@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/internal/passkey-native-state.d.mts

@@ -0,0 +1,15 @@
+import { TableModel } from "./table-model.mjs";
+import "./mapping-error.mjs";
+import { PasskeyCredentialMapping, PasskeyPersistenceMapping } from "./models/passkey-model.mjs";
+import "./native-sql-table.mjs";
+import "./sql-commit.mjs";
+import { Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import { Fragment } from "effect/sql/Statement";
+import "@yielded/auth/Passkey";
+//#region src/internal/passkey-native-state.d.ts
+export type PasskeyNativeRead = PasskeyCredentialMapping<TableModel, TableModel, TableModel, unknown, any>;
+export type PasskeyNativeMapping = PasskeyPersistenceMapping<PasskeyNativeRead, TableModel, unknown, any>;
+export type PasskeyNativeRow = Readonly<Record<string, unknown>>;
+//#endregion
+//# sourceMappingURL=passkey-native-state.d.mts.map

package/dist/internal/passkey-native-state.mjs

@@ -0,0 +1,186 @@
+import { sqlMapping } from "./native-sql-table.mjs";
+import { exactSqlText } from "./sql-change.mjs";
+import { passkeyCredentialKey } from "./passkey-policy.mjs";
+import { makePasskeyNativeFlow } from "./passkey-native-flow.mjs";
+import { Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import * as M from "@yielded/auth/Passkey";
+//#region src/internal/passkey-native-state.ts
+const passkeyNativeInvariant = (value) => {
+	if (!value) throw M.PasskeyUnavailable.make({});
+};
+const makePasskeyNativeReadState = Effect.fnUntraced(function* (tables, read, clock) {
+	const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+	const subject = tables(read.subject.table);
+	const credential = tables(read.credential.table);
+	const factor = tables(read.authority.table);
+	const now = clock === void 0 ? sql`0` : tables.expression(clock.engineNowMillis);
+	const millis = (expression) => clock === void 0 ? expression : tables.expression(clock.toMillis(expression));
+	const storedNow = clock === void 0 ? sql`0` : tables.expression(clock.fromMillis(clock.engineNowMillis));
+	const active = (table) => tables.expression(read[table].activeCondition);
+	const invariant = passkeyNativeInvariant;
+	const sameId = (nativeId, value) => read.subjectIds.equals(nativeId, value);
+	const native = (id) => {
+		const value = read.subjectIds.toNative(id);
+		invariant(read.subjectIds.toSubject(value) === id);
+		return value;
+	};
+	const revisions = (nativeId, rows) => {
+		const entries = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			if (row[read.authority.credentialId] === null) continue;
+			invariant(sameId(nativeId, row[read.authority.subjectId]));
+			if (!read.authority.isActiveStatus(row[read.authority.status])) continue;
+			const entry = Schema.decodeUnknownSync(M.PasskeyRevision.fields.credentials)([{
+				credentialId: row[read.authority.credentialId],
+				revision: row[read.authority.revision]
+			}])[0];
+			invariant(entry !== void 0);
+			const previous = entries.get(entry.credentialId);
+			invariant(previous === void 0 || previous === entry.revision);
+			entries.set(entry.credentialId, entry.revision);
+		}
+		invariant(entries.size <= 64);
+		return [...entries].sort(([a], [b]) => a.localeCompare(b)).map(([credentialId, revision]) => ({
+			credentialId,
+			revision
+		}));
+	};
+	const revision = (row, factors) => {
+		const id = read.subject.decodeId(row);
+		const subjectId = read.subjectIds.toSubject(id);
+		invariant(sameId(native(subjectId), id));
+		return Schema.decodeUnknownSync(M.PasskeyRevision)({
+			subjectId,
+			securityRevision: row[read.subject.securityRevision],
+			credentials: revisions(id, factors)
+		});
+	};
+	const decodeCredential = Effect.fnUntraced(function* (row, current, subjectRow) {
+		const value = read.credential.decode(row);
+		const owned = current.credentials.find((entry) => entry.credentialId === value.credentialId);
+		if (!read.credential.isActiveStatus(row[read.credential.status]) || owned?.revision !== row[read.credential.credentialRevision]) return void 0;
+		invariant(read.subjectIds.toSubject(read.credential.decodeSubjectId(row)) === current.subjectId);
+		return M.snapshotPasskeySync(M.PasskeyCredential, {
+			...value,
+			revision: current,
+			requirement: yield* read.subject.decodeRequirement(subjectRow),
+			active: true
+		});
+	});
+	const readAuthority = Effect.fnUntraced(function* (nativeId, lock, credentialId) {
+		if (lock) {
+			const locked = yield* sql`select ${subject.fields("s_")}, ${now} as "engineNow" from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${active("subject")} ${sql.onDialectOrElse({
+				pg: () => sql`for update`,
+				mysql: () => sql`for update`,
+				orElse: () => sql``
+			})}`;
+			if (locked.length !== 1) return void 0;
+			const row = subject.decode(locked[0], "s_");
+			if (!sameId(read.subject.decodeId(row), nativeId) || !read.subject.isActiveStatus(row[read.subject.status])) return void 0;
+			const lockedFactors = sql`select ${factor.fields("f_")} from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${active("authority")} order by ${factor.column(read.authority.credentialId)} limit 65 ${sql.onDialectOrElse({
+				pg: () => sql`for update`,
+				mysql: () => sql`for update`,
+				orElse: () => sql``
+			})}`;
+			const rows = credentialId === void 0 ? yield* sql`${lockedFactors}` : yield* sql`with locked_factors as ${sql.onDialectOrElse({
+				pg: () => sql`materialized`,
+				orElse: () => sql``
+			})} (${lockedFactors})
+        select locked_factors.*, ${credential.fields("c_")} from ${credential.name} left join locked_factors on 1 = 1
+        where ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${exactSqlText(sql, credential.column(read.credential.credentialId), credential.value(read.credential.credentialId, credentialId))} and ${active("credential")}`;
+			invariant(rows.length <= 64);
+			return {
+				row,
+				credential: credentialId === void 0 || rows[0] === void 0 ? void 0 : credential.decode(rows[0], "c_"),
+				revision: revision(row, rows.map((row) => factor.decode(row, "f_"))),
+				nowMillis: yield* Schema.decodeEffect(Schema.Int)(Number(locked[0].engineNow))
+			};
+		}
+		const observedSubject = joinedSubject, observedFactor = joinedFactor;
+		const rows = yield* sql`select ${observedSubject.fields("s_")}, ${observedFactor.fields("f_")}, ${now} as "engineNow" ${credentialId === void 0 ? sql`` : sql`, ${joinedCredential.fields("c_")}`} from ${selected("subject", "passkey_subject")} left join ${selected("authority", "passkey_factor")} on ${observedFactor.column(read.authority.subjectId)} = ${observedFactor.value(read.authority.subjectId, nativeId)} ${credentialId === void 0 ? sql`` : sql`join ${selected("credential", "passkey_credential")} on ${joinedCredential.column(read.credential.subjectId)} = ${joinedCredential.value(read.credential.subjectId, nativeId)} and ${exactSqlText(sql, joinedCredential.column(read.credential.credentialId), joinedCredential.value(read.credential.credentialId, credentialId))}`} where ${observedSubject.column(read.subject.id)} = ${observedSubject.value(read.subject.id, nativeId)} limit 65`;
+		if (rows.length === 0 || rows.length > 64) return void 0;
+		const row = observedSubject.decode(rows[0], "s_");
+		if (!sameId(read.subject.decodeId(row), nativeId) || !read.subject.isActiveStatus(row[read.subject.status])) return void 0;
+		invariant(rows.every((selected) => {
+			const other = observedSubject.decode(selected, "s_");
+			return sameId(read.subject.decodeId(other), nativeId) && other[read.subject.securityRevision] === row[read.subject.securityRevision] && read.subject.isActiveStatus(other[read.subject.status]);
+		}));
+		return {
+			row,
+			credential: credentialId === void 0 ? void 0 : joinedCredential.decode(rows[0], "c_"),
+			revision: revision(row, rows.map((selected) => observedFactor.decode(selected, "f_"))),
+			nowMillis: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engineNow))
+		};
+	});
+	const joinedSubject = subject.as("passkey_subject");
+	const joinedFactor = factor.as("passkey_factor");
+	const joinedCredential = credential.as("passkey_credential");
+	const selected = (kind, alias) => {
+		return sql`(select * from ${(kind === "subject" ? subject : kind === "authority" ? factor : credential).name} where ${active(kind)}) as ${sql(alias)}`;
+	};
+	return {
+		sql,
+		tables,
+		subject,
+		credential,
+		factor,
+		now,
+		storedNow,
+		millis,
+		active,
+		native,
+		sameId,
+		revision,
+		decodeCredential,
+		readAuthority,
+		lookup: Effect.fnUntraced(function* (rpId, protocolCredentialId) {
+			const key = yield* passkeyCredentialKey(rpId, protocolCredentialId);
+			if (subject.unencodedTextColumn?.(read.subject.id) !== void 0 && credential.unencodedTextColumn?.(read.credential.subjectId) !== void 0 && factor.unencodedTextColumn?.(read.authority.subjectId) !== void 0) {
+				const s = joinedSubject, c = joinedCredential, f = joinedFactor;
+				const rows = yield* sql`select ${s.fields("s_")}, ${c.fields("c_")}, ${f.fields("f_")}
+        from ${selected("credential", "passkey_credential")}
+        join ${selected("subject", "passkey_subject")} on ${exactSqlText(sql, s.column(read.subject.id), c.column(read.credential.subjectId))}
+        left join ${selected("authority", "passkey_factor")} on ${exactSqlText(sql, f.column(read.authority.subjectId), c.column(read.credential.subjectId))}
+        where ${exactSqlText(sql, c.column(read.credential.credentialKey), c.value(read.credential.credentialKey, key))} limit 65`;
+				if (rows.length === 0 || rows.length > 64) return void 0;
+				const row = c.decode(rows[0], "c_");
+				const subjectRow = s.decode(rows[0], "s_");
+				const owner = read.credential.decodeSubjectId(row);
+				invariant(row[read.credential.rpId] === rpId && row[read.credential.protocolCredentialId] === protocolCredentialId);
+				invariant(rows.every((selected) => {
+					const other = c.decode(selected, "c_");
+					const subjectValue = s.decode(selected, "s_");
+					return sameId(owner, read.credential.decodeSubjectId(other)) && sameId(owner, read.subject.decodeId(subjectValue)) && other[read.credential.credentialId] === row[read.credential.credentialId] && other[read.credential.credentialRevision] === row[read.credential.credentialRevision] && subjectValue[read.subject.securityRevision] === subjectRow[read.subject.securityRevision];
+				}));
+				return yield* decodeCredential(row, revision(subjectRow, rows.map((row) => f.decode(row, "f_"))), subjectRow);
+			}
+			const rows = yield* sql`select ${credential.fields("c_")} from ${credential.name} where ${credential.column(read.credential.credentialKey)} = ${credential.value(read.credential.credentialKey, key)} and ${active("credential")}`;
+			if (rows.length !== 1) return void 0;
+			const row = credential.decode(rows[0], "c_");
+			invariant(row[read.credential.rpId] === rpId && row[read.credential.protocolCredentialId] === protocolCredentialId);
+			const current = yield* readAuthority(read.credential.decodeSubjectId(row), false);
+			return current === void 0 ? void 0 : yield* decodeCredential(row, current.revision, current.row);
+		}),
+		joinedSubject,
+		joinedFactor,
+		joinedCredential,
+		selected,
+		mapped: sqlMapping
+	};
+});
+const makePasskeyNativeState = Effect.fnUntraced(function* (tables, mapping) {
+	const state = yield* makePasskeyNativeReadState(tables, mapping.read, mapping.clock);
+	const ceremony = yield* makePasskeyNativeFlow(tables, mapping);
+	return {
+		...state,
+		mapping,
+		ceremony,
+		flow: ceremony.flow,
+		access: ceremony.access
+	};
+});
+//#endregion
+export { makePasskeyNativeReadState, makePasskeyNativeState, passkeyNativeInvariant };
+
+//# sourceMappingURL=passkey-native-state.mjs.map

package/dist/internal/passkey-native-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-native-state.mjs","names":[],"sources":["../../src/internal/passkey-native-state.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- physical mapping generics are erased only at this shared adapter boundary. */\nimport * as M from \"@yielded/auth/Passkey\";\nimport { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport type { PasskeyCredentialMapping, PasskeyPersistenceMapping } from \"./models/passkey-model\";\nimport { sqlMapping, type NativeSqlTables } from \"./native-sql-table\";\nimport { makePasskeyNativeFlow } from \"./passkey-native-flow\";\nimport { passkeyCredentialKey } from \"./passkey-policy\";\nimport { exactSqlText } from \"./sql-change\";\nimport type { TableModel } from \"./table-model\";\n\n// Physical expression types are validated by NativeSqlTables at this boundary.\nexport type PasskeyNativeRead = PasskeyCredentialMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  any\n>;\n\nexport type PasskeyNativeMapping = PasskeyPersistenceMapping<\n  PasskeyNativeRead,\n  TableModel,\n  unknown,\n  any\n>;\n\nexport type PasskeyNativeRow = Readonly<Record<string, unknown>>;\n\nexport const passkeyNativeInvariant: (value: unknown) => asserts value = (value) => {\n  if (!value) throw M.PasskeyUnavailable.make({});\n};\n\nexport const makePasskeyNativeReadState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  read: PasskeyNativeRead,\n  clock?: PasskeyNativeMapping[\"clock\"],\n) {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const subject = tables(read.subject.table);\n  const credential = tables(read.credential.table);\n  const factor = tables(read.authority.table);\n  const now = clock === undefined ? sql`0` : tables.expression(clock.engineNowMillis);\n\n  const millis = (expression: Fragment) =>\n    clock === undefined ? expression : tables.expression(clock.toMillis(expression));\n\n  const storedNow =\n    clock === undefined ? sql`0` : tables.expression(clock.fromMillis(clock.engineNowMillis));\n\n  const active = (table: \"subject\" | \"credential\" | \"authority\") =>\n    tables.expression(read[table].activeCondition);\n\n  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;\n  const sameId = (nativeId: unknown, value: unknown) => read.subjectIds.equals(nativeId, value);\n\n  const native = (id: M.PasskeyCredential[\"revision\"][\"subjectId\"]) => {\n    const value = read.subjectIds.toNative(id);\n\n    invariant(read.subjectIds.toSubject(value) === id);\n\n    return value;\n  };\n\n  const revisions = (nativeId: unknown, rows: ReadonlyArray<PasskeyNativeRow>) => {\n    const entries = new Map<string, M.PasskeyCredential[\"revision\"][\"securityRevision\"]>();\n\n    for (const row of rows) {\n      if (row[read.authority.credentialId] === null) continue;\n      invariant(sameId(nativeId, row[read.authority.subjectId]));\n      if (!read.authority.isActiveStatus(row[read.authority.status])) continue;\n\n      const decoded = Schema.decodeUnknownSync(M.PasskeyRevision.fields.credentials)([\n        {\n          credentialId: row[read.authority.credentialId],\n          revision: row[read.authority.revision],\n        },\n      ]);\n\n      const entry = decoded[0];\n\n      invariant(entry !== undefined);\n      const previous = entries.get(entry.credentialId);\n\n      invariant(previous === undefined || previous === entry.revision);\n      entries.set(entry.credentialId, entry.revision);\n    }\n    invariant(entries.size <= 64);\n\n    return [...entries]\n      .sort(([a], [b]) => a.localeCompare(b))\n      .map(([credentialId, revision]) => ({ credentialId, revision }));\n  };\n\n  const revision = (row: PasskeyNativeRow, factors: ReadonlyArray<PasskeyNativeRow>) => {\n    const id = read.subject.decodeId(row);\n    const subjectId = read.subjectIds.toSubject(id);\n\n    invariant(sameId(native(subjectId), id));\n\n    return Schema.decodeUnknownSync(M.PasskeyRevision)({\n      subjectId,\n      securityRevision: row[read.subject.securityRevision],\n      credentials: revisions(id, factors),\n    });\n  };\n\n  const decodeCredential = Effect.fnUntraced(function* (\n    row: PasskeyNativeRow,\n    current: M.PasskeyCredential[\"revision\"],\n    subjectRow: PasskeyNativeRow,\n  ) {\n    const value = read.credential.decode(row);\n    const owned = current.credentials.find((entry) => entry.credentialId === value.credentialId);\n\n    if (\n      !read.credential.isActiveStatus(row[read.credential.status]) ||\n      owned?.revision !== row[read.credential.credentialRevision]\n    )\n      return undefined;\n    invariant(\n      read.subjectIds.toSubject(read.credential.decodeSubjectId(row)) === current.subjectId,\n    );\n\n    return M.snapshotPasskeySync(M.PasskeyCredential, {\n      ...value,\n      revision: current,\n      requirement: yield* read.subject.decodeRequirement(subjectRow),\n      active: true,\n    });\n  });\n\n  const readAuthority = Effect.fnUntraced(function* (\n    nativeId: unknown,\n    lock: boolean,\n    credentialId?: string,\n  ) {\n    // The subject lock is a distinct first statement; joined FOR UPDATE cannot\n    // establish the lock order required by coordinated application transactions.\n    if (lock) {\n      const locked =\n        yield* sql<PasskeyNativeRow>`select ${subject.fields(\"s_\")}, ${now} as \"engineNow\" from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${active(\"subject\")} ${sql.onDialectOrElse({ pg: () => sql`for update`, mysql: () => sql`for update`, orElse: () => sql`` })}`;\n\n      if (locked.length !== 1) return undefined;\n      const row = subject.decode(locked[0]!, \"s_\");\n\n      if (\n        !sameId(read.subject.decodeId(row), nativeId) ||\n        !read.subject.isActiveStatus(row[read.subject.status])\n      )\n        return undefined;\n\n      const lockedFactors = sql`select ${factor.fields(\"f_\")} from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${active(\"authority\")} order by ${factor.column(read.authority.credentialId)} limit 65 ${sql.onDialectOrElse({ pg: () => sql`for update`, mysql: () => sql`for update`, orElse: () => sql`` })}`;\n\n      const rows =\n        credentialId === undefined\n          ? yield* sql<PasskeyNativeRow>`${lockedFactors}`\n          : yield* sql<PasskeyNativeRow>`with locked_factors as ${sql.onDialectOrElse({ pg: () => sql`materialized`, orElse: () => sql`` })} (${lockedFactors})\n        select locked_factors.*, ${credential.fields(\"c_\")} from ${credential.name} left join locked_factors on 1 = 1\n        where ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${exactSqlText(sql, credential.column(read.credential.credentialId), credential.value(read.credential.credentialId, credentialId))} and ${active(\"credential\")}`;\n\n      invariant(rows.length <= 64);\n\n      return {\n        row,\n        credential:\n          credentialId === undefined || rows[0] === undefined\n            ? undefined\n            : credential.decode(rows[0], \"c_\"),\n        revision: revision(\n          row,\n          rows.map((row) => factor.decode(row, \"f_\")),\n        ),\n        nowMillis: yield* Schema.decodeEffect(Schema.Int)(Number(locked[0]!.engineNow)),\n      };\n    }\n\n    const observedSubject = joinedSubject,\n      observedFactor = joinedFactor;\n\n    const rows =\n      yield* sql<PasskeyNativeRow>`select ${observedSubject.fields(\"s_\")}, ${observedFactor.fields(\"f_\")}, ${now} as \"engineNow\" ${credentialId === undefined ? sql`` : sql`, ${joinedCredential.fields(\"c_\")}`} from ${selected(\"subject\", \"passkey_subject\")} left join ${selected(\"authority\", \"passkey_factor\")} on ${observedFactor.column(read.authority.subjectId)} = ${observedFactor.value(read.authority.subjectId, nativeId)} ${credentialId === undefined ? sql`` : sql`join ${selected(\"credential\", \"passkey_credential\")} on ${joinedCredential.column(read.credential.subjectId)} = ${joinedCredential.value(read.credential.subjectId, nativeId)} and ${exactSqlText(sql, joinedCredential.column(read.credential.credentialId), joinedCredential.value(read.credential.credentialId, credentialId))}`} where ${observedSubject.column(read.subject.id)} = ${observedSubject.value(read.subject.id, nativeId)} limit 65`;\n\n    if (rows.length === 0 || rows.length > 64) return undefined;\n    const row = observedSubject.decode(rows[0]!, \"s_\");\n\n    if (\n      !sameId(read.subject.decodeId(row), nativeId) ||\n      !read.subject.isActiveStatus(row[read.subject.status])\n    )\n      return undefined;\n    invariant(\n      rows.every((selected) => {\n        const other = observedSubject.decode(selected, \"s_\");\n\n        return (\n          sameId(read.subject.decodeId(other), nativeId) &&\n          other[read.subject.securityRevision] === row[read.subject.securityRevision] &&\n          read.subject.isActiveStatus(other[read.subject.status])\n        );\n      }),\n    );\n\n    return {\n      row,\n      credential: credentialId === undefined ? undefined : joinedCredential.decode(rows[0]!, \"c_\"),\n      revision: revision(\n        row,\n        rows.map((selected) => observedFactor.decode(selected, \"f_\")),\n      ),\n      nowMillis: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0]!.engineNow)),\n    };\n  });\n\n  // Active predicates retain their original table qualification inside each\n  // subquery; aliases allow applications to map several roles to one table.\n  const joinedSubject = subject.as(\"passkey_subject\");\n  const joinedFactor = factor.as(\"passkey_factor\");\n  const joinedCredential = credential.as(\"passkey_credential\");\n\n  const selected = (kind: \"subject\" | \"authority\" | \"credential\", alias: string) => {\n    const table = kind === \"subject\" ? subject : kind === \"authority\" ? factor : credential;\n\n    return sql`(select * from ${table.name} where ${active(kind)}) as ${sql(alias)}`;\n  };\n\n  const lookup = Effect.fnUntraced(function* (rpId: string, protocolCredentialId: string) {\n    const key = yield* passkeyCredentialKey(rpId, protocolCredentialId);\n\n    if (\n      subject.unencodedTextColumn?.(read.subject.id) !== undefined &&\n      credential.unencodedTextColumn?.(read.credential.subjectId) !== undefined &&\n      factor.unencodedTextColumn?.(read.authority.subjectId) !== undefined\n    ) {\n      const s = joinedSubject,\n        c = joinedCredential,\n        f = joinedFactor;\n\n      const rows =\n        yield* sql<PasskeyNativeRow>`select ${s.fields(\"s_\")}, ${c.fields(\"c_\")}, ${f.fields(\"f_\")}\n        from ${selected(\"credential\", \"passkey_credential\")}\n        join ${selected(\"subject\", \"passkey_subject\")} on ${exactSqlText(sql, s.column(read.subject.id), c.column(read.credential.subjectId))}\n        left join ${selected(\"authority\", \"passkey_factor\")} on ${exactSqlText(sql, f.column(read.authority.subjectId), c.column(read.credential.subjectId))}\n        where ${exactSqlText(sql, c.column(read.credential.credentialKey), c.value(read.credential.credentialKey, key))} limit 65`;\n\n      if (rows.length === 0 || rows.length > 64) return undefined;\n      const row = c.decode(rows[0]!, \"c_\");\n      const subjectRow = s.decode(rows[0]!, \"s_\");\n      const owner = read.credential.decodeSubjectId(row);\n\n      invariant(\n        row[read.credential.rpId] === rpId &&\n          row[read.credential.protocolCredentialId] === protocolCredentialId,\n      );\n      invariant(\n        rows.every((selected) => {\n          const other = c.decode(selected, \"c_\");\n          const subjectValue = s.decode(selected, \"s_\");\n\n          return (\n            sameId(owner, read.credential.decodeSubjectId(other)) &&\n            sameId(owner, read.subject.decodeId(subjectValue)) &&\n            other[read.credential.credentialId] === row[read.credential.credentialId] &&\n            other[read.credential.credentialRevision] === row[read.credential.credentialRevision] &&\n            subjectValue[read.subject.securityRevision] ===\n              subjectRow[read.subject.securityRevision]\n          );\n        }),\n      );\n\n      return yield* decodeCredential(\n        row,\n        revision(\n          subjectRow,\n          rows.map((row) => f.decode(row, \"f_\")),\n        ),\n        subjectRow,\n      );\n    }\n\n    const rows =\n      yield* sql<PasskeyNativeRow>`select ${credential.fields(\"c_\")} from ${credential.name} where ${credential.column(read.credential.credentialKey)} = ${credential.value(read.credential.credentialKey, key)} and ${active(\"credential\")}`;\n\n    if (rows.length !== 1) return undefined;\n    const row = credential.decode(rows[0]!, \"c_\");\n\n    invariant(\n      row[read.credential.rpId] === rpId &&\n        row[read.credential.protocolCredentialId] === protocolCredentialId,\n    );\n    const current = yield* readAuthority(read.credential.decodeSubjectId(row), false);\n\n    return current === undefined\n      ? undefined\n      : yield* decodeCredential(row, current.revision, current.row);\n  });\n\n  return {\n    sql,\n    tables,\n    subject,\n    credential,\n    factor,\n    now,\n    storedNow,\n    millis,\n    active,\n    native,\n    sameId,\n    revision,\n    decodeCredential,\n    readAuthority,\n    lookup,\n    joinedSubject,\n    joinedFactor,\n    joinedCredential,\n    selected,\n    mapped: sqlMapping,\n  };\n});\n\nexport const makePasskeyNativeState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: PasskeyNativeMapping,\n) {\n  const state = yield* makePasskeyNativeReadState(tables, mapping.read, mapping.clock);\n  const ceremony = yield* makePasskeyNativeFlow(tables, mapping);\n\n  return { ...state, mapping, ceremony, flow: ceremony.flow, access: ceremony.access };\n});\n\nexport type PasskeyNativeReadState = Effect.Success<ReturnType<typeof makePasskeyNativeReadState>>;\nexport type PasskeyNativeState = Effect.Success<ReturnType<typeof makePasskeyNativeState>>;\n"],"mappings":";;;;;;;;AA+BA,MAAa,0BAA6D,UAAU;CAClF,IAAI,CAAC,OAAO,MAAM,EAAE,mBAAmB,KAAK,CAAC,CAAC;AAChD;AAEA,MAAa,6BAA6B,OAAO,WAAW,WAC1D,QACA,MACA,OACA;CACA,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,UAAU,OAAO,KAAK,QAAQ,KAAK;CACzC,MAAM,aAAa,OAAO,KAAK,WAAW,KAAK;CAC/C,MAAM,SAAS,OAAO,KAAK,UAAU,KAAK;CAC1C,MAAM,MAAM,UAAU,KAAA,IAAY,GAAG,MAAM,OAAO,WAAW,MAAM,eAAe;CAElF,MAAM,UAAU,eACd,UAAU,KAAA,IAAY,aAAa,OAAO,WAAW,MAAM,SAAS,UAAU,CAAC;CAEjF,MAAM,YACJ,UAAU,KAAA,IAAY,GAAG,MAAM,OAAO,WAAW,MAAM,WAAW,MAAM,eAAe,CAAC;CAE1F,MAAM,UAAU,UACd,OAAO,WAAW,KAAK,MAAM,CAAC,eAAe;CAE/C,MAAM,YAA2C;CACjD,MAAM,UAAU,UAAmB,UAAmB,KAAK,WAAW,OAAO,UAAU,KAAK;CAE5F,MAAM,UAAU,OAAqD;EACnE,MAAM,QAAQ,KAAK,WAAW,SAAS,EAAE;EAEzC,UAAU,KAAK,WAAW,UAAU,KAAK,MAAM,EAAE;EAEjD,OAAO;CACT;CAEA,MAAM,aAAa,UAAmB,SAA0C;EAC9E,MAAM,0BAAU,IAAI,IAAiE;EAErF,KAAK,MAAM,OAAO,MAAM;GACtB,IAAI,IAAI,KAAK,UAAU,kBAAkB,MAAM;GAC/C,UAAU,OAAO,UAAU,IAAI,KAAK,UAAU,UAAU,CAAC;GACzD,IAAI,CAAC,KAAK,UAAU,eAAe,IAAI,KAAK,UAAU,OAAO,GAAG;GAShE,MAAM,QAPU,OAAO,kBAAkB,EAAE,gBAAgB,OAAO,WAAW,CAAC,CAAC,CAC7E;IACE,cAAc,IAAI,KAAK,UAAU;IACjC,UAAU,IAAI,KAAK,UAAU;GAC/B,CACF,CAEoB,CAAC,CAAC;GAEtB,UAAU,UAAU,KAAA,CAAS;GAC7B,MAAM,WAAW,QAAQ,IAAI,MAAM,YAAY;GAE/C,UAAU,aAAa,KAAA,KAAa,aAAa,MAAM,QAAQ;GAC/D,QAAQ,IAAI,MAAM,cAAc,MAAM,QAAQ;EAChD;EACA,UAAU,QAAQ,QAAQ,EAAE;EAE5B,OAAO,CAAC,GAAG,OAAO,CAAC,CAChB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CACtC,KAAK,CAAC,cAAc,eAAe;GAAE;GAAc;EAAS,EAAE;CACnE;CAEA,MAAM,YAAY,KAAuB,YAA6C;EACpF,MAAM,KAAK,KAAK,QAAQ,SAAS,GAAG;EACpC,MAAM,YAAY,KAAK,WAAW,UAAU,EAAE;EAE9C,UAAU,OAAO,OAAO,SAAS,GAAG,EAAE,CAAC;EAEvC,OAAO,OAAO,kBAAkB,EAAE,eAAe,CAAC,CAAC;GACjD;GACA,kBAAkB,IAAI,KAAK,QAAQ;GACnC,aAAa,UAAU,IAAI,OAAO;EACpC,CAAC;CACH;CAEA,MAAM,mBAAmB,OAAO,WAAW,WACzC,KACA,SACA,YACA;EACA,MAAM,QAAQ,KAAK,WAAW,OAAO,GAAG;EACxC,MAAM,QAAQ,QAAQ,YAAY,MAAM,UAAU,MAAM,iBAAiB,MAAM,YAAY;EAE3F,IACE,CAAC,KAAK,WAAW,eAAe,IAAI,KAAK,WAAW,OAAO,KAC3D,OAAO,aAAa,IAAI,KAAK,WAAW,qBAExC,OAAO,KAAA;EACT,UACE,KAAK,WAAW,UAAU,KAAK,WAAW,gBAAgB,GAAG,CAAC,MAAM,QAAQ,SAC9E;EAEA,OAAO,EAAE,oBAAoB,EAAE,mBAAmB;GAChD,GAAG;GACH,UAAU;GACV,aAAa,OAAO,KAAK,QAAQ,kBAAkB,UAAU;GAC7D,QAAQ;EACV,CAAC;CACH,CAAC;CAED,MAAM,gBAAgB,OAAO,WAAW,WACtC,UACA,MACA,cACA;EAGA,IAAI,MAAM;GACR,MAAM,SACJ,OAAO,GAAqB,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,IAAI,uBAAuB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,OAAO,SAAS,EAAE,GAAG,IAAI,gBAAgB;IAAE,UAAU,GAAG;IAAc,aAAa,GAAG;IAAc,cAAc,GAAG;GAAG,CAAC;GAEhU,IAAI,OAAO,WAAW,GAAG,OAAO,KAAA;GAChC,MAAM,MAAM,QAAQ,OAAO,OAAO,IAAK,IAAI;GAE3C,IACE,CAAC,OAAO,KAAK,QAAQ,SAAS,GAAG,GAAG,QAAQ,KAC5C,CAAC,KAAK,QAAQ,eAAe,IAAI,KAAK,QAAQ,OAAO,GAErD,OAAO,KAAA;GAET,MAAM,gBAAgB,GAAG,UAAU,OAAO,OAAO,IAAI,EAAE,QAAQ,OAAO,KAAK,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,OAAO,OAAO,WAAW,EAAE,YAAY,OAAO,OAAO,KAAK,UAAU,YAAY,EAAE,YAAY,IAAI,gBAAgB;IAAE,UAAU,GAAG;IAAc,aAAa,GAAG;IAAc,cAAc,GAAG;GAAG,CAAC;GAEpX,MAAM,OACJ,iBAAiB,KAAA,IACb,OAAO,GAAqB,GAAG,kBAC/B,OAAO,GAAqB,0BAA0B,IAAI,gBAAgB;IAAE,UAAU,GAAG;IAAgB,cAAc,GAAG;GAAG,CAAC,EAAE,IAAI,cAAc;mCAC3H,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK;gBACnE,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,KAAK,WAAW,YAAY,GAAG,WAAW,MAAM,KAAK,WAAW,cAAc,YAAY,CAAC,EAAE,OAAO,OAAO,YAAY;GAEpR,UAAU,KAAK,UAAU,EAAE;GAE3B,OAAO;IACL;IACA,YACE,iBAAiB,KAAA,KAAa,KAAK,OAAO,KAAA,IACtC,KAAA,IACA,WAAW,OAAO,KAAK,IAAI,IAAI;IACrC,UAAU,SACR,KACA,KAAK,KAAK,QAAQ,OAAO,OAAO,KAAK,IAAI,CAAC,CAC5C;IACA,WAAW,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,OAAO,EAAE,CAAE,SAAS,CAAC;GAChF;EACF;EAEA,MAAM,kBAAkB,eACtB,iBAAiB;EAEnB,MAAM,OACJ,OAAO,GAAqB,UAAU,gBAAgB,OAAO,IAAI,EAAE,IAAI,eAAe,OAAO,IAAI,EAAE,IAAI,IAAI,kBAAkB,iBAAiB,KAAA,IAAY,GAAG,KAAK,GAAG,KAAK,iBAAiB,OAAO,IAAI,IAAI,QAAQ,SAAS,WAAW,iBAAiB,EAAE,aAAa,SAAS,aAAa,gBAAgB,EAAE,MAAM,eAAe,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,eAAe,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,GAAG,iBAAiB,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,SAAS,cAAc,oBAAoB,EAAE,MAAM,iBAAiB,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,iBAAiB,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,aAAa,KAAK,iBAAiB,OAAO,KAAK,WAAW,YAAY,GAAG,iBAAiB,MAAM,KAAK,WAAW,cAAc,YAAY,CAAC,IAAI,SAAS,gBAAgB,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,gBAAgB,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE;EAE33B,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,IAAI,OAAO,KAAA;EAClD,MAAM,MAAM,gBAAgB,OAAO,KAAK,IAAK,IAAI;EAEjD,IACE,CAAC,OAAO,KAAK,QAAQ,SAAS,GAAG,GAAG,QAAQ,KAC5C,CAAC,KAAK,QAAQ,eAAe,IAAI,KAAK,QAAQ,OAAO,GAErD,OAAO,KAAA;EACT,UACE,KAAK,OAAO,aAAa;GACvB,MAAM,QAAQ,gBAAgB,OAAO,UAAU,IAAI;GAEnD,OACE,OAAO,KAAK,QAAQ,SAAS,KAAK,GAAG,QAAQ,KAC7C,MAAM,KAAK,QAAQ,sBAAsB,IAAI,KAAK,QAAQ,qBAC1D,KAAK,QAAQ,eAAe,MAAM,KAAK,QAAQ,OAAO;EAE1D,CAAC,CACH;EAEA,OAAO;GACL;GACA,YAAY,iBAAiB,KAAA,IAAY,KAAA,IAAY,iBAAiB,OAAO,KAAK,IAAK,IAAI;GAC3F,UAAU,SACR,KACA,KAAK,KAAK,aAAa,eAAe,OAAO,UAAU,IAAI,CAAC,CAC9D;GACA,WAAW,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAE,SAAS,CAAC;EAC9E;CACF,CAAC;CAID,MAAM,gBAAgB,QAAQ,GAAG,iBAAiB;CAClD,MAAM,eAAe,OAAO,GAAG,gBAAgB;CAC/C,MAAM,mBAAmB,WAAW,GAAG,oBAAoB;CAE3D,MAAM,YAAY,MAA8C,UAAkB;EAGhF,OAAO,GAAG,mBAFI,SAAS,YAAY,UAAU,SAAS,cAAc,SAAS,WAAA,CAE3C,KAAK,SAAS,OAAO,IAAI,EAAE,OAAO,IAAI,KAAK;CAC/E;CAyEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAtFa,OAAO,WAAW,WAAW,MAAc,sBAA8B;GACtF,MAAM,MAAM,OAAO,qBAAqB,MAAM,oBAAoB;GAElE,IACE,QAAQ,sBAAsB,KAAK,QAAQ,EAAE,MAAM,KAAA,KACnD,WAAW,sBAAsB,KAAK,WAAW,SAAS,MAAM,KAAA,KAChE,OAAO,sBAAsB,KAAK,UAAU,SAAS,MAAM,KAAA,GAC3D;IACA,MAAM,IAAI,eACR,IAAI,kBACJ,IAAI;IAEN,MAAM,OACJ,OAAO,GAAqB,UAAU,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE;eACpF,SAAS,cAAc,oBAAoB,EAAE;eAC7C,SAAS,WAAW,iBAAiB,EAAE,MAAM,aAAa,KAAK,EAAE,OAAO,KAAK,QAAQ,EAAE,GAAG,EAAE,OAAO,KAAK,WAAW,SAAS,CAAC,EAAE;oBAC1H,SAAS,aAAa,gBAAgB,EAAE,MAAM,aAAa,KAAK,EAAE,OAAO,KAAK,UAAU,SAAS,GAAG,EAAE,OAAO,KAAK,WAAW,SAAS,CAAC,EAAE;gBAC7I,aAAa,KAAK,EAAE,OAAO,KAAK,WAAW,aAAa,GAAG,EAAE,MAAM,KAAK,WAAW,eAAe,GAAG,CAAC,EAAE;IAElH,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,IAAI,OAAO,KAAA;IAClD,MAAM,MAAM,EAAE,OAAO,KAAK,IAAK,IAAI;IACnC,MAAM,aAAa,EAAE,OAAO,KAAK,IAAK,IAAI;IAC1C,MAAM,QAAQ,KAAK,WAAW,gBAAgB,GAAG;IAEjD,UACE,IAAI,KAAK,WAAW,UAAU,QAC5B,IAAI,KAAK,WAAW,0BAA0B,oBAClD;IACA,UACE,KAAK,OAAO,aAAa;KACvB,MAAM,QAAQ,EAAE,OAAO,UAAU,IAAI;KACrC,MAAM,eAAe,EAAE,OAAO,UAAU,IAAI;KAE5C,OACE,OAAO,OAAO,KAAK,WAAW,gBAAgB,KAAK,CAAC,KACpD,OAAO,OAAO,KAAK,QAAQ,SAAS,YAAY,CAAC,KACjD,MAAM,KAAK,WAAW,kBAAkB,IAAI,KAAK,WAAW,iBAC5D,MAAM,KAAK,WAAW,wBAAwB,IAAI,KAAK,WAAW,uBAClE,aAAa,KAAK,QAAQ,sBACxB,WAAW,KAAK,QAAQ;IAE9B,CAAC,CACH;IAEA,OAAO,OAAO,iBACZ,KACA,SACE,YACA,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,CACvC,GACA,UACF;GACF;GAEA,MAAM,OACJ,OAAO,GAAqB,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,WAAW,OAAO,KAAK,WAAW,aAAa,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,eAAe,GAAG,EAAE,OAAO,OAAO,YAAY;GAEtO,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;GAC9B,MAAM,MAAM,WAAW,OAAO,KAAK,IAAK,IAAI;GAE5C,UACE,IAAI,KAAK,WAAW,UAAU,QAC5B,IAAI,KAAK,WAAW,0BAA0B,oBAClD;GACA,MAAM,UAAU,OAAO,cAAc,KAAK,WAAW,gBAAgB,GAAG,GAAG,KAAK;GAEhF,OAAO,YAAY,KAAA,IACf,KAAA,IACA,OAAO,iBAAiB,KAAK,QAAQ,UAAU,QAAQ,GAAG;EAChE,CAiBO;EACL;EACA;EACA;EACA;EACA,QAAQ;CACV;AACF,CAAC;AAED,MAAa,yBAAyB,OAAO,WAAW,WACtD,QACA,SACA;CACA,MAAM,QAAQ,OAAO,2BAA2B,QAAQ,QAAQ,MAAM,QAAQ,KAAK;CACnF,MAAM,WAAW,OAAO,sBAAsB,QAAQ,OAAO;CAE7D,OAAO;EAAE,GAAG;EAAO;EAAS;EAAU,MAAM,SAAS;EAAM,QAAQ,SAAS;CAAO;AACrF,CAAC"}

package/dist/internal/passkey-native-write.d.mts

@@ -0,0 +1,82 @@
+import { TableModel } from "./table-model.mjs";
+import "./mapping-error.mjs";
+import { PasskeyManagementMapping } from "./models/passkey-write-model.mjs";
+import "./native-sql-table.mjs";
+import "./sql-commit.mjs";
+import "./passkey-native-state.mjs";
+import { NativePasskeyServices } from "./passkey-native.mjs";
+import { Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import { Fragment } from "effect/sql/Statement";
+import * as M from "@yielded/auth/Passkey";
+//#region src/internal/passkey-native-write.d.ts
+export type NativePasskeyManagementMapping = PasskeyManagementMapping<TableModel, TableModel, TableModel, TableModel, unknown, any>;
+export declare const makePasskeyNativeManagement: (base: NativePasskeyServices, mapping: NativePasskeyManagementMapping) => {
+  passkeyManagementPersistence: {
+    readonly list: (input: {
+      readonly moduleId: string;
+      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+      readonly cursor?: string;
+      readonly limit: number;
+    }) => Effect.Effect<{
+      readonly credentials: ReadonlyArray<M.PasskeyCredentialSummary>;
+      readonly cursor?: string;
+    }, M.PasskeyUnavailable>;
+    readonly completeEnrollment: <A>(input: {
+      readonly access: M.PasskeyAccess;
+      readonly ceremony: M.PasskeyCeremony;
+      readonly verified: M.PasskeyRegistrationVerified;
+      readonly management: M.PasskeyManagementPolicy;
+    }, prepare: M.PreparePasskeyCommit<{
+      readonly _tag: "Enrolled";
+      readonly credential: M.PasskeyCredentialSummary;
+    } | {
+      readonly _tag: "Rejected";
+    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.PasskeyUnavailable>;
+    readonly inspectRemove: (input: {
+      readonly moduleId: string;
+      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+      readonly credentialId: string;
+    }) => Effect.Effect<{
+      readonly _tag: "Target";
+      readonly credential: M.PasskeyCredential;
+    } | {
+      readonly _tag: "Rejected";
+    }, M.PasskeyUnavailable>;
+    readonly remove: <A>(input: {
+      readonly moduleId: string;
+      readonly commandId: string;
+      readonly credential: M.PasskeyCredential;
+      readonly authorization: M.PasskeyActionAuthorization;
+      readonly management: M.PasskeyManagementPolicy;
+      readonly invalidation: import("@yielded/auth/Sessions").SessionInvalidationWindow;
+    }, prepare: M.PreparePasskeyCommit<{
+      readonly _tag: "Removed";
+      readonly result: {
+        readonly credentialId: string;
+        readonly invalidation: {
+          readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
+          readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
+          readonly maximumExposureMillis: number;
+          readonly oldAuthenticationEvidence: "rejected";
+        };
+      };
+    } | {
+      readonly _tag: "Rejected" | "LastSignInMethod";
+    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.PasskeyUnavailable>;
+    readonly rename: <A>(input: {
+      readonly moduleId: string;
+      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
+      readonly commandId: string;
+      readonly credentialId: string;
+      readonly name: string;
+    }, prepare: M.PreparePasskeyCommit<{
+      readonly _tag: "Renamed";
+      readonly credential: M.PasskeyCredentialSummary;
+    } | {
+      readonly _tag: "Rejected";
+    }, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.PasskeyUnavailable>;
+  };
+};
+//#endregion
+//# sourceMappingURL=passkey-native-write.d.mts.map