@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/src/internal/passkey-native-flow.ts

@@ -0,0 +1,140 @@
+import * as M from "@yielded/auth/Passkey";
+import { Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import type { Fragment } from "effect/sql/Statement";
+
+import { sqlBatchAssertion } from "./d1-planning";
+import type { PasskeyCeremonyMapping } from "./models/passkey-model";
+import type { NativeSqlTables } from "./native-sql-table";
+import { passkeyMatchesAccess, validPasskeyCeremony } from "./passkey-policy";
+import { exactSqlText, executeSqlChange } from "./sql-change";
+import { cleanupSqlRows } from "./sql-cleanup";
+import { appendSqlBatchStatement } from "./sql-commit";
+import type { TableModel } from "./table-model";
+
+export const passkeyCeremonyJson = Schema.fromJsonString(M.PasskeyCeremony);
+
+// The physical expression compiler validates this adapter boundary.
+// oxlint-disable-next-line no-explicit-any
+export type PasskeyNativeCeremonyMapping = PasskeyCeremonyMapping<TableModel, any>;
+
+/** One set of challenge statements serves native transactions and fixed D1 plans. */
+export const makePasskeyNativeFlow = Effect.fnUntraced(function* (
+  tables: NativeSqlTables,
+  mapping: PasskeyNativeCeremonyMapping,
+) {
+  const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+  const flow = tables(mapping.flow.table);
+  const now = tables.expression(mapping.clock.engineNowMillis);
+  const millis = (expression: Fragment) => tables.expression(mapping.clock.toMillis(expression));
+
+  const exact = (key: string, value: unknown) =>
+    exactSqlText(sql, flow.column(key), flow.value(key, value));
+
+  const module = (moduleId: string) => exact(mapping.flow.moduleId, moduleId);
+  const validModule = (moduleId: string) => moduleId === mapping.moduleId;
+
+  const access = (input: M.PasskeyAccess, ceremony?: M.PasskeyCeremony) =>
+    sql.and([
+      module(input.moduleId),
+      exact(mapping.flow.purpose, input.purpose),
+      exact(mapping.flow.flowId, input.flowId),
+      exact(mapping.flow.requestBindingVerifier, input.requestBindingVerifier),
+      sql`${flow.column(mapping.flow.requestBindingExpiresAt)} = ${flow.value(mapping.flow.requestBindingExpiresAt, mapping.clock.encodeInstant(input.requestBindingExpiresAtMillis))}`,
+      sql`${millis(flow.column(mapping.flow.expiresAt))} > ${now}`,
+      sql`${millis(flow.column(mapping.flow.requestBindingExpiresAt))} > ${now}`,
+      ...(ceremony === undefined
+        ? []
+        : [
+            exact(mapping.flow.snapshot, Schema.encodeSync(passkeyCeremonyJson)(ceremony)),
+            sql`${flow.column(mapping.flow.issuedAt)} = ${flow.value(mapping.flow.issuedAt, mapping.clock.encodeInstant(ceremony.issuedAtMillis))}`,
+            sql`${flow.column(mapping.flow.expiresAt)} = ${flow.value(mapping.flow.expiresAt, mapping.clock.encodeInstant(ceremony.expiresAtMillis))}`,
+          ]),
+    ]);
+
+  const insert = (ceremony: M.PasskeyCeremony, extra: Readonly<Record<string, unknown>> = {}) => {
+    const values = {
+      ...mapping.flow.encodeInsert({ ceremony }),
+      ...extra,
+      [mapping.flow.moduleId]: ceremony.moduleId,
+      [mapping.flow.flowId]: ceremony.flowId,
+      [mapping.flow.purpose]: ceremony.purpose,
+      [mapping.flow.snapshot]: Schema.encodeSync(passkeyCeremonyJson)(ceremony),
+      [mapping.flow.requestBindingVerifier]: ceremony.requestBindingVerifier,
+      [mapping.flow.requestBindingExpiresAt]: mapping.clock.encodeInstant(
+        ceremony.requestBindingExpiresAtMillis,
+      ),
+      [mapping.flow.issuedAt]: mapping.clock.encodeInstant(ceremony.issuedAtMillis),
+      [mapping.flow.expiresAt]: mapping.clock.encodeInstant(ceremony.expiresAtMillis),
+    };
+
+    return sql`${flow.insert(values)} ${sql.onDialectOrElse({ mysql: () => sql``, orElse: () => sql`on conflict do nothing` })}`;
+  };
+
+  const consume = (
+    input: M.PasskeyAccess,
+    ceremony: M.PasskeyCeremony,
+    condition: Fragment = sql`true`,
+  ) => sql`delete from ${flow.name} where ${access(input, ceremony)} and ${condition}`;
+
+  const context = Effect.fnUntraced(function* (input: M.PasskeyAccess) {
+    if (!validModule(input.moduleId)) return undefined;
+
+    const rows =
+      yield* sql`select ${flow.fields("flow_")} from ${flow.name} where ${access(input)}`;
+
+    if (rows.length !== 1) return undefined;
+    const row = flow.decode(rows[0]!, "flow_");
+
+    const ceremony = yield* Schema.decodeUnknownEffect(passkeyCeremonyJson)(
+      row[mapping.flow.snapshot],
+    );
+
+    return validPasskeyCeremony(ceremony) &&
+      passkeyMatchesAccess(ceremony, input) &&
+      mapping.clock.decodeInstant(row[mapping.flow.issuedAt]) === ceremony.issuedAtMillis &&
+      mapping.clock.decodeInstant(row[mapping.flow.expiresAt]) === ceremony.expiresAtMillis
+      ? ceremony
+      : undefined;
+  });
+
+  const cleanup = (moduleId: string, limit: number, batch = false) =>
+    cleanupSqlRows(
+      [
+        {
+          table: flow,
+          keys: [mapping.flow.moduleId, mapping.flow.flowId],
+          due: sql`${module(moduleId)} and ${millis(flow.column(mapping.flow.expiresAt))} <= ${now}`,
+          order: [flow.column(mapping.flow.expiresAt), flow.column(mapping.flow.flowId)],
+        },
+      ],
+      limit,
+      batch,
+    );
+
+  const stage = Effect.fnUntraced(function* (statement: Fragment, count: number) {
+    yield* appendSqlBatchStatement(sql`${statement}`);
+    yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${count}`));
+  });
+
+  return {
+    sql,
+    flow,
+    now,
+    millis,
+    exact,
+    module,
+    validModule,
+    access,
+    insert,
+    consume,
+    absent: (input: M.PasskeyAccess) =>
+      sql`not exists(select 1 from ${flow.name} where ${module(input.moduleId)} and ${exact(mapping.flow.flowId, input.flowId)})`,
+    context,
+    cleanup,
+    stage,
+    change: (statement: Fragment) => executeSqlChange(sql, statement),
+  };
+});
+
+export type PasskeyNativeFlow = Effect.Success<ReturnType<typeof makePasskeyNativeFlow>>;

package/src/internal/passkey-native-registration.ts

@@ -0,0 +1,221 @@
+/* oxlint-disable no-explicit-any -- physical mapping generics are erased only at this shared adapter boundary. */
+import * as M from "@yielded/auth/Passkey";
+import { Effect, Schema } from "effect";
+
+import { randomId } from "./crypto";
+import { sqlBatchAssertion } from "./d1-planning";
+import type {
+  PasskeyRegistrationMapping,
+  PasskeyRegistrationWriter,
+} from "./models/passkey-write-model";
+import { passkeyCanonicalJson, passkeyDigest } from "./passkey-actions";
+import { preparePasskeyNative, type NativePasskeyServices } from "./passkey-native";
+import { passkeyNativeInvariant } from "./passkey-native-state";
+import { makePasskeyNativeWrites } from "./passkey-native-write";
+import { passkeyMatchesAccess, validPasskeyCeremony } from "./passkey-policy";
+import { appendSqlBatchStatement } from "./sql-commit";
+import type { TableModel } from "./table-model";
+
+// Foreign mapping expressions are compiled at the NativeSqlTables boundary.
+export type NativePasskeyRegistrationMapping<R> = PasskeyRegistrationMapping<
+  TableModel,
+  TableModel,
+  TableModel,
+  TableModel,
+  unknown,
+  R,
+  any
+>;
+
+export const makePasskeyNativeRegistration = <R>(
+  base: NativePasskeyServices,
+  mapping: NativePasskeyRegistrationMapping<R>,
+) => {
+  const { state, run, advisory } = base;
+  const { sql, tables, subject, credential, ceremony: flow } = state;
+
+  const { write, postcondition, check, insertCredential, subjectCondition, owned } =
+    makePasskeyNativeWrites(base, mapping);
+
+  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;
+  const codec = passkeyCanonicalJson(mapping.registration.schema);
+
+  const describe = Effect.fnUntraced(function* (original: R) {
+    const encoded = codec.encode(original);
+
+    invariant(new TextEncoder().encode(encoded).length <= 1048576);
+    const registration = codec.decode(encoded);
+
+    const labels = yield* Schema.decodeEffect(
+      Schema.Struct({ name: M.PasskeyLabel, displayName: M.PasskeyLabel }),
+    )(mapping.registration.describe(registration));
+
+    return {
+      encoded,
+      registration,
+      ...labels,
+      fingerprint: yield* passkeyDigest(mapping.registration.schema, registration),
+    };
+  });
+
+  const writer: PasskeyRegistrationWriter<R> = {
+    inspect: (original) =>
+      advisory(
+        Effect.gen(function* () {
+          const value = yield* describe(original);
+
+          const rows =
+            yield* sql`select case when ${tables.expression(mapping.registration.eligible(value.registration))} then 1 else 0 end as eligible`;
+
+          return {
+            fingerprint: value.fingerprint,
+            name: value.name,
+            displayName: value.displayName,
+            eligible: rows.length === 1 && Number(rows[0]!.eligible) === 1,
+          };
+        }),
+      ),
+    issueRegistration: (input, prepare) =>
+      run(
+        Effect.gen(function* () {
+          const ceremony = M.snapshotPasskeySync(M.PasskeyCeremony, input.ceremony);
+          const value = yield* describe(input.registration);
+
+          if (
+            !flow.validModule(ceremony.moduleId) ||
+            !validPasskeyCeremony(ceremony) ||
+            ceremony.purpose !== "registration" ||
+            ceremony.context._tag !== "Registration" ||
+            !ceremony.profile.primarySignIn ||
+            ceremony.profile.residentKey !== "required" ||
+            ceremony.profile.userVerification !== "required" ||
+            ceremony.allowedCredentials.length !== 0 ||
+            ceremony.context.fingerprint !== value.fingerprint ||
+            ceremony.context.name !== value.name ||
+            ceremony.context.displayName !== value.displayName
+          )
+            return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+          const statement = flow.insert(ceremony, { [mapping.applicationSnapshot]: value.encoded });
+
+          if (base.batch) yield* flow.stage(statement, 1);
+          else if ((yield* flow.change(statement)) !== 1)
+            return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+
+          return yield* preparePasskeyNative({ _tag: "Issued", ceremony }, prepare);
+        }),
+        "statement",
+      ),
+    completeRegistration: (input, prepare) =>
+      run(
+        Effect.gen(function* () {
+          const ceremony = M.snapshotPasskeySync(M.PasskeyCeremony, input.ceremony);
+          const access = M.snapshotPasskeySync(M.PasskeyAccess, input.access);
+          const verified = M.snapshotPasskeySync(M.PasskeyRegistrationVerified, input.verified);
+
+          if (
+            !flow.validModule(ceremony.moduleId) ||
+            ceremony.context._tag !== "Registration" ||
+            ceremony.purpose !== "registration" ||
+            !passkeyMatchesAccess(ceremony, access) ||
+            !verified.userVerified
+          )
+            return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+
+          const rows =
+            yield* sql`select ${flow.flow.fields("flow_")}, ${flow.now} as "engineNow" from ${flow.flow.name} where ${flow.access(access, ceremony)}`;
+
+          if (rows.length !== 1) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+          const row = flow.flow.decode(rows[0]!, "flow_");
+
+          const encoded = yield* Schema.decodeUnknownEffect(Schema.String)(
+            row[mapping.applicationSnapshot],
+          );
+
+          const registration = codec.decode(encoded);
+          const value = yield* describe(registration);
+
+          if (
+            value.fingerprint !== ceremony.context.fingerprint ||
+            value.name !== ceremony.context.name ||
+            value.displayName !== ceremony.context.displayName
+          )
+            return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+          const eligible = tables.expression(mapping.registration.eligible(registration));
+          const marker = yield* randomId;
+          const provision = mapping.registration.subject({ registration, ceremony, marker });
+          const nativeId = provision.subjectId;
+          const subjectId = mapping.read.subjectIds.toSubject(nativeId);
+
+          invariant(
+            mapping.read.subjectIds.equals(mapping.read.subjectIds.toNative(subjectId), nativeId),
+          );
+          if (base.batch) yield* appendSqlBatchStatement(sqlBatchAssertion(sql, eligible));
+          else yield* check(eligible);
+          // Inserting the new subject acquires its lock before the challenge or
+          // credential is mutated. A failed consume rolls this insertion back.
+          yield* write(subject.insert(provision.values), 1);
+          let revision: M.PasskeyCredential["revision"];
+          let nowMillis: number;
+          let subjectRow: Readonly<Record<string, unknown>> = provision.values;
+
+          if (base.batch) {
+            invariant(
+              mapping.read.subject.isActiveStatus(provision.values[mapping.read.subject.status]),
+            );
+            revision = yield* Schema.decodeUnknownEffect(M.PasskeyRevision)({
+              subjectId,
+              securityRevision: provision.values[mapping.read.subject.securityRevision],
+              credentials: [],
+            });
+            nowMillis = yield* Schema.decodeEffect(Schema.Int)(Number(rows[0]!.engineNow));
+          } else {
+            const current = yield* state.readAuthority(nativeId, true);
+
+            invariant(current !== undefined);
+            subjectRow = current.row;
+            revision = current.revision;
+            nowMillis = current.nowMillis;
+          }
+
+          const cap = M.snapshotPasskeySync(
+            M.PasskeyManagementPolicy,
+            mapping.write.policy.management(subjectRow),
+          ).maximumCredentials;
+
+          const count = sql`(select count(*) from ${credential.name} where ${owned(nativeId)})`;
+
+          const finalEligibility = tables.expression(
+            mapping.registration.finalEligibility({ registration, subjectId: nativeId }),
+          );
+
+          yield* write(
+            flow.consume(
+              access,
+              ceremony,
+              sql`${flow.exact(mapping.applicationSnapshot, encoded)} and ${subjectCondition(revision)} and ${count} < ${cap} and ${finalEligibility}`,
+            ),
+            1,
+          );
+
+          const inserted = yield* insertCredential(
+            nativeId,
+            ceremony,
+            verified,
+            revision,
+            value.displayName,
+            nowMillis,
+            subjectRow,
+          );
+
+          yield* postcondition(
+            "passkey-registration-subject",
+            sql`${inserted.condition} and ${flow.absent(access)} and ${subjectCondition(revision)} and ${count} <= ${cap} and ${finalEligibility} and ${state.now} < ${ceremony.expiresAtMillis}`,
+          );
+
+          return yield* preparePasskeyNative({ _tag: "RegistrationAccepted" }, prepare);
+        }),
+      ),
+  };
+
+  return { passkeyRegistrationAuthority: writer };
+};

package/src/internal/passkey-native-state.ts

@@ -0,0 +1,335 @@
+/* oxlint-disable no-explicit-any -- physical mapping generics are erased only at this shared adapter boundary. */
+import * as M from "@yielded/auth/Passkey";
+import { Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import type { Fragment } from "effect/sql/Statement";
+
+import type { PasskeyCredentialMapping, PasskeyPersistenceMapping } from "./models/passkey-model";
+import { sqlMapping, type NativeSqlTables } from "./native-sql-table";
+import { makePasskeyNativeFlow } from "./passkey-native-flow";
+import { passkeyCredentialKey } from "./passkey-policy";
+import { exactSqlText } from "./sql-change";
+import type { TableModel } from "./table-model";
+
+// Physical expression types are validated by NativeSqlTables at this boundary.
+export type PasskeyNativeRead = PasskeyCredentialMapping<
+  TableModel,
+  TableModel,
+  TableModel,
+  unknown,
+  any
+>;
+
+export type PasskeyNativeMapping = PasskeyPersistenceMapping<
+  PasskeyNativeRead,
+  TableModel,
+  unknown,
+  any
+>;
+
+export type PasskeyNativeRow = Readonly<Record<string, unknown>>;
+
+export const passkeyNativeInvariant: (value: unknown) => asserts value = (value) => {
+  if (!value) throw M.PasskeyUnavailable.make({});
+};
+
+export const makePasskeyNativeReadState = Effect.fnUntraced(function* (
+  tables: NativeSqlTables,
+  read: PasskeyNativeRead,
+  clock?: PasskeyNativeMapping["clock"],
+) {
+  const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+  const subject = tables(read.subject.table);
+  const credential = tables(read.credential.table);
+  const factor = tables(read.authority.table);
+  const now = clock === undefined ? sql`0` : tables.expression(clock.engineNowMillis);
+
+  const millis = (expression: Fragment) =>
+    clock === undefined ? expression : tables.expression(clock.toMillis(expression));
+
+  const storedNow =
+    clock === undefined ? sql`0` : tables.expression(clock.fromMillis(clock.engineNowMillis));
+
+  const active = (table: "subject" | "credential" | "authority") =>
+    tables.expression(read[table].activeCondition);
+
+  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;
+  const sameId = (nativeId: unknown, value: unknown) => read.subjectIds.equals(nativeId, value);
+
+  const native = (id: M.PasskeyCredential["revision"]["subjectId"]) => {
+    const value = read.subjectIds.toNative(id);
+
+    invariant(read.subjectIds.toSubject(value) === id);
+
+    return value;
+  };
+
+  const revisions = (nativeId: unknown, rows: ReadonlyArray<PasskeyNativeRow>) => {
+    const entries = new Map<string, M.PasskeyCredential["revision"]["securityRevision"]>();
+
+    for (const row of rows) {
+      if (row[read.authority.credentialId] === null) continue;
+      invariant(sameId(nativeId, row[read.authority.subjectId]));
+      if (!read.authority.isActiveStatus(row[read.authority.status])) continue;
+
+      const decoded = Schema.decodeUnknownSync(M.PasskeyRevision.fields.credentials)([
+        {
+          credentialId: row[read.authority.credentialId],
+          revision: row[read.authority.revision],
+        },
+      ]);
+
+      const entry = decoded[0];
+
+      invariant(entry !== undefined);
+      const previous = entries.get(entry.credentialId);
+
+      invariant(previous === undefined || previous === entry.revision);
+      entries.set(entry.credentialId, entry.revision);
+    }
+    invariant(entries.size <= 64);
+
+    return [...entries]
+      .sort(([a], [b]) => a.localeCompare(b))
+      .map(([credentialId, revision]) => ({ credentialId, revision }));
+  };
+
+  const revision = (row: PasskeyNativeRow, factors: ReadonlyArray<PasskeyNativeRow>) => {
+    const id = read.subject.decodeId(row);
+    const subjectId = read.subjectIds.toSubject(id);
+
+    invariant(sameId(native(subjectId), id));
+
+    return Schema.decodeUnknownSync(M.PasskeyRevision)({
+      subjectId,
+      securityRevision: row[read.subject.securityRevision],
+      credentials: revisions(id, factors),
+    });
+  };
+
+  const decodeCredential = Effect.fnUntraced(function* (
+    row: PasskeyNativeRow,
+    current: M.PasskeyCredential["revision"],
+    subjectRow: PasskeyNativeRow,
+  ) {
+    const value = read.credential.decode(row);
+    const owned = current.credentials.find((entry) => entry.credentialId === value.credentialId);
+
+    if (
+      !read.credential.isActiveStatus(row[read.credential.status]) ||
+      owned?.revision !== row[read.credential.credentialRevision]
+    )
+      return undefined;
+    invariant(
+      read.subjectIds.toSubject(read.credential.decodeSubjectId(row)) === current.subjectId,
+    );
+
+    return M.snapshotPasskeySync(M.PasskeyCredential, {
+      ...value,
+      revision: current,
+      requirement: yield* read.subject.decodeRequirement(subjectRow),
+      active: true,
+    });
+  });
+
+  const readAuthority = Effect.fnUntraced(function* (
+    nativeId: unknown,
+    lock: boolean,
+    credentialId?: string,
+  ) {
+    // The subject lock is a distinct first statement; joined FOR UPDATE cannot
+    // establish the lock order required by coordinated application transactions.
+    if (lock) {
+      const locked =
+        yield* sql<PasskeyNativeRow>`select ${subject.fields("s_")}, ${now} as "engineNow" from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${active("subject")} ${sql.onDialectOrElse({ pg: () => sql`for update`, mysql: () => sql`for update`, orElse: () => sql`` })}`;
+
+      if (locked.length !== 1) return undefined;
+      const row = subject.decode(locked[0]!, "s_");
+
+      if (
+        !sameId(read.subject.decodeId(row), nativeId) ||
+        !read.subject.isActiveStatus(row[read.subject.status])
+      )
+        return undefined;
+
+      const lockedFactors = sql`select ${factor.fields("f_")} from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${active("authority")} order by ${factor.column(read.authority.credentialId)} limit 65 ${sql.onDialectOrElse({ pg: () => sql`for update`, mysql: () => sql`for update`, orElse: () => sql`` })}`;
+
+      const rows =
+        credentialId === undefined
+          ? yield* sql<PasskeyNativeRow>`${lockedFactors}`
+          : yield* sql<PasskeyNativeRow>`with locked_factors as ${sql.onDialectOrElse({ pg: () => sql`materialized`, orElse: () => sql`` })} (${lockedFactors})
+        select locked_factors.*, ${credential.fields("c_")} from ${credential.name} left join locked_factors on 1 = 1
+        where ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${exactSqlText(sql, credential.column(read.credential.credentialId), credential.value(read.credential.credentialId, credentialId))} and ${active("credential")}`;
+
+      invariant(rows.length <= 64);
+
+      return {
+        row,
+        credential:
+          credentialId === undefined || rows[0] === undefined
+            ? undefined
+            : credential.decode(rows[0], "c_"),
+        revision: revision(
+          row,
+          rows.map((row) => factor.decode(row, "f_")),
+        ),
+        nowMillis: yield* Schema.decodeEffect(Schema.Int)(Number(locked[0]!.engineNow)),
+      };
+    }
+
+    const observedSubject = joinedSubject,
+      observedFactor = joinedFactor;
+
+    const rows =
+      yield* sql<PasskeyNativeRow>`select ${observedSubject.fields("s_")}, ${observedFactor.fields("f_")}, ${now} as "engineNow" ${credentialId === undefined ? sql`` : sql`, ${joinedCredential.fields("c_")}`} from ${selected("subject", "passkey_subject")} left join ${selected("authority", "passkey_factor")} on ${observedFactor.column(read.authority.subjectId)} = ${observedFactor.value(read.authority.subjectId, nativeId)} ${credentialId === undefined ? sql`` : sql`join ${selected("credential", "passkey_credential")} on ${joinedCredential.column(read.credential.subjectId)} = ${joinedCredential.value(read.credential.subjectId, nativeId)} and ${exactSqlText(sql, joinedCredential.column(read.credential.credentialId), joinedCredential.value(read.credential.credentialId, credentialId))}`} where ${observedSubject.column(read.subject.id)} = ${observedSubject.value(read.subject.id, nativeId)} limit 65`;
+
+    if (rows.length === 0 || rows.length > 64) return undefined;
+    const row = observedSubject.decode(rows[0]!, "s_");
+
+    if (
+      !sameId(read.subject.decodeId(row), nativeId) ||
+      !read.subject.isActiveStatus(row[read.subject.status])
+    )
+      return undefined;
+    invariant(
+      rows.every((selected) => {
+        const other = observedSubject.decode(selected, "s_");
+
+        return (
+          sameId(read.subject.decodeId(other), nativeId) &&
+          other[read.subject.securityRevision] === row[read.subject.securityRevision] &&
+          read.subject.isActiveStatus(other[read.subject.status])
+        );
+      }),
+    );
+
+    return {
+      row,
+      credential: credentialId === undefined ? undefined : joinedCredential.decode(rows[0]!, "c_"),
+      revision: revision(
+        row,
+        rows.map((selected) => observedFactor.decode(selected, "f_")),
+      ),
+      nowMillis: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0]!.engineNow)),
+    };
+  });
+
+  // Active predicates retain their original table qualification inside each
+  // subquery; aliases allow applications to map several roles to one table.
+  const joinedSubject = subject.as("passkey_subject");
+  const joinedFactor = factor.as("passkey_factor");
+  const joinedCredential = credential.as("passkey_credential");
+
+  const selected = (kind: "subject" | "authority" | "credential", alias: string) => {
+    const table = kind === "subject" ? subject : kind === "authority" ? factor : credential;
+
+    return sql`(select * from ${table.name} where ${active(kind)}) as ${sql(alias)}`;
+  };
+
+  const lookup = Effect.fnUntraced(function* (rpId: string, protocolCredentialId: string) {
+    const key = yield* passkeyCredentialKey(rpId, protocolCredentialId);
+
+    if (
+      subject.unencodedTextColumn?.(read.subject.id) !== undefined &&
+      credential.unencodedTextColumn?.(read.credential.subjectId) !== undefined &&
+      factor.unencodedTextColumn?.(read.authority.subjectId) !== undefined
+    ) {
+      const s = joinedSubject,
+        c = joinedCredential,
+        f = joinedFactor;
+
+      const rows =
+        yield* sql<PasskeyNativeRow>`select ${s.fields("s_")}, ${c.fields("c_")}, ${f.fields("f_")}
+        from ${selected("credential", "passkey_credential")}
+        join ${selected("subject", "passkey_subject")} on ${exactSqlText(sql, s.column(read.subject.id), c.column(read.credential.subjectId))}
+        left join ${selected("authority", "passkey_factor")} on ${exactSqlText(sql, f.column(read.authority.subjectId), c.column(read.credential.subjectId))}
+        where ${exactSqlText(sql, c.column(read.credential.credentialKey), c.value(read.credential.credentialKey, key))} limit 65`;
+
+      if (rows.length === 0 || rows.length > 64) return undefined;
+      const row = c.decode(rows[0]!, "c_");
+      const subjectRow = s.decode(rows[0]!, "s_");
+      const owner = read.credential.decodeSubjectId(row);
+
+      invariant(
+        row[read.credential.rpId] === rpId &&
+          row[read.credential.protocolCredentialId] === protocolCredentialId,
+      );
+      invariant(
+        rows.every((selected) => {
+          const other = c.decode(selected, "c_");
+          const subjectValue = s.decode(selected, "s_");
+
+          return (
+            sameId(owner, read.credential.decodeSubjectId(other)) &&
+            sameId(owner, read.subject.decodeId(subjectValue)) &&
+            other[read.credential.credentialId] === row[read.credential.credentialId] &&
+            other[read.credential.credentialRevision] === row[read.credential.credentialRevision] &&
+            subjectValue[read.subject.securityRevision] ===
+              subjectRow[read.subject.securityRevision]
+          );
+        }),
+      );
+
+      return yield* decodeCredential(
+        row,
+        revision(
+          subjectRow,
+          rows.map((row) => f.decode(row, "f_")),
+        ),
+        subjectRow,
+      );
+    }
+
+    const rows =
+      yield* sql<PasskeyNativeRow>`select ${credential.fields("c_")} from ${credential.name} where ${credential.column(read.credential.credentialKey)} = ${credential.value(read.credential.credentialKey, key)} and ${active("credential")}`;
+
+    if (rows.length !== 1) return undefined;
+    const row = credential.decode(rows[0]!, "c_");
+
+    invariant(
+      row[read.credential.rpId] === rpId &&
+        row[read.credential.protocolCredentialId] === protocolCredentialId,
+    );
+    const current = yield* readAuthority(read.credential.decodeSubjectId(row), false);
+
+    return current === undefined
+      ? undefined
+      : yield* decodeCredential(row, current.revision, current.row);
+  });
+
+  return {
+    sql,
+    tables,
+    subject,
+    credential,
+    factor,
+    now,
+    storedNow,
+    millis,
+    active,
+    native,
+    sameId,
+    revision,
+    decodeCredential,
+    readAuthority,
+    lookup,
+    joinedSubject,
+    joinedFactor,
+    joinedCredential,
+    selected,
+    mapped: sqlMapping,
+  };
+});
+
+export const makePasskeyNativeState = Effect.fnUntraced(function* (
+  tables: NativeSqlTables,
+  mapping: PasskeyNativeMapping,
+) {
+  const state = yield* makePasskeyNativeReadState(tables, mapping.read, mapping.clock);
+  const ceremony = yield* makePasskeyNativeFlow(tables, mapping);
+
+  return { ...state, mapping, ceremony, flow: ceremony.flow, access: ceremony.access };
+});
+
+export type PasskeyNativeReadState = Effect.Success<ReturnType<typeof makePasskeyNativeReadState>>;
+export type PasskeyNativeState = Effect.Success<ReturnType<typeof makePasskeyNativeState>>;