@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/src/internal/passkey/management.ts

@@ -1,426 +0,0 @@
-/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */
-
-import {
-  PasskeyCredentialSummary,
-  PasskeyRemoved,
-  type PasskeyManagementPersistence,
-} from "@yielded/auth/Passkey";
-import { Effect, Schema } from "effect";
-
-import type { PersistenceMappingError } from "../mapping-error";
-import type { SqlExpression as SQL, QueryOperations } from "../query-operations";
-import type { makeTransactionKernel } from "../transaction-kernel";
-import type { makePasskeyAdmissionKernel } from "./admission";
-import type { makePasskeyCredentialsKernel } from "./credentials";
-import { CurrentPasskeyTransaction } from "./state";
-import type { makePasskeyStateKernel } from "./state";
-import type { WriteSubject, makePasskeyWriteStateKernel } from "./write-state";
-
-type Port = PasskeyManagementPersistence["Service"];
-
-export const makePasskeyManagementKernel = (
-  operations: QueryOperations,
-  admission: Pick<ReturnType<typeof makePasskeyAdmissionKernel>, "lockAdmission">,
-  credentials: Pick<
-    ReturnType<typeof makePasskeyCredentialsKernel>,
-    "readModule" | "readPolicyGuards"
-  >,
-  state: Pick<
-    ReturnType<typeof makePasskeyStateKernel>,
-    "credentialKey" | "copiedRow" | "equal" | "invariant" | "sameCredential" | "sameRevision"
-  >,
-  writeState: Pick<
-    ReturnType<typeof makePasskeyWriteStateKernel>,
-    | "authorizeAction"
-    | "credentialRows"
-    | "currentSubject"
-    | "invalidate"
-    | "invalidationMatches"
-    | "jsonStorage"
-    | "managementPolicy"
-    | "metadataAllowed"
-    | "ownedCredential"
-    | "removeDigest"
-    | "summary"
-  >,
-  transactions: Pick<ReturnType<typeof makeTransactionKernel>, "both">,
-) => {
-  const { sql } = operations;
-  const { lockAdmission } = admission;
-  const { readModule, readPolicyGuards } = credentials;
-  const { credentialKey, copiedRow, equal, sameCredential, sameRevision } = state;
-  const invariant: (value: unknown) => asserts value = state.invariant;
-
-  const {
-    authorizeAction,
-    credentialRows,
-    currentSubject,
-    invalidate,
-    invalidationMatches,
-    jsonStorage,
-    managementPolicy,
-    metadataAllowed,
-    ownedCredential,
-    removeDigest,
-    summary,
-  } = writeState;
-
-  const { both } = transactions;
-
-  const decisionCodec = jsonStorage(
-    Schema.Union([
-      Schema.TaggedStruct("Renamed", { credential: PasskeyCredentialSummary }),
-      Schema.TaggedStruct("Removed", { result: PasskeyRemoved }),
-    ]),
-  );
-
-  const intentCodec = jsonStorage(
-    Schema.Struct({
-      operation: Schema.Literals(["rename", "remove"]),
-      credentialId: Schema.String,
-      name: Schema.optionalKey(Schema.String),
-    }),
-  );
-
-  const command = Effect.fn("passkey.managementCommand")(function* (
-    mapping: any,
-    subject: WriteSubject,
-    commandId: string,
-    credentialId: string,
-    intent: string,
-  ) {
-    const owner = yield* CurrentPasskeyTransaction;
-    const table = mapping.command;
-
-    const observation = yield* owner.read(
-      table.table,
-      equal(table.table, { [table.moduleId]: mapping.moduleId, [table.commandId]: commandId }),
-      { limit: 1 },
-    );
-
-    const row = observation.rows[0];
-
-    if (row === undefined) return { _tag: "New", observation } as const;
-    if (
-      !mapping.read.subjectIds.equals(row[table.subjectId], subject.nativeId) ||
-      row[table.credentialId] !== credentialId ||
-      row[table.intent] !== intent
-    )
-      return { _tag: "Rejected" } as const;
-
-    return { _tag: "Replay", decision: decisionCodec.decode(row[table.decision]) } as const;
-  });
-
-  const record = Effect.fn("passkey.recordManagementCommand")(function* (
-    mapping: any,
-    subject: WriteSubject,
-    commandId: string,
-    credentialId: string,
-    intent: string,
-    decision: Parameters<typeof decisionCodec.encode>[0],
-    retentionUntilMillis: number,
-    observation: any,
-  ) {
-    const owner = yield* CurrentPasskeyTransaction;
-    const table = mapping.command;
-
-    const inserted = yield* owner.insert(
-      table.table,
-      {
-        ...table.encodeInsert({
-          moduleId: mapping.moduleId,
-          subjectId: subject.nativeId,
-          commandId,
-          credentialId,
-        }),
-        [table.moduleId]: mapping.moduleId,
-        [table.commandId]: commandId,
-        [table.subjectId]: subject.nativeId,
-        [table.credentialId]: credentialId,
-        [table.intent]: intent,
-        [table.decision]: decisionCodec.encode(decision),
-        [table.retentionUntil]: mapping.clock.encodeInstant(retentionUntilMillis),
-        [table.version]: owner.marker,
-      },
-      { [table.moduleId]: mapping.moduleId, [table.commandId]: commandId },
-    );
-
-    observation.rows = inserted.rows;
-  });
-
-  const access = Effect.fn("passkey.managementAccess")(function* (
-    mapping: any,
-    moduleId: string,
-    subjectId: Parameters<Port["list"]>[0]["subjectId"],
-    mutation: boolean,
-  ) {
-    if (moduleId !== mapping.moduleId || (yield* readModule(mapping)) === undefined)
-      return undefined;
-    if (mutation) yield* lockAdmission(mapping);
-    const subject = yield* currentSubject(mapping, subjectId);
-
-    if (subject === undefined) return undefined;
-    yield* readPolicyGuards(mapping);
-
-    return (yield* metadataAllowed(mapping, subject)) ? subject : undefined;
-  });
-
-  const listCredentials = Effect.fn("passkey.listCredentials")(function* (
-    mapping: any,
-    input: Parameters<Port["list"]>[0],
-  ) {
-    const subject = yield* access(mapping, input.moduleId, input.subjectId, false);
-
-    invariant(subject !== undefined);
-    const rows = [...(yield* credentialRows(mapping, subject))];
-
-    rows.sort((left, right) => {
-      const a = left[mapping.read.credential.credentialId],
-        b = right[mapping.read.credential.credentialId];
-
-      return a < b ? -1 : a > b ? 1 : 0;
-    });
-
-    const eligible = rows.filter(
-      (row) =>
-        input.cursor === undefined || row[mapping.read.credential.credentialId] > input.cursor,
-    );
-
-    const page = eligible.slice(0, input.limit);
-    const credentials = [];
-
-    for (const row of page) {
-      invariant((yield* ownedCredential(mapping, subject, row)) !== undefined);
-      credentials.push(summary(mapping, row));
-    }
-
-    return {
-      credentials,
-      ...(eligible.length > input.limit ? { cursor: credentials.at(-1)!.credentialId } : {}),
-    };
-  });
-
-  const renameCredential = Effect.fn("passkey.renameCredential")(function* (
-    mapping: any,
-    input: Parameters<Port["rename"]>[0],
-  ) {
-    const subject = yield* access(mapping, input.moduleId, input.subjectId, true);
-
-    if (subject === undefined) return { _tag: "Rejected" } as const;
-
-    const intent = intentCodec.encode({
-      operation: "rename",
-      credentialId: input.credentialId,
-      name: input.name,
-    });
-
-    const prior = yield* command(mapping, subject, input.commandId, input.credentialId, intent);
-
-    if (prior._tag === "Rejected") return prior;
-    const rows = yield* credentialRows(mapping, subject);
-
-    const row = rows.find(
-      (item) => item[mapping.read.credential.credentialId] === input.credentialId,
-    );
-
-    if (row === undefined || (yield* ownedCredential(mapping, subject, row)) === undefined)
-      return { _tag: "Rejected" } as const;
-    if (prior._tag === "Replay")
-      return prior.decision._tag === "Renamed"
-        ? { ...prior.decision, replayed: true }
-        : ({ _tag: "Rejected" } as const);
-    const owner = yield* CurrentPasskeyTransaction;
-    const table = mapping.read.credential;
-
-    yield* owner.update(
-      table.table,
-      { [table.credentialId]: input.credentialId, [table.subjectId]: subject.nativeId },
-      { [mapping.write.credential.name]: input.name },
-    );
-    const credential = summary(mapping, { ...row, [mapping.write.credential.name]: input.name });
-
-    yield* record(
-      mapping,
-      subject,
-      input.commandId,
-      input.credentialId,
-      intent,
-      { _tag: "Renamed", credential },
-      input.retentionUntilMillis,
-      prior.observation,
-    );
-
-    return { _tag: "Renamed", credential, replayed: false } as const;
-  });
-
-  const inspectRemove = Effect.fn("passkey.inspectRemove")(function* (
-    mapping: any,
-    input: Parameters<Port["inspectRemove"]>[0],
-  ) {
-    const subject = yield* access(mapping, input.moduleId, input.subjectId, false);
-
-    if (subject === undefined) return { _tag: "Rejected" } as const;
-
-    const prior = yield* command(
-      mapping,
-      subject,
-      input.commandId,
-      input.credentialId,
-      intentCodec.encode({ operation: "remove", credentialId: input.credentialId }),
-    );
-
-    if (prior._tag === "Rejected") return prior;
-    if (prior._tag === "Replay")
-      return prior.decision._tag === "Removed"
-        ? ({ _tag: "Replay", result: { ...prior.decision.result, replayed: true } } as const)
-        : ({ _tag: "Rejected" } as const);
-
-    const row = (yield* credentialRows(mapping, subject)).find(
-      (item) => item[mapping.read.credential.credentialId] === input.credentialId,
-    );
-
-    const credential =
-      row === undefined ? undefined : yield* ownedCredential(mapping, subject, row);
-
-    return credential === undefined
-      ? ({ _tag: "Rejected" } as const)
-      : ({ _tag: "Target", credential } as const);
-  });
-
-  const removeCredential = Effect.fn("passkey.removeCredential")(function* (
-    mapping: any,
-    input: Parameters<Port["remove"]>[0],
-  ) {
-    const subject = yield* access(
-      mapping,
-      input.moduleId,
-      input.credential.revision.subjectId,
-      true,
-    );
-
-    if (subject === undefined) return { _tag: "Rejected" } as const;
-    const id = input.credential.credentialId;
-    const intent = intentCodec.encode({ operation: "remove", credentialId: id });
-    const prior = yield* command(mapping, subject, input.commandId, id, intent);
-
-    if (prior._tag === "Rejected") return prior;
-    if (prior._tag === "Replay")
-      return prior.decision._tag === "Removed"
-        ? ({ _tag: "Removed", result: { ...prior.decision.result, replayed: true } } as const)
-        : ({ _tag: "Rejected" } as const);
-
-    const row = (yield* credentialRows(mapping, subject)).find(
-      (item) => item[mapping.read.credential.credentialId] === id,
-    );
-
-    const credential =
-      row === undefined ? undefined : yield* ownedCredential(mapping, subject, row);
-
-    const policy = managementPolicy(mapping, subject);
-
-    if (
-      credential === undefined ||
-      !sameCredential(input.credential, credential) ||
-      !sameRevision(input.credential.revision, credential.revision) ||
-      !invalidationMatches(mapping, input.invalidation, policy) ||
-      !invalidationMatches(mapping, input.invalidation, input.management)
-    )
-      return { _tag: "Rejected" } as const;
-    if (
-      !(yield* authorizeAction(
-        mapping,
-        subject,
-        input.authorization,
-        {
-          action: "remove",
-          commandId: input.commandId,
-          flowId: input.commandId,
-          bindingDigest: yield* removeDigest(mapping.moduleId, input.commandId, input.credential),
-          revision: input.credential.revision,
-        },
-        {
-          ...policy,
-          maximumEvidenceAgeMillis: Math.min(
-            policy.maximumEvidenceAgeMillis,
-            input.management.maximumEvidenceAgeMillis,
-          ),
-        },
-      ))
-    )
-      return { _tag: "Rejected" } as const;
-    const owner = yield* CurrentPasskeyTransaction;
-
-    const remainingEffect: Effect.Effect<SQL, PersistenceMappingError> =
-      mapping.write.policy.remainingSignIn(subject.nativeId, id, copiedRow(subject.row));
-
-    const remaining = yield* remainingEffect;
-
-    if (!(yield* owner.check(remaining))) return { _tag: "LastSignInMethod" } as const;
-    const read = mapping.read;
-    const table = read.credential;
-
-    yield* owner.update(
-      table.table,
-      { [table.credentialId]: id, [table.subjectId]: subject.nativeId },
-      {
-        [table.status]: mapping.write.credential.removedStatus,
-        [table.credentialRevision]: owner.marker,
-      },
-    );
-    const factor = read.authority;
-
-    yield* owner.update(
-      factor.table,
-      { [factor.subjectId]: subject.nativeId, [factor.credentialId]: id },
-      { [factor.status]: mapping.write.authority.removedStatus, [factor.revision]: owner.marker },
-    );
-    for (const observation of owner.observations) {
-      if (observation.table === table.table)
-        observation.rows = observation.rows.filter((item) => item[table.credentialId] !== id);
-      if (observation.table === factor.table)
-        observation.rows = observation.rows.filter((item) => item[factor.credentialId] !== id);
-    }
-    const tuple = read.credentialOwnership;
-
-    yield* owner.update(
-      tuple.table,
-      {
-        [tuple.credentialKey]: yield* credentialKey(
-          credential.rpId,
-          credential.protocolCredentialId,
-        ),
-      },
-      {
-        [tuple.state]: mapping.write.credentialOwnership.removedState,
-        [tuple.version]: owner.marker,
-      },
-    );
-    yield* invalidate(mapping, subject, input.invalidation);
-    owner.postconditions.push(
-      remaining,
-      sql`not exists(select 1 from ${table.table} where ${both(equal(table.table, { [table.credentialId]: id }), table.activeCondition)})`,
-      sql`not exists(select 1 from ${factor.table} where ${both(equal(factor.table, { [factor.subjectId]: subject.nativeId, [factor.credentialId]: id }), factor.activeCondition)})`,
-    );
-
-    const result = {
-      credentialId: credential.credentialId,
-      replayed: false,
-      invalidation: input.invalidation,
-    };
-
-    yield* record(
-      mapping,
-      subject,
-      input.commandId,
-      id,
-      intent,
-      { _tag: "Removed", result },
-      input.retentionUntilMillis,
-      prior.observation,
-    );
-
-    return { _tag: "Removed", result } as const;
-  });
-
-  return { listCredentials, renameCredential, inspectRemove, removeCredential };
-};

package/src/internal/passkey/registration-ceremony.ts

@@ -1,283 +0,0 @@
-/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */
-
-import {
-  PasskeyClaim,
-  type PasskeyAccess,
-  type PasskeyCeremony,
-  type PasskeyMethodPolicy,
-  snapshotPasskeySync,
-} from "@yielded/auth/Passkey";
-import { Effect } from "effect";
-
-import type { QueryOperations } from "../query-operations";
-import type { makeTransactionKernel } from "../transaction-kernel";
-import type { makePasskeyAdmissionKernel } from "./admission";
-import type { makePasskeyCredentialsKernel } from "./credentials";
-import type { makePasskeyFlowKernel } from "./flow";
-import type { makePasskeyRegistrationCustodyKernel } from "./registration-custody";
-import { CurrentPasskeyTransaction } from "./state";
-import type { makePasskeyStateKernel } from "./state";
-
-export const makePasskeyRegistrationCeremonyKernel = (
-  operations: QueryOperations,
-  admission: Pick<
-    ReturnType<typeof makePasskeyAdmissionKernel>,
-    "admissionCondition" | "guardAdmission" | "guardChargeSet" | "lockAdmission" | "readCharges"
-  >,
-  credentials: Pick<
-    ReturnType<typeof makePasskeyCredentialsKernel>,
-    "readModule" | "readPolicyGuards"
-  >,
-  flow: Pick<
-    ReturnType<typeof makePasskeyFlowKernel>,
-    "compatiblePolicy" | "liveCondition" | "matchesAccess" | "readFlow" | "terminalFlow"
-  >,
-  registrationCustody: Pick<
-    ReturnType<typeof makePasskeyRegistrationCustodyKernel>,
-    "releaseRegistrationCustody"
-  >,
-  state: Pick<
-    ReturnType<typeof makePasskeyStateKernel>,
-    "ceremonyStorage" | "equal" | "handleKey" | "invariant" | "mappedColumns" | "policyStorage"
-  >,
-  transactions: Pick<ReturnType<typeof makeTransactionKernel>, "both">,
-) => {
-  const { sql } = operations;
-
-  const { admissionCondition, guardAdmission, guardChargeSet, lockAdmission, readCharges } =
-    admission;
-
-  const { readModule, readPolicyGuards } = credentials;
-  const { compatiblePolicy, liveCondition, matchesAccess, readFlow, terminalFlow } = flow;
-  const { releaseRegistrationCustody } = registrationCustody;
-  const { ceremonyStorage, equal, handleKey, mappedColumns, policyStorage } = state;
-  const invariant: (value: unknown) => asserts value = state.invariant;
-  const { both } = transactions;
-
-  /** The issuing registration authority owns the application value and reservation.
-   * This facet only compares its opaque custody and cannot issue or provision. */
-  const custody = Effect.fn("passkey.registrationCustody")(function* (
-    mapping: any,
-    ceremony: PasskeyCeremony,
-    pending: boolean,
-  ) {
-    const owner = yield* CurrentPasskeyTransaction;
-
-    invariant(ceremony.context._tag === "Registration");
-
-    const context = ceremony.context,
-      intent = mapping.intent,
-      handle = mapping.handle;
-
-    const identity = { [intent.moduleId]: mapping.moduleId, [intent.flowId]: ceremony.flowId };
-
-    const advisory = (yield* owner.read(intent.table, equal(intent.table, identity), {
-      limit: 1,
-      lock: false,
-      observe: false,
-    })).rows[0];
-
-    if (advisory === undefined) return false;
-    const hashedHandle = yield* handleKey(ceremony.profile.rpId, context.userHandle);
-
-    const held = (yield* owner.read(
-      handle.table,
-      equal(handle.table, { [handle.handleKey]: hashedHandle }),
-      { limit: 1, columns: mappedColumns(handle) },
-    )).rows[0];
-
-    if (
-      held === undefined ||
-      !handle.isReservedState(held[handle.state]) ||
-      held[handle.handleKey] !== hashedHandle ||
-      held[handle.rpId] !== ceremony.profile.rpId ||
-      held[handle.userHandle] !== context.userHandle ||
-      held[handle.reservationId] !== advisory[intent.reservationId]
-    )
-      return false;
-    const heldCondition = sql`exists (select 1 from ${handle.table} where ${both(owner.exact(handle.table, held), handle.reservedCondition)})`;
-
-    if (!(yield* owner.check(heldCondition))) return false;
-
-    const row = (yield* owner.read(intent.table, equal(intent.table, identity), {
-      limit: 1,
-      columns: mappedColumns(intent),
-    })).rows[0];
-
-    if (
-      row === undefined ||
-      row[intent.commandId] !== ceremony.commandId ||
-      row[intent.fingerprint] !== context.fingerprint ||
-      row[intent.handleKey] !== hashedHandle ||
-      row[intent.reservationId] !== held[handle.reservationId] ||
-      row[intent.ceremonySnapshot] !== ceremonyStorage.encode(ceremony) ||
-      typeof row[intent.applicationSnapshot] !== "string" ||
-      new TextEncoder().encode(row[intent.applicationSnapshot]).length > 1048576 ||
-      (pending && !intent.isPendingState(row[intent.state]))
-    )
-      return false;
-    const condition = pending ? intent.pendingCondition : intent.custodyCondition;
-
-    if (
-      !(yield* owner.check(
-        sql`exists (select 1 from ${intent.table} where ${both(owner.exact(intent.table, row), condition)})`,
-      ))
-    )
-      return false;
-
-    return [
-      heldCondition,
-      sql`exists (select 1 from ${intent.table} where ${both(owner.exact(intent.table, row), condition)})`,
-    ];
-  });
-
-  const contextRegistration = Effect.fn("passkey.contextRegistration")(function* (
-    mapping: any,
-    access: PasskeyAccess,
-  ) {
-    const owner = yield* CurrentPasskeyTransaction;
-
-    if (access.moduleId !== mapping.moduleId) return undefined;
-    const current = yield* readModule(mapping);
-
-    if (current === undefined) return undefined;
-    yield* readPolicyGuards(mapping);
-    const table = mapping.flow;
-
-    const advisory = (yield* owner.read(
-      table.table,
-      equal(table.table, { [table.moduleId]: mapping.moduleId, [table.flowId]: access.flowId }),
-      { limit: 1, lock: false, observe: false },
-    )).rows[0];
-
-    if (advisory === undefined) return undefined;
-    const ceremony = ceremonyStorage.decode(advisory[table.snapshot]);
-
-    if (ceremony.purpose !== "registration" || !matchesAccess(ceremony, access)) return undefined;
-    const held = yield* custody(mapping, ceremony, true);
-
-    if (!held) return undefined;
-    const read = yield* readFlow(mapping, access.flowId);
-
-    if (
-      read === undefined ||
-      read.state !== "Pending" ||
-      ceremonyStorage.encode(read.ceremony) !== ceremonyStorage.encode(ceremony) ||
-      !compatiblePolicy(read.ceremony, read.policy, current) ||
-      !(yield* owner.check(liveCondition(mapping, ceremony)))
-    )
-      return undefined;
-    owner.postconditions.push(...held, liveCondition(mapping, ceremony));
-
-    return read.ceremony;
-  });
-
-  const claimRegistration = Effect.fn("passkey.claimRegistration")(function* (
-    mapping: any,
-    input: {
-      readonly access: PasskeyAccess;
-      readonly policy: PasskeyMethodPolicy;
-      readonly ceremony: PasskeyCeremony;
-      readonly claimId: string;
-    },
-  ) {
-    const owner = yield* CurrentPasskeyTransaction;
-    const current = yield* readModule(mapping);
-
-    if (current === undefined || input.access.moduleId !== mapping.moduleId)
-      return { _tag: "Rejected" } as const;
-    yield* lockAdmission(mapping);
-    yield* readPolicyGuards(mapping);
-    const held = yield* custody(mapping, input.ceremony, true);
-    const read = yield* readFlow(mapping, input.access.flowId);
-
-    if (
-      read === undefined ||
-      read.state !== "Pending" ||
-      !matchesAccess(read.ceremony, input.access)
-    )
-      return { _tag: "Rejected" } as const;
-    invariant(ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(input.ceremony));
-    if (
-      !held ||
-      !compatiblePolicy(read.ceremony, read.policy, current) ||
-      policyStorage.encode(current) !== policyStorage.encode(input.policy) ||
-      !(yield* owner.check(liveCondition(mapping, read.ceremony))) ||
-      !(yield* owner.check(
-        yield* admissionCondition(
-          mapping,
-          [read.policy, current],
-          read.ceremony,
-          undefined,
-          [],
-          false,
-          false,
-        ),
-      ))
-    ) {
-      if (held) yield* releaseRegistrationCustody(mapping, read.ceremony);
-      yield* terminalFlow(mapping, read, "Rejected");
-
-      return { _tag: "Rejected" } as const;
-    }
-    yield* readCharges(mapping, read.ceremony, read.policy, undefined);
-    const claimedAtMillis = yield* owner.now(mapping.clock);
-
-    const claim = snapshotPasskeySync(PasskeyClaim, {
-      ceremony: read.ceremony,
-      claimId: input.claimId,
-      claimedAtMillis,
-      claimExpiresAtMillis: Math.min(
-        claimedAtMillis + read.ceremony.claimLifetimeMillis,
-        read.ceremony.expiresAtMillis,
-      ),
-    });
-
-    const table = mapping.flow;
-
-    yield* owner.update(
-      table.table,
-      { [table.moduleId]: mapping.moduleId, [table.flowId]: read.ceremony.flowId },
-      {
-        [table.state]: table.states.Claimed,
-        [table.version]: owner.marker,
-        [table.claimId]: claim.claimId,
-        [table.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),
-        [table.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),
-      },
-    );
-    yield* guardChargeSet(mapping, read.ceremony, undefined);
-    yield* guardAdmission(mapping, [read.policy, current], read.ceremony, undefined);
-    owner.postconditions.push(...held, liveCondition(mapping, read.ceremony, claim));
-
-    return { _tag: "Claimed", claim } as const;
-  });
-
-  const settleRegistration = Effect.fn("passkey.settleRegistration")(function* (
-    mapping: any,
-    claim: PasskeyClaim,
-    outcome: "Rejected" | "Ambiguous",
-  ) {
-    yield* readModule(mapping);
-    yield* lockAdmission(mapping);
-    yield* readPolicyGuards(mapping);
-    const read = yield* readFlow(mapping, claim.ceremony.flowId);
-
-    if (
-      read === undefined ||
-      read.state !== "Claimed" ||
-      read.claim === undefined ||
-      read.claim.claimId !== claim.claimId ||
-      read.claim.claimedAtMillis !== claim.claimedAtMillis ||
-      read.claim.claimExpiresAtMillis !== claim.claimExpiresAtMillis ||
-      ceremonyStorage.encode(read.ceremony) !== ceremonyStorage.encode(claim.ceremony)
-    )
-      return "Rejected" as const;
-
-    if (outcome === "Rejected") yield* releaseRegistrationCustody(mapping, claim.ceremony);
-
-    return yield* terminalFlow(mapping, read, outcome);
-  });
-
-  return { contextRegistration, claimRegistration, settleRegistration };
-};