns(m.read.subject.table)[name] !== undefined);\n          invariant(\n            m.write.credential.activeStatus !== m.write.credential.removedStatus &&\n              m.write.authority.activeStatus !== m.write.authority.removedStatus &&\n              m.write.credentialOwnership.ownedState !== m.write.credentialOwnership.removedState,\n          );\n          invariant(\n            m.read.credential.isActiveStatus(m.write.credential.activeStatus) &&\n              !m.read.credential.isActiveStatus(m.write.credential.removedStatus) &&\n              m.read.authority.isActiveStatus(m.write.authority.activeStatus) &&\n              !m.read.authority.isActiveStatus(m.write.authority.removedStatus) &&\n              m.read.credentialOwnership.isOwnedState(m.write.credentialOwnership.ownedState) &&\n              !m.read.credentialOwnership.isOwnedState(m.write.credentialOwnership.removedState) &&\n              m.read.handleOwnership.isOwnedState(m.write.handleOwnership.ownedState),\n          );\n          if (registration) {\n            descriptor(m.intent);\n            descriptor(m.handle);\n            invariant(m.handle.table === m.read.handleOwnership.table);\n            invariant(\n              m.handle.reservedState !== m.write.handleOwnership.ownedState &&\n                m.intent.pendingState !== m.intent.acceptedState &&\n                m.intent.rejectedState !== m.intent.pendingState &&\n                m.intent.rejectedState !== m.intent.acceptedState,\n            );\n            invariant(\n              m.registrationConstraints.intentFlow.join(\"/\") === \"moduleId/flowId\" &&\n                m.registrationConstraints.intentCommand.join(\"/\") === \"moduleId/commandId\" &&\n                m.registrationConstraints.handle.join(\"/\") === \"handleKey\",\n            );\n          } else {\n            descriptor(m.command);\n            invariant(m.managementConstraints.command.join(\"/\") === \"moduleId/commandId\");\n            snapshotPasskeySync(SessionInvalidationWindow, m.invalidation.window);\n            invariant(\n              m.invalidation.window.trigger === \"credential-change\" &&\n                m.invalidation.mutations.length <= 32,\n            );\n          }\n\n          return mapping;\n        },\n        catch: () => PasskeyConfigurationError.make({}),\n      }),\n    );\n\n  const managementServices = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyManagementServices => ({\n    passkeyManagementPersistence: managementService(mapping, execute),\n    passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, false, true),\n  });\n\n  const registrationServices = <R>(\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyRegistrationServices<R> => ({\n    passkeyRegistrationAuthority: registrationService<R>(mapping, execute),\n    passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true),\n  });\n\n  const makeTargetPasskeyManagement = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ) =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, false);\n      const execution = yield* makePasskeyExecution(configuration);\n\n      return managementServices(mapping, execution, configuration);\n    });\n\n  const makeTargetPasskeyRegistrationWriter = <M, R, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ) =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, true);\n      const execution = yield* makePasskeyExecution(configuration);\n\n      return registrationServices<R>(mapping, execution, configuration);\n    });\n\n  const coordinateTargetPasskeyManagement = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    body: (\n      transaction: Transaction,\n      services: PasskeyManagementServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, false);\n      const hooks = yield* LifecycleHooks;\n\n      return yield* coordinateTransactionOwner(\n        database,\n        CurrentPasskeyTransaction,\n        configuration,\n        Effect.void,\n        unavailable,\n        nonce,\n        (execute) =>\n          managementServices(\n            mapping,\n            {\n              ...execute,\n              run: (operation, mutation) =>\n                execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n            },\n            configuration,\n          ),\n        body,\n      ).pipe(Effect.provideService(LifecycleHooks, hooks));\n    });\n\n  const coordinateTargetPasskeyRegistrationWriter = <M, Value, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    body: (\n      transaction: Transaction,\n      services: PasskeyRegistrationServices<Value>,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, true);\n      const hooks = yield* LifecycleHooks;\n\n      return yield* coordinateTransactionOwner(\n        database,\n        CurrentPasskeyTransaction,\n        configuration,\n        Effect.void,\n        unavailable,\n        nonce,\n        (execute) =>\n          registrationServices<Value>(\n            mapping,\n            {\n              ...execute,\n              run: (operation, mutation) =>\n                execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n            },\n            configuration,\n          ),\n        body,\n      ).pipe(Effect.provideService(LifecycleHooks, hooks));\n    });\n\n  return {\n    passkeyManagementPersistenceLayer,\n    makeTargetPasskeyManagement,\n    makeTargetPasskeyRegistrationWriter,\n    coordinateTargetPasskeyManagement,\n    coordinateTargetPasskeyRegistrationWriter,\n  };\n};\n"],"mappings":";;;;;;;;AAoCA,MAAa,gCACX,YACA,YAIA,YAIA,mBAIA,OACA,QASA,cACG;CACH,MAAM,EAAE,oBAAoB;CAC5B,MAAM,EAAE,oBAAoB,oBAAoB;CAChD,MAAM,EAAE,eAAe,iBAAiB,kBAAkB,qBAAqB;CAC/E,MAAM,EAAE,sBAAsB,qBAAqB,sBAAsB;CACzE,MAAM,EAAE,OAAO,gBAAgB;CAC/B,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,iBACA,iBACA,sBACA,wBACA,sBACA,iBACE;CAEJ,MAAM,EAAE,+BAA+B;CAEvC,MAAM,qCACJ,aAEA,MAAM,OACJ,8BACA,OAAO,IAAI,WAAW,UAAU,MAAM,4BAA4B,CACpE;CAEF,MAAM,cAAc,OAAO,OAAO;EAChC,UAAU,EAAE;EACZ,QAAQ;EACR,YAAY;EACZ,eAAe,EAAE;CACnB,CAAC;CAED,MAAM,iBAAiB,OAAO,OAAO;EACnC,OAAO,EAAE;EACT,UAAU,EAAE;EACZ,eAAe,EAAE;EACjB,YAAY;EACZ,WAAW,EAAE;CACf,CAAC;CAED,MAAM,WAAW;EAAE,UAAU,EAAE;EAAiB,WAAW;CAAU;CAErE,MAAM,WAAW;EACf,GAAG;EACH,WAAW,EAAE;EACb,cAAc,EAAE;CAClB;CAEA,MAAM,YAAY;EAAE,WAAW,EAAE;EAAgB,sBAAsB,EAAE;CAAe;CAExF,MAAM,oBAAoB;EACxB,MAAM,OAAO,OAAO;GAClB,GAAG;GACH,QAAQ,OAAO,YAAY,EAAE,mBAAmB;GAChD,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;IAAE,SAAS;IAAG,SAAS;GAAG,CAAC,CAAC;EACvE,CAAC;EACD,iBAAiB;EACjB,oBAAoB;EACpB,eAAe,OAAO,OAAO,QAAQ;EACrC,QAAQ,OAAO,OAAO;GAAE,GAAG;GAAU,GAAG;GAAW,MAAM,EAAE;EAAa,CAAC;EACzE,QAAQ,OAAO,OAAO;GACpB,UAAU,EAAE;GACZ,WAAW,EAAE;GACb,YAAY,EAAE;GACd,eAAe,EAAE;GACjB,YAAY;GACZ,cAAc;GACd,GAAG;EACL,CAAC;CACH;CAEA,MAAM,WAAW,OAAO,MAAM,CAC5B,OAAO,aAAa,YAAY,EAAE,YAAY,EAAE,yBAAyB,CAAC,GAC1E,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;CAED,MAAM,UAAU,OAAO,MAAM,CAC3B,OAAO,aAAa,WAAW;EAC7B,YAAY,EAAE;EACd,UAAU,OAAO;CACnB,CAAC,GACD,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;CAED,MAAM,UAAU,OAAO,MAAM;EAC3B,OAAO,aAAa,WAAW,EAAE,QAAQ,EAAE,eAAe,CAAC;EAC3D,OAAO,aAAa,YAAY,CAAC,CAAC;EAClC,OAAO,aAAa,oBAAoB,CAAC,CAAC;CAC5C,CAAC;CAED,MAAM,uBAAuB,OAAO,MAAM,CACxC,EAAE,2BACF,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;CAED,MAAM,qBACJ,SACA,YAEA,gBACE;EACE,OAAO,UAAU,QAAQ,IAAI,qBAAqB,gBAAgB,SAAS,KAAK,CAAC,GAAG,KAAK;EACzF,gBAAgB,UACd,QAAQ,IAAI,qBAAqB,cAAc,SAAS,KAAK,CAAC,GAAG,KAAK;EACxE,kBAAkB,OAAO,YACvB,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,EAAE,sBAAsB,OAAO,gBAAgB,SAAS,KAAK,CAAC,GAClF,OACF;EACF,CAAC,CACH;EACF,qBAAqB,OAAO,YAC1B,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,UAAU,OAAO,mBAAmB,SAAS,KAAK,CAAC,GACvE,OACF;EACF,CAAC,CACH;EACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,SAAS,OAAO,iBAAiB,SAAS,KAAK,CAAC,GACpE,OACF;EACF,CAAC,CACH;EACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,SAAS,OAAO,iBAAiB,SAAS,KAAK,CAAC,GACpE,OACF;EACF,CAAC,CACH;CACJ,GACA,mBACA,OACF;CAEF,MAAM,uBACJ,SACA,YAEA,gBACE;EACE,UAAU,iBACR,QAAQ,IAAI,qBAAqB,oBAAoB,SAAS,YAAY,CAAC,GAAG,KAAK;EACrF,oBAAoB,OAAO,YACzB,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBACE,EAAE,sBACF,OAAO,kBAAkB,SAAS,KAAK,CACzC,GACA,OACF;EACF,CAAC,CACH;EACF,uBAAuB,OAAO,YAC5B,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBACE,sBACA,OAAO,qBAAqB,SAAS,KAAK,CAC5C,GACA,OACF;EACF,CAAC,CACH;CACJ,GACA;EACE,SAAS,OAAO,OAAO,QAAQ,aAAa,MAAM;EAClD,mBAAmB,OAAO,OAAO;GAC/B,UAAU,EAAE;GACZ,QAAQ;GACR,cAAc,OAAO,OAAO,QAAQ,aAAa,MAAM;EACzD,CAAC;EACD,sBAAsB,OAAO,OAAO;GAClC,OAAO,EAAE;GACT,UAAU,EAAE;GACZ,WAAW,EAAE;EACf,CAAC;CACH,GACA,OACF;CAEF,MAAM,cAAc,UAAe;EACjC,MAAM,UAAU,gBAAgB,MAAM,KAAK;EAE3C,KAAK,MAAM,CAAC,OAAO,SAAS,OAAO,QAAQ,KAAK,GAC9C,IAAI,OAAO,SAAS,YAAY,CAAC,MAAM,SAAS,OAAO,GACrD,UAAU,QAAQ,UAAU,KAAA,CAAS;CAC3C;CAEA,MAAM,gBACJ,QACA,eACA,iBAEA,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,aAAa,IAAI,YACnE,OAAO,IAAI;EACT,WAAW;GACT,MAAM,IAAI;GAEV,KAAK,MAAM,QAAQ,CAAC,EAAE,MAAM,WAAW,MAAM,EAAE,MAAM,WAAW,SAAS,GACvE,UAAU,gBAAgB,EAAE,KAAK,WAAW,KAAK,CAAC,CAAC,UAAU,KAAA,CAAS;GACxE,KAAK,MAAM,QAAQ,EAAE,MAAM,OAAO,gBAChC,UAAU,gBAAgB,EAAE,KAAK,QAAQ,KAAK,CAAC,CAAC,UAAU,KAAA,CAAS;GACrE,UACE,EAAE,MAAM,WAAW,iBAAiB,EAAE,MAAM,WAAW,iBACrD,EAAE,MAAM,UAAU,iBAAiB,EAAE,MAAM,UAAU,iBACrD,EAAE,MAAM,oBAAoB,eAAe,EAAE,MAAM,oBAAoB,YAC3E;GACA,UACE,EAAE,KAAK,WAAW,eAAe,EAAE,MAAM,WAAW,YAAY,KAC9D,CAAC,EAAE,KAAK,WAAW,eAAe,EAAE,MAAM,WAAW,aAAa,KAClE,EAAE,KAAK,UAAU,eAAe,EAAE,MAAM,UAAU,YAAY,KAC9D,CAAC,EAAE,KAAK,UAAU,eAAe,EAAE,MAAM,UAAU,aAAa,KAChE,EAAE,KAAK,oBAAoB,aAAa,EAAE,MAAM,oBAAoB,UAAU,KAC9E,CAAC,EAAE,KAAK,oBAAoB,aAAa,EAAE,MAAM,oBAAoB,YAAY,KACjF,EAAE,KAAK,gBAAgB,aAAa,EAAE,MAAM,gBAAgB,UAAU,CAC1E;GACA,IAAI,cAAc;IAChB,WAAW,EAAE,MAAM;IACnB,WAAW,EAAE,MAAM;IACnB,UAAU,EAAE,OAAO,UAAU,EAAE,KAAK,gBAAgB,KAAK;IACzD,UACE,EAAE,OAAO,kBAAkB,EAAE,MAAM,gBAAgB,cACjD,EAAE,OAAO,iBAAiB,EAAE,OAAO,iBACnC,EAAE,OAAO,kBAAkB,EAAE,OAAO,gBACpC,EAAE,OAAO,kBAAkB,EAAE,OAAO,aACxC;IACA,UACE,EAAE,wBAAwB,WAAW,KAAK,GAAG,MAAM,qBACjD,EAAE,wBAAwB,cAAc,KAAK,GAAG,MAAM,wBACtD,EAAE,wBAAwB,OAAO,KAAK,GAAG,MAAM,WACnD;GACF,OAAO;IACL,WAAW,EAAE,OAAO;IACpB,UAAU,EAAE,sBAAsB,QAAQ,KAAK,GAAG,MAAM,oBAAoB;IAC5E,oBAAoB,2BAA2B,EAAE,aAAa,MAAM;IACpE,UACE,EAAE,aAAa,OAAO,YAAY,uBAChC,EAAE,aAAa,UAAU,UAAU,EACvC;GACF;GAEA,OAAO;EACT;EACA,aAAa,0BAA0B,KAAK,CAAC,CAAC;CAChD,CAAC,CACH;CAEF,MAAM,sBACJ,SACA,SACA,mBAC+B;EAC/B,8BAA8B,kBAAkB,SAAS,OAAO;EAChE,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,OAAO,IAAI;CACzF;CAEA,MAAM,wBACJ,SACA,SACA,mBACoC;EACpC,8BAA8B,oBAAuB,SAAS,OAAO;EACrE,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,IAAI;CAClF;CAEA,MAAM,+BACJ,QACA,kBAEA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,KAAK;EAChE,MAAM,YAAY,OAAO,qBAAqB,aAAa;EAE3D,OAAO,mBAAmB,SAAS,WAAW,aAAa;CAC7D,CAAC;CAEH,MAAM,uCACJ,QACA,kBAEA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,IAAI;EAC/D,MAAM,YAAY,OAAO,qBAAqB,aAAa;EAE3D,OAAO,qBAAwB,SAAS,WAAW,aAAa;CAClE,CAAC;CAEH,MAAM,qCACJ,UACA,QACA,eACA,SAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,KAAK;EAChE,MAAM,QAAQ,OAAO;EAErB,OAAO,OAAO,2BACZ,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,YACC,mBACE,SACA;GACE,GAAG;GACH,MAAM,WAAW,aACf,QAAQ,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtF,GACA,aACF,GACF,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACrD,CAAC;CAEH,MAAM,6CACJ,UACA,QACA,eACA,SAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,IAAI;EAC/D,MAAM,QAAQ,OAAO;EAErB,OAAO,OAAO,2BACZ,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,YACC,qBACE,SACA;GACE,GAAG;GACH,MAAM,WAAW,aACf,QAAQ,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtF,GACA,aACF,GACF,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACrD,CAAC;CAEH,OAAO;EACL;EACA;EACA;EACA;EACA;CACF;AACF"}
+{"version":3,"file":"write-target.mjs","names":[],"sources":["../../../src/internal/passkey/write-target.ts"],"sourcesContent":["import { LifecycleHooks } from \"@yielded/auth/Hooks\";\n/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\nimport {\n  PasskeyConfigurationError,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport * as M from \"@yielded/auth/Passkey\";\nimport { SubjectId } from \"@yielded/auth/Schema\";\nimport { SessionInvalidationWindow } from \"@yielded/auth/Sessions\";\nimport { Effect, Layer, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PasskeyMappingSource } from \"../models/passkey-model\";\nimport type {\n  PasskeyManagementServices,\n  PasskeyRegistrationServices,\n  PasskeyRegistrationWriter,\n} from \"../models/passkey-write-model\";\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionExecutionKernel } from \"../transaction-execution-kernel\";\nimport type { NativeDatabase } from \"../transaction-kernel\";\nimport type { makePasskeyEnrollmentKernel } from \"./enrollment\";\nimport type { makePasskeyManagementKernel } from \"./management\";\nimport type { makePasskeyRegistrationWriteKernel } from \"./registration-write\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\nimport type {\n  PasskeyExecution,\n  PasskeyCoordinatorError,\n  PasskeyTargetConfiguration,\n  makePasskeyTargetKernel,\n} from \"./target\";\n\nexport const makePasskeyWriteTargetKernel = (\n  operations: QueryOperations,\n  enrollment: Pick<\n    ReturnType<typeof makePasskeyEnrollmentKernel>,\n    \"completeEnrollment\" | \"issueEnrollment\"\n  >,\n  management: Pick<\n    ReturnType<typeof makePasskeyManagementKernel>,\n    \"inspectRemove\" | \"listCredentials\" | \"removeCredential\" | \"renameCredential\"\n  >,\n  registrationWrite: Pick<\n    ReturnType<typeof makePasskeyRegistrationWriteKernel>,\n    \"completeRegistration\" | \"inspectRegistration\" | \"issueRegistration\"\n  >,\n  state: Pick<ReturnType<typeof makePasskeyStateKernel>, \"invariant\" | \"nonce\" | \"unavailable\">,\n  target: Pick<\n    ReturnType<typeof makePasskeyTargetKernel>,\n    | \"capturedMapping\"\n    | \"capturedService\"\n    | \"makePasskeyExecution\"\n    | \"makePasskeyPersistence\"\n    | \"observationalContext\"\n    | \"prepareValue\"\n  >,\n  execution: Pick<ReturnType<typeof makeTransactionExecutionKernel>, \"coordinateTransactionOwner\">,\n) => {\n  const { getTableColumns } = operations;\n  const { completeEnrollment, issueEnrollment } = enrollment;\n  const { inspectRemove, listCredentials, removeCredential, renameCredential } = management;\n  const { completeRegistration, inspectRegistration, issueRegistration } = registrationWrite;\n  const { nonce, unavailable } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    capturedMapping,\n    capturedService,\n    makePasskeyExecution,\n    makePasskeyPersistence,\n    observationalContext,\n    prepareValue,\n  } = target;\n\n  const { coordinateTransactionOwner } = execution;\n\n  const passkeyManagementPersistenceLayer = <E, R>(\n    services: Effect.Effect<PasskeyManagementServices, E, R>,\n  ) =>\n    Layer.effect(\n      PasskeyManagementPersistence,\n      Effect.map(services, (value) => value.passkeyManagementPersistence),\n    );\n\n  const issueSchema = Schema.Struct({\n    ceremony: M.PasskeyCeremony,\n    policy: PasskeyMethodPolicy,\n    management: PasskeyManagementPolicy,\n    authorization: M.PasskeyActionAuthorization,\n  });\n\n  const completeSchema = Schema.Struct({\n    claim: M.PasskeyClaim,\n    verified: M.PasskeyRegistrationVerified,\n    authorization: M.PasskeyActionAuthorization,\n    management: PasskeyManagementPolicy,\n    nowMillis: M.PasskeyInstant,\n  });\n\n  const metadata = { moduleId: M.PasskeyModuleId, subjectId: SubjectId };\n\n  const identity = {\n    ...metadata,\n    commandId: M.PasskeyCommandId,\n    credentialId: M.PasskeyCredentialId,\n  };\n\n  const retention = { nowMillis: M.PasskeyInstant, retentionUntilMillis: M.PasskeyInstant };\n\n  const managementSchemas = {\n    list: Schema.Struct({\n      ...metadata,\n      cursor: Schema.optionalKey(M.PasskeyCredentialId),\n      limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 64 })),\n    }),\n    issueEnrollment: issueSchema,\n    completeEnrollment: completeSchema,\n    inspectRemove: Schema.Struct(identity),\n    rename: Schema.Struct({ ...identity, ...retention, name: M.PasskeyLabel }),\n    remove: Schema.Struct({\n      moduleId: M.PasskeyModuleId,\n      commandId: M.PasskeyCommandId,\n      credential: M.PasskeyCredential,\n      authorization: M.PasskeyActionAuthorization,\n      management: PasskeyManagementPolicy,\n      invalidation: SessionInvalidationWindow,\n      ...retention,\n    }),\n  };\n\n  const enrolled = Schema.Union([\n    Schema.TaggedStruct(\"Enrolled\", { credential: M.PasskeyCredentialSummary }),\n    Schema.TaggedStruct(\"Rejected\", {}),\n  ]);\n\n  const renamed = Schema.Union([\n    Schema.TaggedStruct(\"Renamed\", {\n      credential: M.PasskeyCredentialSummary,\n      replayed: Schema.Boolean,\n    }),\n    Schema.TaggedStruct(\"Rejected\", {}),\n  ]);\n\n  const removed = Schema.Union([\n    Schema.TaggedStruct(\"Removed\", { result: M.PasskeyRemoved }),\n    Schema.TaggedStruct(\"Rejected\", {}),\n    Schema.TaggedStruct(\"LastSignInMethod\", {}),\n  ]);\n\n  const registrationDecision = Schema.Union([\n    M.PasskeyRegistrationResult,\n    Schema.TaggedStruct(\"Rejected\", {}),\n  ]);\n\n  const managementService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyManagementPersistence[\"Service\"] =>\n    capturedService<PasskeyManagementPersistence[\"Service\"]>(\n      {\n        list: (input) => execute.run(observationalContext(listCredentials(mapping, input)), false),\n        inspectRemove: (input) =>\n          execute.run(observationalContext(inspectRemove(mapping, input)), false),\n        issueEnrollment: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(M.PasskeyIssueDecision, yield* issueEnrollment(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n        completeEnrollment: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(enrolled, yield* completeEnrollment(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n        rename: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(renamed, yield* renameCredential(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n        remove: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(removed, yield* removeCredential(mapping, input)),\n                prepare,\n              );\n            }),\n          ),\n      },\n      managementSchemas,\n      execute,\n    );\n\n  const registrationService = <R>(\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyRegistrationWriter<R> =>\n    capturedService<PasskeyRegistrationWriter<R>>(\n      {\n        inspect: (registration) =>\n          execute.run(observationalContext(inspectRegistration(mapping, registration)), false),\n        issueRegistration: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(\n                  M.PasskeyIssueDecision,\n                  yield* issueRegistration(mapping, input),\n                ),\n                prepare,\n              );\n            }),\n          ),\n        completeRegistration: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              return yield* prepareValue(\n                snapshotPasskeySync(\n                  registrationDecision,\n                  yield* completeRegistration(mapping, input),\n                ),\n                prepare,\n              );\n            }),\n          ),\n      },\n      {\n        inspect: Schema.toType(mapping.registration.schema),\n        issueRegistration: Schema.Struct({\n          ceremony: M.PasskeyCeremony,\n          policy: PasskeyMethodPolicy,\n          registration: Schema.toType(mapping.registration.schema),\n        }),\n        completeRegistration: Schema.Struct({\n          claim: M.PasskeyClaim,\n          verified: M.PasskeyRegistrationVerified,\n          nowMillis: M.PasskeyInstant,\n        }),\n      },\n      execute,\n    );\n\n  const descriptor = (table: any) => {\n    const columns = getTableColumns(table.table);\n\n    for (const [field, name] of Object.entries(table))\n      if (typeof name === \"string\" && !field.endsWith(\"State\"))\n        invariant(columns[name] !== undefined);\n  };\n\n  const writeMapping = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    registration: boolean,\n  ) =>\n    Effect.flatMap(capturedMapping(source, \"assertion\", configuration), (mapping) =>\n      Effect.try({\n        try: () => {\n          const m = mapping as any;\n\n          for (const name of [m.write.credential.name, m.write.credential.createdAt])\n            invariant(getTableColumns(m.read.credential.table)[name] !== undefined);\n          for (const name of m.write.policy.subjectColumns)\n            invariant(getTableColumns(m.read.subject.table)[name] !== undefined);\n          invariant(\n            m.write.credential.activeStatus !== m.write.credential.removedStatus &&\n              m.write.authority.activeStatus !== m.write.authority.removedStatus &&\n              m.write.credentialOwnership.ownedState !== m.write.credentialOwnership.removedState,\n          );\n          invariant(\n            m.read.credential.isActiveStatus(m.write.credential.activeStatus) &&\n              !m.read.credential.isActiveStatus(m.write.credential.removedStatus) &&\n              m.read.authority.isActiveStatus(m.write.authority.activeStatus) &&\n              !m.read.authority.isActiveStatus(m.write.authority.removedStatus) &&\n              m.read.credentialOwnership.isOwnedState(m.write.credentialOwnership.ownedState) &&\n              !m.read.credentialOwnership.isOwnedState(m.write.credentialOwnership.removedState) &&\n              m.read.handleOwnership.isOwnedState(m.write.handleOwnership.ownedState),\n          );\n          if (registration) {\n            descriptor(m.intent);\n            descriptor(m.handle);\n            invariant(m.handle.table === m.read.handleOwnership.table);\n            invariant(\n              m.handle.reservedState !== m.write.handleOwnership.ownedState &&\n                m.intent.pendingState !== m.intent.acceptedState &&\n                m.intent.rejectedState !== m.intent.pendingState &&\n                m.intent.rejectedState !== m.intent.acceptedState,\n            );\n            invariant(\n              m.registrationConstraints.intentFlow.join(\"/\") === \"moduleId/flowId\" &&\n                m.registrationConstraints.intentCommand.join(\"/\") === \"moduleId/commandId\" &&\n                m.registrationConstraints.handle.join(\"/\") === \"handleKey\",\n            );\n          } else {\n            descriptor(m.command);\n            invariant(m.managementConstraints.command.join(\"/\") === \"moduleId/commandId\");\n            snapshotPasskeySync(SessionInvalidationWindow, m.invalidation.window);\n            invariant(\n              m.invalidation.window.trigger === \"credential-change\" &&\n                m.invalidation.mutations.length <= 32,\n            );\n          }\n\n          return mapping;\n        },\n        catch: () => PasskeyConfigurationError.make({}),\n      }),\n    );\n\n  const managementServices = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyManagementServices => ({\n    passkeyManagementPersistence: managementService(mapping, execute),\n    passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, false, true),\n  });\n\n  const registrationServices = <R>(\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyRegistrationServices<R> => ({\n    passkeyRegistrationAuthority: registrationService<R>(mapping, execute),\n    passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true),\n  });\n\n  const makeTargetPasskeyManagement = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ) =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, false);\n      const execution = yield* makePasskeyExecution(configuration, mapping);\n\n      return managementServices(mapping, execution, configuration);\n    });\n\n  const makeTargetPasskeyRegistrationWriter = <M, R, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ) =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, true);\n      const execution = yield* makePasskeyExecution(configuration, mapping);\n\n      return registrationServices<R>(mapping, execution, configuration);\n    });\n\n  const coordinateTargetPasskeyManagement = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    body: (\n      transaction: Transaction,\n      services: PasskeyManagementServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, false);\n      const hooks = yield* LifecycleHooks;\n\n      return yield* coordinateTransactionOwner(\n        database,\n        CurrentPasskeyTransaction,\n        configuration,\n        operations.validateStorage?.(mapping) ?? Effect.void,\n        unavailable,\n        nonce,\n        (execute) =>\n          managementServices(\n            mapping,\n            {\n              ...execute,\n              run: (operation, mutation) =>\n                execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n            },\n            configuration,\n          ),\n        body,\n      ).pipe(Effect.provideService(LifecycleHooks, hooks));\n    });\n\n  const coordinateTargetPasskeyRegistrationWriter = <M, Value, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    body: (\n      transaction: Transaction,\n      services: PasskeyRegistrationServices<Value>,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks | NativeDatabase> =>\n    Effect.gen(function* () {\n      const mapping = yield* writeMapping(source, configuration, true);\n      const hooks = yield* LifecycleHooks;\n\n      return yield* coordinateTransactionOwner(\n        database,\n        CurrentPasskeyTransaction,\n        configuration,\n        operations.validateStorage?.(mapping) ?? Effect.void,\n        unavailable,\n        nonce,\n        (execute) =>\n          registrationServices<Value>(\n            mapping,\n            {\n              ...execute,\n              run: (operation, mutation) =>\n                execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n            },\n            configuration,\n          ),\n        body,\n      ).pipe(Effect.provideService(LifecycleHooks, hooks));\n    });\n\n  return {\n    passkeyManagementPersistenceLayer,\n    makeTargetPasskeyManagement,\n    makeTargetPasskeyRegistrationWriter,\n    coordinateTargetPasskeyManagement,\n    coordinateTargetPasskeyRegistrationWriter,\n  };\n};\n"],"mappings":";;;;;;;;AAoCA,MAAa,gCACX,YACA,YAIA,YAIA,mBAIA,OACA,QASA,cACG;CACH,MAAM,EAAE,oBAAoB;CAC5B,MAAM,EAAE,oBAAoB,oBAAoB;CAChD,MAAM,EAAE,eAAe,iBAAiB,kBAAkB,qBAAqB;CAC/E,MAAM,EAAE,sBAAsB,qBAAqB,sBAAsB;CACzE,MAAM,EAAE,OAAO,gBAAgB;CAC/B,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,iBACA,iBACA,sBACA,wBACA,sBACA,iBACE;CAEJ,MAAM,EAAE,+BAA+B;CAEvC,MAAM,qCACJ,aAEA,MAAM,OACJ,8BACA,OAAO,IAAI,WAAW,UAAU,MAAM,4BAA4B,CACpE;CAEF,MAAM,cAAc,OAAO,OAAO;EAChC,UAAU,EAAE;EACZ,QAAQ;EACR,YAAY;EACZ,eAAe,EAAE;CACnB,CAAC;CAED,MAAM,iBAAiB,OAAO,OAAO;EACnC,OAAO,EAAE;EACT,UAAU,EAAE;EACZ,eAAe,EAAE;EACjB,YAAY;EACZ,WAAW,EAAE;CACf,CAAC;CAED,MAAM,WAAW;EAAE,UAAU,EAAE;EAAiB,WAAW;CAAU;CAErE,MAAM,WAAW;EACf,GAAG;EACH,WAAW,EAAE;EACb,cAAc,EAAE;CAClB;CAEA,MAAM,YAAY;EAAE,WAAW,EAAE;EAAgB,sBAAsB,EAAE;CAAe;CAExF,MAAM,oBAAoB;EACxB,MAAM,OAAO,OAAO;GAClB,GAAG;GACH,QAAQ,OAAO,YAAY,EAAE,mBAAmB;GAChD,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;IAAE,SAAS;IAAG,SAAS;GAAG,CAAC,CAAC;EACvE,CAAC;EACD,iBAAiB;EACjB,oBAAoB;EACpB,eAAe,OAAO,OAAO,QAAQ;EACrC,QAAQ,OAAO,OAAO;GAAE,GAAG;GAAU,GAAG;GAAW,MAAM,EAAE;EAAa,CAAC;EACzE,QAAQ,OAAO,OAAO;GACpB,UAAU,EAAE;GACZ,WAAW,EAAE;GACb,YAAY,EAAE;GACd,eAAe,EAAE;GACjB,YAAY;GACZ,cAAc;GACd,GAAG;EACL,CAAC;CACH;CAEA,MAAM,WAAW,OAAO,MAAM,CAC5B,OAAO,aAAa,YAAY,EAAE,YAAY,EAAE,yBAAyB,CAAC,GAC1E,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;CAED,MAAM,UAAU,OAAO,MAAM,CAC3B,OAAO,aAAa,WAAW;EAC7B,YAAY,EAAE;EACd,UAAU,OAAO;CACnB,CAAC,GACD,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;CAED,MAAM,UAAU,OAAO,MAAM;EAC3B,OAAO,aAAa,WAAW,EAAE,QAAQ,EAAE,eAAe,CAAC;EAC3D,OAAO,aAAa,YAAY,CAAC,CAAC;EAClC,OAAO,aAAa,oBAAoB,CAAC,CAAC;CAC5C,CAAC;CAED,MAAM,uBAAuB,OAAO,MAAM,CACxC,EAAE,2BACF,OAAO,aAAa,YAAY,CAAC,CAAC,CACpC,CAAC;CAED,MAAM,qBACJ,SACA,YAEA,gBACE;EACE,OAAO,UAAU,QAAQ,IAAI,qBAAqB,gBAAgB,SAAS,KAAK,CAAC,GAAG,KAAK;EACzF,gBAAgB,UACd,QAAQ,IAAI,qBAAqB,cAAc,SAAS,KAAK,CAAC,GAAG,KAAK;EACxE,kBAAkB,OAAO,YACvB,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,EAAE,sBAAsB,OAAO,gBAAgB,SAAS,KAAK,CAAC,GAClF,OACF;EACF,CAAC,CACH;EACF,qBAAqB,OAAO,YAC1B,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,UAAU,OAAO,mBAAmB,SAAS,KAAK,CAAC,GACvE,OACF;EACF,CAAC,CACH;EACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,SAAS,OAAO,iBAAiB,SAAS,KAAK,CAAC,GACpE,OACF;EACF,CAAC,CACH;EACF,SAAS,OAAO,YACd,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBAAoB,SAAS,OAAO,iBAAiB,SAAS,KAAK,CAAC,GACpE,OACF;EACF,CAAC,CACH;CACJ,GACA,mBACA,OACF;CAEF,MAAM,uBACJ,SACA,YAEA,gBACE;EACE,UAAU,iBACR,QAAQ,IAAI,qBAAqB,oBAAoB,SAAS,YAAY,CAAC,GAAG,KAAK;EACrF,oBAAoB,OAAO,YACzB,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBACE,EAAE,sBACF,OAAO,kBAAkB,SAAS,KAAK,CACzC,GACA,OACF;EACF,CAAC,CACH;EACF,uBAAuB,OAAO,YAC5B,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,OAAO,OAAO,aACZ,oBACE,sBACA,OAAO,qBAAqB,SAAS,KAAK,CAC5C,GACA,OACF;EACF,CAAC,CACH;CACJ,GACA;EACE,SAAS,OAAO,OAAO,QAAQ,aAAa,MAAM;EAClD,mBAAmB,OAAO,OAAO;GAC/B,UAAU,EAAE;GACZ,QAAQ;GACR,cAAc,OAAO,OAAO,QAAQ,aAAa,MAAM;EACzD,CAAC;EACD,sBAAsB,OAAO,OAAO;GAClC,OAAO,EAAE;GACT,UAAU,EAAE;GACZ,WAAW,EAAE;EACf,CAAC;CACH,GACA,OACF;CAEF,MAAM,cAAc,UAAe;EACjC,MAAM,UAAU,gBAAgB,MAAM,KAAK;EAE3C,KAAK,MAAM,CAAC,OAAO,SAAS,OAAO,QAAQ,KAAK,GAC9C,IAAI,OAAO,SAAS,YAAY,CAAC,MAAM,SAAS,OAAO,GACrD,UAAU,QAAQ,UAAU,KAAA,CAAS;CAC3C;CAEA,MAAM,gBACJ,QACA,eACA,iBAEA,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,aAAa,IAAI,YACnE,OAAO,IAAI;EACT,WAAW;GACT,MAAM,IAAI;GAEV,KAAK,MAAM,QAAQ,CAAC,EAAE,MAAM,WAAW,MAAM,EAAE,MAAM,WAAW,SAAS,GACvE,UAAU,gBAAgB,EAAE,KAAK,WAAW,KAAK,CAAC,CAAC,UAAU,KAAA,CAAS;GACxE,KAAK,MAAM,QAAQ,EAAE,MAAM,OAAO,gBAChC,UAAU,gBAAgB,EAAE,KAAK,QAAQ,KAAK,CAAC,CAAC,UAAU,KAAA,CAAS;GACrE,UACE,EAAE,MAAM,WAAW,iBAAiB,EAAE,MAAM,WAAW,iBACrD,EAAE,MAAM,UAAU,iBAAiB,EAAE,MAAM,UAAU,iBACrD,EAAE,MAAM,oBAAoB,eAAe,EAAE,MAAM,oBAAoB,YAC3E;GACA,UACE,EAAE,KAAK,WAAW,eAAe,EAAE,MAAM,WAAW,YAAY,KAC9D,CAAC,EAAE,KAAK,WAAW,eAAe,EAAE,MAAM,WAAW,aAAa,KAClE,EAAE,KAAK,UAAU,eAAe,EAAE,MAAM,UAAU,YAAY,KAC9D,CAAC,EAAE,KAAK,UAAU,eAAe,EAAE,MAAM,UAAU,aAAa,KAChE,EAAE,KAAK,oBAAoB,aAAa,EAAE,MAAM,oBAAoB,UAAU,KAC9E,CAAC,EAAE,KAAK,oBAAoB,aAAa,EAAE,MAAM,oBAAoB,YAAY,KACjF,EAAE,KAAK,gBAAgB,aAAa,EAAE,MAAM,gBAAgB,UAAU,CAC1E;GACA,IAAI,cAAc;IAChB,WAAW,EAAE,MAAM;IACnB,WAAW,EAAE,MAAM;IACnB,UAAU,EAAE,OAAO,UAAU,EAAE,KAAK,gBAAgB,KAAK;IACzD,UACE,EAAE,OAAO,kBAAkB,EAAE,MAAM,gBAAgB,cACjD,EAAE,OAAO,iBAAiB,EAAE,OAAO,iBACnC,EAAE,OAAO,kBAAkB,EAAE,OAAO,gBACpC,EAAE,OAAO,kBAAkB,EAAE,OAAO,aACxC;IACA,UACE,EAAE,wBAAwB,WAAW,KAAK,GAAG,MAAM,qBACjD,EAAE,wBAAwB,cAAc,KAAK,GAAG,MAAM,wBACtD,EAAE,wBAAwB,OAAO,KAAK,GAAG,MAAM,WACnD;GACF,OAAO;IACL,WAAW,EAAE,OAAO;IACpB,UAAU,EAAE,sBAAsB,QAAQ,KAAK,GAAG,MAAM,oBAAoB;IAC5E,oBAAoB,2BAA2B,EAAE,aAAa,MAAM;IACpE,UACE,EAAE,aAAa,OAAO,YAAY,uBAChC,EAAE,aAAa,UAAU,UAAU,EACvC;GACF;GAEA,OAAO;EACT;EACA,aAAa,0BAA0B,KAAK,CAAC,CAAC;CAChD,CAAC,CACH;CAEF,MAAM,sBACJ,SACA,SACA,mBAC+B;EAC/B,8BAA8B,kBAAkB,SAAS,OAAO;EAChE,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,OAAO,IAAI;CACzF;CAEA,MAAM,wBACJ,SACA,SACA,mBACoC;EACpC,8BAA8B,oBAAuB,SAAS,OAAO;EACrE,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,IAAI;CAClF;CAEA,MAAM,+BACJ,QACA,kBAEA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,KAAK;EAChE,MAAM,YAAY,OAAO,qBAAqB,eAAe,OAAO;EAEpE,OAAO,mBAAmB,SAAS,WAAW,aAAa;CAC7D,CAAC;CAEH,MAAM,uCACJ,QACA,kBAEA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,IAAI;EAC/D,MAAM,YAAY,OAAO,qBAAqB,eAAe,OAAO;EAEpE,OAAO,qBAAwB,SAAS,WAAW,aAAa;CAClE,CAAC;CAEH,MAAM,qCACJ,UACA,QACA,eACA,SAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,KAAK;EAChE,MAAM,QAAQ,OAAO;EAErB,OAAO,OAAO,2BACZ,UACA,2BACA,eACA,WAAW,kBAAkB,OAAO,KAAK,OAAO,MAChD,aACA,QACC,YACC,mBACE,SACA;GACE,GAAG;GACH,MAAM,WAAW,aACf,QAAQ,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtF,GACA,aACF,GACF,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACrD,CAAC;CAEH,MAAM,6CACJ,UACA,QACA,eACA,SAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,aAAa,QAAQ,eAAe,IAAI;EAC/D,MAAM,QAAQ,OAAO;EAErB,OAAO,OAAO,2BACZ,UACA,2BACA,eACA,WAAW,kBAAkB,OAAO,KAAK,OAAO,MAChD,aACA,QACC,YACC,qBACE,SACA;GACE,GAAG;GACH,MAAM,WAAW,aACf,QAAQ,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACtF,GACA,aACF,GACF,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACrD,CAAC;CAEH,OAAO;EACL;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/internal/passkey-kernel.d.mts

@@ -1,9 +1,9 @@
-import { QueryOperations, SqlColumn, SqlExpression, SqlFragment } from "./query-operations.mjs";
 import { PersistenceMappingError } from "./mapping-error.mjs";
+import { NativeDatabase, Row } from "./transaction-kernel.mjs";
+import { QueryOperations, SqlColumn, SqlExpression, SqlFragment } from "./query-operations.mjs";
 import { PasskeyChargeKind, PasskeyCredentialServices, PasskeyEnrollmentContextServices, PasskeyMappingSource, PasskeyPersistenceServices } from "./models/passkey-model.mjs";
 import { PasskeyRegistrationCeremonyServices } from "./models/passkey-registration-ceremony-model.mjs";
 import { PasskeyManagementServices, PasskeyRegistrationServices } from "./models/passkey-write-model.mjs";
-import { NativeDatabase, Row } from "./transaction-kernel.mjs";
 import { CurrentPasskeyTransaction } from "./passkey/state.mjs";
 import { SubjectRead } from "./passkey/credentials.mjs";
 import { FlowRead } from "./passkey/flow.mjs";
@@ -4348,7 +4348,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
   };
   target: {
     sqlClientPasskeyStandaloneGuard: (transactionService: Parameters<<Failure>(unavailable: () => Failure, transactionService: import("effect/sql/SqlClient").SqlClient["transactionService"] | undefined) => import("effect/Effect").Effect<void, Failure, never>>[1]) => import("effect/Effect").Effect<void, import("@yielded/auth/Passkey").PasskeyUnavailable, never>;
-    makePasskeyExecution: (configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyExecution, never, import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    makePasskeyExecution: (configuration: PasskeyTargetConfiguration, mapping: unknown) => import("effect/Effect").Effect<PasskeyExecution, import("@yielded/auth/Passkey").PasskeyConfigurationError, import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
     capturedService: <S>(service: S, schemas: Record<string, import("effect/Schema").Codec<any, any, never, never>>, execute: PasskeyExecution) => S;
     prepareValue: <Value, A>(value: Value, prepare: import("@yielded/auth/Passkey").PreparePasskeyCommit<Value, A>) => import("effect/Effect").Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, never, CurrentPasskeyTransaction>;
     observationalContext: <A, E, R>(operation: import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, E, CurrentPasskeyTransaction | Exclude<R, CurrentPasskeyTransaction>>;
@@ -4358,8 +4358,8 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
     makeTargetPasskeyEnrollmentContext: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyEnrollmentContextServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | NativeDatabase>;
     makeTargetPasskeyPersistence: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyPersistenceServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
     makeTargetPasskeyRegistration: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyRegistrationCeremonyServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    coordinateTargetPasskey: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, owner: (transaction: Transaction, services: PasskeyPersistenceServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks>;
-    coordinateTargetPasskeyRegistration: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, owner: (transaction: Transaction, services: PasskeyRegistrationCeremonyServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks>;
+    coordinateTargetPasskey: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, owner: (transaction: Transaction, services: PasskeyPersistenceServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    coordinateTargetPasskeyRegistration: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, owner: (transaction: Transaction, services: PasskeyRegistrationCeremonyServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
   };
   writeState: {
     jsonStorage: <S extends import("effect/Schema").Codec<unknown, unknown, never, never>>(schema: S) => {
@@ -5178,8 +5178,8 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly management: import("@yielded/auth/Passkey").PasskeyManagementPolicy;
       readonly nowMillis: number;
     }) => import("effect/Effect").Effect<{
+      credential?: undefined;
       readonly _tag: "Rejected";
-      readonly credential?: undefined;
     } | {
       readonly _tag: "Enrolled";
       readonly credential: {
@@ -5250,7 +5250,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
       readonly _tag: "Rejected";
       readonly decision?: undefined;
     } | {
-      readonly credential?: undefined;
+      credential?: undefined;
       readonly _tag: "Replay";
       readonly result: {
         readonly credentialId: string;
@@ -5581,8 +5581,8 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
     passkeyManagementPersistenceLayer: <E, R>(services: import("effect/Effect").Effect<PasskeyManagementServices, E, R>) => import("effect/Layer").Layer<import("@yielded/auth/Passkey").PasskeyManagementPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
     makeTargetPasskeyManagement: <M, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyManagementServices, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
     makeTargetPasskeyRegistrationWriter: <M, R, RSetup>(source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration) => import("effect/Effect").Effect<PasskeyRegistrationServices<R>, import("@yielded/auth/Passkey").PasskeyConfigurationError | PersistenceMappingError, RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
-    coordinateTargetPasskeyManagement: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, body: (transaction: Transaction, services: PasskeyManagementServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks>;
-    coordinateTargetPasskeyRegistrationWriter: <M, Value, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, body: (transaction: Transaction, services: PasskeyRegistrationServices<Value>, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks>;
+    coordinateTargetPasskeyManagement: <M, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, body: (transaction: Transaction, services: PasskeyManagementServices, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
+    coordinateTargetPasskeyRegistrationWriter: <M, Value, RSetup, Transaction, A, E, R>(database: any, source: PasskeyMappingSource<M, RSetup>, configuration: PasskeyTargetConfiguration, body: (transaction: Transaction, services: PasskeyRegistrationServices<Value>, append: (statement: import("effect/sql/Statement").Statement<unknown>) => void) => import("effect/Effect").Effect<A, E, R>) => import("effect/Effect").Effect<A, PasskeyCoordinatorError<E>, R | RSetup | import("@yielded/auth/Hooks").LifecycleHooks | NativeDatabase>;
   };
 };
 //#endregion

package/dist/internal/passkey-kernel.mjs

@@ -23,7 +23,7 @@ const makePasskeyKernel = (operations) => {
 	const registrationCustody = makePasskeyRegistrationCustodyKernel(state);
 	const flow = makePasskeyFlowKernel(operations, admission, credentials, registrationCustody, state, transactions);
 	const registrationCeremony = makePasskeyRegistrationCeremonyKernel(operations, admission, credentials, flow, registrationCustody, state, transactions);
-	const target = makePasskeyTargetKernel(credentials, flow, registrationCeremony, state, execution);
+	const target = makePasskeyTargetKernel(credentials, flow, registrationCeremony, state, execution, operations);
 	const writeState = makePasskeyWriteStateKernel(operations, state, transactions);
 	const enrollment = makePasskeyEnrollmentKernel(operations, admission, credentials, flow, state, writeState, transactions);
 	const management = makePasskeyManagementKernel(operations, admission, credentials, state, writeState, transactions);

package/dist/internal/passkey-kernel.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-kernel.mjs","names":[],"sources":["../../src/internal/passkey-kernel.ts"],"sourcesContent":["import { makePasskeyAdmissionKernel } from \"./passkey/admission\";\nimport { makePasskeyCredentialsKernel } from \"./passkey/credentials\";\nimport { makePasskeyEnrollmentKernel } from \"./passkey/enrollment\";\nimport { makePasskeyFlowKernel } from \"./passkey/flow\";\nimport { makePasskeyManagementKernel } from \"./passkey/management\";\nimport { makePasskeyRegistrationCeremonyKernel } from \"./passkey/registration-ceremony\";\nimport { makePasskeyRegistrationCustodyKernel } from \"./passkey/registration-custody\";\nimport { makePasskeyRegistrationWriteKernel } from \"./passkey/registration-write\";\nimport { makePasskeyStateKernel } from \"./passkey/state\";\nimport { makePasskeyTargetKernel } from \"./passkey/target\";\nimport { makePasskeyWriteStateKernel } from \"./passkey/write-state\";\nimport { makePasskeyWriteTargetKernel } from \"./passkey/write-target\";\nimport type { QueryOperations } from \"./query-operations\";\nimport { makeTransactionExecutionKernel } from \"./transaction-execution-kernel\";\nimport { makeTransactionKernel } from \"./transaction-kernel\";\n\nexport type PasskeyKernel = ReturnType<typeof makePasskeyKernel>;\n\n/** One set of passkey state machines, supplied with a SQL compiler and transaction owner. */\nexport const makePasskeyKernel = (operations: QueryOperations) => {\n  const transactions = makeTransactionKernel(operations);\n  const execution = makeTransactionExecutionKernel(transactions);\n  const state = makePasskeyStateKernel(operations, transactions);\n  const credentials = makePasskeyCredentialsKernel(operations, state, transactions);\n  const admission = makePasskeyAdmissionKernel(operations, state, transactions);\n  const registrationCustody = makePasskeyRegistrationCustodyKernel(state);\n\n  const flow = makePasskeyFlowKernel(\n    operations,\n    admission,\n    credentials,\n    registrationCustody,\n    state,\n    transactions,\n  );\n\n  const registrationCeremony = makePasskeyRegistrationCeremonyKernel(\n    operations,\n    admission,\n    credentials,\n    flow,\n    registrationCustody,\n    state,\n    transactions,\n  );\n\n  const target = makePasskeyTargetKernel(credentials, flow, registrationCeremony, state, execution);\n  const writeState = makePasskeyWriteStateKernel(operations, state, transactions);\n\n  const enrollment = makePasskeyEnrollmentKernel(\n    operations,\n    admission,\n    credentials,\n    flow,\n    state,\n    writeState,\n    transactions,\n  );\n\n  const management = makePasskeyManagementKernel(\n    operations,\n    admission,\n    credentials,\n    state,\n    writeState,\n    transactions,\n  );\n\n  const registrationWrite = makePasskeyRegistrationWriteKernel(\n    operations,\n    admission,\n    credentials,\n    flow,\n    registrationCustody,\n    state,\n    writeState,\n    transactions,\n  );\n\n  const writeTarget = makePasskeyWriteTargetKernel(\n    operations,\n    enrollment,\n    management,\n    registrationWrite,\n    state,\n    target,\n    execution,\n  );\n\n  return {\n    state,\n    credentials,\n    admission,\n    registrationCustody,\n    flow,\n    registrationCeremony,\n    target,\n    writeState,\n    enrollment,\n    management,\n    registrationWrite,\n    writeTarget,\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAmBA,MAAa,qBAAqB,eAAgC;CAChE,MAAM,eAAe,sBAAsB,UAAU;CACrD,MAAM,YAAY,+BAA+B,YAAY;CAC7D,MAAM,QAAQ,uBAAuB,YAAY,YAAY;CAC7D,MAAM,cAAc,6BAA6B,YAAY,OAAO,YAAY;CAChF,MAAM,YAAY,2BAA2B,YAAY,OAAO,YAAY;CAC5E,MAAM,sBAAsB,qCAAqC,KAAK;CAEtE,MAAM,OAAO,sBACX,YACA,WACA,aACA,qBACA,OACA,YACF;CAEA,MAAM,uBAAuB,sCAC3B,YACA,WACA,aACA,MACA,qBACA,OACA,YACF;CAEA,MAAM,SAAS,wBAAwB,aAAa,MAAM,sBAAsB,OAAO,SAAS;CAChG,MAAM,aAAa,4BAA4B,YAAY,OAAO,YAAY;CAE9E,MAAM,aAAa,4BACjB,YACA,WACA,aACA,MACA,OACA,YACA,YACF;CAEA,MAAM,aAAa,4BACjB,YACA,WACA,aACA,OACA,YACA,YACF;CAEA,MAAM,oBAAoB,mCACxB,YACA,WACA,aACA,MACA,qBACA,OACA,YACA,YACF;CAYA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,aAtBkB,6BAClB,YACA,YACA,YACA,mBACA,OACA,QACA,SAeU;CACZ;AACF"}
+{"version":3,"file":"passkey-kernel.mjs","names":[],"sources":["../../src/internal/passkey-kernel.ts"],"sourcesContent":["import { makePasskeyAdmissionKernel } from \"./passkey/admission\";\nimport { makePasskeyCredentialsKernel } from \"./passkey/credentials\";\nimport { makePasskeyEnrollmentKernel } from \"./passkey/enrollment\";\nimport { makePasskeyFlowKernel } from \"./passkey/flow\";\nimport { makePasskeyManagementKernel } from \"./passkey/management\";\nimport { makePasskeyRegistrationCeremonyKernel } from \"./passkey/registration-ceremony\";\nimport { makePasskeyRegistrationCustodyKernel } from \"./passkey/registration-custody\";\nimport { makePasskeyRegistrationWriteKernel } from \"./passkey/registration-write\";\nimport { makePasskeyStateKernel } from \"./passkey/state\";\nimport { makePasskeyTargetKernel } from \"./passkey/target\";\nimport { makePasskeyWriteStateKernel } from \"./passkey/write-state\";\nimport { makePasskeyWriteTargetKernel } from \"./passkey/write-target\";\nimport type { QueryOperations } from \"./query-operations\";\nimport { makeTransactionExecutionKernel } from \"./transaction-execution-kernel\";\nimport { makeTransactionKernel } from \"./transaction-kernel\";\n\nexport type PasskeyKernel = ReturnType<typeof makePasskeyKernel>;\n\n/** One set of passkey state machines, supplied with a SQL compiler and transaction owner. */\nexport const makePasskeyKernel = (operations: QueryOperations) => {\n  const transactions = makeTransactionKernel(operations);\n  const execution = makeTransactionExecutionKernel(transactions);\n  const state = makePasskeyStateKernel(operations, transactions);\n  const credentials = makePasskeyCredentialsKernel(operations, state, transactions);\n  const admission = makePasskeyAdmissionKernel(operations, state, transactions);\n  const registrationCustody = makePasskeyRegistrationCustodyKernel(state);\n\n  const flow = makePasskeyFlowKernel(\n    operations,\n    admission,\n    credentials,\n    registrationCustody,\n    state,\n    transactions,\n  );\n\n  const registrationCeremony = makePasskeyRegistrationCeremonyKernel(\n    operations,\n    admission,\n    credentials,\n    flow,\n    registrationCustody,\n    state,\n    transactions,\n  );\n\n  const target = makePasskeyTargetKernel(\n    credentials,\n    flow,\n    registrationCeremony,\n    state,\n    execution,\n    operations,\n  );\n\n  const writeState = makePasskeyWriteStateKernel(operations, state, transactions);\n\n  const enrollment = makePasskeyEnrollmentKernel(\n    operations,\n    admission,\n    credentials,\n    flow,\n    state,\n    writeState,\n    transactions,\n  );\n\n  const management = makePasskeyManagementKernel(\n    operations,\n    admission,\n    credentials,\n    state,\n    writeState,\n    transactions,\n  );\n\n  const registrationWrite = makePasskeyRegistrationWriteKernel(\n    operations,\n    admission,\n    credentials,\n    flow,\n    registrationCustody,\n    state,\n    writeState,\n    transactions,\n  );\n\n  const writeTarget = makePasskeyWriteTargetKernel(\n    operations,\n    enrollment,\n    management,\n    registrationWrite,\n    state,\n    target,\n    execution,\n  );\n\n  return {\n    state,\n    credentials,\n    admission,\n    registrationCustody,\n    flow,\n    registrationCeremony,\n    target,\n    writeState,\n    enrollment,\n    management,\n    registrationWrite,\n    writeTarget,\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAmBA,MAAa,qBAAqB,eAAgC;CAChE,MAAM,eAAe,sBAAsB,UAAU;CACrD,MAAM,YAAY,+BAA+B,YAAY;CAC7D,MAAM,QAAQ,uBAAuB,YAAY,YAAY;CAC7D,MAAM,cAAc,6BAA6B,YAAY,OAAO,YAAY;CAChF,MAAM,YAAY,2BAA2B,YAAY,OAAO,YAAY;CAC5E,MAAM,sBAAsB,qCAAqC,KAAK;CAEtE,MAAM,OAAO,sBACX,YACA,WACA,aACA,qBACA,OACA,YACF;CAEA,MAAM,uBAAuB,sCAC3B,YACA,WACA,aACA,MACA,qBACA,OACA,YACF;CAEA,MAAM,SAAS,wBACb,aACA,MACA,sBACA,OACA,WACA,UACF;CAEA,MAAM,aAAa,4BAA4B,YAAY,OAAO,YAAY;CAE9E,MAAM,aAAa,4BACjB,YACA,WACA,aACA,MACA,OACA,YACA,YACF;CAEA,MAAM,aAAa,4BACjB,YACA,WACA,aACA,OACA,YACA,YACF;CAEA,MAAM,oBAAoB,mCACxB,YACA,WACA,aACA,MACA,qBACA,OACA,YACA,YACF;CAYA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,aAtBkB,6BAClB,YACA,YACA,YACA,mBACA,OACA,QACA,SAeU;CACZ;AACF"}

package/dist/internal/password-kernel.d.mts

@@ -1,5 +1,6 @@
-import { QueryFailure, QueryOperations, SqlColumn, SqlFragment } from "./query-operations.mjs";
 import { PersistenceMappingError } from "./mapping-error.mjs";
+import { NativeDatabase } from "./transaction-kernel.mjs";
+import { QueryFailure, QueryOperations, SqlColumn, SqlFragment } from "./query-operations.mjs";
 import { AnyPasswordPersistenceMapping } from "./models/password-model.mjs";
 import { CurrentProofSql, ProofSqlConfiguration, makeProofKernel } from "./proof-kernel.mjs";
 import { Context, DateTime, Effect, Option, Redacted } from "effect";
@@ -87,7 +88,7 @@ export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFrag
       readonly removed: number;
       readonly hasMore: boolean;
     }, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
-  }, never, CurrentPasswordSql | LifecycleHooks>;
+  }, PasswordUnavailable, CurrentPasswordSql | LifecycleHooks | NativeDatabase>;
   passwordSqlKernel: {
     allocate: <A>(mode: PasswordSqlConfiguration["mode"], asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined, syncValue: (() => A) | undefined) => Effect.Effect<A, PasswordUnavailable | PersistenceMappingError>;
     allocateNextSecurityRevision: (mapping: AnyPasswordPersistenceMapping<Fragment>, mode: PasswordSqlConfiguration["mode"], current: SecurityRevision) => Effect.Effect<string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">, PasswordUnavailable | PersistenceMappingError, never>;

package/dist/internal/password-kernel.mjs

@@ -391,6 +391,10 @@ const makePasswordKernel = (operations, proofs) => {
 	});
 	const makeSqlPasswordPersistence = Effect.fn("makeSqlPasswordPersistence")(function* (mapping, configuration) {
 		const database = yield* CurrentPasswordSql;
+		if (!configuration.coordinated) yield* (operations.validateStorage?.({
+			...mapping,
+			proof: configuration.proof?.mapping
+		}) ?? Effect.void).pipe(Effect.mapError(unavailable));
 		const hooks = yield* LifecycleHooks;
 		return PasswordPersistence.of({
 			admitAttempt: (input, prepare) => Effect.gen(function* () {