@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/passkey/target.mjs

@@ -1,200 +0,0 @@
-import { CurrentPasskeyTransaction } from "./state.mjs";
-import { Effect, Schema } from "effect";
-import { PasskeyAccess, PasskeyAssertionVerified, PasskeyCeremony, PasskeyClaim, PasskeyClaimDecision, PasskeyCleanupResult, PasskeyConfigurationError, PasskeyCredential, PasskeyEnrollmentSnapshot, PasskeyEvidence, PasskeyInstant, PasskeyIssueDecision, PasskeyMethodPolicy, PasskeyModuleId, PasskeyProfile, PasskeyProtocolCredentialId, PasskeySettlement, snapshotPasskeySync } from "@yielded/auth/Passkey";
-import { SubjectId } from "@yielded/auth/Schema";
-import { LifecycleHooks } from "@yielded/auth/Hooks";
-//#region src/internal/passkey/target.ts
-const makePasskeyTargetKernel = (credentials, flow, registrationCeremony, state, execution, operations) => {
-	const { captureEnrollmentContext, lookupCredential } = credentials;
-	const { assertionPurposes, claimAssertion, cleanupCeremonies, contextAssertion, issueAssertion, settleAssertion } = flow;
-	const { claimRegistration, contextRegistration, settleRegistration } = registrationCeremony;
-	const { captureMapping, nonce, unavailable, validateMapping } = state;
-	const invariant = state.invariant;
-	const { coordinateTransactionOwner, makeTransactionExecution, sqlClientTransactionStandaloneGuard } = execution;
-	const sqlClientPasskeyStandaloneGuard = (transactionService) => sqlClientTransactionStandaloneGuard(unavailable, transactionService);
-	const emptyHooks = {
-		before: () => Effect.void,
-		after: () => Effect.succeed([])
-	};
-	const makePasskeyExecution = Effect.fnUntraced(function* (configuration, mapping) {
-		const hooks = yield* LifecycleHooks;
-		yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(Effect.mapError(() => PasskeyConfigurationError.make({})));
-		const execution = yield* makeTransactionExecution(CurrentPasskeyTransaction, configuration, unavailable, nonce);
-		return {
-			...execution,
-			run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
-		};
-	});
-	const issueInput = Schema.Struct({
-		ceremony: PasskeyCeremony,
-		policy: PasskeyMethodPolicy
-	});
-	const claimInput = Schema.Struct({
-		access: PasskeyAccess,
-		policy: PasskeyMethodPolicy,
-		ceremony: PasskeyCeremony,
-		claimId: PasskeyClaim.fields.claimId,
-		credential: Schema.optionalKey(PasskeyCredential)
-	});
-	const settleInput = Schema.Struct({
-		claim: PasskeyClaim,
-		nowMillis: PasskeyInstant,
-		outcome: Schema.Union([
-			Schema.TaggedStruct("Rejected", {}),
-			Schema.TaggedStruct("Ambiguous", {}),
-			Schema.TaggedStruct("Assertion", {
-				credential: PasskeyCredential,
-				assertion: PasskeyAssertionVerified,
-				evidence: PasskeyEvidence
-			})
-		])
-	});
-	const cleanupInput = Schema.Struct({
-		moduleId: PasskeyModuleId,
-		nowMillis: PasskeyInstant,
-		limit: Schema.Int.check(Schema.isBetween({
-			minimum: 1,
-			maximum: 1e3
-		}))
-	});
-	const lookupInput = Schema.Struct({
-		rpId: PasskeyProfile.fields.rpId,
-		protocolCredentialId: PasskeyProtocolCredentialId
-	});
-	const contextInput = Schema.Struct({
-		moduleId: PasskeyModuleId,
-		rpId: PasskeyProfile.fields.rpId,
-		subjectId: SubjectId
-	});
-	const inputs = {
-		issue: issueInput,
-		context: PasskeyAccess,
-		claim: claimInput,
-		settle: settleInput,
-		cleanup: cleanupInput
-	};
-	const capturedService = (service, schemas, execute) => Object.freeze(Object.fromEntries(Object.entries(service).map(([name, method]) => [name, (original, prepare) => Effect.suspend(() => {
-		invariant(execute.active());
-		return method(snapshotPasskeySync(schemas[name], original), prepare);
-	}).pipe(Effect.onExit((exit) => Effect.sync(() => {
-		if (exit._tag === "Failure") execute.poison();
-	})), Effect.catchDefect(() => Effect.fail(unavailable())))])));
-	const prepareValue = (value, prepare) => Effect.flatMap(CurrentPasskeyTransaction, (owner) => Effect.sync(() => {
-		owner.guards.push(owner.journal.prepare(void 0));
-		const receipt = prepare(value, owner.journal);
-		invariant(receipt !== null && typeof receipt === "object" && receipt._tag === "PreparedCommit" && typeof receipt.read === "object" && Effect.isEffect(receipt.read));
-		owner.guards.push(receipt);
-		return receipt;
-	}));
-	const requirePurpose = (purpose, registration, enrollment = false) => invariant(enrollment ? purpose === "enrollment" : registration ? purpose === "registration" : assertionPurposes.some((supported) => supported === purpose));
-	/** Context is advisory. Retain observations and final predicates without taking
-	* later-ranked locks before a subsequent mutation acquires its full lock set. */
-	const observationalContext = (operation) => Effect.flatMap(CurrentPasskeyTransaction, (owner) => operation.pipe(Effect.provideService(CurrentPasskeyTransaction, {
-		...owner,
-		read: (table, where, options) => owner.read(table, where, {
-			...options,
-			lock: false
-		})
-	})));
-	const makePasskeyPersistence = (mapping, execute, configuration, registration = false, enrollment = false) => capturedService({
-		issue: (input, prepare) => Effect.suspend(() => {
-			invariant(!registration && !enrollment);
-			requirePurpose(input.ceremony.purpose, false);
-			return execute.run(Effect.gen(function* () {
-				const value = yield* issueAssertion(mapping, input.ceremony, input.policy);
-				return yield* prepareValue(snapshotPasskeySync(PasskeyIssueDecision, value), prepare);
-			}));
-		}),
-		context: (access) => Effect.suspend(() => {
-			requirePurpose(access.purpose, registration, enrollment);
-			return execute.run(observationalContext(registration ? contextRegistration(mapping, access) : contextAssertion(mapping, access)), false);
-		}),
-		claim: (input, prepare) => Effect.suspend(() => {
-			requirePurpose(input.access.purpose, registration, enrollment);
-			requirePurpose(input.ceremony.purpose, registration, enrollment);
-			invariant(!registration && !enrollment || input.credential === void 0);
-			return execute.run(Effect.gen(function* () {
-				const value = yield* registration ? claimRegistration(mapping, input) : claimAssertion(mapping, input);
-				return yield* prepareValue(snapshotPasskeySync(PasskeyClaimDecision, value), prepare);
-			}));
-		}),
-		settle: (input, prepare) => Effect.suspend(() => {
-			requirePurpose(input.claim.ceremony.purpose, registration, enrollment);
-			invariant(!registration && !enrollment || input.outcome._tag !== "Assertion");
-			return execute.run(Effect.gen(function* () {
-				const value = yield* registration ? settleRegistration(mapping, input.claim, input.outcome._tag) : settleAssertion(mapping, input.claim, input.outcome, configuration.dialect);
-				return yield* prepareValue(snapshotPasskeySync(PasskeySettlement, value), prepare);
-			}));
-		}),
-		cleanup: (input, prepare) => execute.run(Effect.gen(function* () {
-			const value = yield* cleanupCeremonies(mapping, input, registration ? ["registration"] : enrollment ? ["enrollment"] : assertionPurposes);
-			return yield* prepareValue(snapshotPasskeySync(PasskeyCleanupResult, value), prepare);
-		}))
-	}, inputs, execute);
-	const credentialService = (mapping, execute) => capturedService({ lookup: (input) => execute.run(lookupCredential(mapping, input.rpId, input.protocolCredentialId), false) }, { lookup: lookupInput }, execute);
-	const enrollmentService = (mapping, execute) => capturedService({ capture: (input) => execute.run(Effect.map(captureEnrollmentContext(mapping, input), (value) => value === void 0 ? void 0 : snapshotPasskeySync(PasskeyEnrollmentSnapshot, value)), false) }, { capture: contextInput }, execute);
-	const registrationServices = (mapping, execute, configuration) => ({
-		capabilities: Object.freeze({
-			purposes: Object.freeze(["registration"]),
-			issue: "registration-authority",
-			assertionSettlement: false
-		}),
-		passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true)
-	});
-	const capturedMapping = (source, kind, configuration) => Effect.flatMap(Effect.isEffect(source) ? source : Effect.succeed(source), (mapping) => Effect.try({
-		try: () => {
-			const captured = captureMapping(mapping);
-			validateMapping(captured, kind);
-			if (configuration.mode === "batch") invariant(captured.d1?.primary === true);
-			return captured;
-		},
-		catch: () => PasskeyConfigurationError.make({})
-	}));
-	const makeTargetPasskeyCredentials = (source, configuration) => Effect.gen(function* () {
-		const mapping = yield* capturedMapping(source, "read", configuration);
-		const execution = yield* makePasskeyExecution(configuration, mapping).pipe(Effect.provideService(LifecycleHooks, emptyHooks));
-		return { passkeyCredentials: credentialService(mapping, execution) };
-	});
-	const makeTargetPasskeyEnrollmentContext = (source, configuration) => Effect.gen(function* () {
-		const mapping = yield* capturedMapping(source, "context", configuration);
-		const execution = yield* makePasskeyExecution(configuration, mapping).pipe(Effect.provideService(LifecycleHooks, emptyHooks));
-		return { passkeyEnrollmentContext: enrollmentService(mapping, execution) };
-	});
-	const makeTargetPasskeyPersistence = (source, configuration) => Effect.gen(function* () {
-		const mapping = yield* capturedMapping(source, "assertion", configuration);
-		const execution = yield* makePasskeyExecution(configuration, mapping);
-		return { passkeyPersistence: makePasskeyPersistence(mapping, execution, configuration) };
-	});
-	const makeTargetPasskeyRegistration = (source, configuration) => Effect.gen(function* () {
-		const mapping = yield* capturedMapping(source, "registration", configuration);
-		const execution = yield* makePasskeyExecution(configuration, mapping);
-		return registrationServices(mapping, execution, configuration);
-	});
-	const coordinateTargetPasskey = (database, source, configuration, owner) => Effect.flatMap(capturedMapping(source, "assertion", configuration), (mapping) => Effect.flatMap(LifecycleHooks, (hooks) => coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, operations.validateStorage?.(mapping) ?? Effect.void, unavailable, nonce, (execution) => ({ passkeyPersistence: makePasskeyPersistence(mapping, {
-		...execution,
-		run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
-	}, configuration) }), owner).pipe(Effect.provideService(LifecycleHooks, hooks))));
-	const coordinateTargetPasskeyRegistration = (database, source, configuration, owner) => Effect.flatMap(capturedMapping(source, "registration", configuration), (mapping) => Effect.flatMap(LifecycleHooks, (hooks) => coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, operations.validateStorage?.(mapping) ?? Effect.void, unavailable, nonce, (execution) => registrationServices(mapping, {
-		...execution,
-		run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
-	}, configuration), owner).pipe(Effect.provideService(LifecycleHooks, hooks))));
-	return {
-		sqlClientPasskeyStandaloneGuard,
-		makePasskeyExecution,
-		capturedService,
-		prepareValue,
-		observationalContext,
-		makePasskeyPersistence,
-		capturedMapping,
-		makeTargetPasskeyCredentials,
-		makeTargetPasskeyEnrollmentContext,
-		makeTargetPasskeyPersistence,
-		makeTargetPasskeyRegistration,
-		coordinateTargetPasskey,
-		coordinateTargetPasskeyRegistration
-	};
-};
-//#endregion
-export { makePasskeyTargetKernel };
-
-//# sourceMappingURL=target.mjs.map

package/dist/internal/passkey/target.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"target.mjs","names":[],"sources":["../../../src/internal/passkey/target.ts"],"sourcesContent":["import { type PreparedCommit, LifecycleHooks } from \"@yielded/auth/Hooks\";\n/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\nimport {\n  PasskeyConfigurationError,\n  type PasskeyUnavailable,\n  type PasskeyCredentials,\n  type PasskeyEnrollmentContext,\n  type PasskeyPersistence,\n  type PreparePasskeyCommit,\n  PasskeyAccess,\n  PasskeyAssertionVerified,\n  PasskeyCeremony,\n  PasskeyClaim,\n  PasskeyClaimDecision,\n  PasskeyCleanupResult,\n  PasskeyCredential,\n  PasskeyEnrollmentSnapshot,\n  PasskeyEvidence,\n  PasskeyInstant,\n  PasskeyIssueDecision,\n  PasskeyModuleId,\n  PasskeyProfile,\n  PasskeyProtocolCredentialId,\n  PasskeySettlement,\n  PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport { SubjectId } from \"@yielded/auth/Schema\";\nimport { type Crypto, Effect, Schema } from \"effect\";\nimport type { Statement } from \"effect/sql/Statement\";\n\nimport type { PersistenceMappingError } from \"../mapping-error\";\nimport type {\n  PasskeyCredentialServices,\n  PasskeyEnrollmentContextServices,\n  PasskeyMappingSource,\n  PasskeyPersistenceServices,\n} from \"../models/passkey-model\";\nimport type { PasskeyRegistrationCeremonyServices } from \"../models/passkey-registration-ceremony-model\";\nimport type { QueryOperations } from \"../query-operations\";\nimport type {\n  TransactionCoordinatorError,\n  TransactionExecution,\n  TransactionTargetConfiguration,\n  makeTransactionExecutionKernel,\n} from \"../transaction-execution-kernel\";\nimport type { NativeDatabase } from \"../transaction-kernel\";\nimport type { makePasskeyCredentialsKernel } from \"./credentials\";\nimport type { makePasskeyFlowKernel } from \"./flow\";\nimport type { makePasskeyRegistrationCeremonyKernel } from \"./registration-ceremony\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport type PasskeyTargetConfiguration = TransactionTargetConfiguration<PasskeyUnavailable>;\n\nexport type PasskeyCoordinatorError<E> =\n  | TransactionCoordinatorError<E, PasskeyUnavailable>\n  | PasskeyConfigurationError\n  | PersistenceMappingError;\n\nexport type PasskeyExecution = TransactionExecution<\n  PasskeyUnavailable,\n  CurrentPasskeyTransaction,\n  never\n>;\n\nexport const makePasskeyTargetKernel = (\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"captureEnrollmentContext\" | \"lookupCredential\"\n  >,\n  flow: Pick<\n    ReturnType<typeof makePasskeyFlowKernel>,\n    | \"assertionPurposes\"\n    | \"claimAssertion\"\n    | \"cleanupCeremonies\"\n    | \"contextAssertion\"\n    | \"issueAssertion\"\n    | \"settleAssertion\"\n  >,\n  registrationCeremony: Pick<\n    ReturnType<typeof makePasskeyRegistrationCeremonyKernel>,\n    \"claimRegistration\" | \"contextRegistration\" | \"settleRegistration\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    \"captureMapping\" | \"invariant\" | \"nonce\" | \"unavailable\" | \"validateMapping\"\n  >,\n  execution: Pick<\n    ReturnType<typeof makeTransactionExecutionKernel>,\n    | \"coordinateTransactionOwner\"\n    | \"makeTransactionExecution\"\n    | \"sqlClientTransactionStandaloneGuard\"\n  >,\n  operations: QueryOperations,\n) => {\n  const { captureEnrollmentContext, lookupCredential } = credentials;\n\n  const {\n    assertionPurposes,\n    claimAssertion,\n    cleanupCeremonies,\n    contextAssertion,\n    issueAssertion,\n    settleAssertion,\n  } = flow;\n\n  const { claimRegistration, contextRegistration, settleRegistration } = registrationCeremony;\n  const { captureMapping, nonce, unavailable, validateMapping } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    coordinateTransactionOwner,\n    makeTransactionExecution,\n    sqlClientTransactionStandaloneGuard,\n  } = execution;\n\n  const sqlClientPasskeyStandaloneGuard = (\n    transactionService: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n  ) => sqlClientTransactionStandaloneGuard(unavailable, transactionService);\n\n  const emptyHooks: LifecycleHooks[\"Service\"] = {\n    before: () => Effect.void,\n    after: () => Effect.succeed([]),\n  };\n\n  const makePasskeyExecution = Effect.fnUntraced(function* (\n    configuration: PasskeyTargetConfiguration,\n    mapping: unknown,\n  ): Effect.fn.Return<\n    PasskeyExecution,\n    PasskeyConfigurationError,\n    LifecycleHooks | NativeDatabase | Crypto.Crypto\n  > {\n    const hooks = yield* LifecycleHooks;\n\n    yield* (operations.validateStorage?.(mapping) ?? Effect.void).pipe(\n      Effect.mapError(() => PasskeyConfigurationError.make({})),\n    );\n\n    const execution = yield* makeTransactionExecution(\n      CurrentPasskeyTransaction,\n      configuration,\n      unavailable,\n      nonce,\n    );\n\n    return {\n      ...execution,\n      run: (operation, mutation) =>\n        execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    };\n  });\n\n  const issueInput = Schema.Struct({ ceremony: PasskeyCeremony, policy: PasskeyMethodPolicy });\n\n  const claimInput = Schema.Struct({\n    access: PasskeyAccess,\n    policy: PasskeyMethodPolicy,\n    ceremony: PasskeyCeremony,\n    claimId: PasskeyClaim.fields.claimId,\n    credential: Schema.optionalKey(PasskeyCredential),\n  });\n\n  const settleInput = Schema.Struct({\n    claim: PasskeyClaim,\n    nowMillis: PasskeyInstant,\n    outcome: Schema.Union([\n      Schema.TaggedStruct(\"Rejected\", {}),\n      Schema.TaggedStruct(\"Ambiguous\", {}),\n      Schema.TaggedStruct(\"Assertion\", {\n        credential: PasskeyCredential,\n        assertion: PasskeyAssertionVerified,\n        evidence: PasskeyEvidence,\n      }),\n    ]),\n  });\n\n  const cleanupInput = Schema.Struct({\n    moduleId: PasskeyModuleId,\n    nowMillis: PasskeyInstant,\n    limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n  });\n\n  const lookupInput = Schema.Struct({\n    rpId: PasskeyProfile.fields.rpId,\n    protocolCredentialId: PasskeyProtocolCredentialId,\n  });\n\n  const contextInput = Schema.Struct({\n    moduleId: PasskeyModuleId,\n    rpId: PasskeyProfile.fields.rpId,\n    subjectId: SubjectId,\n  });\n\n  const inputs = {\n    issue: issueInput,\n    context: PasskeyAccess,\n    claim: claimInput,\n    settle: settleInput,\n    cleanup: cleanupInput,\n  };\n\n  const capturedService = <S>(\n    service: S,\n    schemas: Record<string, Schema.Codec<any, any, never, never>>,\n    execute: PasskeyExecution,\n  ): S =>\n    Object.freeze(\n      Object.fromEntries(\n        Object.entries(\n          service as Record<string, (...args: any[]) => Effect.Effect<any, PasskeyUnavailable>>,\n        ).map(([name, method]) => [\n          name,\n          (original: any, prepare?: any) =>\n            Effect.suspend(() => {\n              invariant(execute.active());\n              const input = snapshotPasskeySync(schemas[name]!, original);\n\n              return method(input, prepare);\n            }).pipe(\n              Effect.onExit((exit) =>\n                Effect.sync(() => {\n                  if (exit._tag === \"Failure\") execute.poison();\n                }),\n              ),\n              Effect.catchDefect(() => Effect.fail(unavailable())),\n            ),\n        ]),\n      ),\n    ) as S;\n\n  const prepareValue = <Value, A>(\n    value: Value,\n    prepare: PreparePasskeyCommit<Value, A>,\n  ): Effect.Effect<PreparedCommit<A>, never, CurrentPasskeyTransaction> =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      Effect.sync(() => {\n        owner.guards.push(owner.journal.prepare(undefined));\n        const receipt = prepare(value, owner.journal);\n\n        invariant(\n          receipt !== null &&\n            typeof receipt === \"object\" &&\n            receipt._tag === \"PreparedCommit\" &&\n            typeof receipt.read === \"object\" &&\n            Effect.isEffect(receipt.read),\n        );\n        owner.guards.push(receipt);\n\n        return receipt;\n      }),\n    );\n\n  const requirePurpose = (purpose: string, registration: boolean, enrollment = false) =>\n    invariant(\n      enrollment\n        ? purpose === \"enrollment\"\n        : registration\n          ? purpose === \"registration\"\n          : assertionPurposes.some((supported) => supported === purpose),\n    );\n\n  /** Context is advisory. Retain observations and final predicates without taking\n   * later-ranked locks before a subsequent mutation acquires its full lock set. */\n  const observationalContext = <A, E, R>(operation: Effect.Effect<A, E, R>) =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      operation.pipe(\n        Effect.provideService(CurrentPasskeyTransaction, {\n          ...owner,\n          read: (table, where, options) => owner.read(table, where, { ...options, lock: false }),\n        }),\n      ),\n    );\n\n  const makePasskeyPersistence = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n    registration = false,\n    enrollment = false,\n  ): PasskeyPersistence[\"Service\"] =>\n    capturedService<PasskeyPersistence[\"Service\"]>(\n      {\n        issue: (input, prepare) =>\n          Effect.suspend(() => {\n            invariant(!registration && !enrollment);\n            requirePurpose(input.ceremony.purpose, false);\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* issueAssertion(mapping, input.ceremony, input.policy);\n\n                return yield* prepareValue(\n                  snapshotPasskeySync(PasskeyIssueDecision, value),\n                  prepare,\n                );\n              }),\n            );\n          }),\n        context: (access) =>\n          Effect.suspend(() => {\n            requirePurpose(access.purpose, registration, enrollment);\n\n            return execute.run(\n              observationalContext(\n                registration\n                  ? contextRegistration(mapping, access)\n                  : contextAssertion(mapping, access),\n              ),\n              false,\n            );\n          }),\n        claim: (input, prepare) =>\n          Effect.suspend(() => {\n            requirePurpose(input.access.purpose, registration, enrollment);\n            requirePurpose(input.ceremony.purpose, registration, enrollment);\n            invariant((!registration && !enrollment) || input.credential === undefined);\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* registration\n                  ? claimRegistration(mapping, input)\n                  : claimAssertion(mapping, input);\n\n                return yield* prepareValue(\n                  snapshotPasskeySync(PasskeyClaimDecision, value),\n                  prepare,\n                );\n              }),\n            );\n          }),\n        settle: (input, prepare) =>\n          Effect.suspend(() => {\n            requirePurpose(input.claim.ceremony.purpose, registration, enrollment);\n            invariant((!registration && !enrollment) || input.outcome._tag !== \"Assertion\");\n\n            return execute.run(\n              Effect.gen(function* () {\n                const value = yield* registration\n                  ? settleRegistration(\n                      mapping,\n                      input.claim,\n                      input.outcome._tag as \"Rejected\" | \"Ambiguous\",\n                    )\n                  : settleAssertion(mapping, input.claim, input.outcome, configuration.dialect);\n\n                return yield* prepareValue(snapshotPasskeySync(PasskeySettlement, value), prepare);\n              }),\n            );\n          }),\n        cleanup: (input, prepare) =>\n          execute.run(\n            Effect.gen(function* () {\n              const value = yield* cleanupCeremonies(\n                mapping,\n                input,\n                registration ? [\"registration\"] : enrollment ? [\"enrollment\"] : assertionPurposes,\n              );\n\n              return yield* prepareValue(snapshotPasskeySync(PasskeyCleanupResult, value), prepare);\n            }),\n          ),\n      },\n      inputs,\n      execute,\n    );\n\n  const credentialService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyCredentials[\"Service\"] =>\n    capturedService<PasskeyCredentials[\"Service\"]>(\n      {\n        lookup: (input) =>\n          execute.run(lookupCredential(mapping, input.rpId, input.protocolCredentialId), false),\n      },\n      { lookup: lookupInput },\n      execute,\n    );\n\n  const enrollmentService = (\n    mapping: any,\n    execute: PasskeyExecution,\n  ): PasskeyEnrollmentContext[\"Service\"] =>\n    capturedService<PasskeyEnrollmentContext[\"Service\"]>(\n      {\n        capture: (input) =>\n          execute.run(\n            Effect.map(captureEnrollmentContext(mapping, input), (value) =>\n              value === undefined\n                ? undefined\n                : snapshotPasskeySync(PasskeyEnrollmentSnapshot, value),\n            ),\n            false,\n          ),\n      },\n      { capture: contextInput },\n      execute,\n    );\n\n  const registrationServices = (\n    mapping: any,\n    execute: PasskeyExecution,\n    configuration: PasskeyTargetConfiguration,\n  ): PasskeyRegistrationCeremonyServices => ({\n    capabilities: Object.freeze({\n      purposes: Object.freeze([\"registration\"] as const),\n      issue: \"registration-authority\",\n      assertionSettlement: false,\n    }),\n    passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true),\n  });\n\n  const capturedMapping = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    kind: \"read\" | \"context\" | \"assertion\" | \"registration\",\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<M, PasskeyConfigurationError | PersistenceMappingError, RSetup> =>\n    Effect.flatMap(Effect.isEffect(source) ? source : Effect.succeed(source), (mapping) =>\n      Effect.try({\n        try: () => {\n          const captured = captureMapping(mapping);\n\n          validateMapping(captured, kind);\n          if (configuration.mode === \"batch\") invariant((captured as any).d1?.primary === true);\n\n          return captured;\n        },\n        catch: () => PasskeyConfigurationError.make({}),\n      }),\n    );\n\n  const makeTargetPasskeyCredentials = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyCredentialServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | NativeDatabase | Crypto.Crypto\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"read\", configuration);\n\n      const execution = yield* makePasskeyExecution(configuration, mapping).pipe(\n        Effect.provideService(LifecycleHooks, emptyHooks),\n      );\n\n      return { passkeyCredentials: credentialService(mapping, execution) };\n    });\n\n  const makeTargetPasskeyEnrollmentContext = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyEnrollmentContextServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | NativeDatabase | Crypto.Crypto\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"context\", configuration);\n\n      const execution = yield* makePasskeyExecution(configuration, mapping).pipe(\n        Effect.provideService(LifecycleHooks, emptyHooks),\n      );\n\n      return { passkeyEnrollmentContext: enrollmentService(mapping, execution) };\n    });\n\n  const makeTargetPasskeyPersistence = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyPersistenceServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"assertion\", configuration);\n      const execution = yield* makePasskeyExecution(configuration, mapping);\n\n      return {\n        passkeyPersistence: makePasskeyPersistence(mapping, execution, configuration),\n      };\n    });\n\n  const makeTargetPasskeyRegistration = <M, RSetup>(\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n  ): Effect.Effect<\n    PasskeyRegistrationCeremonyServices,\n    PasskeyConfigurationError | PersistenceMappingError,\n    RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto\n  > =>\n    Effect.gen(function* () {\n      const mapping = yield* capturedMapping(source, \"registration\", configuration);\n      const execution = yield* makePasskeyExecution(configuration, mapping);\n\n      return registrationServices(mapping, execution, configuration);\n    });\n\n  const coordinateTargetPasskey = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: PasskeyPersistenceServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E>,\n    R | RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto\n  > =>\n    Effect.flatMap(capturedMapping(source, \"assertion\", configuration), (mapping) =>\n      Effect.flatMap(LifecycleHooks, (hooks) =>\n        coordinateTransactionOwner(\n          database,\n          CurrentPasskeyTransaction,\n          configuration,\n          operations.validateStorage?.(mapping) ?? Effect.void,\n          unavailable,\n          nonce,\n          (execution) => ({\n            passkeyPersistence: makePasskeyPersistence(\n              mapping,\n              {\n                ...execution,\n                run: (operation, mutation) =>\n                  execution\n                    .run(operation, mutation)\n                    .pipe(Effect.provideService(LifecycleHooks, hooks)),\n              },\n              configuration,\n            ),\n          }),\n          owner,\n        ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      ),\n    );\n\n  const coordinateTargetPasskeyRegistration = <M, RSetup, Transaction, A, E, R>(\n    database: any,\n    source: PasskeyMappingSource<M, RSetup>,\n    configuration: PasskeyTargetConfiguration,\n    owner: (\n      transaction: Transaction,\n      services: PasskeyRegistrationCeremonyServices,\n      append: (statement: Statement<unknown>) => void,\n    ) => Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E>,\n    R | RSetup | LifecycleHooks | NativeDatabase | Crypto.Crypto\n  > =>\n    Effect.flatMap(capturedMapping(source, \"registration\", configuration), (mapping) =>\n      Effect.flatMap(LifecycleHooks, (hooks) =>\n        coordinateTransactionOwner(\n          database,\n          CurrentPasskeyTransaction,\n          configuration,\n          operations.validateStorage?.(mapping) ?? Effect.void,\n          unavailable,\n          nonce,\n          (execution) =>\n            registrationServices(\n              mapping,\n              {\n                ...execution,\n                run: (operation, mutation) =>\n                  execution\n                    .run(operation, mutation)\n                    .pipe(Effect.provideService(LifecycleHooks, hooks)),\n              },\n              configuration,\n            ),\n          owner,\n        ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n      ),\n    );\n\n  return {\n    sqlClientPasskeyStandaloneGuard,\n    makePasskeyExecution,\n    capturedService,\n    prepareValue,\n    observationalContext,\n    makePasskeyPersistence,\n    capturedMapping,\n    makeTargetPasskeyCredentials,\n    makeTargetPasskeyEnrollmentContext,\n    makeTargetPasskeyPersistence,\n    makeTargetPasskeyRegistration,\n    coordinateTargetPasskey,\n    coordinateTargetPasskeyRegistration,\n  };\n};\n"],"mappings":";;;;;;AAkEA,MAAa,2BACX,aAIA,MASA,sBAIA,OAIA,WAMA,eACG;CACH,MAAM,EAAE,0BAA0B,qBAAqB;CAEvD,MAAM,EACJ,mBACA,gBACA,mBACA,kBACA,gBACA,oBACE;CAEJ,MAAM,EAAE,mBAAmB,qBAAqB,uBAAuB;CACvE,MAAM,EAAE,gBAAgB,OAAO,aAAa,oBAAoB;CAChE,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,4BACA,0BACA,wCACE;CAEJ,MAAM,mCACJ,uBACG,oCAAoC,aAAa,kBAAkB;CAExE,MAAM,aAAwC;EAC5C,cAAc,OAAO;EACrB,aAAa,OAAO,QAAQ,CAAC,CAAC;CAChC;CAEA,MAAM,uBAAuB,OAAO,WAAW,WAC7C,eACA,SAKA;EACA,MAAM,QAAQ,OAAO;EAErB,QAAQ,WAAW,kBAAkB,OAAO,KAAK,OAAO,KAAA,CAAM,KAC5D,OAAO,eAAe,0BAA0B,KAAK,CAAC,CAAC,CAAC,CAC1D;EAEA,MAAM,YAAY,OAAO,yBACvB,2BACA,eACA,aACA,KACF;EAEA,OAAO;GACL,GAAG;GACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;EACxF;CACF,CAAC;CAED,MAAM,aAAa,OAAO,OAAO;EAAE,UAAU;EAAiB,QAAQ;CAAoB,CAAC;CAE3F,MAAM,aAAa,OAAO,OAAO;EAC/B,QAAQ;EACR,QAAQ;EACR,UAAU;EACV,SAAS,aAAa,OAAO;EAC7B,YAAY,OAAO,YAAY,iBAAiB;CAClD,CAAC;CAED,MAAM,cAAc,OAAO,OAAO;EAChC,OAAO;EACP,WAAW;EACX,SAAS,OAAO,MAAM;GACpB,OAAO,aAAa,YAAY,CAAC,CAAC;GAClC,OAAO,aAAa,aAAa,CAAC,CAAC;GACnC,OAAO,aAAa,aAAa;IAC/B,YAAY;IACZ,WAAW;IACX,UAAU;GACZ,CAAC;EACH,CAAC;CACH,CAAC;CAED,MAAM,eAAe,OAAO,OAAO;EACjC,UAAU;EACV,WAAW;EACX,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAK,CAAC,CAAC;CACzE,CAAC;CAED,MAAM,cAAc,OAAO,OAAO;EAChC,MAAM,eAAe,OAAO;EAC5B,sBAAsB;CACxB,CAAC;CAED,MAAM,eAAe,OAAO,OAAO;EACjC,UAAU;EACV,MAAM,eAAe,OAAO;EAC5B,WAAW;CACb,CAAC;CAED,MAAM,SAAS;EACb,OAAO;EACP,SAAS;EACT,OAAO;EACP,QAAQ;EACR,SAAS;CACX;CAEA,MAAM,mBACJ,SACA,SACA,YAEA,OAAO,OACL,OAAO,YACL,OAAO,QACL,OACF,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CACxB,OACC,UAAe,YACd,OAAO,cAAc;EACnB,UAAU,QAAQ,OAAO,CAAC;EAG1B,OAAO,OAFO,oBAAoB,QAAQ,OAAQ,QAEhC,GAAG,OAAO;CAC9B,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;EAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;CAC9C,CAAC,CACH,GACA,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD,CACJ,CAAC,CACH,CACF;CAEF,MAAM,gBACJ,OACA,YAEA,OAAO,QAAQ,4BAA4B,UACzC,OAAO,WAAW;EAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;EAClD,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO;EAE5C,UACE,YAAY,QACV,OAAO,YAAY,YACnB,QAAQ,SAAS,oBACjB,OAAO,QAAQ,SAAS,YACxB,OAAO,SAAS,QAAQ,IAAI,CAChC;EACA,MAAM,OAAO,KAAK,OAAO;EAEzB,OAAO;CACT,CAAC,CACH;CAEF,MAAM,kBAAkB,SAAiB,cAAuB,aAAa,UAC3E,UACE,aACI,YAAY,eACZ,eACE,YAAY,iBACZ,kBAAkB,MAAM,cAAc,cAAc,OAAO,CACnE;;;CAIF,MAAM,wBAAiC,cACrC,OAAO,QAAQ,4BAA4B,UACzC,UAAU,KACR,OAAO,eAAe,2BAA2B;EAC/C,GAAG;EACH,OAAO,OAAO,OAAO,YAAY,MAAM,KAAK,OAAO,OAAO;GAAE,GAAG;GAAS,MAAM;EAAM,CAAC;CACvF,CAAC,CACH,CACF;CAEF,MAAM,0BACJ,SACA,SACA,eACA,eAAe,OACf,aAAa,UAEb,gBACE;EACE,QAAQ,OAAO,YACb,OAAO,cAAc;GACnB,UAAU,CAAC,gBAAgB,CAAC,UAAU;GACtC,eAAe,MAAM,SAAS,SAAS,KAAK;GAE5C,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,MAAM;IAEzE,OAAO,OAAO,aACZ,oBAAoB,sBAAsB,KAAK,GAC/C,OACF;GACF,CAAC,CACH;EACF,CAAC;EACH,UAAU,WACR,OAAO,cAAc;GACnB,eAAe,OAAO,SAAS,cAAc,UAAU;GAEvD,OAAO,QAAQ,IACb,qBACE,eACI,oBAAoB,SAAS,MAAM,IACnC,iBAAiB,SAAS,MAAM,CACtC,GACA,KACF;EACF,CAAC;EACH,QAAQ,OAAO,YACb,OAAO,cAAc;GACnB,eAAe,MAAM,OAAO,SAAS,cAAc,UAAU;GAC7D,eAAe,MAAM,SAAS,SAAS,cAAc,UAAU;GAC/D,UAAW,CAAC,gBAAgB,CAAC,cAAe,MAAM,eAAe,KAAA,CAAS;GAE1E,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eACjB,kBAAkB,SAAS,KAAK,IAChC,eAAe,SAAS,KAAK;IAEjC,OAAO,OAAO,aACZ,oBAAoB,sBAAsB,KAAK,GAC/C,OACF;GACF,CAAC,CACH;EACF,CAAC;EACH,SAAS,OAAO,YACd,OAAO,cAAc;GACnB,eAAe,MAAM,MAAM,SAAS,SAAS,cAAc,UAAU;GACrE,UAAW,CAAC,gBAAgB,CAAC,cAAe,MAAM,QAAQ,SAAS,WAAW;GAE9E,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,OAAO,eACjB,mBACE,SACA,MAAM,OACN,MAAM,QAAQ,IAChB,IACA,gBAAgB,SAAS,MAAM,OAAO,MAAM,SAAS,cAAc,OAAO;IAE9E,OAAO,OAAO,aAAa,oBAAoB,mBAAmB,KAAK,GAAG,OAAO;GACnF,CAAC,CACH;EACF,CAAC;EACH,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,kBACnB,SACA,OACA,eAAe,CAAC,cAAc,IAAI,aAAa,CAAC,YAAY,IAAI,iBAClE;GAEA,OAAO,OAAO,aAAa,oBAAoB,sBAAsB,KAAK,GAAG,OAAO;EACtF,CAAC,CACH;CACJ,GACA,QACA,OACF;CAEF,MAAM,qBACJ,SACA,YAEA,gBACE,EACE,SAAS,UACP,QAAQ,IAAI,iBAAiB,SAAS,MAAM,MAAM,MAAM,oBAAoB,GAAG,KAAK,EACxF,GACA,EAAE,QAAQ,YAAY,GACtB,OACF;CAEF,MAAM,qBACJ,SACA,YAEA,gBACE,EACE,UAAU,UACR,QAAQ,IACN,OAAO,IAAI,yBAAyB,SAAS,KAAK,IAAI,UACpD,UAAU,KAAA,IACN,KAAA,IACA,oBAAoB,2BAA2B,KAAK,CAC1D,GACA,KACF,EACJ,GACA,EAAE,SAAS,aAAa,GACxB,OACF;CAEF,MAAM,wBACJ,SACA,SACA,mBACyC;EACzC,cAAc,OAAO,OAAO;GAC1B,UAAU,OAAO,OAAO,CAAC,cAAc,CAAU;GACjD,OAAO;GACP,qBAAqB;EACvB,CAAC;EACD,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,IAAI;CAClF;CAEA,MAAM,mBACJ,QACA,MACA,kBAEA,OAAO,QAAQ,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM,IAAI,YACzE,OAAO,IAAI;EACT,WAAW;GACT,MAAM,WAAW,eAAe,OAAO;GAEvC,gBAAgB,UAAU,IAAI;GAC9B,IAAI,cAAc,SAAS,SAAS,UAAW,SAAiB,IAAI,YAAY,IAAI;GAEpF,OAAO;EACT;EACA,aAAa,0BAA0B,KAAK,CAAC,CAAC;CAChD,CAAC,CACH;CAEF,MAAM,gCACJ,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,QAAQ,aAAa;EAEpE,MAAM,YAAY,OAAO,qBAAqB,eAAe,OAAO,CAAC,CAAC,KACpE,OAAO,eAAe,gBAAgB,UAAU,CAClD;EAEA,OAAO,EAAE,oBAAoB,kBAAkB,SAAS,SAAS,EAAE;CACrE,CAAC;CAEH,MAAM,sCACJ,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,WAAW,aAAa;EAEvE,MAAM,YAAY,OAAO,qBAAqB,eAAe,OAAO,CAAC,CAAC,KACpE,OAAO,eAAe,gBAAgB,UAAU,CAClD;EAEA,OAAO,EAAE,0BAA0B,kBAAkB,SAAS,SAAS,EAAE;CAC3E,CAAC;CAEH,MAAM,gCACJ,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,aAAa,aAAa;EACzE,MAAM,YAAY,OAAO,qBAAqB,eAAe,OAAO;EAEpE,OAAO,EACL,oBAAoB,uBAAuB,SAAS,WAAW,aAAa,EAC9E;CACF,CAAC;CAEH,MAAM,iCACJ,QACA,kBAMA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,gBAAgB,aAAa;EAC5E,MAAM,YAAY,OAAO,qBAAqB,eAAe,OAAO;EAEpE,OAAO,qBAAqB,SAAS,WAAW,aAAa;CAC/D,CAAC;CAEH,MAAM,2BACJ,UACA,QACA,eACA,UAUA,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,aAAa,IAAI,YACnE,OAAO,QAAQ,iBAAiB,UAC9B,2BACE,UACA,2BACA,eACA,WAAW,kBAAkB,OAAO,KAAK,OAAO,MAChD,aACA,QACC,eAAe,EACd,oBAAoB,uBAClB,SACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,UACG,IAAI,WAAW,QAAQ,CAAC,CACxB,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxD,GACA,aACF,EACF,IACA,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD,CACF;CAEF,MAAM,uCACJ,UACA,QACA,eACA,UAUA,OAAO,QAAQ,gBAAgB,QAAQ,gBAAgB,aAAa,IAAI,YACtE,OAAO,QAAQ,iBAAiB,UAC9B,2BACE,UACA,2BACA,eACA,WAAW,kBAAkB,OAAO,KAAK,OAAO,MAChD,aACA,QACC,cACC,qBACE,SACA;EACE,GAAG;EACH,MAAM,WAAW,aACf,UACG,IAAI,WAAW,QAAQ,CAAC,CACxB,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxD,GACA,aACF,GACF,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD,CACF;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/internal/passkey/write-state.d.mts

@@ -1,17 +0,0 @@
-import "../mapping-error.mjs";
-import "../transaction-kernel.mjs";
-import "../query-operations.mjs";
-import "./state.mjs";
-import { DateTime, Effect, Schema } from "effect";
-import { PasskeyActionAuthorization, PasskeyCeremony, PasskeyCredential, PasskeyManagementPolicy, PasskeyRevision } from "@yielded/auth/Passkey";
-import { SubjectId } from "@yielded/auth/Schema";
-import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
-//#region src/internal/passkey/write-state.d.ts
-export interface WriteSubject {
-  readonly subjectId: SubjectId;
-  readonly nativeId: any;
-  readonly row: Record<string, any>;
-  readonly revision: typeof PasskeyRevision.Type;
-}
-//#endregion
-//# sourceMappingURL=write-state.d.mts.map

package/dist/internal/passkey/write-state.mjs

@@ -1,354 +0,0 @@
-import { digest } from "../crypto.mjs";
-import { CurrentPasskeyTransaction } from "./state.mjs";
-import { DateTime, Effect, Schema } from "effect";
-import { PasskeyBegin, PasskeyCredential, PasskeyCredentialSummary, PasskeyDescriptor, PasskeyLabel, PasskeyManagementPolicy, PasskeyModuleId, PasskeyProfile, PasskeyRequirement, PasskeyRevision, PasskeyUserHandle, snapshotPasskeySync } from "@yielded/auth/Passkey";
-import "@yielded/auth/Schema";
-import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
-//#region src/internal/passkey/write-state.ts
-const makePasskeyWriteStateKernel = (operations, state, transactions) => {
-	const { sql } = operations;
-	const { col, copiedRow, credentialKey, equal, handleKey, mappedColumns, sameCredential, sameRevision, subjectScope } = state;
-	const invariant = state.invariant;
-	const { both } = transactions;
-	const jsonStorage = (schema) => {
-		const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));
-		return {
-			encode: (value) => Schema.encodeSync(codec)(snapshotPasskeySync(schema, value)),
-			decode: (text) => {
-				return Schema.decodeUnknownSync(codec)(text);
-			}
-		};
-	};
-	const digest$1 = (schema, value) => digest(jsonStorage(schema).encode(value));
-	const currentSubject = Effect.fn("passkey.currentWriteSubject")(function* (mapping, subjectId) {
-		const owner = yield* CurrentPasskeyTransaction;
-		const read = mapping.read;
-		const table = read.subject;
-		const nativeId = read.subjectIds.toNative(subjectId);
-		invariant(read.subjectIds.toSubject(nativeId) === subjectId);
-		const row = (yield* owner.read(table.table, equal(table.table, { [table.id]: nativeId }), {
-			limit: 1,
-			columns: [.../* @__PURE__ */ new Set([
-				table.id,
-				table.status,
-				table.securityRevision,
-				...mapping.write.policy.subjectColumns
-			])]
-		})).rows[0];
-		if (row === void 0 || !table.isActiveStatus(row[table.status])) return void 0;
-		invariant(read.subjectIds.equals(table.decodeId(copiedRow(row)), nativeId));
-		const active = sql`exists(select 1 from ${table.table} where ${both(equal(table.table, { [table.id]: nativeId }), table.activeCondition)})`;
-		if (!(yield* owner.check(active))) return void 0;
-		owner.postconditions.push(active);
-		const factor = read.authority;
-		const factors = (yield* owner.read(factor.table, both(equal(factor.table, { [factor.subjectId]: nativeId }), factor.activeCondition), {
-			limit: 64,
-			columns: mappedColumns(factor),
-			orderBy: col(factor.table, factor.credentialId)
-		})).rows;
-		const revision = snapshotPasskeySync(PasskeyRevision, {
-			subjectId,
-			securityRevision: row[table.securityRevision],
-			credentials: factors.map((value) => ({
-				credentialId: value[factor.credentialId],
-				revision: value[factor.revision]
-			}))
-		});
-		invariant(new Set(revision.credentials.map((item) => item.credentialId)).size === revision.credentials.length);
-		return {
-			subjectId,
-			nativeId,
-			row,
-			revision
-		};
-	});
-	const credentialRows = Effect.fn("passkey.writeCredentialRows")(function* (mapping, subject, rpId) {
-		const owner = yield* CurrentPasskeyTransaction;
-		const table = mapping.read.credential;
-		return (yield* owner.read(table.table, both(equal(table.table, { [table.subjectId]: subject.nativeId }), table.activeCondition, rpId === void 0 ? void 0 : equal(table.table, { [table.rpId]: rpId })), {
-			limit: 64,
-			orderBy: col(table.table, table.credentialId)
-		})).rows;
-	});
-	const summary = (mapping, row) => {
-		const table = mapping.read.credential;
-		const write = mapping.write.credential;
-		const decoded = table.decode(copiedRow(row));
-		return snapshotPasskeySync(PasskeyCredentialSummary, {
-			credentialId: decoded.credentialId,
-			name: row[write.name],
-			primarySignIn: decoded.primarySignIn,
-			createdAtMillis: mapping.clock.decodeInstant(row[write.createdAt]),
-			...row[mapping.telemetry.lastUsedAt] === null || row[mapping.telemetry.lastUsedAt] === void 0 ? {} : { lastUsedAtMillis: mapping.clock.decodeInstant(row[mapping.telemetry.lastUsedAt]) }
-		});
-	};
-	const ownedCredential = Effect.fn("passkey.ownedWriteCredential")(function* (mapping, subject, row) {
-		const owner = yield* CurrentPasskeyTransaction;
-		const read = mapping.read;
-		const table = read.credential;
-		const decoded = snapshotPasskeySync(PasskeyCredential, {
-			...table.decode(copiedRow(row)),
-			revision: subject.revision,
-			active: true
-		});
-		invariant(decoded.credentialId === row[table.credentialId] && decoded.profile.rpId === decoded.rpId && read.subjectIds.equals(table.decodeSubjectId(copiedRow(row)), subject.nativeId));
-		const ownership = read.credentialOwnership;
-		const key = yield* credentialKey(decoded.rpId, decoded.protocolCredentialId);
-		const tuple = (yield* owner.read(ownership.table, equal(ownership.table, { [ownership.credentialKey]: key }), {
-			limit: 1,
-			columns: mappedColumns(ownership)
-		})).rows[0];
-		if (tuple === void 0 || !ownership.isOwnedState(tuple[ownership.state]) || !read.subjectIds.equals(ownership.decodeSubjectId(copiedRow(tuple)), subject.nativeId)) return void 0;
-		invariant(tuple[ownership.rpId] === decoded.rpId && tuple[ownership.protocolCredentialId] === decoded.protocolCredentialId && tuple[ownership.credentialId] === decoded.credentialId && row[table.credentialKey] === key);
-		const handle = read.handleOwnership;
-		const hashedHandle = yield* handleKey(decoded.rpId, decoded.userHandle);
-		const held = (yield* owner.read(handle.table, equal(handle.table, { [handle.handleKey]: hashedHandle }), {
-			limit: 1,
-			columns: mappedColumns(handle)
-		})).rows[0];
-		if (held === void 0 || !handle.isOwnedState(held[handle.state]) || !read.subjectIds.equals(handle.decodeSubjectId(copiedRow(held)), subject.nativeId)) return void 0;
-		invariant(held[handle.rpId] === decoded.rpId && held[handle.userHandle] === decoded.userHandle && row[table.handleKey] === hashedHandle);
-		invariant(subject.revision.credentials.some((item) => item.credentialId === decoded.credentialId && item.revision === row[table.credentialRevision]));
-		return decoded;
-	});
-	const managementPolicy = (mapping, subject) => snapshotPasskeySync(PasskeyManagementPolicy, mapping.write.policy.management(copiedRow(subject.row)));
-	const metadataAllowed = Effect.fn("passkey.metadataAllowed")(function* (mapping, subject) {
-		const owner = yield* CurrentPasskeyTransaction;
-		const condition = mapping.write.policy.metadata(subject.nativeId);
-		const allowed = yield* owner.check(condition);
-		if (allowed) owner.postconditions.push(condition);
-		return allowed;
-	});
-	const enrollmentDigest = (ceremony) => {
-		invariant(ceremony.context._tag === "Enrollment");
-		const context = ceremony.context;
-		return digest$1(Schema.Tuple([
-			PasskeyModuleId,
-			Schema.Literal("enrollment"),
-			Schema.Struct({
-				...PasskeyBegin.fields,
-				name: PasskeyLabel
-			}),
-			PasskeyProfile,
-			PasskeyRevision,
-			PasskeyUserHandle,
-			Schema.Array(PasskeyDescriptor)
-		]), [
-			ceremony.moduleId,
-			"enrollment",
-			{
-				flowId: ceremony.flowId,
-				commandId: ceremony.commandId,
-				profileId: ceremony.profile.profileId,
-				name: context.name
-			},
-			ceremony.profile,
-			context.revision,
-			context.userHandle,
-			ceremony.allowedCredentials
-		]);
-	};
-	const removeDigest = (moduleId, commandId, credential) => digest$1(Schema.Tuple([
-		PasskeyModuleId,
-		Schema.Literal("remove"),
-		PasskeyBegin.fields.commandId,
-		PasskeyCredential
-	]), [
-		PasskeyModuleId.make(moduleId),
-		"remove",
-		PasskeyBegin.fields.commandId.make(commandId),
-		credential
-	]);
-	const authorizeAction = Effect.fn("passkey.authorizeWriteAction")(function* (mapping, subject, authorization, expected, policy, original) {
-		const owner = yield* CurrentPasskeyTransaction;
-		const { challenge, evidence } = authorization;
-		if (challenge.moduleId !== mapping.moduleId || challenge.action !== expected.action || challenge.commandId !== expected.commandId || challenge.flowId !== expected.flowId || challenge.bindingDigest !== expected.bindingDigest || evidence.flowId !== expected.flowId || evidence.bindingDigest !== expected.bindingDigest || !sameRevision(challenge.revision, expected.revision) || subject.revision.subjectId !== expected.revision.subjectId || subject.revision.securityRevision !== expected.revision.securityRevision || evidence.revision.subjectId !== subject.subjectId || evidence.revision.securityRevision !== subject.revision.securityRevision) return false;
-		for (const revision of [expected.revision, evidence.revision]) if (revision.credentials.some((item) => !subject.revision.credentials.some((current) => current.credentialId === item.credentialId && current.revision === item.revision))) return false;
-		const now = yield* owner.now(mapping.clock);
-		if (evidence.proofs.some((proof) => DateTime.toEpochMillis(proof.verifiedAt) > now || !evidence.revision.credentials.some((item) => item.credentialId === proof.credentialId))) return false;
-		const currentRequirement = mapping.write.policy.requirement(copiedRow(subject.row), expected.action);
-		const current = snapshotPasskeySync(PasskeyRequirement, yield* currentRequirement);
-		for (const requirement of [
-			authorization.requirement,
-			current,
-			...original === void 0 ? [] : [original]
-		]) {
-			const age = Math.min(policy.maximumEvidenceAgeMillis, requirement.maximumAgeMillis);
-			const fresh = evidence.proofs.filter((proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age);
-			const factors = new Set(fresh.flatMap((proof) => proof.factors));
-			if (!requirement.alternatives.some((alternative) => alternative.factors.every((factor) => factors.has(factor)) && new Set(fresh.map((proof) => proof.credentialId)).size >= alternative.minimumCredentials && fresh.some((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)))) return false;
-			owner.postconditions.push(both(sql`${mapping.clock.engineNowMillis} >= ${now}`, ...fresh.map((proof) => sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`)));
-		}
-		const condition = mapping.write.policy.action(subject.nativeId, authorization);
-		if (!(yield* owner.check(condition))) return false;
-		owner.postconditions.push(condition);
-		return true;
-	});
-	const invalidationMatches = (mapping, supplied, policy) => {
-		if (supplied.existingSessions === "cache-expiry" && supplied.maximumExposureMillis === 0) return false;
-		const authoritative = supplied.existingSessions === "cache-expiry" && mapping.invalidation.window.existingSessions === "immediate" ? {
-			...supplied,
-			existingSessions: "immediate",
-			maximumExposureMillis: 0
-		} : supplied;
-		return jsonStorage(SessionInvalidationWindow).encode(authoritative) === jsonStorage(SessionInvalidationWindow).encode(mapping.invalidation.window) && (!policy.requireImmediateInvalidation || supplied.existingSessions === "immediate");
-	};
-	const invalidate = Effect.fn("passkey.invalidateCredentialChange")(function* (mapping, subject, invalidation) {
-		const owner = yield* CurrentPasskeyTransaction;
-		const table = mapping.read.subject;
-		const revision = PasskeyRevision.fields.securityRevision.make(owner.marker);
-		yield* owner.update(table.table, { [table.id]: subject.nativeId }, { [table.securityRevision]: revision });
-		const input = {
-			subjectId: subject.nativeId,
-			previousRevision: subject.revision.securityRevision,
-			securityRevision: revision,
-			invalidation
-		};
-		for (const mutation of mapping.invalidation.mutations) {
-			yield* owner.write(owner.database.update(mutation.table).set(mutation.values(input)).where(mutation.where(input)));
-			owner.postconditions.push(mutation.postcondition(input));
-		}
-		owner.postconditions.push(mapping.invalidation.postcondition(input));
-		const flow = mapping.flow;
-		const scope = yield* subjectScope(subject.subjectId);
-		const where = both(equal(flow.table, { [flow.subjectScope]: scope }), sql`${col(flow.table, flow.state)} in (${flow.states.Pending}, ${flow.states.Claimed})`);
-		yield* owner.write(owner.database.update(flow.table).set({
-			[flow.state]: flow.states.Rejected,
-			[flow.version]: owner.marker
-		}).where(where));
-		for (const observation of owner.observations) if (observation.table === flow.table) observation.rows = observation.rows.map((row) => row[flow.subjectScope] === scope && [flow.states.Pending, flow.states.Claimed].includes(row[flow.state]) ? {
-			...row,
-			[flow.state]: flow.states.Rejected,
-			[flow.version]: owner.marker
-		} : row);
-		owner.postconditions.push(sql`not exists(select 1 from ${flow.table} where ${where})`);
-		return revision;
-	});
-	const validRegistration = (ceremony, verified) => ceremony.profile.algorithms.some((algorithm) => algorithm === verified.algorithm) && (ceremony.profile.userVerification !== "required" || verified.userVerified) && (!verified.backupState || verified.backupEligible) && !ceremony.allowedCredentials.some((item) => item.id === verified.protocolCredentialId);
-	return {
-		jsonStorage,
-		digest: digest$1,
-		currentSubject,
-		credentialRows,
-		summary,
-		ownedCredential,
-		managementPolicy,
-		metadataAllowed,
-		enrollmentDigest,
-		removeDigest,
-		authorizeAction,
-		invalidationMatches,
-		invalidate,
-		validRegistration,
-		insertCredential: Effect.fn("passkey.insertCredential")(function* (mapping, subject, ceremony, verified, now) {
-			const owner = yield* CurrentPasskeyTransaction;
-			invariant(ceremony.context._tag === "Enrollment" || ceremony.context._tag === "Registration");
-			const read = mapping.read;
-			const write = mapping.write;
-			const id = PasskeyCredential.fields.credentialId.make(owner.marker);
-			const credential = snapshotPasskeySync(PasskeyCredential, {
-				credentialId: id,
-				rpId: ceremony.profile.rpId,
-				protocolCredentialId: verified.protocolCredentialId,
-				userHandle: ceremony.context.userHandle,
-				publicKey: verified.publicKey,
-				algorithm: verified.algorithm,
-				profile: ceremony.profile,
-				revision: {
-					...subject.revision,
-					credentials: [...subject.revision.credentials, {
-						credentialId: id,
-						revision: PasskeyRevision.fields.securityRevision.make(owner.marker)
-					}]
-				},
-				active: true,
-				primarySignIn: ceremony.profile.primarySignIn && verified.userVerified,
-				enrollmentUserVerified: verified.userVerified,
-				backupEligible: verified.backupEligible,
-				backupState: verified.backupState,
-				counter: verified.counter,
-				maximumCounter: verified.counter
-			});
-			const safe = snapshotPasskeySync(PasskeyCredentialSummary, {
-				credentialId: id,
-				name: ceremony.context.name,
-				primarySignIn: credential.primarySignIn,
-				createdAtMillis: now
-			});
-			const input = {
-				subjectId: subject.nativeId,
-				credential,
-				summary: safe,
-				marker: owner.marker
-			};
-			const tupleKey = yield* credentialKey(credential.rpId, credential.protocolCredentialId);
-			const hashedHandle = yield* handleKey(credential.rpId, credential.userHandle);
-			const tuple = read.credentialOwnership;
-			const absent = yield* owner.read(tuple.table, equal(tuple.table, { [tuple.credentialKey]: tupleKey }), { limit: 1 });
-			invariant(absent.rows.length === 0);
-			const inserted = yield* owner.insert(tuple.table, {
-				...write.credentialOwnership.encodeInsert(input),
-				[tuple.credentialKey]: tupleKey,
-				[tuple.rpId]: credential.rpId,
-				[tuple.protocolCredentialId]: credential.protocolCredentialId,
-				[tuple.subjectId]: subject.nativeId,
-				[tuple.credentialId]: id,
-				[tuple.state]: write.credentialOwnership.ownedState,
-				[tuple.version]: owner.marker,
-				[tuple.reservationId]: null
-			}, { [tuple.credentialKey]: tupleKey });
-			absent.rows = inserted.rows;
-			const table = read.credential;
-			const values = {
-				...write.credential.encodeInsert(input),
-				[table.credentialId]: id,
-				[table.subjectId]: subject.nativeId,
-				[table.rpId]: credential.rpId,
-				[table.protocolCredentialId]: credential.protocolCredentialId,
-				[table.credentialKey]: tupleKey,
-				[table.handleKey]: hashedHandle,
-				[table.userHandle]: credential.userHandle,
-				[table.algorithm]: credential.algorithm,
-				[table.credentialRevision]: owner.marker,
-				[table.status]: write.credential.activeStatus,
-				[table.primarySignIn]: write.credential.encodePrimarySignIn(credential.primarySignIn),
-				[table.enrollmentUserVerified]: write.credential.encodeEnrollmentUserVerified(credential.enrollmentUserVerified),
-				[table.backupEligible]: write.credential.encodeBackupEligible(credential.backupEligible),
-				[table.backupState]: mapping.telemetry.encodeBackupState(credential.backupState),
-				[table.counter]: credential.counter,
-				[table.maximumCounter]: credential.maximumCounter,
-				[write.credential.name]: safe.name,
-				[write.credential.createdAt]: mapping.clock.encodeInstant(now),
-				[mapping.telemetry.lastUsedAt]: null
-			};
-			yield* owner.insert(table.table, values, { [table.credentialId]: id });
-			for (const observation of owner.observations) if (observation.table === table.table && observation.rows !== inserted.rows && !observation.rows.some((row) => row[table.credentialId] === id)) observation.rows = [...observation.rows, values];
-			const factor = read.authority;
-			const factorValues = {
-				...write.authority.encodeInsert(input),
-				[factor.subjectId]: subject.nativeId,
-				[factor.credentialId]: id,
-				[factor.revision]: owner.marker,
-				[factor.status]: write.authority.activeStatus
-			};
-			yield* owner.insert(factor.table, factorValues, {
-				[factor.subjectId]: subject.nativeId,
-				[factor.credentialId]: id
-			});
-			for (const observation of owner.observations) if (observation.table === factor.table && !observation.rows.some((row) => row[factor.credentialId] === id)) observation.rows = [...observation.rows, factorValues];
-			const decoded = snapshotPasskeySync(PasskeyCredential, {
-				...table.decode(copiedRow(values)),
-				revision: credential.revision,
-				active: true
-			});
-			invariant(sameCredential(decoded, credential) && decoded.counter === credential.counter && decoded.maximumCounter === credential.maximumCounter && decoded.backupState === credential.backupState);
-			invariant(summary(mapping, values).credentialId === id);
-			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now}`);
-			return safe;
-		})
-	};
-};
-//#endregion
-export { makePasskeyWriteStateKernel };
-
-//# sourceMappingURL=write-state.mjs.map