@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/passkey-kernel.mjs

@@ -1,49 +0,0 @@
-import { makePasskeyStateKernel } from "./passkey/state.mjs";
-import { makePasskeyAdmissionKernel } from "./passkey/admission.mjs";
-import { makePasskeyCredentialsKernel } from "./passkey/credentials.mjs";
-import { makePasskeyEnrollmentKernel } from "./passkey/enrollment.mjs";
-import { makePasskeyFlowKernel } from "./passkey/flow.mjs";
-import { makePasskeyManagementKernel } from "./passkey/management.mjs";
-import { makePasskeyRegistrationCeremonyKernel } from "./passkey/registration-ceremony.mjs";
-import { makePasskeyRegistrationCustodyKernel } from "./passkey/registration-custody.mjs";
-import { makePasskeyRegistrationWriteKernel } from "./passkey/registration-write.mjs";
-import { makePasskeyTargetKernel } from "./passkey/target.mjs";
-import { makePasskeyWriteStateKernel } from "./passkey/write-state.mjs";
-import { makePasskeyWriteTargetKernel } from "./passkey/write-target.mjs";
-import { makeTransactionKernel } from "./transaction-kernel.mjs";
-import { makeTransactionExecutionKernel } from "./transaction-execution-kernel.mjs";
-//#region src/internal/passkey-kernel.ts
-/** One set of passkey state machines, supplied with a SQL compiler and transaction owner. */
-const makePasskeyKernel = (operations) => {
-	const transactions = makeTransactionKernel(operations);
-	const execution = makeTransactionExecutionKernel(transactions);
-	const state = makePasskeyStateKernel(operations, transactions);
-	const credentials = makePasskeyCredentialsKernel(operations, state, transactions);
-	const admission = makePasskeyAdmissionKernel(operations, state, transactions);
-	const registrationCustody = makePasskeyRegistrationCustodyKernel(state);
-	const flow = makePasskeyFlowKernel(operations, admission, credentials, registrationCustody, state, transactions);
-	const registrationCeremony = makePasskeyRegistrationCeremonyKernel(operations, admission, credentials, flow, registrationCustody, state, transactions);
-	const target = makePasskeyTargetKernel(credentials, flow, registrationCeremony, state, execution, operations);
-	const writeState = makePasskeyWriteStateKernel(operations, state, transactions);
-	const enrollment = makePasskeyEnrollmentKernel(operations, admission, credentials, flow, state, writeState, transactions);
-	const management = makePasskeyManagementKernel(operations, admission, credentials, state, writeState, transactions);
-	const registrationWrite = makePasskeyRegistrationWriteKernel(operations, admission, credentials, flow, registrationCustody, state, writeState, transactions);
-	return {
-		state,
-		credentials,
-		admission,
-		registrationCustody,
-		flow,
-		registrationCeremony,
-		target,
-		writeState,
-		enrollment,
-		management,
-		registrationWrite,
-		writeTarget: makePasskeyWriteTargetKernel(operations, enrollment, management, registrationWrite, state, target, execution)
-	};
-};
-//#endregion
-export { makePasskeyKernel };
-
-//# sourceMappingURL=passkey-kernel.mjs.map

package/dist/internal/passkey-kernel.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkey-kernel.mjs","names":[],"sources":["../../src/internal/passkey-kernel.ts"],"sourcesContent":["import { makePasskeyAdmissionKernel } from \"./passkey/admission\";\nimport { makePasskeyCredentialsKernel } from \"./passkey/credentials\";\nimport { makePasskeyEnrollmentKernel } from \"./passkey/enrollment\";\nimport { makePasskeyFlowKernel } from \"./passkey/flow\";\nimport { makePasskeyManagementKernel } from \"./passkey/management\";\nimport { makePasskeyRegistrationCeremonyKernel } from \"./passkey/registration-ceremony\";\nimport { makePasskeyRegistrationCustodyKernel } from \"./passkey/registration-custody\";\nimport { makePasskeyRegistrationWriteKernel } from \"./passkey/registration-write\";\nimport { makePasskeyStateKernel } from \"./passkey/state\";\nimport { makePasskeyTargetKernel } from \"./passkey/target\";\nimport { makePasskeyWriteStateKernel } from \"./passkey/write-state\";\nimport { makePasskeyWriteTargetKernel } from \"./passkey/write-target\";\nimport type { QueryOperations } from \"./query-operations\";\nimport { makeTransactionExecutionKernel } from \"./transaction-execution-kernel\";\nimport { makeTransactionKernel } from \"./transaction-kernel\";\n\nexport type PasskeyKernel = ReturnType<typeof makePasskeyKernel>;\n\n/** One set of passkey state machines, supplied with a SQL compiler and transaction owner. */\nexport const makePasskeyKernel = (operations: QueryOperations) => {\n  const transactions = makeTransactionKernel(operations);\n  const execution = makeTransactionExecutionKernel(transactions);\n  const state = makePasskeyStateKernel(operations, transactions);\n  const credentials = makePasskeyCredentialsKernel(operations, state, transactions);\n  const admission = makePasskeyAdmissionKernel(operations, state, transactions);\n  const registrationCustody = makePasskeyRegistrationCustodyKernel(state);\n\n  const flow = makePasskeyFlowKernel(\n    operations,\n    admission,\n    credentials,\n    registrationCustody,\n    state,\n    transactions,\n  );\n\n  const registrationCeremony = makePasskeyRegistrationCeremonyKernel(\n    operations,\n    admission,\n    credentials,\n    flow,\n    registrationCustody,\n    state,\n    transactions,\n  );\n\n  const target = makePasskeyTargetKernel(\n    credentials,\n    flow,\n    registrationCeremony,\n    state,\n    execution,\n    operations,\n  );\n\n  const writeState = makePasskeyWriteStateKernel(operations, state, transactions);\n\n  const enrollment = makePasskeyEnrollmentKernel(\n    operations,\n    admission,\n    credentials,\n    flow,\n    state,\n    writeState,\n    transactions,\n  );\n\n  const management = makePasskeyManagementKernel(\n    operations,\n    admission,\n    credentials,\n    state,\n    writeState,\n    transactions,\n  );\n\n  const registrationWrite = makePasskeyRegistrationWriteKernel(\n    operations,\n    admission,\n    credentials,\n    flow,\n    registrationCustody,\n    state,\n    writeState,\n    transactions,\n  );\n\n  const writeTarget = makePasskeyWriteTargetKernel(\n    operations,\n    enrollment,\n    management,\n    registrationWrite,\n    state,\n    target,\n    execution,\n  );\n\n  return {\n    state,\n    credentials,\n    admission,\n    registrationCustody,\n    flow,\n    registrationCeremony,\n    target,\n    writeState,\n    enrollment,\n    management,\n    registrationWrite,\n    writeTarget,\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAmBA,MAAa,qBAAqB,eAAgC;CAChE,MAAM,eAAe,sBAAsB,UAAU;CACrD,MAAM,YAAY,+BAA+B,YAAY;CAC7D,MAAM,QAAQ,uBAAuB,YAAY,YAAY;CAC7D,MAAM,cAAc,6BAA6B,YAAY,OAAO,YAAY;CAChF,MAAM,YAAY,2BAA2B,YAAY,OAAO,YAAY;CAC5E,MAAM,sBAAsB,qCAAqC,KAAK;CAEtE,MAAM,OAAO,sBACX,YACA,WACA,aACA,qBACA,OACA,YACF;CAEA,MAAM,uBAAuB,sCAC3B,YACA,WACA,aACA,MACA,qBACA,OACA,YACF;CAEA,MAAM,SAAS,wBACb,aACA,MACA,sBACA,OACA,WACA,UACF;CAEA,MAAM,aAAa,4BAA4B,YAAY,OAAO,YAAY;CAE9E,MAAM,aAAa,4BACjB,YACA,WACA,aACA,MACA,OACA,YACA,YACF;CAEA,MAAM,aAAa,4BACjB,YACA,WACA,aACA,OACA,YACA,YACF;CAEA,MAAM,oBAAoB,mCACxB,YACA,WACA,aACA,MACA,qBACA,OACA,YACA,YACF;CAYA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,aAtBkB,6BAClB,YACA,YACA,YACA,mBACA,OACA,QACA,SAeU;CACZ;AACF"}

package/dist/internal/passkeys.d.mts

@@ -1,7 +0,0 @@
-import { QueryOperations } from "./query-operations.mjs";
-import { Backend } from "./persistence.mjs";
-//#region src/internal/passkeys.d.ts
-/** Share the same passkey algorithms across raw SQL and Drizzle compilers. */
-export declare const makeComposedPasskeys: (operations: QueryOperations) => Backend<object, never>["passkeys"];
-//#endregion
-//# sourceMappingURL=passkeys.d.mts.map

package/dist/internal/passkeys.mjs

@@ -1,387 +0,0 @@
-import { PersistenceConfigurationError } from "./configuration.mjs";
-import { PersistenceMappingError } from "./mapping-error.mjs";
-import { digest } from "./crypto.mjs";
-import { requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "./models/passkey-model.mjs";
-import { requiredPasskeyManagementConstraints } from "./models/passkey-write-model.mjs";
-import { requireStandalone } from "./standalone.mjs";
-import { makePasskeyKernel } from "./passkey-kernel.mjs";
-import { CurrentProofSql } from "./proof-kernel.mjs";
-import { storageTables } from "./storage-tables.mjs";
-import { Context, Effect, Schema } from "effect";
-import { SqlClient } from "effect/sql";
-import { PasskeyCredential, PasskeyCredentials, PasskeyEnrollmentContext, PasskeyManagementPersistence, PasskeyManagementPolicy, PasskeyMethodPolicy, PasskeyPersistence, PasskeyProfile, PasskeyRequirement, PasskeyUnavailable } from "@yielded/auth/Passkey";
-//#region src/internal/passkeys.ts
-const profileJson = Schema.fromJsonString(PasskeyProfile);
-const policyJson = Schema.fromJsonString(PasskeyMethodPolicy);
-const seedJson = Schema.fromJsonString(Schema.Struct({
-	policy: PasskeyMethodPolicy,
-	management: Schema.optionalKey(PasskeyManagementPolicy)
-}));
-const ModuleRow = Schema.Struct({
-	active: Schema.Boolean,
-	policy: Schema.String,
-	policyRevision: Schema.String
-});
-const ConfiguredModuleRow = Schema.Struct({
-	moduleId: Schema.String,
-	active: Schema.Boolean,
-	policyRevision: Schema.String,
-	admitted: Schema.Literals(["present", "missing"])
-});
-const credentialData = PasskeyCredential.mapFields(({ revision: _revision, active: _active, ...fields }) => fields);
-const unavailable = () => PasskeyUnavailable.make({});
-const configurationError = (reason) => PersistenceConfigurationError.make({ reason });
-/** Share the same passkey algorithms across raw SQL and Drizzle compilers. */
-const makeComposedPasskeys = (operations) => {
-	const { and, eq, getTableColumns, inArray, or, sql } = operations;
-	const { target, writeTarget } = makePasskeyKernel(operations);
-	const { makeTargetPasskeyCredentials, makeTargetPasskeyEnrollmentContext, makeTargetPasskeyPersistence } = target;
-	const { makeTargetPasskeyManagement } = writeTarget;
-	const mappings = (storage, namespace, dialect, passwordModules, signInProfiles) => {
-		const table = (role) => {
-			const value = storage.tables[role];
-			if (value === void 0) throw configurationError(`Missing ${role} mapping`);
-			return value;
-		};
-		const mapped = (role) => ({
-			table: table(role),
-			...Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key]))
-		});
-		const column = (role, key) => getTableColumns(table(role))[key];
-		const s = storage.subjects;
-		const subject = s.table;
-		const sc = getTableColumns(subject);
-		const active = (value) => value === true;
-		const owned = (value) => value === "owned";
-		const read = {
-			subject: {
-				table: subject,
-				id: s.id,
-				status: s.status,
-				securityRevision: s.securityRevision,
-				decodeId: (row) => row[s.id],
-				isActiveStatus: (value) => Object.is(value, s.activeValue),
-				activeCondition: eq(sc[s.status], s.activeValue)
-			},
-			credential: {
-				...mapped("passkeyCredentials"),
-				status: "active",
-				decode: (row) => Schema.decodeUnknownSync(credentialData)({
-					...row,
-					profile: Schema.decodeUnknownSync(profileJson)(row.profile)
-				}),
-				decodeSubjectId: (row) => row.subjectId,
-				isActiveStatus: active,
-				activeCondition: eq(column("passkeyCredentials", "active"), true)
-			},
-			authority: {
-				...mapped("credentials"),
-				status: "active",
-				isActiveStatus: active,
-				activeCondition: eq(column("credentials", "active"), true)
-			},
-			credentialOwnership: {
-				...mapped("passkeyOwnership"),
-				isOwnedState: owned,
-				ownedCondition: eq(column("passkeyOwnership", "state"), "owned"),
-				decodeSubjectId: (row) => row.subjectId
-			},
-			handleOwnership: {
-				...mapped("passkeyHandles"),
-				isOwnedState: owned,
-				ownedCondition: eq(column("passkeyHandles", "state"), "owned"),
-				decodeSubjectId: (row) => row.subjectId
-			},
-			subjectIds: {
-				toNative: s.toNativeSync,
-				toSubject: s.toSubjectSync,
-				equals: Object.is
-			},
-			constraints: requiredPasskeyCredentialConstraints
-		};
-		const base = (feature) => ({
-			moduleId: feature.moduleId,
-			authorityScope: namespace,
-			read,
-			module: {
-				...mapped("passkeyModules"),
-				status: "active",
-				policyColumns: ["policy", "policyRevision"],
-				isActiveStatus: active,
-				activeCondition: eq(column("passkeyModules", "active"), true),
-				decodeMethodPolicy: (row) => Schema.decodeUnknownSync(policyJson)(row.policy)
-			},
-			flow: {
-				...mapped("passkeyFlows"),
-				states: {
-					Pending: "Pending",
-					Claimed: "Claimed",
-					Verified: "Verified",
-					Rejected: "Rejected",
-					Ambiguous: "Ambiguous",
-					RegistrationAccepted: "RegistrationAccepted",
-					ProvisioningPending: "ProvisioningPending"
-				},
-				encodeInsert: () => ({})
-			},
-			admission: mapped("passkeyAdmissions"),
-			charge: {
-				...mapped("passkeyCharges"),
-				encodeInsert: () => ({})
-			},
-			clock: {
-				encodeInstant: storage.encodeInstant,
-				decodeInstant: storage.decodeInstantSync,
-				engineNowMillis: dialect === "pg" ? sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)` : sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`,
-				toMillis: (expression) => expression,
-				fromMillis: (expression) => expression
-			},
-			telemetry: {
-				lastUsedAt: "lastUsedAt",
-				encodeBackupState: (value) => value
-			},
-			constraints: requiredPasskeyPersistenceConstraints
-		});
-		const management = (feature) => {
-			const policy = feature.managementPolicy;
-			if (policy === void 0) throw configurationError(`Missing passkey management policy for ${feature.moduleId}`);
-			const c = getTableColumns(table("passkeyCredentials"));
-			const f = getTableColumns(table("credentials"));
-			const metadata = (subjectId) => sql`exists(select 1 from ${subject} where ${sc[s.id]} = ${subjectId} and ${sc[s.status]} = ${s.activeValue})`;
-			return {
-				...base(feature),
-				write: {
-					credential: {
-						name: "name",
-						createdAt: "createdAt",
-						encodeInsert: ({ credential, subjectId, summary, marker }) => ({
-							credentialId: credential.credentialId,
-							subjectId,
-							rpId: credential.rpId,
-							protocolCredentialId: credential.protocolCredentialId,
-							userHandle: credential.userHandle,
-							credentialKey: "",
-							handleKey: "",
-							publicKey: credential.publicKey,
-							algorithm: credential.algorithm,
-							profile: Schema.encodeSync(profileJson)(credential.profile),
-							credentialRevision: marker,
-							active: true,
-							primarySignIn: credential.primarySignIn,
-							enrollmentUserVerified: credential.enrollmentUserVerified,
-							backupEligible: credential.backupEligible,
-							backupState: credential.backupState,
-							counter: credential.counter,
-							maximumCounter: credential.maximumCounter,
-							name: summary.name,
-							createdAt: storage.encodeInstant(summary.createdAtMillis)
-						}),
-						encodePrimarySignIn: (value) => value,
-						encodeEnrollmentUserVerified: (value) => value,
-						encodeBackupEligible: (value) => value,
-						activeStatus: true,
-						removedStatus: false
-					},
-					authority: {
-						encodeInsert: ({ subjectId, credential, marker }) => ({
-							subjectId,
-							credentialId: credential.credentialId,
-							revision: marker,
-							active: true
-						}),
-						activeStatus: true,
-						removedStatus: false
-					},
-					credentialOwnership: {
-						encodeInsert: ({ credential, marker }) => ({
-							credentialKey: "",
-							rpId: credential.rpId,
-							protocolCredentialId: credential.protocolCredentialId,
-							state: "owned",
-							version: marker
-						}),
-						ownedState: "owned",
-						removedState: "removed"
-					},
-					handleOwnership: {
-						encodeInsert: ({ subjectId, rpId, userHandle, marker }) => ({
-							subjectId,
-							rpId,
-							userHandle,
-							handleKey: "",
-							state: "owned",
-							version: marker
-						}),
-						ownedState: "owned"
-					},
-					policy: {
-						subjectColumns: Object.keys(sc),
-						management: () => policy,
-						requirement: s.actionRequirements,
-						metadata,
-						action: metadata,
-						remainingSignIn: (subjectId, excluded, row) => Effect.gen(function* () {
-							const requirement = yield* Schema.decodeEffect(PasskeyRequirement)(yield* s.requirements(row));
-							const alternatives = [];
-							if (requirement.alternatives.some((alternative) => alternative.minimumCredentials === 1 && alternative.factors.every((factor) => factor === "possession"))) {
-								const profiles = signInProfiles.map((profile) => Schema.encodeSync(profileJson)(profile));
-								alternatives.push(sql`exists(
-                  select 1 from ${table("passkeyCredentials")} join ${table("credentials")}
-                  on ${f.credentialId} = ${c.credentialId} and ${f.subjectId} = ${c.subjectId}
-                    and ${f.revision} = ${c.credentialRevision} and ${f.active} = ${true}
-                  where ${c.subjectId} = ${subjectId} and ${c.credentialId} <> ${excluded}
-                    and ${c.active} = ${true} and ${c.primarySignIn} = ${true}
-                    and ${c.enrollmentUserVerified} = ${true} and ${inArray(c.profile, profiles)}
-                )`);
-							}
-							if (passwordModules.length > 0 && requirement.alternatives.some((alternative) => alternative.minimumCredentials === 1 && !alternative.userVerified && !alternative.phishingResistant && alternative.factors.every((factor) => factor === "knowledge"))) {
-								const p = getTableColumns(table("passwords"));
-								const i = getTableColumns(table("identifiers"));
-								alternatives.push(sql`exists(
-                  select 1 from ${table("passwords")} join ${table("credentials")}
-                  on ${f.credentialId} = ${p.credentialId} and ${f.subjectId} = ${p.subjectId}
-                    and ${f.revision} = ${p.credentialRevision} and ${f.active} = ${true}
-                  join ${table("identifiers")} on ${i.subjectId} = ${p.subjectId}
-                    and ${i.active} = ${true} and ${i.namespace} = 'email'
-                  where ${p.subjectId} = ${subjectId} and ${p.credentialId} <> ${excluded}
-                    and ${inArray(p.moduleId, passwordModules)}
-                )`);
-							}
-							return or(...alternatives) ?? sql`false`;
-						}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
-							operation: "mapping",
-							cause
-						})))
-					}
-				},
-				command: {
-					...mapped("passkeyCommands"),
-					encodeInsert: (input) => ({ ...input })
-				},
-				managementConstraints: requiredPasskeyManagementConstraints,
-				invalidation: {
-					window: {
-						trigger: "credential-change",
-						existingSessions: "immediate",
-						maximumExposureMillis: 0,
-						oldAuthenticationEvidence: "rejected"
-					},
-					mutations: [],
-					postcondition: ({ subjectId, securityRevision }) => sql`exists(select 1 from ${subject} where ${sc[s.id]} = ${subjectId} and ${sc[s.securityRevision]} = ${securityRevision})`
-				}
-			};
-		};
-		return {
-			read,
-			base,
-			management,
-			table
-		};
-	};
-	return Effect.fn("AuthPersistence.passkeys")(function* ({ storage, namespace, dialect, features, passwordModules }) {
-		const client = yield* SqlClient.SqlClient;
-		const policies = yield* Effect.forEach(features, (feature) => Effect.gen(function* () {
-			const policy = yield* feature.policy;
-			return {
-				feature,
-				policy,
-				encoded: yield* Schema.encodeEffect(policyJson)(policy),
-				policyRevision: yield* digest(yield* Schema.encodeEffect(seedJson)({
-					policy,
-					...feature.managementPolicy === void 0 ? {} : { management: feature.managementPolicy }
-				}))
-			};
-		}));
-		const m = yield* Effect.try({
-			try: () => mappings(storage, namespace, dialect, passwordModules, policies.flatMap(({ feature, policy }) => feature.management ? [] : policy.profiles)),
-			catch: () => configurationError("Invalid passkey table mappings")
-		});
-		const configuration = {
-			mode: "interactive",
-			dialect,
-			locking: dialect === "pg",
-			standaloneGuard: () => requireStandalone(unavailable, client.transactionService)
-		};
-		const native = yield* CurrentProofSql;
-		const module = m.table("passkeyModules");
-		const columns = getTableColumns(module);
-		const admission = m.table("passkeyAdmissions");
-		const ac = getTableColumns(admission);
-		if (!(yield* native.select({
-			moduleId: columns.moduleId,
-			active: columns.active,
-			policyRevision: columns.policyRevision,
-			admitted: sql`case when exists(select 1 from ${admission}
-            where ${and(eq(ac.authorityScope, namespace), eq(ac.moduleId, columns.moduleId))})
-              then 'present' else 'missing' end`
-		}).from(module).where(inArray(columns.moduleId, policies.map(({ feature }) => feature.moduleId))).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(ConfiguredModuleRow))), Effect.map((rows) => policies.every(({ feature, policyRevision }) => rows.some((row) => row.moduleId === feature.moduleId && row.active && row.admitted === "present" && row.policyRevision === policyRevision)))))) yield* client.withTransaction(Effect.gen(function* () {
-			if (dialect === "pg") yield* client`select pg_advisory_xact_lock(hashtext(${`${namespace}/passkeys`}))`;
-			for (const { feature, policy, encoded, policyRevision } of policies) {
-				yield* native.insert(module).values({
-					moduleId: feature.moduleId,
-					active: true,
-					policy: encoded,
-					policyRevision
-				}).onConflictDoNothing();
-				const rows = yield* native.select().from(module).where(eq(columns.moduleId, feature.moduleId));
-				const row = yield* Schema.decodeUnknownEffect(ModuleRow)(rows[0]);
-				if (!row.active) return yield* configurationError(`Passkey module ${feature.moduleId} is disabled`);
-				if (row.policyRevision !== policyRevision) {
-					const previous = yield* Schema.decodeEffect(policyJson)(row.policy);
-					if (policy.generation <= previous.generation) return yield* configurationError(`Increase the passkey policy generation to change ${feature.moduleId}`);
-					yield* native.update(module).set({
-						policy: encoded,
-						policyRevision
-					}).where(and(eq(columns.moduleId, feature.moduleId), eq(columns.policyRevision, row.policyRevision), eq(columns.active, true)));
-					const updated = yield* native.select().from(module).where(eq(columns.moduleId, feature.moduleId));
-					const applied = yield* Schema.decodeUnknownEffect(ModuleRow)(updated[0]);
-					if (!applied.active || applied.policyRevision !== policyRevision) return yield* configurationError(`Passkey policy changed while configuring ${feature.moduleId}`);
-				}
-				yield* native.insert(m.table("passkeyAdmissions")).values({
-					authorityScope: namespace,
-					moduleId: feature.moduleId,
-					version: policyRevision,
-					ownerMarker: policyRevision
-				}).onConflictDoNothing();
-			}
-		}));
-		const credential = yield* makeTargetPasskeyCredentials(m.read, configuration);
-		const persistence = /* @__PURE__ */ new Map();
-		const managers = /* @__PURE__ */ new Map();
-		const enrollment = /* @__PURE__ */ new Map();
-		for (const feature of features) if (feature.management) {
-			const mapping = yield* Effect.try({
-				try: () => m.management(feature),
-				catch: () => configurationError(`Invalid passkey management mapping for ${feature.moduleId}`)
-			});
-			const services = yield* makeTargetPasskeyManagement(mapping, configuration);
-			persistence.set(feature.moduleId, services.passkeyPersistence);
-			managers.set(feature.moduleId, services.passkeyManagementPersistence);
-			enrollment.set(feature.moduleId, (yield* makeTargetPasskeyEnrollmentContext(mapping, configuration)).passkeyEnrollmentContext);
-		} else persistence.set(feature.moduleId, (yield* makeTargetPasskeyPersistence(m.base(feature), configuration)).passkeyPersistence);
-		const service = (services, moduleId) => {
-			const value = services.get(moduleId);
-			return value === void 0 ? Effect.fail(unavailable()) : Effect.succeed(value);
-		};
-		let context = Context.make(PasskeyCredentials, credential.passkeyCredentials).pipe(Context.add(PasskeyPersistence, {
-			issue: (input, prepare) => Effect.flatMap(service(persistence, input.ceremony.moduleId), (s) => s.issue(input, prepare)),
-			context: (input) => Effect.flatMap(service(persistence, input.moduleId), (s) => s.context(input)),
-			claim: (input, prepare) => Effect.flatMap(service(persistence, input.ceremony.moduleId), (s) => s.claim(input, prepare)),
-			settle: (input, prepare) => Effect.flatMap(service(persistence, input.claim.ceremony.moduleId), (s) => s.settle(input, prepare)),
-			cleanup: (input, prepare) => Effect.flatMap(service(persistence, input.moduleId), (s) => s.cleanup(input, prepare))
-		}));
-		if (managers.size > 0) context = context.pipe(Context.add(PasskeyEnrollmentContext, { capture: (input) => Effect.flatMap(service(enrollment, input.moduleId), (s) => s.capture(input)) }), Context.add(PasskeyManagementPersistence, {
-			issueEnrollment: (input, prepare) => Effect.flatMap(service(managers, input.ceremony.moduleId), (s) => s.issueEnrollment(input, prepare)),
-			completeEnrollment: (input, prepare) => Effect.flatMap(service(managers, input.claim.ceremony.moduleId), (s) => s.completeEnrollment(input, prepare)),
-			list: (input) => Effect.flatMap(service(managers, input.moduleId), (s) => s.list(input)),
-			inspectRemove: (input) => Effect.flatMap(service(managers, input.moduleId), (s) => s.inspectRemove(input)),
-			rename: (input, prepare) => Effect.flatMap(service(managers, input.moduleId), (s) => s.rename(input, prepare)),
-			remove: (input, prepare) => Effect.flatMap(service(managers, input.moduleId), (s) => s.remove(input, prepare))
-		}));
-		return context;
-	}, Effect.mapError((error) => Schema.is(PersistenceConfigurationError)(error) ? error : configurationError("Unable to configure passkey persistence")));
-};
-//#endregion
-export { makeComposedPasskeys };
-
-//# sourceMappingURL=passkeys.mjs.map

package/dist/internal/passkeys.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkeys.mjs","names":[],"sources":["../../src/internal/passkeys.ts"],"sourcesContent":["import {\n  PasskeyCredentials,\n  PasskeyCredential,\n  PasskeyEnrollmentContext,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  PasskeyPersistence,\n  PasskeyProfile,\n  PasskeyRequirement,\n  PasskeyUnavailable,\n} from \"@yielded/auth/Passkey\";\nimport { Context, Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport {\n  PersistenceConfigurationError,\n  type MappingInput,\n  type PasskeyFeature,\n} from \"./configuration\";\nimport { digest } from \"./crypto\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n  requiredPasskeyCredentialConstraints,\n  requiredPasskeyPersistenceConstraints,\n  type PasskeyCredentialMapping,\n  type PasskeyPersistenceMapping,\n} from \"./models/passkey-model\";\nimport {\n  requiredPasskeyManagementConstraints,\n  type PasskeyManagementMapping,\n} from \"./models/passkey-write-model\";\nimport { makePasskeyKernel } from \"./passkey-kernel\";\nimport type { PasskeyTargetConfiguration } from \"./passkey/target\";\nimport type { Backend } from \"./persistence\";\nimport { CurrentProofSql } from \"./proof-kernel\";\nimport type { SqlExpression as SQL, QueryOperations, TableModel } from \"./query-operations\";\nimport { requireStandalone } from \"./standalone\";\nimport { storageTables, type StorageRole } from \"./storage-tables\";\n\nconst profileJson = Schema.fromJsonString(PasskeyProfile);\nconst policyJson = Schema.fromJsonString(PasskeyMethodPolicy);\n\nconst seedJson = Schema.fromJsonString(\n  Schema.Struct({\n    policy: PasskeyMethodPolicy,\n    management: Schema.optionalKey(PasskeyManagementPolicy),\n  }),\n);\n\nconst ModuleRow = Schema.Struct({\n  active: Schema.Boolean,\n  policy: Schema.String,\n  policyRevision: Schema.String,\n});\n\nconst ConfiguredModuleRow = Schema.Struct({\n  moduleId: Schema.String,\n  active: Schema.Boolean,\n  policyRevision: Schema.String,\n  admitted: Schema.Literals([\"present\", \"missing\"]),\n});\n\nconst credentialData = PasskeyCredential.mapFields(\n  ({ revision: _revision, active: _active, ...fields }) => fields,\n);\n\nconst unavailable = () => PasskeyUnavailable.make({});\nconst configurationError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\ntype ReadMapping = PasskeyCredentialMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown\n>;\ntype BaseMapping = PasskeyPersistenceMapping<\n  ReadMapping,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown\n>;\ntype ManagementMapping = PasskeyManagementMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown\n>;\n\n/** Share the same passkey algorithms across raw SQL and Drizzle compilers. */\nexport const makeComposedPasskeys = (\n  operations: QueryOperations,\n): Backend<object, never>[\"passkeys\"] => {\n  const { and, eq, getTableColumns, inArray, or, sql } = operations;\n  const { target, writeTarget } = makePasskeyKernel(operations);\n\n  const {\n    makeTargetPasskeyCredentials,\n    makeTargetPasskeyEnrollmentContext,\n    makeTargetPasskeyPersistence,\n  } = target;\n\n  const { makeTargetPasskeyManagement } = writeTarget;\n\n  const mappings = (\n    storage: MappingInput,\n    namespace: string,\n    dialect: \"pg\" | \"sqlite\",\n    passwordModules: ReadonlyArray<string>,\n    signInProfiles: ReadonlyArray<PasskeyProfile>,\n  ) => {\n    const table = (role: StorageRole) => {\n      const value = storage.tables[role];\n\n      if (value === undefined) throw configurationError(`Missing ${role} mapping`);\n\n      // Backend validation owns the foreign table shape. Row values are decoded below.\n      return value;\n    };\n\n    const mapped = <Role extends StorageRole>(role: Role) => ({\n      table: table(role),\n      ...(Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key])) as {\n        readonly [Key in keyof (typeof storageTables)[Role][\"columns\"]]: Key;\n      }),\n    });\n\n    const column = (role: StorageRole, key: string) => getTableColumns(table(role))[key];\n    const s = storage.subjects;\n    const subject = s.table;\n    const sc = getTableColumns(subject);\n    const active = (value: unknown) => value === true;\n    const owned = (value: unknown) => value === \"owned\";\n\n    const read: ReadMapping = {\n      subject: {\n        table: subject,\n        id: s.id,\n        status: s.status,\n        securityRevision: s.securityRevision,\n        decodeId: (row) => row[s.id],\n        isActiveStatus: (value) => Object.is(value, s.activeValue),\n        activeCondition: eq(sc[s.status], s.activeValue),\n      },\n      credential: {\n        ...mapped(\"passkeyCredentials\"),\n        status: \"active\",\n        decode: (row) =>\n          Schema.decodeUnknownSync(credentialData)({\n            ...row,\n            profile: Schema.decodeUnknownSync(profileJson)(row.profile),\n          }),\n        decodeSubjectId: (row) => row.subjectId,\n        isActiveStatus: active,\n        activeCondition: eq(column(\"passkeyCredentials\", \"active\"), true),\n      },\n      authority: {\n        ...mapped(\"credentials\"),\n        status: \"active\",\n        isActiveStatus: active,\n        activeCondition: eq(column(\"credentials\", \"active\"), true),\n      },\n      credentialOwnership: {\n        ...mapped(\"passkeyOwnership\"),\n        isOwnedState: owned,\n        ownedCondition: eq(column(\"passkeyOwnership\", \"state\"), \"owned\"),\n        decodeSubjectId: (row) => row.subjectId,\n      },\n      handleOwnership: {\n        ...mapped(\"passkeyHandles\"),\n        isOwnedState: owned,\n        ownedCondition: eq(column(\"passkeyHandles\", \"state\"), \"owned\"),\n        decodeSubjectId: (row) => row.subjectId,\n      },\n      subjectIds: { toNative: s.toNativeSync, toSubject: s.toSubjectSync, equals: Object.is },\n      constraints: requiredPasskeyCredentialConstraints,\n    };\n\n    const base = (feature: PasskeyFeature): BaseMapping => ({\n      moduleId: feature.moduleId,\n      authorityScope: namespace,\n      read,\n      module: {\n        ...mapped(\"passkeyModules\"),\n        status: \"active\",\n        policyColumns: [\"policy\", \"policyRevision\"],\n        isActiveStatus: active,\n        activeCondition: eq(column(\"passkeyModules\", \"active\"), true),\n        decodeMethodPolicy: (row) => Schema.decodeUnknownSync(policyJson)(row.policy),\n      },\n      flow: {\n        ...mapped(\"passkeyFlows\"),\n        states: {\n          Pending: \"Pending\",\n          Claimed: \"Claimed\",\n          Verified: \"Verified\",\n          Rejected: \"Rejected\",\n          Ambiguous: \"Ambiguous\",\n          RegistrationAccepted: \"RegistrationAccepted\",\n          ProvisioningPending: \"ProvisioningPending\",\n        },\n        encodeInsert: () => ({}),\n      },\n      admission: mapped(\"passkeyAdmissions\"),\n      charge: { ...mapped(\"passkeyCharges\"), encodeInsert: () => ({}) },\n      clock: {\n        encodeInstant: storage.encodeInstant,\n        decodeInstant: storage.decodeInstantSync,\n        engineNowMillis:\n          dialect === \"pg\"\n            ? sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)`\n            : sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`,\n        toMillis: (expression) => expression,\n        fromMillis: (expression) => expression,\n      },\n      telemetry: { lastUsedAt: \"lastUsedAt\", encodeBackupState: (value) => value },\n      constraints: requiredPasskeyPersistenceConstraints,\n    });\n\n    const management = (feature: PasskeyFeature): ManagementMapping => {\n      const policy = feature.managementPolicy;\n\n      if (policy === undefined)\n        throw configurationError(`Missing passkey management policy for ${feature.moduleId}`);\n      const c = getTableColumns(table(\"passkeyCredentials\"));\n      const f = getTableColumns(table(\"credentials\"));\n\n      const metadata = (subjectId: unknown) =>\n        sql`exists(select 1 from ${subject} where ${sc[s.id]} = ${subjectId} and ${sc[s.status]} = ${s.activeValue})`;\n\n      return {\n        ...base(feature),\n        write: {\n          credential: {\n            name: \"name\",\n            createdAt: \"createdAt\",\n            encodeInsert: ({ credential, subjectId, summary, marker }) => ({\n              credentialId: credential.credentialId,\n              subjectId,\n              rpId: credential.rpId,\n              protocolCredentialId: credential.protocolCredentialId,\n              userHandle: credential.userHandle,\n              credentialKey: \"\",\n              handleKey: \"\",\n              publicKey: credential.publicKey,\n              algorithm: credential.algorithm,\n              profile: Schema.encodeSync(profileJson)(credential.profile),\n              credentialRevision: marker,\n              active: true,\n              primarySignIn: credential.primarySignIn,\n              enrollmentUserVerified: credential.enrollmentUserVerified,\n              backupEligible: credential.backupEligible,\n              backupState: credential.backupState,\n              counter: credential.counter,\n              maximumCounter: credential.maximumCounter,\n              name: summary.name,\n              createdAt: storage.encodeInstant(summary.createdAtMillis),\n            }),\n            encodePrimarySignIn: (value) => value,\n            encodeEnrollmentUserVerified: (value) => value,\n            encodeBackupEligible: (value) => value,\n            activeStatus: true,\n            removedStatus: false,\n          },\n          authority: {\n            encodeInsert: ({ subjectId, credential, marker }) => ({\n              subjectId,\n              credentialId: credential.credentialId,\n              revision: marker,\n              active: true,\n            }),\n            activeStatus: true,\n            removedStatus: false,\n          },\n          credentialOwnership: {\n            encodeInsert: ({ credential, marker }) => ({\n              credentialKey: \"\",\n              rpId: credential.rpId,\n              protocolCredentialId: credential.protocolCredentialId,\n              state: \"owned\",\n              version: marker,\n            }),\n            ownedState: \"owned\",\n            removedState: \"removed\",\n          },\n          handleOwnership: {\n            encodeInsert: ({ subjectId, rpId, userHandle, marker }) => ({\n              subjectId,\n              rpId,\n              userHandle,\n              handleKey: \"\",\n              state: \"owned\",\n              version: marker,\n            }),\n            ownedState: \"owned\",\n          },\n          policy: {\n            subjectColumns: Object.keys(sc),\n            management: () => policy,\n            requirement: s.actionRequirements,\n            metadata,\n            action: metadata,\n            remainingSignIn: (subjectId, excluded, row) =>\n              Effect.gen(function* () {\n                const requirement = yield* Schema.decodeEffect(PasskeyRequirement)(\n                  yield* s.requirements(row),\n                );\n\n                const alternatives: SQL[] = [];\n\n                // Only retain complete sign-in paths enabled by this Auth definition.\n                // More involved combinations require an explicit application's predicate.\n                if (\n                  requirement.alternatives.some(\n                    (alternative) =>\n                      alternative.minimumCredentials === 1 &&\n                      alternative.factors.every((factor) => factor === \"possession\"),\n                  )\n                ) {\n                  const profiles = signInProfiles.map((profile) =>\n                    Schema.encodeSync(profileJson)(profile),\n                  );\n\n                  alternatives.push(sql`exists(\n                  select 1 from ${table(\"passkeyCredentials\")} join ${table(\"credentials\")}\n                  on ${f.credentialId} = ${c.credentialId} and ${f.subjectId} = ${c.subjectId}\n                    and ${f.revision} = ${c.credentialRevision} and ${f.active} = ${true}\n                  where ${c.subjectId} = ${subjectId} and ${c.credentialId} <> ${excluded}\n                    and ${c.active} = ${true} and ${c.primarySignIn} = ${true}\n                    and ${c.enrollmentUserVerified} = ${true} and ${inArray(c.profile, profiles)}\n                )`);\n                }\n                if (\n                  passwordModules.length > 0 &&\n                  requirement.alternatives.some(\n                    (alternative) =>\n                      alternative.minimumCredentials === 1 &&\n                      !alternative.userVerified &&\n                      !alternative.phishingResistant &&\n                      alternative.factors.every((factor) => factor === \"knowledge\"),\n                  )\n                ) {\n                  const p = getTableColumns(table(\"passwords\"));\n                  const i = getTableColumns(table(\"identifiers\"));\n\n                  alternatives.push(sql`exists(\n                  select 1 from ${table(\"passwords\")} join ${table(\"credentials\")}\n                  on ${f.credentialId} = ${p.credentialId} and ${f.subjectId} = ${p.subjectId}\n                    and ${f.revision} = ${p.credentialRevision} and ${f.active} = ${true}\n                  join ${table(\"identifiers\")} on ${i.subjectId} = ${p.subjectId}\n                    and ${i.active} = ${true} and ${i.namespace} = 'email'\n                  where ${p.subjectId} = ${subjectId} and ${p.credentialId} <> ${excluded}\n                    and ${inArray(p.moduleId, passwordModules)}\n                )`);\n                }\n\n                return or(...alternatives) ?? sql`false`;\n              }).pipe(\n                Effect.mapError((cause) =>\n                  PersistenceMappingError.make({ operation: \"mapping\", cause }),\n                ),\n              ),\n          },\n        },\n        command: { ...mapped(\"passkeyCommands\"), encodeInsert: (input) => ({ ...input }) },\n        managementConstraints: requiredPasskeyManagementConstraints,\n        invalidation: {\n          window: {\n            trigger: \"credential-change\",\n            existingSessions: \"immediate\",\n            maximumExposureMillis: 0,\n            oldAuthenticationEvidence: \"rejected\",\n          },\n          mutations: [],\n          postcondition: ({ subjectId, securityRevision }) =>\n            sql`exists(select 1 from ${subject} where ${sc[s.id]} = ${subjectId} and ${sc[s.securityRevision]} = ${securityRevision})`,\n        },\n      };\n    };\n\n    return { read, base, management, table };\n  };\n\n  const make: Backend<object, never>[\"passkeys\"] = Effect.fn(\"AuthPersistence.passkeys\")(\n    function* ({ storage, namespace, dialect, features, passwordModules }) {\n      const client = yield* SqlClient.SqlClient;\n\n      const policies = yield* Effect.forEach(features, (feature) =>\n        Effect.gen(function* () {\n          const policy = yield* feature.policy;\n          const encoded = yield* Schema.encodeEffect(policyJson)(policy);\n\n          const policyRevision = yield* digest(\n            yield* Schema.encodeEffect(seedJson)({\n              policy,\n              ...(feature.managementPolicy === undefined\n                ? {}\n                : { management: feature.managementPolicy }),\n            }),\n          );\n\n          return { feature, policy, encoded, policyRevision };\n        }),\n      );\n\n      const m = yield* Effect.try({\n        try: () =>\n          mappings(\n            storage,\n            namespace,\n            dialect,\n            passwordModules,\n            policies.flatMap(({ feature, policy }) => (feature.management ? [] : policy.profiles)),\n          ),\n        catch: () => configurationError(\"Invalid passkey table mappings\"),\n      });\n\n      const configuration: PasskeyTargetConfiguration = {\n        mode: \"interactive\",\n        dialect,\n        locking: dialect === \"pg\",\n        standaloneGuard: () => requireStandalone(unavailable, client.transactionService),\n      };\n\n      const native = yield* CurrentProofSql;\n      const module = m.table(\"passkeyModules\");\n      const columns = getTableColumns(module);\n      const admission = m.table(\"passkeyAdmissions\");\n      const ac = getTableColumns(admission);\n\n      // Read live configuration on every acquisition. Matching modules and\n      // admission ownership need no initialization writes or advisory lock.\n      const configured = yield* native\n        .select({\n          moduleId: columns.moduleId,\n          active: columns.active,\n          policyRevision: columns.policyRevision,\n          // Predicate SQL preserves qualifiers through single-table projections.\n          admitted: sql`case when exists(select 1 from ${admission}\n            where ${and(eq(ac.authorityScope, namespace), eq(ac.moduleId, columns.moduleId))})\n              then 'present' else 'missing' end`,\n        })\n        .from(module)\n        .where(\n          inArray(\n            columns.moduleId,\n            policies.map(({ feature }) => feature.moduleId),\n          ),\n        )\n        .pipe(\n          Effect.flatMap(Schema.decodeUnknownEffect(Schema.Array(ConfiguredModuleRow))),\n          Effect.map((rows) =>\n            policies.every(({ feature, policyRevision }) =>\n              rows.some(\n                (row) =>\n                  row.moduleId === feature.moduleId &&\n                  row.active &&\n                  row.admitted === \"present\" &&\n                  row.policyRevision === policyRevision,\n              ),\n            ),\n          ),\n        );\n\n      if (!configured)\n        yield* client.withTransaction(\n          Effect.gen(function* () {\n            if (dialect === \"pg\")\n              yield* client`select pg_advisory_xact_lock(hashtext(${`${namespace}/passkeys`}))`;\n            for (const { feature, policy, encoded, policyRevision } of policies) {\n              yield* native\n                .insert(module)\n                .values({\n                  moduleId: feature.moduleId,\n                  active: true,\n                  policy: encoded,\n                  policyRevision,\n                })\n                .onConflictDoNothing();\n\n              const rows = yield* native\n                .select()\n                .from(module)\n                .where(eq(columns.moduleId, feature.moduleId));\n\n              const row = yield* Schema.decodeUnknownEffect(ModuleRow)(rows[0]);\n\n              if (!row.active)\n                return yield* configurationError(`Passkey module ${feature.moduleId} is disabled`);\n              if (row.policyRevision !== policyRevision) {\n                const previous = yield* Schema.decodeEffect(policyJson)(row.policy);\n\n                if (policy.generation <= previous.generation)\n                  return yield* configurationError(\n                    `Increase the passkey policy generation to change ${feature.moduleId}`,\n                  );\n                yield* native\n                  .update(module)\n                  .set({ policy: encoded, policyRevision })\n                  .where(\n                    and(\n                      eq(columns.moduleId, feature.moduleId),\n                      eq(columns.policyRevision, row.policyRevision),\n                      eq(columns.active, true),\n                    ),\n                  );\n\n                const updated = yield* native\n                  .select()\n                  .from(module)\n                  .where(eq(columns.moduleId, feature.moduleId));\n\n                const applied = yield* Schema.decodeUnknownEffect(ModuleRow)(updated[0]);\n\n                if (!applied.active || applied.policyRevision !== policyRevision)\n                  return yield* configurationError(\n                    `Passkey policy changed while configuring ${feature.moduleId}`,\n                  );\n              }\n              yield* native\n                .insert(m.table(\"passkeyAdmissions\"))\n                .values({\n                  authorityScope: namespace,\n                  moduleId: feature.moduleId,\n                  version: policyRevision,\n                  ownerMarker: policyRevision,\n                })\n                .onConflictDoNothing();\n            }\n          }),\n        );\n\n      const credential = yield* makeTargetPasskeyCredentials<ReadMapping, never>(\n        m.read,\n        configuration,\n      );\n\n      const persistence = new Map<string, PasskeyPersistence[\"Service\"]>();\n      const managers = new Map<string, PasskeyManagementPersistence[\"Service\"]>();\n      const enrollment = new Map<string, PasskeyEnrollmentContext[\"Service\"]>();\n\n      for (const feature of features) {\n        if (feature.management) {\n          const mapping = yield* Effect.try({\n            try: () => m.management(feature),\n            catch: () =>\n              configurationError(`Invalid passkey management mapping for ${feature.moduleId}`),\n          });\n\n          const services = yield* makeTargetPasskeyManagement<ManagementMapping, never>(\n            mapping,\n            configuration,\n          );\n\n          persistence.set(feature.moduleId, services.passkeyPersistence);\n          managers.set(feature.moduleId, services.passkeyManagementPersistence);\n          enrollment.set(\n            feature.moduleId,\n            (yield* makeTargetPasskeyEnrollmentContext<ManagementMapping, never>(\n              mapping,\n              configuration,\n            )).passkeyEnrollmentContext,\n          );\n        } else {\n          persistence.set(\n            feature.moduleId,\n            (yield* makeTargetPasskeyPersistence<BaseMapping, never>(\n              m.base(feature),\n              configuration,\n            )).passkeyPersistence,\n          );\n        }\n      }\n\n      const service = <A>(services: ReadonlyMap<string, A>, moduleId: string) => {\n        const value = services.get(moduleId);\n\n        return value === undefined ? Effect.fail(unavailable()) : Effect.succeed(value);\n      };\n\n      let context: Context.Context<never> = Context.make(\n        PasskeyCredentials,\n        credential.passkeyCredentials,\n      ).pipe(\n        Context.add(PasskeyPersistence, {\n          issue: (input, prepare) =>\n            Effect.flatMap(service(persistence, input.ceremony.moduleId), (s) =>\n              s.issue(input, prepare),\n            ),\n          context: (input) =>\n            Effect.flatMap(service(persistence, input.moduleId), (s) => s.context(input)),\n          claim: (input, prepare) =>\n            Effect.flatMap(service(persistence, input.ceremony.moduleId), (s) =>\n              s.claim(input, prepare),\n            ),\n          settle: (input, prepare) =>\n            Effect.flatMap(service(persistence, input.claim.ceremony.moduleId), (s) =>\n              s.settle(input, prepare),\n            ),\n          cleanup: (input, prepare) =>\n            Effect.flatMap(service(persistence, input.moduleId), (s) => s.cleanup(input, prepare)),\n        }),\n      );\n\n      if (managers.size > 0)\n        context = context.pipe(\n          Context.add(PasskeyEnrollmentContext, {\n            capture: (input) =>\n              Effect.flatMap(service(enrollment, input.moduleId), (s) => s.capture(input)),\n          }),\n          Context.add(PasskeyManagementPersistence, {\n            issueEnrollment: (input, prepare) =>\n              Effect.flatMap(service(managers, input.ceremony.moduleId), (s) =>\n                s.issueEnrollment(input, prepare),\n              ),\n            completeEnrollment: (input, prepare) =>\n              Effect.flatMap(service(managers, input.claim.ceremony.moduleId), (s) =>\n                s.completeEnrollment(input, prepare),\n              ),\n            list: (input) =>\n              Effect.flatMap(service(managers, input.moduleId), (s) => s.list(input)),\n            inspectRemove: (input) =>\n              Effect.flatMap(service(managers, input.moduleId), (s) => s.inspectRemove(input)),\n            rename: (input, prepare) =>\n              Effect.flatMap(service(managers, input.moduleId), (s) => s.rename(input, prepare)),\n            remove: (input, prepare) =>\n              Effect.flatMap(service(managers, input.moduleId), (s) => s.remove(input, prepare)),\n          }),\n        );\n\n      return context;\n    },\n    Effect.mapError((error) =>\n      Schema.is(PersistenceConfigurationError)(error)\n        ? error\n        : configurationError(\"Unable to configure passkey persistence\"),\n    ),\n  );\n\n  return make;\n};\n"],"mappings":";;;;;;;;;;;;;AAwCA,MAAM,cAAc,OAAO,eAAe,cAAc;AACxD,MAAM,aAAa,OAAO,eAAe,mBAAmB;AAE5D,MAAM,WAAW,OAAO,eACtB,OAAO,OAAO;CACZ,QAAQ;CACR,YAAY,OAAO,YAAY,uBAAuB;AACxD,CAAC,CACH;AAEA,MAAM,YAAY,OAAO,OAAO;CAC9B,QAAQ,OAAO;CACf,QAAQ,OAAO;CACf,gBAAgB,OAAO;AACzB,CAAC;AAED,MAAM,sBAAsB,OAAO,OAAO;CACxC,UAAU,OAAO;CACjB,QAAQ,OAAO;CACf,gBAAgB,OAAO;CACvB,UAAU,OAAO,SAAS,CAAC,WAAW,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,iBAAiB,kBAAkB,WACtC,EAAE,UAAU,WAAW,QAAQ,SAAS,GAAG,aAAa,MAC3D;AAEA,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;AACpD,MAAM,sBAAsB,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;;AAiC5F,MAAa,wBACX,eACuC;CACvC,MAAM,EAAE,KAAK,IAAI,iBAAiB,SAAS,IAAI,QAAQ;CACvD,MAAM,EAAE,QAAQ,gBAAgB,kBAAkB,UAAU;CAE5D,MAAM,EACJ,8BACA,oCACA,iCACE;CAEJ,MAAM,EAAE,gCAAgC;CAExC,MAAM,YACJ,SACA,WACA,SACA,iBACA,mBACG;EACH,MAAM,SAAS,SAAsB;GACnC,MAAM,QAAQ,QAAQ,OAAO;GAE7B,IAAI,UAAU,KAAA,GAAW,MAAM,mBAAmB,WAAW,KAAK,SAAS;GAG3E,OAAO;EACT;EAEA,MAAM,UAAoC,UAAgB;GACxD,OAAO,MAAM,IAAI;GACjB,GAAI,OAAO,YAAY,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;EAG1F;EAEA,MAAM,UAAU,MAAmB,QAAgB,gBAAgB,MAAM,IAAI,CAAC,CAAC,CAAC;EAChF,MAAM,IAAI,QAAQ;EAClB,MAAM,UAAU,EAAE;EAClB,MAAM,KAAK,gBAAgB,OAAO;EAClC,MAAM,UAAU,UAAmB,UAAU;EAC7C,MAAM,SAAS,UAAmB,UAAU;EAE5C,MAAM,OAAoB;GACxB,SAAS;IACP,OAAO;IACP,IAAI,EAAE;IACN,QAAQ,EAAE;IACV,kBAAkB,EAAE;IACpB,WAAW,QAAQ,IAAI,EAAE;IACzB,iBAAiB,UAAU,OAAO,GAAG,OAAO,EAAE,WAAW;IACzD,iBAAiB,GAAG,GAAG,EAAE,SAAS,EAAE,WAAW;GACjD;GACA,YAAY;IACV,GAAG,OAAO,oBAAoB;IAC9B,QAAQ;IACR,SAAS,QACP,OAAO,kBAAkB,cAAc,CAAC,CAAC;KACvC,GAAG;KACH,SAAS,OAAO,kBAAkB,WAAW,CAAC,CAAC,IAAI,OAAO;IAC5D,CAAC;IACH,kBAAkB,QAAQ,IAAI;IAC9B,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,sBAAsB,QAAQ,GAAG,IAAI;GAClE;GACA,WAAW;IACT,GAAG,OAAO,aAAa;IACvB,QAAQ;IACR,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,eAAe,QAAQ,GAAG,IAAI;GAC3D;GACA,qBAAqB;IACnB,GAAG,OAAO,kBAAkB;IAC5B,cAAc;IACd,gBAAgB,GAAG,OAAO,oBAAoB,OAAO,GAAG,OAAO;IAC/D,kBAAkB,QAAQ,IAAI;GAChC;GACA,iBAAiB;IACf,GAAG,OAAO,gBAAgB;IAC1B,cAAc;IACd,gBAAgB,GAAG,OAAO,kBAAkB,OAAO,GAAG,OAAO;IAC7D,kBAAkB,QAAQ,IAAI;GAChC;GACA,YAAY;IAAE,UAAU,EAAE;IAAc,WAAW,EAAE;IAAe,QAAQ,OAAO;GAAG;GACtF,aAAa;EACf;EAEA,MAAM,QAAQ,aAA0C;GACtD,UAAU,QAAQ;GAClB,gBAAgB;GAChB;GACA,QAAQ;IACN,GAAG,OAAO,gBAAgB;IAC1B,QAAQ;IACR,eAAe,CAAC,UAAU,gBAAgB;IAC1C,gBAAgB;IAChB,iBAAiB,GAAG,OAAO,kBAAkB,QAAQ,GAAG,IAAI;IAC5D,qBAAqB,QAAQ,OAAO,kBAAkB,UAAU,CAAC,CAAC,IAAI,MAAM;GAC9E;GACA,MAAM;IACJ,GAAG,OAAO,cAAc;IACxB,QAAQ;KACN,SAAS;KACT,SAAS;KACT,UAAU;KACV,UAAU;KACV,WAAW;KACX,sBAAsB;KACtB,qBAAqB;IACvB;IACA,qBAAqB,CAAC;GACxB;GACA,WAAW,OAAO,mBAAmB;GACrC,QAAQ;IAAE,GAAG,OAAO,gBAAgB;IAAG,qBAAqB,CAAC;GAAG;GAChE,OAAO;IACL,eAAe,QAAQ;IACvB,eAAe,QAAQ;IACvB,iBACE,YAAY,OACR,GAAG,iEACH,GAAG;IACT,WAAW,eAAe;IAC1B,aAAa,eAAe;GAC9B;GACA,WAAW;IAAE,YAAY;IAAc,oBAAoB,UAAU;GAAM;GAC3E,aAAa;EACf;EAEA,MAAM,cAAc,YAA+C;GACjE,MAAM,SAAS,QAAQ;GAEvB,IAAI,WAAW,KAAA,GACb,MAAM,mBAAmB,yCAAyC,QAAQ,UAAU;GACtF,MAAM,IAAI,gBAAgB,MAAM,oBAAoB,CAAC;GACrD,MAAM,IAAI,gBAAgB,MAAM,aAAa,CAAC;GAE9C,MAAM,YAAY,cAChB,GAAG,wBAAwB,QAAQ,SAAS,GAAG,EAAE,IAAI,KAAK,UAAU,OAAO,GAAG,EAAE,QAAQ,KAAK,EAAE,YAAY;GAE7G,OAAO;IACL,GAAG,KAAK,OAAO;IACf,OAAO;KACL,YAAY;MACV,MAAM;MACN,WAAW;MACX,eAAe,EAAE,YAAY,WAAW,SAAS,cAAc;OAC7D,cAAc,WAAW;OACzB;OACA,MAAM,WAAW;OACjB,sBAAsB,WAAW;OACjC,YAAY,WAAW;OACvB,eAAe;OACf,WAAW;OACX,WAAW,WAAW;OACtB,WAAW,WAAW;OACtB,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC,WAAW,OAAO;OAC1D,oBAAoB;OACpB,QAAQ;OACR,eAAe,WAAW;OAC1B,wBAAwB,WAAW;OACnC,gBAAgB,WAAW;OAC3B,aAAa,WAAW;OACxB,SAAS,WAAW;OACpB,gBAAgB,WAAW;OAC3B,MAAM,QAAQ;OACd,WAAW,QAAQ,cAAc,QAAQ,eAAe;MAC1D;MACA,sBAAsB,UAAU;MAChC,+BAA+B,UAAU;MACzC,uBAAuB,UAAU;MACjC,cAAc;MACd,eAAe;KACjB;KACA,WAAW;MACT,eAAe,EAAE,WAAW,YAAY,cAAc;OACpD;OACA,cAAc,WAAW;OACzB,UAAU;OACV,QAAQ;MACV;MACA,cAAc;MACd,eAAe;KACjB;KACA,qBAAqB;MACnB,eAAe,EAAE,YAAY,cAAc;OACzC,eAAe;OACf,MAAM,WAAW;OACjB,sBAAsB,WAAW;OACjC,OAAO;OACP,SAAS;MACX;MACA,YAAY;MACZ,cAAc;KAChB;KACA,iBAAiB;MACf,eAAe,EAAE,WAAW,MAAM,YAAY,cAAc;OAC1D;OACA;OACA;OACA,WAAW;OACX,OAAO;OACP,SAAS;MACX;MACA,YAAY;KACd;KACA,QAAQ;MACN,gBAAgB,OAAO,KAAK,EAAE;MAC9B,kBAAkB;MAClB,aAAa,EAAE;MACf;MACA,QAAQ;MACR,kBAAkB,WAAW,UAAU,QACrC,OAAO,IAAI,aAAa;OACtB,MAAM,cAAc,OAAO,OAAO,aAAa,kBAAkB,CAAC,CAChE,OAAO,EAAE,aAAa,GAAG,CAC3B;OAEA,MAAM,eAAsB,CAAC;OAI7B,IACE,YAAY,aAAa,MACtB,gBACC,YAAY,uBAAuB,KACnC,YAAY,QAAQ,OAAO,WAAW,WAAW,YAAY,CACjE,GACA;QACA,MAAM,WAAW,eAAe,KAAK,YACnC,OAAO,WAAW,WAAW,CAAC,CAAC,OAAO,CACxC;QAEA,aAAa,KAAK,GAAG;kCACL,MAAM,oBAAoB,EAAE,QAAQ,MAAM,aAAa,EAAE;uBACpE,EAAE,aAAa,KAAK,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,EAAE,UAAU;0BACpE,EAAE,SAAS,KAAK,EAAE,mBAAmB,OAAO,EAAE,OAAO,KAAK,KAAK;0BAC/D,EAAE,UAAU,KAAK,UAAU,OAAO,EAAE,aAAa,MAAM,SAAS;0BAChE,EAAE,OAAO,KAAK,KAAK,OAAO,EAAE,cAAc,KAAK,KAAK;0BACpD,EAAE,uBAAuB,KAAK,KAAK,OAAO,QAAQ,EAAE,SAAS,QAAQ,EAAE;kBAC/E;OACF;OACA,IACE,gBAAgB,SAAS,KACzB,YAAY,aAAa,MACtB,gBACC,YAAY,uBAAuB,KACnC,CAAC,YAAY,gBACb,CAAC,YAAY,qBACb,YAAY,QAAQ,OAAO,WAAW,WAAW,WAAW,CAChE,GACA;QACA,MAAM,IAAI,gBAAgB,MAAM,WAAW,CAAC;QAC5C,MAAM,IAAI,gBAAgB,MAAM,aAAa,CAAC;QAE9C,aAAa,KAAK,GAAG;kCACL,MAAM,WAAW,EAAE,QAAQ,MAAM,aAAa,EAAE;uBAC3D,EAAE,aAAa,KAAK,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,EAAE,UAAU;0BACpE,EAAE,SAAS,KAAK,EAAE,mBAAmB,OAAO,EAAE,OAAO,KAAK,KAAK;yBAChE,MAAM,aAAa,EAAE,MAAM,EAAE,UAAU,KAAK,EAAE,UAAU;0BACvD,EAAE,OAAO,KAAK,KAAK,OAAO,EAAE,UAAU;0BACtC,EAAE,UAAU,KAAK,UAAU,OAAO,EAAE,aAAa,MAAM,SAAS;0BAChE,QAAQ,EAAE,UAAU,eAAe,EAAE;kBAC7C;OACF;OAEA,OAAO,GAAG,GAAG,YAAY,KAAK,GAAG;MACnC,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,wBAAwB,KAAK;OAAE,WAAW;OAAW;MAAM,CAAC,CAC9D,CACF;KACJ;IACF;IACA,SAAS;KAAE,GAAG,OAAO,iBAAiB;KAAG,eAAe,WAAW,EAAE,GAAG,MAAM;IAAG;IACjF,uBAAuB;IACvB,cAAc;KACZ,QAAQ;MACN,SAAS;MACT,kBAAkB;MAClB,uBAAuB;MACvB,2BAA2B;KAC7B;KACA,WAAW,CAAC;KACZ,gBAAgB,EAAE,WAAW,uBAC3B,GAAG,wBAAwB,QAAQ,SAAS,GAAG,EAAE,IAAI,KAAK,UAAU,OAAO,GAAG,EAAE,kBAAkB,KAAK,iBAAiB;IAC5H;GACF;EACF;EAEA,OAAO;GAAE;GAAM;GAAM;GAAY;EAAM;CACzC;CAkQA,OAhQiD,OAAO,GAAG,0BAA0B,CAAC,CACpF,WAAW,EAAE,SAAS,WAAW,SAAS,UAAU,mBAAmB;EACrE,MAAM,SAAS,OAAO,UAAU;EAEhC,MAAM,WAAW,OAAO,OAAO,QAAQ,WAAW,YAChD,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,QAAQ;GAY9B,OAAO;IAAE;IAAS;IAAQ,SAAA,OAXH,OAAO,aAAa,UAAU,CAAC,CAAC,MAAM;IAW1B,gBAAA,OATL,OAC5B,OAAO,OAAO,aAAa,QAAQ,CAAC,CAAC;KACnC;KACA,GAAI,QAAQ,qBAAqB,KAAA,IAC7B,CAAC,IACD,EAAE,YAAY,QAAQ,iBAAiB;IAC7C,CAAC,CACH;GAEkD;EACpD,CAAC,CACH;EAEA,MAAM,IAAI,OAAO,OAAO,IAAI;GAC1B,WACE,SACE,SACA,WACA,SACA,iBACA,SAAS,SAAS,EAAE,SAAS,aAAc,QAAQ,aAAa,CAAC,IAAI,OAAO,QAAS,CACvF;GACF,aAAa,mBAAmB,gCAAgC;EAClE,CAAC;EAED,MAAM,gBAA4C;GAChD,MAAM;GACN;GACA,SAAS,YAAY;GACrB,uBAAuB,kBAAkB,aAAa,OAAO,kBAAkB;EACjF;EAEA,MAAM,SAAS,OAAO;EACtB,MAAM,SAAS,EAAE,MAAM,gBAAgB;EACvC,MAAM,UAAU,gBAAgB,MAAM;EACtC,MAAM,YAAY,EAAE,MAAM,mBAAmB;EAC7C,MAAM,KAAK,gBAAgB,SAAS;EAoCpC,IAAI,EAAC,OAhCqB,OACvB,OAAO;GACN,UAAU,QAAQ;GAClB,QAAQ,QAAQ;GAChB,gBAAgB,QAAQ;GAExB,UAAU,GAAG,kCAAkC,UAAU;oBAC/C,IAAI,GAAG,GAAG,gBAAgB,SAAS,GAAG,GAAG,GAAG,UAAU,QAAQ,QAAQ,CAAC,EAAE;;EAErF,CAAC,CAAC,CACD,KAAK,MAAM,CAAC,CACZ,MACC,QACE,QAAQ,UACR,SAAS,KAAK,EAAE,cAAc,QAAQ,QAAQ,CAChD,CACF,CAAC,CACA,KACC,OAAO,QAAQ,OAAO,oBAAoB,OAAO,MAAM,mBAAmB,CAAC,CAAC,GAC5E,OAAO,KAAK,SACV,SAAS,OAAO,EAAE,SAAS,qBACzB,KAAK,MACF,QACC,IAAI,aAAa,QAAQ,YACzB,IAAI,UACJ,IAAI,aAAa,aACjB,IAAI,mBAAmB,cAC3B,CACF,CACF,CACF,IAGA,OAAO,OAAO,gBACZ,OAAO,IAAI,aAAa;GACtB,IAAI,YAAY,MACd,OAAO,MAAM,yCAAyC,GAAG,UAAU,WAAW;GAChF,KAAK,MAAM,EAAE,SAAS,QAAQ,SAAS,oBAAoB,UAAU;IACnE,OAAO,OACJ,OAAO,MAAM,CAAC,CACd,OAAO;KACN,UAAU,QAAQ;KAClB,QAAQ;KACR,QAAQ;KACR;IACF,CAAC,CAAC,CACD,oBAAoB;IAEvB,MAAM,OAAO,OAAO,OACjB,OAAO,CAAC,CACR,KAAK,MAAM,CAAC,CACZ,MAAM,GAAG,QAAQ,UAAU,QAAQ,QAAQ,CAAC;IAE/C,MAAM,MAAM,OAAO,OAAO,oBAAoB,SAAS,CAAC,CAAC,KAAK,EAAE;IAEhE,IAAI,CAAC,IAAI,QACP,OAAO,OAAO,mBAAmB,kBAAkB,QAAQ,SAAS,aAAa;IACnF,IAAI,IAAI,mBAAmB,gBAAgB;KACzC,MAAM,WAAW,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,IAAI,MAAM;KAElE,IAAI,OAAO,cAAc,SAAS,YAChC,OAAO,OAAO,mBACZ,oDAAoD,QAAQ,UAC9D;KACF,OAAO,OACJ,OAAO,MAAM,CAAC,CACd,IAAI;MAAE,QAAQ;MAAS;KAAe,CAAC,CAAC,CACxC,MACC,IACE,GAAG,QAAQ,UAAU,QAAQ,QAAQ,GACrC,GAAG,QAAQ,gBAAgB,IAAI,cAAc,GAC7C,GAAG,QAAQ,QAAQ,IAAI,CACzB,CACF;KAEF,MAAM,UAAU,OAAO,OACpB,OAAO,CAAC,CACR,KAAK,MAAM,CAAC,CACZ,MAAM,GAAG,QAAQ,UAAU,QAAQ,QAAQ,CAAC;KAE/C,MAAM,UAAU,OAAO,OAAO,oBAAoB,SAAS,CAAC,CAAC,QAAQ,EAAE;KAEvE,IAAI,CAAC,QAAQ,UAAU,QAAQ,mBAAmB,gBAChD,OAAO,OAAO,mBACZ,4CAA4C,QAAQ,UACtD;IACJ;IACA,OAAO,OACJ,OAAO,EAAE,MAAM,mBAAmB,CAAC,CAAC,CACpC,OAAO;KACN,gBAAgB;KAChB,UAAU,QAAQ;KAClB,SAAS;KACT,aAAa;IACf,CAAC,CAAC,CACD,oBAAoB;GACzB;EACF,CAAC,CACH;EAEF,MAAM,aAAa,OAAO,6BACxB,EAAE,MACF,aACF;EAEA,MAAM,8BAAc,IAAI,IAA2C;EACnE,MAAM,2BAAW,IAAI,IAAqD;EAC1E,MAAM,6BAAa,IAAI,IAAiD;EAExE,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,YAAY;GACtB,MAAM,UAAU,OAAO,OAAO,IAAI;IAChC,WAAW,EAAE,WAAW,OAAO;IAC/B,aACE,mBAAmB,0CAA0C,QAAQ,UAAU;GACnF,CAAC;GAED,MAAM,WAAW,OAAO,4BACtB,SACA,aACF;GAEA,YAAY,IAAI,QAAQ,UAAU,SAAS,kBAAkB;GAC7D,SAAS,IAAI,QAAQ,UAAU,SAAS,4BAA4B;GACpE,WAAW,IACT,QAAQ,WACP,OAAO,mCACN,SACA,aACF,EAAA,CAAG,wBACL;EACF,OACE,YAAY,IACV,QAAQ,WACP,OAAO,6BACN,EAAE,KAAK,OAAO,GACd,aACF,EAAA,CAAG,kBACL;EAIJ,MAAM,WAAc,UAAkC,aAAqB;GACzE,MAAM,QAAQ,SAAS,IAAI,QAAQ;GAEnC,OAAO,UAAU,KAAA,IAAY,OAAO,KAAK,YAAY,CAAC,IAAI,OAAO,QAAQ,KAAK;EAChF;EAEA,IAAI,UAAkC,QAAQ,KAC5C,oBACA,WAAW,kBACb,CAAC,CAAC,KACA,QAAQ,IAAI,oBAAoB;GAC9B,QAAQ,OAAO,YACb,OAAO,QAAQ,QAAQ,aAAa,MAAM,SAAS,QAAQ,IAAI,MAC7D,EAAE,MAAM,OAAO,OAAO,CACxB;GACF,UAAU,UACR,OAAO,QAAQ,QAAQ,aAAa,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,KAAK,CAAC;GAC9E,QAAQ,OAAO,YACb,OAAO,QAAQ,QAAQ,aAAa,MAAM,SAAS,QAAQ,IAAI,MAC7D,EAAE,MAAM,OAAO,OAAO,CACxB;GACF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,aAAa,MAAM,MAAM,SAAS,QAAQ,IAAI,MACnE,EAAE,OAAO,OAAO,OAAO,CACzB;GACF,UAAU,OAAO,YACf,OAAO,QAAQ,QAAQ,aAAa,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;EACzF,CAAC,CACH;EAEA,IAAI,SAAS,OAAO,GAClB,UAAU,QAAQ,KAChB,QAAQ,IAAI,0BAA0B,EACpC,UAAU,UACR,OAAO,QAAQ,QAAQ,YAAY,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,KAAK,CAAC,EAC/E,CAAC,GACD,QAAQ,IAAI,8BAA8B;GACxC,kBAAkB,OAAO,YACvB,OAAO,QAAQ,QAAQ,UAAU,MAAM,SAAS,QAAQ,IAAI,MAC1D,EAAE,gBAAgB,OAAO,OAAO,CAClC;GACF,qBAAqB,OAAO,YAC1B,OAAO,QAAQ,QAAQ,UAAU,MAAM,MAAM,SAAS,QAAQ,IAAI,MAChE,EAAE,mBAAmB,OAAO,OAAO,CACrC;GACF,OAAO,UACL,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,KAAK,KAAK,CAAC;GACxE,gBAAgB,UACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,cAAc,KAAK,CAAC;GACjF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;GACnF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,UAAU,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,OAAO,OAAO,CAAC;EACrF,CAAC,CACH;EAEF,OAAO;CACT,GACA,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,mBAAmB,yCAAyC,CAClE,CAGQ;AACZ"}

package/dist/internal/password-credentials.d.mts

@@ -1,11 +0,0 @@
-import "./transaction-kernel.mjs";
-import "./models/password-model.mjs";
-import "./native-sql-table.mjs";
-import "./password-kernel.mjs";
-import { Effect, Option, Redacted } from "effect";
-import { EncodedPasswordHash, PasswordCredentialSnapshot, PasswordUnavailable } from "@yielded/auth/Password";
-import { LoginIdentifier } from "@yielded/auth/Identity";
-//#region src/internal/password-credentials.d.ts
-export declare const samePasswordCredentialSnapshot: (a: PasswordCredentialSnapshot, b: PasswordCredentialSnapshot) => boolean;
-//#endregion
-//# sourceMappingURL=password-credentials.d.mts.map