@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/internal/passkey-native.mjs

@@ -0,0 +1,175 @@
+import { sqlBatchAssertion } from "./d1-planning.mjs";
+import { exactSqlText } from "./sql-change.mjs";
+import { CurrentSqlCommit, SqlBatchCommit, makeSqlCommitExecutor, registerSqlBatchPostcondition, registerSqlCommitReceipt, registerSqlPostcondition } from "./sql-commit.mjs";
+import { passkeyOperationInputs } from "./passkey-inputs.mjs";
+import { passkeyAssertionPurposes, passkeyCredentialKey, passkeyMatchesAccess, validPasskeyCeremony } from "./passkey-policy.mjs";
+import { makePasskeyNativeReadState, makePasskeyNativeState, passkeyNativeInvariant } from "./passkey-native-state.mjs";
+import { Crypto, Effect, Option, Schema } from "effect";
+import { CurrentCommitJournal } from "@yielded/auth/Hooks";
+import * as M from "@yielded/auth/Passkey";
+import { SqlError } from "effect/sql/SqlError";
+//#region src/internal/passkey-native.ts
+const unavailable = () => M.PasskeyUnavailable.make({});
+const preparePasskeyNative = (value, prepare) => Effect.gen(function* () {
+	const receipt = prepare(value, yield* CurrentCommitJournal);
+	passkeyNativeInvariant(receipt?._tag === "PreparedCommit" && Effect.isEffect(receipt.read));
+	yield* registerSqlCommitReceipt(receipt);
+	return receipt;
+});
+const services = Effect.fnUntraced(function* (tables, mapping, batch) {
+	const boundOwner = yield* Effect.serviceOption(CurrentSqlCommit);
+	const state = yield* makePasskeyNativeState(tables, mapping);
+	const executor = yield* makeSqlCommitExecutor(unavailable);
+	const crypto = yield* Crypto.Crypto;
+	const { sql, ceremony: flow, credential } = state;
+	const read = mapping.read;
+	const provide = (effect) => Effect.provideService(effect, Crypto.Crypto, crypto);
+	const run = (effect, mode = "transaction") => batch === void 0 ? executor.run(provide(effect), mode) : executor.batch(provide(effect)).pipe(Effect.provideService(SqlBatchCommit, batch));
+	const advisory = (effect) => executor.read(provide(effect));
+	const issue = (original, prepare) => run(Effect.gen(function* () {
+		const ceremony = M.snapshotPasskeySync(passkeyOperationInputs.issue, original).ceremony;
+		if (!flow.validModule(ceremony.moduleId) || !validPasskeyCeremony(ceremony) || ceremony.purpose === "registration") return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+		const statement = flow.insert(ceremony);
+		let changed;
+		if (batch !== void 0) {
+			yield* flow.stage(statement, 1);
+			changed = 1;
+		} else changed = yield* flow.change(statement).pipe(Effect.catchIf((error) => Schema.is(SqlError)(error) && error.reason._tag === "UniqueViolation", () => Effect.succeed(0)));
+		return yield* preparePasskeyNative(changed === 1 ? {
+			_tag: "Issued",
+			ceremony
+		} : { _tag: "Rejected" }, prepare);
+	}), "statement");
+	const persistence = {
+		issue,
+		context: (original) => advisory(Effect.suspend(() => flow.context(M.snapshotPasskeySync(M.PasskeyAccess, original)))),
+		consume: (original, prepare) => run(Effect.gen(function* () {
+			const input = M.snapshotPasskeySync(passkeyOperationInputs.consume, original);
+			const captured = input.credential;
+			const revision = captured.revision.credentials.find((entry) => entry.credentialId === captured.credentialId);
+			const assertion = input.assertion;
+			if (!flow.validModule(input.access.moduleId) || !passkeyMatchesAccess(input.ceremony, input.access) || !passkeyAssertionPurposes.some((purpose) => purpose === input.ceremony.purpose) || !validPasskeyCeremony(input.ceremony) || revision === void 0 || !captured.active || captured.rpId !== input.ceremony.profile.rpId || assertion.protocolCredentialId !== captured.protocolCredentialId || assertion.backupEligible !== captured.backupEligible || assertion.userHandle !== void 0 && assertion.userHandle !== captured.userHandle) return yield* preparePasskeyNative("Rejected", prepare);
+			const consumed = flow.consume(input.access, input.ceremony);
+			if (batch === void 0) {
+				if ((yield* flow.change(consumed)) !== 1) return yield* preparePasskeyNative("Rejected", prepare);
+			} else yield* flow.stage(consumed, 1);
+			const key = yield* passkeyCredentialKey(captured.rpId, captured.protocolCredentialId);
+			const exact = (column, value) => exactSqlText(sql, credential.column(column), credential.value(column, value));
+			const counter = credential.column(read.credential.counter);
+			const next = credential.value(read.credential.counter, assertion.counter);
+			const merged = captured.backupEligible ? sql`case when ${counter} > ${next} then ${counter} else ${next} end` : next;
+			const identity = [
+				exact(read.credential.credentialId, captured.credentialId),
+				exact(read.credential.credentialKey, key),
+				exact(read.credential.credentialRevision, revision.revision),
+				sql`${credential.column(read.credential.backupEligible)} = ${credential.value(read.credential.backupEligible, mapping.telemetry.encodeBackupEligible(captured.backupEligible))}`,
+				state.active("credential")
+			];
+			const statement = sql`${credential.update({
+				[read.credential.counter]: merged,
+				[read.credential.backupState]: mapping.telemetry.encodeBackupState(assertion.backupState),
+				[mapping.telemetry.lastUsedAt]: state.storedNow
+			})} where ${sql.and([...identity, captured.backupEligible ? sql`true` : sql`((${counter} = 0 and ${next} = 0) or ${counter} < ${next})`])}`;
+			let changed;
+			if (batch === void 0) {
+				changed = yield* flow.change(statement);
+				if (changed === 0 && sql.onDialectOrElse({
+					mysql: () => true,
+					orElse: () => false
+				}) && (captured.backupEligible || assertion.counter === 0)) {
+					if ((yield* sql`select 1 as matched from ${credential.name} where ${sql.and(identity)} and ${captured.backupEligible ? sql`${counter} >= ${next}` : sql`${counter} = 0`} and ${credential.column(read.credential.backupState)} = ${credential.value(read.credential.backupState, mapping.telemetry.encodeBackupState(assertion.backupState))}`).length === 1) changed = 1;
+				}
+			} else {
+				yield* flow.stage(statement, 1);
+				changed = 1;
+			}
+			if (Option.isSome(boundOwner)) {
+				const acceptedCounter = captured.backupEligible ? sql`${counter} >= ${credential.value(read.credential.counter, Math.max(captured.counter, assertion.counter))}` : sql`${counter} = ${next}`;
+				const condition = sql.and([flow.absent(input.access), changed === 1 ? sql`exists(select 1 from ${credential.name} where ${sql.and(identity)} and ${acceptedCounter}
+                    and ${credential.column(read.credential.backupState)} = ${credential.value(read.credential.backupState, mapping.telemetry.encodeBackupState(assertion.backupState))})` : sql`true`]);
+				if (batch === void 0) yield* registerSqlPostcondition({
+					name: "passkey-consume-preserved",
+					check: Effect.gen(function* () {
+						const rows = yield* sql`select 1 where ${condition}`;
+						passkeyNativeInvariant(rows.length === 1);
+					})
+				});
+				else yield* registerSqlBatchPostcondition({
+					name: "passkey-consume-preserved",
+					statement: sqlBatchAssertion(sql, condition)
+				});
+			}
+			return yield* preparePasskeyNative(changed === 1 ? "Verified" : "Rejected", prepare);
+		})),
+		cleanup: (original, prepare) => run(Effect.gen(function* () {
+			const input = M.snapshotPasskeySync(passkeyOperationInputs.cleanup, original);
+			passkeyNativeInvariant(flow.validModule(input.moduleId));
+			return yield* preparePasskeyNative(yield* flow.cleanup(input.moduleId, input.limit, batch !== void 0), prepare);
+		}), "statement")
+	};
+	const credentials = makePasskeyNativeCredentialService(state, read, advisory);
+	return {
+		batch: batch !== void 0,
+		state,
+		executor,
+		run,
+		advisory,
+		passkeyPersistence: persistence,
+		passkeyCredentials: credentials
+	};
+});
+const makeNativePasskeyServices = (tables, mapping) => services(tables, mapping);
+const makeBatchPasskeyServices = (tables, mapping) => Effect.flatMap(SqlBatchCommit, (batch) => services(tables, mapping, batch));
+const makePasskeyNativeCredentialService = (state, read, advisory) => {
+	const { sql, joinedSubject: subject, joinedFactor: factor, joinedCredential: credential } = state;
+	return {
+		lookup: (original) => advisory(Effect.gen(function* () {
+			const input = M.snapshotPasskeySync(passkeyOperationInputs.lookup, original);
+			return yield* state.lookup(input.rpId, input.protocolCredentialId);
+		})),
+		listForSubject: (original) => advisory(Effect.gen(function* () {
+			const input = M.snapshotPasskeySync(passkeyOperationInputs.listForSubject, original);
+			const nativeId = state.native(input.subjectId);
+			const rows = yield* sql`select ${subject.fields("s_")}, ${factor.fields("f_")}, ${credential.fields("c_")}
+        from ${state.selected("subject", "passkey_subject")}
+        left join ${state.selected("authority", "passkey_factor")} on ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)}
+        left join ${state.selected("credential", "passkey_credential")} on ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${credential.column(read.credential.rpId)} = ${credential.value(read.credential.rpId, input.rpId)}
+        where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} limit 4097`;
+			if (rows.length === 0 || rows.length > 4096) return void 0;
+			const subjectRow = subject.decode(rows[0], "s_");
+			passkeyNativeInvariant(rows.every((selected) => {
+				const other = subject.decode(selected, "s_");
+				return state.sameId(read.subject.decodeId(other), nativeId) && other[read.subject.securityRevision] === subjectRow[read.subject.securityRevision];
+			}));
+			const revision = state.revision(subjectRow, rows.map((row) => factor.decode(row, "f_")));
+			passkeyNativeInvariant(revision.subjectId === input.subjectId);
+			const values = /* @__PURE__ */ new Map();
+			for (const selected of rows) {
+				const row = credential.decode(selected, "c_");
+				if (row[read.credential.credentialId] === null) continue;
+				const decoded = yield* state.decodeCredential(row, revision, subjectRow);
+				if (decoded !== void 0) values.set(decoded.credentialId, decoded);
+			}
+			const userHandle = values.values().next().value?.userHandle;
+			return M.snapshotPasskeySync(M.PasskeyEnrollmentSnapshot, {
+				revision,
+				...userHandle === void 0 ? {} : { userHandle },
+				credentials: [...values.values()].map((value) => ({
+					type: "public-key",
+					id: value.protocolCredentialId
+				}))
+			});
+		}))
+	};
+};
+const makeNativePasskeyCredentialServices = Effect.fnUntraced(function* (tables, mapping) {
+	const state = yield* makePasskeyNativeReadState(tables, mapping);
+	const executor = yield* makeSqlCommitExecutor(unavailable);
+	const crypto = yield* Crypto.Crypto;
+	const advisory = (effect) => executor.read(Effect.provideService(effect, Crypto.Crypto, crypto));
+	return { passkeyCredentials: makePasskeyNativeCredentialService(state, mapping, advisory) };
+});
+//#endregion
+export { makeBatchPasskeyServices, makeNativePasskeyCredentialServices, makeNativePasskeyServices, preparePasskeyNative };
+
+//# sourceMappingURL=passkey-native.mjs.map

package/dist/internal/passkey-native.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-native.mjs","names":[],"sources":["../../src/internal/passkey-native.ts"],"sourcesContent":["import { CurrentCommitJournal } from \"@yielded/auth/Hooks\";\nimport * as M from \"@yielded/auth/Passkey\";\nimport { Crypto, Effect, Option, Schema } from \"effect\";\nimport { SqlError } from \"effect/sql/SqlError\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { passkeyOperationInputs } from \"./passkey-inputs\";\nimport {\n  makePasskeyNativeReadState,\n  makePasskeyNativeState,\n  passkeyNativeInvariant,\n  type PasskeyNativeMapping,\n  type PasskeyNativeRead,\n  type PasskeyNativeReadState,\n} from \"./passkey-native-state\";\nimport {\n  passkeyAssertionPurposes,\n  passkeyCredentialKey,\n  passkeyMatchesAccess,\n  validPasskeyCeremony,\n} from \"./passkey-policy\";\nimport { exactSqlText } from \"./sql-change\";\nimport {\n  CurrentSqlCommit,\n  makeSqlCommitExecutor,\n  registerSqlCommitReceipt,\n  registerSqlPostcondition,\n  registerSqlBatchPostcondition,\n  SqlBatchCommit,\n} from \"./sql-commit\";\n\nconst unavailable = () => M.PasskeyUnavailable.make({});\n\nexport const preparePasskeyNative = <Value, A>(\n  value: Value,\n  prepare: M.PreparePasskeyCommit<Value, A>,\n) =>\n  Effect.gen(function* () {\n    const journal = yield* CurrentCommitJournal;\n\n    const receipt = prepare(value, journal);\n\n    passkeyNativeInvariant(receipt?._tag === \"PreparedCommit\" && Effect.isEffect(receipt.read));\n    yield* registerSqlCommitReceipt(receipt);\n\n    return receipt;\n  });\n\nconst services = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: PasskeyNativeMapping,\n  batch?: SqlBatchCommit[\"Service\"],\n) {\n  const boundOwner = yield* Effect.serviceOption(CurrentSqlCommit);\n  const state = yield* makePasskeyNativeState(tables, mapping);\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const crypto = yield* Crypto.Crypto;\n  const { sql, ceremony: flow, credential } = state;\n  const read = mapping.read;\n\n  const provide = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    Effect.provideService(effect, Crypto.Crypto, crypto);\n\n  const run = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n    mode: \"transaction\" | \"statement\" = \"transaction\",\n  ) =>\n    batch === undefined\n      ? executor.run(provide(effect), mode)\n      : executor.batch(provide(effect)).pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const advisory = <A, E, R>(effect: Effect.Effect<A, E, R>) => executor.read(provide(effect));\n\n  const issue: M.PasskeyPersistence[\"Service\"][\"issue\"] = (original, prepare) =>\n    run(\n      Effect.gen(function* () {\n        const input = M.snapshotPasskeySync(passkeyOperationInputs.issue, original);\n        const ceremony = input.ceremony;\n\n        if (\n          !flow.validModule(ceremony.moduleId) ||\n          !validPasskeyCeremony(ceremony) ||\n          ceremony.purpose === \"registration\"\n        )\n          return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n        const statement = flow.insert(ceremony);\n        let changed: number;\n\n        if (batch !== undefined) {\n          yield* flow.stage(statement, 1);\n          changed = 1;\n        } else {\n          changed = yield* flow.change(statement).pipe(\n            Effect.catchIf(\n              (error) => Schema.is(SqlError)(error) && error.reason._tag === \"UniqueViolation\",\n              () => Effect.succeed(0),\n            ),\n          );\n        }\n\n        return yield* preparePasskeyNative(\n          changed === 1 ? { _tag: \"Issued\", ceremony } : { _tag: \"Rejected\" },\n          prepare,\n        );\n      }),\n      \"statement\",\n    );\n\n  const persistence: M.PasskeyPersistence[\"Service\"] = {\n    issue,\n    context: (original) =>\n      advisory(\n        Effect.suspend(() => flow.context(M.snapshotPasskeySync(M.PasskeyAccess, original))),\n      ),\n    consume: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyOperationInputs.consume, original);\n          const captured = input.credential;\n\n          const revision = captured.revision.credentials.find(\n            (entry) => entry.credentialId === captured.credentialId,\n          );\n\n          const assertion = input.assertion;\n\n          if (\n            !flow.validModule(input.access.moduleId) ||\n            !passkeyMatchesAccess(input.ceremony, input.access) ||\n            !passkeyAssertionPurposes.some((purpose) => purpose === input.ceremony.purpose) ||\n            !validPasskeyCeremony(input.ceremony) ||\n            revision === undefined ||\n            !captured.active ||\n            captured.rpId !== input.ceremony.profile.rpId ||\n            assertion.protocolCredentialId !== captured.protocolCredentialId ||\n            assertion.backupEligible !== captured.backupEligible ||\n            (assertion.userHandle !== undefined && assertion.userHandle !== captured.userHandle)\n          )\n            return yield* preparePasskeyNative(\"Rejected\", prepare);\n          const consumed = flow.consume(input.access, input.ceremony);\n\n          if (batch === undefined) {\n            if ((yield* flow.change(consumed)) !== 1)\n              return yield* preparePasskeyNative(\"Rejected\", prepare);\n          } else yield* flow.stage(consumed, 1);\n          const key = yield* passkeyCredentialKey(captured.rpId, captured.protocolCredentialId);\n\n          const exact = (column: string, value: unknown) =>\n            exactSqlText(sql, credential.column(column), credential.value(column, value));\n\n          const counter = credential.column(read.credential.counter);\n          const next = credential.value(read.credential.counter, assertion.counter);\n\n          const merged = captured.backupEligible\n            ? sql`case when ${counter} > ${next} then ${counter} else ${next} end`\n            : next;\n\n          const identity = [\n            exact(read.credential.credentialId, captured.credentialId),\n            exact(read.credential.credentialKey, key),\n            exact(read.credential.credentialRevision, revision.revision),\n            sql`${credential.column(read.credential.backupEligible)} = ${credential.value(read.credential.backupEligible, mapping.telemetry.encodeBackupEligible(captured.backupEligible))}`,\n            state.active(\"credential\"),\n          ];\n\n          const statement = sql`${credential.update({\n            [read.credential.counter]: merged,\n            [read.credential.backupState]: mapping.telemetry.encodeBackupState(\n              assertion.backupState,\n            ),\n            [mapping.telemetry.lastUsedAt]: state.storedNow,\n          })} where ${sql.and([\n            ...identity,\n            captured.backupEligible\n              ? sql`true`\n              : sql`((${counter} = 0 and ${next} = 0) or ${counter} < ${next})`,\n          ])}`;\n\n          let changed: number;\n\n          if (batch === undefined) {\n            changed = yield* flow.change(statement);\n            if (\n              changed === 0 &&\n              sql.onDialectOrElse({ mysql: () => true, orElse: () => false }) &&\n              (captured.backupEligible || assertion.counter === 0)\n            ) {\n              // mysql2 can disable FOUND_ROWS. The UPDATE still holds the row lock;\n              // prove the unchanged telemetry matched this exact semantic key.\n              const matched =\n                yield* sql`select 1 as matched from ${credential.name} where ${sql.and(identity)} and ${captured.backupEligible ? sql`${counter} >= ${next}` : sql`${counter} = 0`} and ${credential.column(read.credential.backupState)} = ${credential.value(read.credential.backupState, mapping.telemetry.encodeBackupState(assertion.backupState))}`;\n\n              if (matched.length === 1) changed = 1;\n            }\n          } else {\n            yield* flow.stage(statement, 1);\n            changed = 1;\n          }\n\n          if (Option.isSome(boundOwner)) {\n            // Protect the accepted result from later bound application SQL. BE\n            // retains the observed accepted floor; it does not compare an entire\n            // telemetry snapshot or reject valid out-of-order assertions.\n            const acceptedCounter = captured.backupEligible\n              ? sql`${counter} >= ${credential.value(read.credential.counter, Math.max(captured.counter, assertion.counter))}`\n              : sql`${counter} = ${next}`;\n\n            const condition = sql.and([\n              flow.absent(input.access),\n              changed === 1\n                ? sql`exists(select 1 from ${credential.name} where ${sql.and(identity)} and ${acceptedCounter}\n                    and ${credential.column(read.credential.backupState)} = ${credential.value(read.credential.backupState, mapping.telemetry.encodeBackupState(assertion.backupState))})`\n                : sql`true`,\n            ]);\n\n            if (batch === undefined) {\n              yield* registerSqlPostcondition({\n                name: \"passkey-consume-preserved\",\n                check: Effect.gen(function* () {\n                  const rows = yield* sql`select 1 where ${condition}`;\n\n                  passkeyNativeInvariant(rows.length === 1);\n                }),\n              });\n            } else {\n              yield* registerSqlBatchPostcondition({\n                name: \"passkey-consume-preserved\",\n                statement: sqlBatchAssertion(sql, condition),\n              });\n            }\n          }\n\n          return yield* preparePasskeyNative(changed === 1 ? \"Verified\" : \"Rejected\", prepare);\n        }),\n      ),\n    cleanup: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyOperationInputs.cleanup, original);\n\n          passkeyNativeInvariant(flow.validModule(input.moduleId));\n\n          return yield* preparePasskeyNative(\n            yield* flow.cleanup(input.moduleId, input.limit, batch !== undefined),\n            prepare,\n          );\n        }),\n        \"statement\",\n      ),\n  };\n\n  const credentials = makePasskeyNativeCredentialService(state, read, advisory);\n\n  return {\n    batch: batch !== undefined,\n    state,\n    executor,\n    run,\n    advisory,\n    passkeyPersistence: persistence,\n    passkeyCredentials: credentials,\n  };\n});\n\nexport const makeNativePasskeyServices = (tables: NativeSqlTables, mapping: PasskeyNativeMapping) =>\n  services(tables, mapping);\n\nexport const makeBatchPasskeyServices = (tables: NativeSqlTables, mapping: PasskeyNativeMapping) =>\n  Effect.flatMap(SqlBatchCommit, (batch) => services(tables, mapping, batch));\n\nexport type NativePasskeyServices = Effect.Success<ReturnType<typeof makeNativePasskeyServices>>;\n\nconst makePasskeyNativeCredentialService = (\n  state: PasskeyNativeReadState,\n  read: PasskeyNativeRead,\n  advisory: <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ) => Effect.Effect<\n    A,\n    M.PasskeyUnavailable,\n    Exclude<\n      Exclude<Exclude<R, Crypto.Crypto>, import(\"effect/sql/SqlClient\").SqlClient>,\n      import(\"@yielded/auth/Hooks\").LifecycleHooks\n    >\n  >,\n) => {\n  const { sql, joinedSubject: subject, joinedFactor: factor, joinedCredential: credential } = state;\n\n  const credentials: M.PasskeyCredentials[\"Service\"] = {\n    lookup: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyOperationInputs.lookup, original);\n\n          return yield* state.lookup(input.rpId, input.protocolCredentialId);\n        }),\n      ),\n    listForSubject: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyOperationInputs.listForSubject, original);\n\n          const nativeId = state.native(input.subjectId);\n\n          const rows =\n            yield* sql`select ${subject.fields(\"s_\")}, ${factor.fields(\"f_\")}, ${credential.fields(\"c_\")}\n        from ${state.selected(\"subject\", \"passkey_subject\")}\n        left join ${state.selected(\"authority\", \"passkey_factor\")} on ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)}\n        left join ${state.selected(\"credential\", \"passkey_credential\")} on ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${credential.column(read.credential.rpId)} = ${credential.value(read.credential.rpId, input.rpId)}\n        where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} limit 4097`;\n\n          if (rows.length === 0 || rows.length > 4096) return undefined;\n          const subjectRow = subject.decode(rows[0]!, \"s_\");\n\n          passkeyNativeInvariant(\n            rows.every((selected) => {\n              const other = subject.decode(selected, \"s_\");\n\n              return (\n                state.sameId(read.subject.decodeId(other), nativeId) &&\n                other[read.subject.securityRevision] === subjectRow[read.subject.securityRevision]\n              );\n            }),\n          );\n\n          const revision = state.revision(\n            subjectRow,\n            rows.map((row) => factor.decode(row, \"f_\")),\n          );\n\n          passkeyNativeInvariant(revision.subjectId === input.subjectId);\n          const values = new Map<string, M.PasskeyCredential>();\n\n          for (const selected of rows) {\n            const row = credential.decode(selected, \"c_\");\n\n            if (row[read.credential.credentialId] === null) continue;\n            const decoded = yield* state.decodeCredential(row, revision, subjectRow);\n\n            if (decoded !== undefined) values.set(decoded.credentialId, decoded);\n          }\n          const userHandle = values.values().next().value?.userHandle;\n\n          return M.snapshotPasskeySync(M.PasskeyEnrollmentSnapshot, {\n            revision,\n            ...(userHandle === undefined ? {} : { userHandle }),\n            credentials: [...values.values()].map((value) => ({\n              type: \"public-key\" as const,\n              id: value.protocolCredentialId,\n            })),\n          });\n        }),\n      ),\n  };\n\n  return credentials;\n};\n\nexport const makeNativePasskeyCredentialServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: PasskeyNativeRead,\n) {\n  const state = yield* makePasskeyNativeReadState(tables, mapping);\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const crypto = yield* Crypto.Crypto;\n\n  const advisory = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    executor.read(Effect.provideService(effect, Crypto.Crypto, crypto));\n\n  return { passkeyCredentials: makePasskeyNativeCredentialService(state, mapping, advisory) };\n});\n"],"mappings":";;;;;;;;;;;AAgCA,MAAM,oBAAoB,EAAE,mBAAmB,KAAK,CAAC,CAAC;AAEtD,MAAa,wBACX,OACA,YAEA,OAAO,IAAI,aAAa;CAGtB,MAAM,UAAU,QAAQ,OAAO,OAFR,oBAEe;CAEtC,uBAAuB,SAAS,SAAS,oBAAoB,OAAO,SAAS,QAAQ,IAAI,CAAC;CAC1F,OAAO,yBAAyB,OAAO;CAEvC,OAAO;AACT,CAAC;AAEH,MAAM,WAAW,OAAO,WAAW,WACjC,QACA,SACA,OACA;CACA,MAAM,aAAa,OAAO,OAAO,cAAc,gBAAgB;CAC/D,MAAM,QAAQ,OAAO,uBAAuB,QAAQ,OAAO;CAC3D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,EAAE,KAAK,UAAU,MAAM,eAAe;CAC5C,MAAM,OAAO,QAAQ;CAErB,MAAM,WAAoB,WACxB,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM;CAErD,MAAM,OACJ,QACA,OAAoC,kBAEpC,UAAU,KAAA,IACN,SAAS,IAAI,QAAQ,MAAM,GAAG,IAAI,IAClC,SAAS,MAAM,QAAQ,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAEvF,MAAM,YAAqB,WAAmC,SAAS,KAAK,QAAQ,MAAM,CAAC;CAE3F,MAAM,SAAmD,UAAU,YACjE,IACE,OAAO,IAAI,aAAa;EAEtB,MAAM,WADQ,EAAE,oBAAoB,uBAAuB,OAAO,QAC7C,CAAC,CAAC;EAEvB,IACE,CAAC,KAAK,YAAY,SAAS,QAAQ,KACnC,CAAC,qBAAqB,QAAQ,KAC9B,SAAS,YAAY,gBAErB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;EAClE,MAAM,YAAY,KAAK,OAAO,QAAQ;EACtC,IAAI;EAEJ,IAAI,UAAU,KAAA,GAAW;GACvB,OAAO,KAAK,MAAM,WAAW,CAAC;GAC9B,UAAU;EACZ,OACE,UAAU,OAAO,KAAK,OAAO,SAAS,CAAC,CAAC,KACtC,OAAO,SACJ,UAAU,OAAO,GAAG,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM,OAAO,SAAS,yBACzD,OAAO,QAAQ,CAAC,CACxB,CACF;EAGF,OAAO,OAAO,qBACZ,YAAY,IAAI;GAAE,MAAM;GAAU;EAAS,IAAI,EAAE,MAAM,WAAW,GAClE,OACF;CACF,CAAC,GACD,WACF;CAEF,MAAM,cAA+C;EACnD;EACA,UAAU,aACR,SACE,OAAO,cAAc,KAAK,QAAQ,EAAE,oBAAoB,EAAE,eAAe,QAAQ,CAAC,CAAC,CACrF;EACF,UAAU,UAAU,YAClB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,uBAAuB,SAAS,QAAQ;GAC5E,MAAM,WAAW,MAAM;GAEvB,MAAM,WAAW,SAAS,SAAS,YAAY,MAC5C,UAAU,MAAM,iBAAiB,SAAS,YAC7C;GAEA,MAAM,YAAY,MAAM;GAExB,IACE,CAAC,KAAK,YAAY,MAAM,OAAO,QAAQ,KACvC,CAAC,qBAAqB,MAAM,UAAU,MAAM,MAAM,KAClD,CAAC,yBAAyB,MAAM,YAAY,YAAY,MAAM,SAAS,OAAO,KAC9E,CAAC,qBAAqB,MAAM,QAAQ,KACpC,aAAa,KAAA,KACb,CAAC,SAAS,UACV,SAAS,SAAS,MAAM,SAAS,QAAQ,QACzC,UAAU,yBAAyB,SAAS,wBAC5C,UAAU,mBAAmB,SAAS,kBACrC,UAAU,eAAe,KAAA,KAAa,UAAU,eAAe,SAAS,YAEzE,OAAO,OAAO,qBAAqB,YAAY,OAAO;GACxD,MAAM,WAAW,KAAK,QAAQ,MAAM,QAAQ,MAAM,QAAQ;GAE1D,IAAI,UAAU,KAAA,GACP;SAAA,OAAO,KAAK,OAAO,QAAQ,OAAO,GACrC,OAAO,OAAO,qBAAqB,YAAY,OAAO;GAAA,OACnD,OAAO,KAAK,MAAM,UAAU,CAAC;GACpC,MAAM,MAAM,OAAO,qBAAqB,SAAS,MAAM,SAAS,oBAAoB;GAEpF,MAAM,SAAS,QAAgB,UAC7B,aAAa,KAAK,WAAW,OAAO,MAAM,GAAG,WAAW,MAAM,QAAQ,KAAK,CAAC;GAE9E,MAAM,UAAU,WAAW,OAAO,KAAK,WAAW,OAAO;GACzD,MAAM,OAAO,WAAW,MAAM,KAAK,WAAW,SAAS,UAAU,OAAO;GAExE,MAAM,SAAS,SAAS,iBACpB,GAAG,aAAa,QAAQ,KAAK,KAAK,QAAQ,QAAQ,QAAQ,KAAK,QAC/D;GAEJ,MAAM,WAAW;IACf,MAAM,KAAK,WAAW,cAAc,SAAS,YAAY;IACzD,MAAM,KAAK,WAAW,eAAe,GAAG;IACxC,MAAM,KAAK,WAAW,oBAAoB,SAAS,QAAQ;IAC3D,GAAG,GAAG,WAAW,OAAO,KAAK,WAAW,cAAc,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,gBAAgB,QAAQ,UAAU,qBAAqB,SAAS,cAAc,CAAC;IAC7K,MAAM,OAAO,YAAY;GAC3B;GAEA,MAAM,YAAY,GAAG,GAAG,WAAW,OAAO;KACvC,KAAK,WAAW,UAAU;KAC1B,KAAK,WAAW,cAAc,QAAQ,UAAU,kBAC/C,UAAU,WACZ;KACC,QAAQ,UAAU,aAAa,MAAM;GACxC,CAAC,EAAE,SAAS,IAAI,IAAI,CAClB,GAAG,UACH,SAAS,iBACL,GAAG,SACH,GAAG,KAAK,QAAQ,WAAW,KAAK,WAAW,QAAQ,KAAK,KAAK,EACnE,CAAC;GAED,IAAI;GAEJ,IAAI,UAAU,KAAA,GAAW;IACvB,UAAU,OAAO,KAAK,OAAO,SAAS;IACtC,IACE,YAAY,KACZ,IAAI,gBAAgB;KAAE,aAAa;KAAM,cAAc;IAAM,CAAC,MAC7D,SAAS,kBAAkB,UAAU,YAAY,IAO9C;UAAA,OAFK,GAAG,4BAA4B,WAAW,KAAK,SAAS,IAAI,IAAI,QAAQ,EAAE,OAAO,SAAS,iBAAiB,GAAG,GAAG,QAAQ,MAAM,SAAS,GAAG,GAAG,QAAQ,MAAM,OAAO,WAAW,OAAO,KAAK,WAAW,WAAW,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,aAAa,QAAQ,UAAU,kBAAkB,UAAU,WAAW,CAAC,IAAA,CAE5T,WAAW,GAAG,UAAU;IAAA;GAExC,OAAO;IACL,OAAO,KAAK,MAAM,WAAW,CAAC;IAC9B,UAAU;GACZ;GAEA,IAAI,OAAO,OAAO,UAAU,GAAG;IAI7B,MAAM,kBAAkB,SAAS,iBAC7B,GAAG,GAAG,QAAQ,MAAM,WAAW,MAAM,KAAK,WAAW,SAAS,KAAK,IAAI,SAAS,SAAS,UAAU,OAAO,CAAC,MAC3G,GAAG,GAAG,QAAQ,KAAK;IAEvB,MAAM,YAAY,IAAI,IAAI,CACxB,KAAK,OAAO,MAAM,MAAM,GACxB,YAAY,IACR,GAAG,wBAAwB,WAAW,KAAK,SAAS,IAAI,IAAI,QAAQ,EAAE,OAAO,gBAAgB;0BACrF,WAAW,OAAO,KAAK,WAAW,WAAW,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,aAAa,QAAQ,UAAU,kBAAkB,UAAU,WAAW,CAAC,EAAE,KACtK,GAAG,MACT,CAAC;IAED,IAAI,UAAU,KAAA,GACZ,OAAO,yBAAyB;KAC9B,MAAM;KACN,OAAO,OAAO,IAAI,aAAa;MAC7B,MAAM,OAAO,OAAO,GAAG,kBAAkB;MAEzC,uBAAuB,KAAK,WAAW,CAAC;KAC1C,CAAC;IACH,CAAC;SAED,OAAO,8BAA8B;KACnC,MAAM;KACN,WAAW,kBAAkB,KAAK,SAAS;IAC7C,CAAC;GAEL;GAEA,OAAO,OAAO,qBAAqB,YAAY,IAAI,aAAa,YAAY,OAAO;EACrF,CAAC,CACH;EACF,UAAU,UAAU,YAClB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,uBAAuB,SAAS,QAAQ;GAE5E,uBAAuB,KAAK,YAAY,MAAM,QAAQ,CAAC;GAEvD,OAAO,OAAO,qBACZ,OAAO,KAAK,QAAQ,MAAM,UAAU,MAAM,OAAO,UAAU,KAAA,CAAS,GACpE,OACF;EACF,CAAC,GACD,WACF;CACJ;CAEA,MAAM,cAAc,mCAAmC,OAAO,MAAM,QAAQ;CAE5E,OAAO;EACL,OAAO,UAAU,KAAA;EACjB;EACA;EACA;EACA;EACA,oBAAoB;EACpB,oBAAoB;CACtB;AACF,CAAC;AAED,MAAa,6BAA6B,QAAyB,YACjE,SAAS,QAAQ,OAAO;AAE1B,MAAa,4BAA4B,QAAyB,YAChE,OAAO,QAAQ,iBAAiB,UAAU,SAAS,QAAQ,SAAS,KAAK,CAAC;AAI5E,MAAM,sCACJ,OACA,MACA,aAUG;CACH,MAAM,EAAE,KAAK,eAAe,SAAS,cAAc,QAAQ,kBAAkB,eAAe;CAqE5F,OAAO;EAlEL,SAAS,aACP,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,uBAAuB,QAAQ,QAAQ;GAE3E,OAAO,OAAO,MAAM,OAAO,MAAM,MAAM,MAAM,oBAAoB;EACnE,CAAC,CACH;EACF,iBAAiB,aACf,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,uBAAuB,gBAAgB,QAAQ;GAEnF,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAE7C,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,OAAO,OAAO,IAAI,EAAE,IAAI,WAAW,OAAO,IAAI,EAAE;eAC1F,MAAM,SAAS,WAAW,iBAAiB,EAAE;oBACxC,MAAM,SAAS,aAAa,gBAAgB,EAAE,MAAM,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE;oBAClJ,MAAM,SAAS,cAAc,oBAAoB,EAAE,MAAM,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,WAAW,OAAO,KAAK,WAAW,IAAI,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,MAAM,MAAM,IAAI,EAAE;gBAC5Q,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE;GAEpF,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,MAAM,OAAO,KAAA;GACpD,MAAM,aAAa,QAAQ,OAAO,KAAK,IAAK,IAAI;GAEhD,uBACE,KAAK,OAAO,aAAa;IACvB,MAAM,QAAQ,QAAQ,OAAO,UAAU,IAAI;IAE3C,OACE,MAAM,OAAO,KAAK,QAAQ,SAAS,KAAK,GAAG,QAAQ,KACnD,MAAM,KAAK,QAAQ,sBAAsB,WAAW,KAAK,QAAQ;GAErE,CAAC,CACH;GAEA,MAAM,WAAW,MAAM,SACrB,YACA,KAAK,KAAK,QAAQ,OAAO,OAAO,KAAK,IAAI,CAAC,CAC5C;GAEA,uBAAuB,SAAS,cAAc,MAAM,SAAS;GAC7D,MAAM,yBAAS,IAAI,IAAiC;GAEpD,KAAK,MAAM,YAAY,MAAM;IAC3B,MAAM,MAAM,WAAW,OAAO,UAAU,IAAI;IAE5C,IAAI,IAAI,KAAK,WAAW,kBAAkB,MAAM;IAChD,MAAM,UAAU,OAAO,MAAM,iBAAiB,KAAK,UAAU,UAAU;IAEvE,IAAI,YAAY,KAAA,GAAW,OAAO,IAAI,QAAQ,cAAc,OAAO;GACrE;GACA,MAAM,aAAa,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO;GAEjD,OAAO,EAAE,oBAAoB,EAAE,2BAA2B;IACxD;IACA,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;IACjD,aAAa,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,WAAW;KAChD,MAAM;KACN,IAAI,MAAM;IACZ,EAAE;GACJ,CAAC;EACH,CAAC,CACH;CAGa;AACnB;AAEA,MAAa,sCAAsC,OAAO,WAAW,WACnE,QACA,SACA;CACA,MAAM,QAAQ,OAAO,2BAA2B,QAAQ,OAAO;CAC/D,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,OAAO;CAE7B,MAAM,YAAqB,WACzB,SAAS,KAAK,OAAO,eAAe,QAAQ,OAAO,QAAQ,MAAM,CAAC;CAEpE,OAAO,EAAE,oBAAoB,mCAAmC,OAAO,SAAS,QAAQ,EAAE;AAC5F,CAAC"}

package/dist/internal/passkey-policy.mjs

@@ -0,0 +1,115 @@
+import { Crypto, DateTime, Effect, Schema } from "effect";
+import { PasskeyCredential, PasskeyUnavailable, snapshotPasskeySync } from "@yielded/auth/Passkey";
+//#region src/internal/passkey-policy.ts
+const invariant = (value) => {
+	if (!value) throw PasskeyUnavailable.make({});
+};
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+/** RP tuples have no collation-dependent string identity. */
+const passkeyKey = Effect.fnUntraced(function* (kind, fields) {
+	const values = ["effect-auth/passkey/" + kind + "/v1", ...fields].map((field) => {
+		const bytes = encoder.encode(field);
+		invariant(decoder.decode(bytes) === field);
+		return bytes;
+	});
+	const packed = new Uint8Array(values.reduce((size, bytes) => size + 4 + bytes.length, 0));
+	const view = new DataView(packed.buffer);
+	let offset = 0;
+	for (const bytes of values) {
+		view.setUint32(offset, bytes.length, false);
+		packed.set(bytes, offset + 4);
+		offset += 4 + bytes.length;
+	}
+	const hashed = yield* (yield* Crypto.Crypto).digest("SHA-256", packed);
+	return "v1:" + Array.from(hashed, (value) => value.toString(16).padStart(2, "0")).join("");
+});
+const passkeyCredentialKey = (rpId, id) => passkeyKey("credential", [rpId, id]);
+/** Private passkeyStorage is decoded Type data, never a consumer wire transform. */
+const passkeyStorage = (schema, maximumBytes) => {
+	const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));
+	const encode = (value) => {
+		const text = "v1:" + Schema.encodeSync(codec)(snapshotPasskeySync(schema, value));
+		invariant(encoder.encode(text).length <= maximumBytes);
+		return text;
+	};
+	return {
+		encode,
+		decode: (text) => {
+			invariant(typeof text === "string" && text.startsWith("v1:"));
+			invariant(encoder.encode(text).length <= maximumBytes);
+			const value = snapshotPasskeySync(schema, Schema.decodeSync(codec)(text.slice(3)));
+			invariant(encode(value) === text);
+			return value;
+		}
+	};
+};
+const passkeyCredentialStorage = passkeyStorage(PasskeyCredential, 524288);
+const samePasskeyCredential = (left, right) => {
+	const semantic = (value) => ({
+		...value,
+		counter: 0,
+		backupState: false,
+		revision: {
+			...value.revision,
+			credentials: []
+		}
+	});
+	return passkeyCredentialStorage.encode(semantic(left)) === passkeyCredentialStorage.encode(semantic(right));
+};
+const samePasskeyRevision = (left, right) => {
+	const pairs = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));
+	return left.subjectId === right.subjectId && left.securityRevision === right.securityRevision && pairs.size === left.credentials.length && new Set(right.credentials.map((item) => item.credentialId)).size === right.credentials.length && pairs.size === right.credentials.length && right.credentials.every((item) => pairs.get(item.credentialId) === item.revision);
+};
+const passkeyAssertionPurposes = [
+	"sign-in",
+	"pending",
+	"step-up",
+	"action"
+];
+const contextPurpose = {
+	SignIn: "sign-in",
+	Pending: "pending",
+	StepUp: "step-up",
+	Action: "action",
+	Enrollment: "enrollment",
+	Registration: "registration"
+};
+const validPasskeyCeremony = (ceremony) => ceremony.expiresAtMillis > ceremony.issuedAtMillis && ceremony.expiresAtMillis <= ceremony.requestBindingExpiresAtMillis && contextPurpose[ceremony.context._tag] === ceremony.purpose && new Set(ceremony.allowedCredentials.map((item) => item.id)).size === ceremony.allowedCredentials.length;
+const passkeyMatchesAccess = (ceremony, access) => ceremony.moduleId === access.moduleId && ceremony.purpose === access.purpose && ceremony.flowId === access.flowId && ceremony.requestBindingVerifier === access.requestBindingVerifier && ceremony.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis;
+/** Reject stale bindings before evaluating application requirements. */
+const validPasskeyActionEvidence = (facts, authorization) => {
+	const { challenge, evidence } = authorization;
+	const { expected, revision, nowMillis: now } = facts;
+	if (challenge.moduleId !== facts.moduleId || challenge.action !== expected.action || challenge.commandId !== expected.commandId || challenge.flowId !== expected.flowId || challenge.bindingDigest !== expected.bindingDigest || evidence.flowId !== expected.flowId || evidence.bindingDigest !== expected.bindingDigest || !samePasskeyRevision(challenge.revision, expected.revision) || revision.subjectId !== expected.revision.subjectId || revision.securityRevision !== expected.revision.securityRevision || evidence.revision.subjectId !== revision.subjectId || evidence.revision.securityRevision !== revision.securityRevision) return false;
+	for (const requested of [expected.revision, evidence.revision]) if (requested.credentials.some((item) => !revision.credentials.some((current) => current.credentialId === item.credentialId && current.revision === item.revision))) return false;
+	if (evidence.proofs.some((proof) => DateTime.toEpochMillis(proof.verifiedAt) > now || !evidence.revision.credentials.some((item) => item.credentialId === proof.credentialId))) return false;
+	return true;
+};
+/** SQL policy predicates remain native. This authorizes the exact evidence and
+* returns the deadline every backend must retain through its final commit. */
+const assessPasskeyAction = (facts, authorization, policy) => {
+	if (!validPasskeyActionEvidence(facts, authorization)) return void 0;
+	const { evidence } = authorization;
+	const now = facts.nowMillis;
+	let expiresBefore = Infinity;
+	for (const requirement of [
+		authorization.requirement,
+		facts.currentRequirement,
+		...facts.originalRequirement === void 0 ? [] : [facts.originalRequirement]
+	]) {
+		const age = Math.min(policy.maximumEvidenceAgeMillis, requirement.maximumAgeMillis);
+		const fresh = evidence.proofs.filter((proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age);
+		const factors = new Set(fresh.flatMap((proof) => proof.factors));
+		if (!requirement.alternatives.some((alternative) => alternative.factors.every((factor) => factors.has(factor)) && new Set(fresh.map((proof) => proof.credentialId)).size >= alternative.minimumCredentials && fresh.some((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)))) return void 0;
+		for (const proof of fresh) expiresBefore = Math.min(expiresBefore, DateTime.toEpochMillis(proof.verifiedAt) + age);
+	}
+	return {
+		notBeforeMillis: now,
+		expiresBeforeMillis: expiresBefore
+	};
+};
+//#endregion
+export { assessPasskeyAction, passkeyAssertionPurposes, passkeyCredentialKey, passkeyCredentialStorage, passkeyKey, passkeyMatchesAccess, passkeyStorage, samePasskeyCredential, samePasskeyRevision, validPasskeyActionEvidence, validPasskeyCeremony };
+
+//# sourceMappingURL=passkey-policy.mjs.map

package/dist/internal/passkey-policy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-policy.mjs","names":[],"sources":["../../src/internal/passkey-policy.ts"],"sourcesContent":["import {\n  PasskeyUnavailable,\n  type PasskeyCeremony,\n  PasskeyCredential,\n  type PasskeyRevision,\n  snapshotPasskeySync,\n  type PasskeyAccess,\n  type PasskeyActionAuthorization,\n  type PasskeyManagementPolicy,\n  type PasskeyRequirement,\n} from \"@yielded/auth/Passkey\";\nimport { Crypto, DateTime, Effect, Schema } from \"effect\";\n\nconst invariant: (value: unknown) => asserts value = (value) => {\n  if (!value) throw PasskeyUnavailable.make({});\n};\n\nconst encoder = new TextEncoder();\n\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\n/** RP tuples have no collation-dependent string identity. */\nexport const passkeyKey = Effect.fnUntraced(function* (\n  kind: string,\n  fields: ReadonlyArray<string>,\n) {\n  const values = [\"effect-auth/passkey/\" + kind + \"/v1\", ...fields].map((field) => {\n    const bytes = encoder.encode(field);\n\n    invariant(decoder.decode(bytes) === field);\n\n    return bytes;\n  });\n\n  const packed = new Uint8Array(values.reduce((size, bytes) => size + 4 + bytes.length, 0));\n  const view = new DataView(packed.buffer);\n  let offset = 0;\n\n  for (const bytes of values) {\n    view.setUint32(offset, bytes.length, false);\n    packed.set(bytes, offset + 4);\n    offset += 4 + bytes.length;\n  }\n\n  const crypto = yield* Crypto.Crypto;\n  const hashed = yield* crypto.digest(\"SHA-256\", packed);\n\n  return \"v1:\" + Array.from(hashed, (value) => value.toString(16).padStart(2, \"0\")).join(\"\");\n});\n\nexport const passkeyCredentialKey = (rpId: string, id: string) =>\n  passkeyKey(\"credential\", [rpId, id]);\n\n/** Private passkeyStorage is decoded Type data, never a consumer wire transform. */\nexport const passkeyStorage = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  maximumBytes: number,\n) => {\n  const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n\n  const encode = (value: S[\"Type\"]) => {\n    const text = \"v1:\" + Schema.encodeSync(codec)(snapshotPasskeySync(schema, value));\n\n    invariant(encoder.encode(text).length <= maximumBytes);\n\n    return text;\n  };\n\n  return {\n    encode,\n    decode: (text: unknown): S[\"Type\"] => {\n      invariant(typeof text === \"string\" && text.startsWith(\"v1:\"));\n      invariant(encoder.encode(text).length <= maximumBytes);\n      const value = snapshotPasskeySync(schema, Schema.decodeSync(codec)(text.slice(3)));\n\n      invariant(encode(value) === text);\n\n      return value;\n    },\n  };\n};\n\n// Legal 32 x 16 x 2048 origins require more than one MiB before JSON escaping.\nexport const passkeyCredentialStorage = passkeyStorage(PasskeyCredential, 512 * 1024);\n\nexport const samePasskeyCredential = (left: PasskeyCredential, right: PasskeyCredential) => {\n  const semantic = (value: PasskeyCredential) => ({\n    ...value,\n    counter: 0,\n    backupState: false,\n    revision: { ...value.revision, credentials: [] },\n  });\n\n  return (\n    passkeyCredentialStorage.encode(semantic(left)) ===\n    passkeyCredentialStorage.encode(semantic(right))\n  );\n};\n\nexport const samePasskeyRevision = (\n  left: typeof PasskeyRevision.Type,\n  right: typeof PasskeyRevision.Type,\n) => {\n  const pairs = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));\n\n  return (\n    left.subjectId === right.subjectId &&\n    left.securityRevision === right.securityRevision &&\n    pairs.size === left.credentials.length &&\n    new Set(right.credentials.map((item) => item.credentialId)).size === right.credentials.length &&\n    pairs.size === right.credentials.length &&\n    right.credentials.every((item) => pairs.get(item.credentialId) === item.revision)\n  );\n};\n\nexport const passkeyAssertionPurposes = [\"sign-in\", \"pending\", \"step-up\", \"action\"] as const;\n\nconst contextPurpose = {\n  SignIn: \"sign-in\",\n  Pending: \"pending\",\n  StepUp: \"step-up\",\n  Action: \"action\",\n  Enrollment: \"enrollment\",\n  Registration: \"registration\",\n} as const;\n\nexport const validPasskeyCeremony = (ceremony: PasskeyCeremony) =>\n  ceremony.expiresAtMillis > ceremony.issuedAtMillis &&\n  ceremony.expiresAtMillis <= ceremony.requestBindingExpiresAtMillis &&\n  contextPurpose[ceremony.context._tag] === ceremony.purpose &&\n  new Set(ceremony.allowedCredentials.map((item) => item.id)).size ===\n    ceremony.allowedCredentials.length;\n\nexport const passkeyMatchesAccess = (ceremony: PasskeyCeremony, access: PasskeyAccess) =>\n  ceremony.moduleId === access.moduleId &&\n  ceremony.purpose === access.purpose &&\n  ceremony.flowId === access.flowId &&\n  ceremony.requestBindingVerifier === access.requestBindingVerifier &&\n  ceremony.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis;\n\nexport interface PasskeyActionFacts {\n  readonly moduleId: string;\n  readonly revision: typeof PasskeyRevision.Type;\n  readonly nowMillis: number;\n  readonly currentRequirement: typeof PasskeyRequirement.Type;\n  readonly expected: {\n    readonly action: PasskeyActionAuthorization[\"challenge\"][\"action\"];\n    readonly commandId: string;\n    readonly flowId: string;\n    readonly bindingDigest: string;\n    readonly revision: typeof PasskeyRevision.Type;\n  };\n  readonly originalRequirement?: typeof PasskeyRequirement.Type;\n}\n\n/** Reject stale bindings before evaluating application requirements. */\nexport const validPasskeyActionEvidence = (\n  facts: Pick<PasskeyActionFacts, \"moduleId\" | \"revision\" | \"expected\" | \"nowMillis\">,\n  authorization: PasskeyActionAuthorization,\n) => {\n  const { challenge, evidence } = authorization;\n  const { expected, revision, nowMillis: now } = facts;\n\n  if (\n    challenge.moduleId !== facts.moduleId ||\n    challenge.action !== expected.action ||\n    challenge.commandId !== expected.commandId ||\n    challenge.flowId !== expected.flowId ||\n    challenge.bindingDigest !== expected.bindingDigest ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== expected.bindingDigest ||\n    !samePasskeyRevision(challenge.revision, expected.revision) ||\n    revision.subjectId !== expected.revision.subjectId ||\n    revision.securityRevision !== expected.revision.securityRevision ||\n    evidence.revision.subjectId !== revision.subjectId ||\n    evidence.revision.securityRevision !== revision.securityRevision\n  )\n    return false;\n  for (const requested of [expected.revision, evidence.revision])\n    if (\n      requested.credentials.some(\n        (item) =>\n          !revision.credentials.some(\n            (current) =>\n              current.credentialId === item.credentialId && current.revision === item.revision,\n          ),\n      )\n    )\n      return false;\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        DateTime.toEpochMillis(proof.verifiedAt) > now ||\n        !evidence.revision.credentials.some((item) => item.credentialId === proof.credentialId),\n    )\n  )\n    return false;\n\n  return true;\n};\n\n/** SQL policy predicates remain native. This authorizes the exact evidence and\n * returns the deadline every backend must retain through its final commit. */\nexport const assessPasskeyAction = (\n  facts: PasskeyActionFacts,\n  authorization: PasskeyActionAuthorization,\n  policy: PasskeyManagementPolicy,\n) => {\n  if (!validPasskeyActionEvidence(facts, authorization)) return undefined;\n  const { evidence } = authorization;\n  const now = facts.nowMillis;\n  let expiresBefore = Infinity;\n\n  for (const requirement of [\n    authorization.requirement,\n    facts.currentRequirement,\n    ...(facts.originalRequirement === undefined ? [] : [facts.originalRequirement]),\n  ]) {\n    const age = Math.min(policy.maximumEvidenceAgeMillis, requirement.maximumAgeMillis);\n\n    const fresh = evidence.proofs.filter(\n      (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n    );\n\n    const factors = new Set(fresh.flatMap((proof) => proof.factors));\n\n    if (\n      !requirement.alternatives.some(\n        (alternative) =>\n          alternative.factors.every((factor) => factors.has(factor)) &&\n          new Set(fresh.map((proof) => proof.credentialId)).size >=\n            alternative.minimumCredentials &&\n          fresh.some(\n            (proof) =>\n              (!alternative.userVerified || proof.userVerified) &&\n              (!alternative.phishingResistant || proof.phishingResistant),\n          ),\n      )\n    )\n      return undefined;\n    for (const proof of fresh)\n      expiresBefore = Math.min(expiresBefore, DateTime.toEpochMillis(proof.verifiedAt) + age);\n  }\n\n  return { notBeforeMillis: now, expiresBeforeMillis: expiresBefore };\n};\n"],"mappings":";;;AAaA,MAAM,aAAgD,UAAU;CAC9D,IAAI,CAAC,OAAO,MAAM,mBAAmB,KAAK,CAAC,CAAC;AAC9C;AAEA,MAAM,UAAU,IAAI,YAAY;AAEhC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;;AAGxD,MAAa,aAAa,OAAO,WAAW,WAC1C,MACA,QACA;CACA,MAAM,SAAS,CAAC,yBAAyB,OAAO,OAAO,GAAG,MAAM,CAAC,CAAC,KAAK,UAAU;EAC/E,MAAM,QAAQ,QAAQ,OAAO,KAAK;EAElC,UAAU,QAAQ,OAAO,KAAK,MAAM,KAAK;EAEzC,OAAO;CACT,CAAC;CAED,MAAM,SAAS,IAAI,WAAW,OAAO,QAAQ,MAAM,UAAU,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC;CACxF,MAAM,OAAO,IAAI,SAAS,OAAO,MAAM;CACvC,IAAI,SAAS;CAEb,KAAK,MAAM,SAAS,QAAQ;EAC1B,KAAK,UAAU,QAAQ,MAAM,QAAQ,KAAK;EAC1C,OAAO,IAAI,OAAO,SAAS,CAAC;EAC5B,UAAU,IAAI,MAAM;CACtB;CAGA,MAAM,SAAS,QAAO,OADA,OAAO,OAAA,CACA,OAAO,WAAW,MAAM;CAErD,OAAO,QAAQ,MAAM,KAAK,SAAS,UAAU,MAAM,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAC3F,CAAC;AAED,MAAa,wBAAwB,MAAc,OACjD,WAAW,cAAc,CAAC,MAAM,EAAE,CAAC;;AAGrC,MAAa,kBACX,QACA,iBACG;CACH,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;CAE7E,MAAM,UAAU,UAAqB;EACnC,MAAM,OAAO,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,oBAAoB,QAAQ,KAAK,CAAC;EAEhF,UAAU,QAAQ,OAAO,IAAI,CAAC,CAAC,UAAU,YAAY;EAErD,OAAO;CACT;CAEA,OAAO;EACL;EACA,SAAS,SAA6B;GACpC,UAAU,OAAO,SAAS,YAAY,KAAK,WAAW,KAAK,CAAC;GAC5D,UAAU,QAAQ,OAAO,IAAI,CAAC,CAAC,UAAU,YAAY;GACrD,MAAM,QAAQ,oBAAoB,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;GAEjF,UAAU,OAAO,KAAK,MAAM,IAAI;GAEhC,OAAO;EACT;CACF;AACF;AAGA,MAAa,2BAA2B,eAAe,mBAAmB,MAAU;AAEpF,MAAa,yBAAyB,MAAyB,UAA6B;CAC1F,MAAM,YAAY,WAA8B;EAC9C,GAAG;EACH,SAAS;EACT,aAAa;EACb,UAAU;GAAE,GAAG,MAAM;GAAU,aAAa,CAAC;EAAE;CACjD;CAEA,OACE,yBAAyB,OAAO,SAAS,IAAI,CAAC,MAC9C,yBAAyB,OAAO,SAAS,KAAK,CAAC;AAEnD;AAEA,MAAa,uBACX,MACA,UACG;CACH,MAAM,QAAQ,IAAI,IAAI,KAAK,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAAC;CAExF,OACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,MAAM,SAAS,KAAK,YAAY,UAChC,IAAI,IAAI,MAAM,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,MAAM,YAAY,UACvF,MAAM,SAAS,MAAM,YAAY,UACjC,MAAM,YAAY,OAAO,SAAS,MAAM,IAAI,KAAK,YAAY,MAAM,KAAK,QAAQ;AAEpF;AAEA,MAAa,2BAA2B;CAAC;CAAW;CAAW;CAAW;AAAQ;AAElF,MAAM,iBAAiB;CACrB,QAAQ;CACR,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,YAAY;CACZ,cAAc;AAChB;AAEA,MAAa,wBAAwB,aACnC,SAAS,kBAAkB,SAAS,kBACpC,SAAS,mBAAmB,SAAS,iCACrC,eAAe,SAAS,QAAQ,UAAU,SAAS,WACnD,IAAI,IAAI,SAAS,mBAAmB,KAAK,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,SAC1D,SAAS,mBAAmB;AAEhC,MAAa,wBAAwB,UAA2B,WAC9D,SAAS,aAAa,OAAO,YAC7B,SAAS,YAAY,OAAO,WAC5B,SAAS,WAAW,OAAO,UAC3B,SAAS,2BAA2B,OAAO,0BAC3C,SAAS,kCAAkC,OAAO;;AAkBpD,MAAa,8BACX,OACA,kBACG;CACH,MAAM,EAAE,WAAW,aAAa;CAChC,MAAM,EAAE,UAAU,UAAU,WAAW,QAAQ;CAE/C,IACE,UAAU,aAAa,MAAM,YAC7B,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,WAAW,SAAS,UAC9B,UAAU,kBAAkB,SAAS,iBACrC,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,SAAS,iBACpC,CAAC,oBAAoB,UAAU,UAAU,SAAS,QAAQ,KAC1D,SAAS,cAAc,SAAS,SAAS,aACzC,SAAS,qBAAqB,SAAS,SAAS,oBAChD,SAAS,SAAS,cAAc,SAAS,aACzC,SAAS,SAAS,qBAAqB,SAAS,kBAEhD,OAAO;CACT,KAAK,MAAM,aAAa,CAAC,SAAS,UAAU,SAAS,QAAQ,GAC3D,IACE,UAAU,YAAY,MACnB,SACC,CAAC,SAAS,YAAY,MACnB,YACC,QAAQ,iBAAiB,KAAK,gBAAgB,QAAQ,aAAa,KAAK,QAC5E,CACJ,GAEA,OAAO;CACX,IACE,SAAS,OAAO,MACb,UACC,SAAS,cAAc,MAAM,UAAU,IAAI,OAC3C,CAAC,SAAS,SAAS,YAAY,MAAM,SAAS,KAAK,iBAAiB,MAAM,YAAY,CAC1F,GAEA,OAAO;CAET,OAAO;AACT;;;AAIA,MAAa,uBACX,OACA,eACA,WACG;CACH,IAAI,CAAC,2BAA2B,OAAO,aAAa,GAAG,OAAO,KAAA;CAC9D,MAAM,EAAE,aAAa;CACrB,MAAM,MAAM,MAAM;CAClB,IAAI,gBAAgB;CAEpB,KAAK,MAAM,eAAe;EACxB,cAAc;EACd,MAAM;EACN,GAAI,MAAM,wBAAwB,KAAA,IAAY,CAAC,IAAI,CAAC,MAAM,mBAAmB;CAC/E,GAAG;EACD,MAAM,MAAM,KAAK,IAAI,OAAO,0BAA0B,YAAY,gBAAgB;EAElF,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;EAEA,MAAM,UAAU,IAAI,IAAI,MAAM,SAAS,UAAU,MAAM,OAAO,CAAC;EAE/D,IACE,CAAC,YAAY,aAAa,MACvB,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,IAAI,IAAI,MAAM,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,QAChD,YAAY,sBACd,MAAM,MACH,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ,GAEA,OAAO,KAAA;EACT,KAAK,MAAM,SAAS,OAClB,gBAAgB,KAAK,IAAI,eAAe,SAAS,cAAc,MAAM,UAAU,IAAI,GAAG;CAC1F;CAEA,OAAO;EAAE,iBAAiB;EAAK,qBAAqB;CAAc;AACpE"}

package/dist/internal/password-credentials.mjs

@@ -1,21 +1,23 @@
 import { sqlMapping } from "./native-sql-table.mjs";
-import { NativeDatabase } from "./transaction-kernel.mjs";
 import { Effect, Option, Redacted, Schema } from "effect";
+import { SqlClient } from "effect/sql";
 import { CurrentCommitJournal, hasCommitScope } from "@yielded/auth/Hooks";
-import { reportPersistenceFailure } from "@yielded/auth/Persistence";
 import { EncodedPasswordHash, PasswordUnavailable, snapshotPasswordCredential } from "@yielded/auth/Password";
+import { reportPersistenceFailure } from "@yielded/auth/Persistence";
+import { SecurityRevision } from "@yielded/auth/Sessions";
 //#region src/internal/password-credentials.ts
 const unavailable = () => PasswordUnavailable.make({});
 const failure = (effect) => reportPersistenceFailure(effect, Schema.is(PasswordUnavailable)).pipe(Effect.mapError(unavailable));
 const samePasswordCredentialSnapshot = (a, b) => a.moduleId === b.moduleId && a.revision.subjectId === b.revision.subjectId && a.revision.securityRevision === b.revision.securityRevision && a.revision.credentials.length === b.revision.credentials.length && new Set(a.revision.credentials.map((entry) => entry.credentialId)).size === a.revision.credentials.length && new Set(b.revision.credentials.map((entry) => entry.credentialId)).size === b.revision.credentials.length && a.revision.credentials.every((entry) => b.revision.credentials.some((other) => entry.credentialId === other.credentialId && entry.revision === other.revision)) && a.credentialId === b.credentialId && a.credentialRevision === b.credentialRevision && a.verifierVersion === b.verifierVersion && Redacted.value(a.verifier) === Redacted.value(b.verifier) && a.normalization === b.normalization && a.identifier.namespace === b.identifier.namespace && a.identifier.value === b.identifier.value && a.identifierBindingRevision === b.identifierBindingRevision && a.identifierVerifiedAtMillis === b.identifierVerifiedAtMillis;
 /** Lookup is read-only; rehash is one conditional maintenance write, never authentication. */
 const makePasswordCredentials = Effect.fnUntraced(function* (table, mapping, options) {
-	const sql = (yield* NativeDatabase).$client.withoutTransforms();
+	const sql = (yield* SqlClient.SqlClient).withoutTransforms();
 	const parent = yield* Effect.serviceOption(CurrentCommitJournal);
-	const [s, i, c] = yield* sqlMapping(() => [
+	const [s, i, c, a] = yield* sqlMapping(() => [
 		table(mapping.subject.table),
 		table(mapping.identifier.table),
-		table(mapping.credential.table)
+		table(mapping.credential.table),
+		table(mapping.authorityCredential.table)
 	]).pipe(failure);
 	const standalone = Effect.gen(function* () {
 		if (options.coordinated) {
@@ -37,28 +39,55 @@ const makePasswordCredentials = Effect.fnUntraced(function* (table, mapping, opt
 		const subjectTable = s.as("password_subject");
 		const identifierTable = i.as("password_identifier");
 		const credentialTable = c.as("password_credential");
-		const rows = yield* sqlMapping(() => sql`select ${subjectTable.fields("subject_")}, ${identifierTable.fields("identifier_")}, ${credentialTable.fields("credential_")}
+		const authorityTable = a.as("password_authority");
+		const authority = mapping.authorityCredential;
+		const rows = yield* sqlMapping(() => sql`select ${subjectTable.fields("subject_")}, ${identifierTable.fields("identifier_")}, ${credentialTable.fields("credential_")}, ${authorityTable.fields("authority_")}
       from ${subjectTable.name}
       inner join ${identifierTable.name} on ${identifierTable.column(mapping.identifier.namespace)} = ${identifierTable.value(mapping.identifier.namespace, identifier.namespace)}
         and ${identifierTable.column(mapping.identifier.value)} = ${identifierTable.value(mapping.identifier.value, identifier.value)}
         and ${identifierTable.column(mapping.identifier.subjectId)} = ${identifierTable.value(mapping.identifier.subjectId, nativeId)}
       inner join ${credentialTable.name} on ${credentialTable.column(mapping.credential.moduleId)} = ${credentialTable.value(mapping.credential.moduleId, moduleId)}
         and ${credentialTable.column(mapping.credential.subjectId)} = ${credentialTable.value(mapping.credential.subjectId, nativeId)}
-      where ${subjectTable.column(mapping.subject.id)} = ${subjectTable.value(mapping.subject.id, nativeId)}
+      left join ${authorityTable.name} on ${authorityTable.column(authority.subjectId)} = ${authorityTable.value(authority.subjectId, nativeId)}
+        ${authority.status === void 0 || authority.d1ActiveStatusValue === void 0 ? sql`` : sql`and ${authorityTable.column(authority.status)} = ${authorityTable.value(authority.status, authority.d1ActiveStatusValue)}`}
+      where ${subjectTable.column(mapping.subject.id)} = ${subjectTable.value(mapping.subject.id, nativeId)} order by ${authorityTable.column(authority.credentialId)} limit 4097
       `).pipe(Effect.flatten);
-		if (rows.length !== 1) return void 0;
+		if (rows.length === 0) return void 0;
+		if (rows.length > 4096) return yield* unavailable();
 		const [subject, identifierRow, credential] = yield* sqlMapping(() => [
 			s.decode(rows[0], "subject_"),
 			i.decode(rows[0], "identifier_"),
 			c.decode(rows[0], "credential_")
 		]);
 		if (yield* sqlMapping(() => !mapping.subject.isActiveStatus(subject[mapping.subject.status]) || !mapping.identifier.isCurrent(identifierRow) || !mapping.subjectId.equals(nativeId, identifierRow[mapping.identifier.subjectId]) || !mapping.subjectId.equals(nativeId, subject[mapping.subject.id]) || !mapping.subjectId.equals(nativeId, credential[mapping.credential.subjectId]))) return void 0;
-		return yield* sqlMapping(() => mapping.credential.decode({
+		const captured = yield* sqlMapping(() => mapping.credential.decode({
 			moduleId,
 			subject,
 			identifier: identifierRow,
 			credential
 		})).pipe(Effect.flatten, Effect.flatMap(snapshotPasswordCredential));
+		const factors = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const factor = yield* sqlMapping(() => a.decode(row, "authority_"));
+			if (factor[authority.credentialId] === null || factor[authority.credentialId] === void 0) continue;
+			if (!mapping.subjectId.equals(nativeId, factor[authority.subjectId])) return yield* unavailable();
+			if (authority.status !== void 0 && authority.isActiveStatus?.(factor[authority.status]) !== true) continue;
+			const credentialId = yield* Schema.decodeUnknownEffect(Schema.String)(factor[authority.credentialId]);
+			const revision = yield* Schema.decodeUnknownEffect(SecurityRevision)(factor[authority.revision]);
+			if (factors.has(credentialId)) return yield* unavailable();
+			factors.set(credentialId, revision);
+		}
+		if (factors.size > 64 || factors.get(captured.credentialId) !== captured.credentialRevision) return void 0;
+		return yield* snapshotPasswordCredential({
+			...captured,
+			revision: {
+				...captured.revision,
+				credentials: [...factors].map(([credentialId, revision]) => ({
+					credentialId,
+					revision
+				}))
+			}
+		});
 	});
 	return {
 		findCredential: (uncaptured) => Effect.gen(function* () {

package/dist/internal/password-credentials.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password-credentials.mjs","names":[],"sources":["../../src/internal/password-credentials.ts"],"sourcesContent":["import { CurrentCommitJournal, hasCommitScope } from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  EncodedPasswordHash,\n  type PasswordPersistence,\n  PasswordUnavailable,\n  snapshotPasswordCredential,\n  type PasswordCredentialSnapshot,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { Effect, Option, Redacted, Schema } from \"effect\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { AnyPasswordPersistenceMapping } from \"./models/password-model\";\nimport { sqlMapping, type SqlTable } from \"./native-sql-table\";\nimport type { PasswordSqlConfiguration } from \"./password-kernel\";\nimport { NativeDatabase } from \"./transaction-kernel\";\n\ntype Row = Readonly<Record<string, unknown>>;\nconst unavailable = () => PasswordUnavailable.make({});\n\nconst failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  reportPersistenceFailure(effect, Schema.is(PasswordUnavailable)).pipe(\n    Effect.mapError(unavailable),\n  );\n\nexport const samePasswordCredentialSnapshot = (\n  a: PasswordCredentialSnapshot,\n  b: PasswordCredentialSnapshot,\n) =>\n  a.moduleId === b.moduleId &&\n  a.revision.subjectId === b.revision.subjectId &&\n  a.revision.securityRevision === b.revision.securityRevision &&\n  a.revision.credentials.length === b.revision.credentials.length &&\n  new Set(a.revision.credentials.map((entry) => entry.credentialId)).size ===\n    a.revision.credentials.length &&\n  new Set(b.revision.credentials.map((entry) => entry.credentialId)).size ===\n    b.revision.credentials.length &&\n  a.revision.credentials.every((entry) =>\n    b.revision.credentials.some(\n      (other) => entry.credentialId === other.credentialId && entry.revision === other.revision,\n    ),\n  ) &&\n  a.credentialId === b.credentialId &&\n  a.credentialRevision === b.credentialRevision &&\n  a.verifierVersion === b.verifierVersion &&\n  Redacted.value(a.verifier) === Redacted.value(b.verifier) &&\n  a.normalization === b.normalization &&\n  a.identifier.namespace === b.identifier.namespace &&\n  a.identifier.value === b.identifier.value &&\n  a.identifierBindingRevision === b.identifierBindingRevision &&\n  a.identifierVerifiedAtMillis === b.identifierVerifiedAtMillis;\n\n/** Lookup is read-only; rehash is one conditional maintenance write, never authentication. */\nexport const makePasswordCredentials = Effect.fnUntraced(function* (\n  table: (table: object) => SqlTable,\n  mapping: AnyPasswordPersistenceMapping,\n  options: PasswordSqlConfiguration,\n): Effect.fn.Return<\n  Pick<PasswordPersistence[\"Service\"], \"findCredential\" | \"rehashIfCurrent\">,\n  PasswordUnavailable,\n  NativeDatabase\n> {\n  const sql = (yield* NativeDatabase).$client.withoutTransforms();\n  const parent = yield* Effect.serviceOption(CurrentCommitJournal);\n\n  const [s, i, c] = yield* sqlMapping(\n    () =>\n      [\n        table(mapping.subject.table),\n        table(mapping.identifier.table),\n        table(mapping.credential.table),\n      ] as const,\n  ).pipe(failure);\n\n  const standalone = Effect.gen(function* () {\n    if (options.coordinated) {\n      const current = yield* Effect.serviceOption(CurrentCommitJournal);\n\n      if (Option.isNone(parent) || Option.isNone(current) || parent.value !== current.value)\n        return yield* unavailable();\n    } else {\n      if (yield* hasCommitScope) return yield* unavailable();\n      yield* options.standaloneGuard;\n    }\n  });\n\n  const allocate = <A>(\n    asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,\n    sync: (() => A) | undefined,\n  ) => {\n    if (options.mode !== \"synchronous\" && asynchronous !== undefined) return asynchronous;\n\n    return sync === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({ try: sync, catch: unavailable });\n  };\n\n  // Bind each native ID through its own column codec. Physical encodings of the\n  // same application ID need not match across subject, identifier and password.\n  const snapshot = Effect.fnUntraced(function* (\n    nativeId: unknown,\n    moduleId: string,\n    identifier: LoginIdentifier,\n  ) {\n    const subjectTable = s.as(\"password_subject\");\n    const identifierTable = i.as(\"password_identifier\");\n    const credentialTable = c.as(\"password_credential\");\n\n    const rows = yield* sqlMapping(\n      () =>\n        sql<Row>`select ${subjectTable.fields(\"subject_\")}, ${identifierTable.fields(\"identifier_\")}, ${credentialTable.fields(\"credential_\")}\n      from ${subjectTable.name}\n      inner join ${identifierTable.name} on ${identifierTable.column(mapping.identifier.namespace)} = ${identifierTable.value(mapping.identifier.namespace, identifier.namespace)}\n        and ${identifierTable.column(mapping.identifier.value)} = ${identifierTable.value(mapping.identifier.value, identifier.value)}\n        and ${identifierTable.column(mapping.identifier.subjectId)} = ${identifierTable.value(mapping.identifier.subjectId, nativeId)}\n      inner join ${credentialTable.name} on ${credentialTable.column(mapping.credential.moduleId)} = ${credentialTable.value(mapping.credential.moduleId, moduleId)}\n        and ${credentialTable.column(mapping.credential.subjectId)} = ${credentialTable.value(mapping.credential.subjectId, nativeId)}\n      where ${subjectTable.column(mapping.subject.id)} = ${subjectTable.value(mapping.subject.id, nativeId)}\n      `,\n    ).pipe(Effect.flatten);\n\n    if (rows.length !== 1) return undefined;\n\n    const [subject, identifierRow, credential] = yield* sqlMapping(\n      () =>\n        [\n          s.decode(rows[0]!, \"subject_\"),\n          i.decode(rows[0]!, \"identifier_\"),\n          c.decode(rows[0]!, \"credential_\"),\n        ] as const,\n    );\n\n    if (\n      yield* sqlMapping(\n        () =>\n          !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n          !mapping.identifier.isCurrent(identifierRow) ||\n          !mapping.subjectId.equals(nativeId, identifierRow[mapping.identifier.subjectId]) ||\n          !mapping.subjectId.equals(nativeId, subject[mapping.subject.id]) ||\n          !mapping.subjectId.equals(nativeId, credential[mapping.credential.subjectId]),\n      )\n    )\n      return undefined;\n\n    const captured = yield* sqlMapping(() =>\n      mapping.credential.decode({ moduleId, subject, identifier: identifierRow, credential }),\n    ).pipe(Effect.flatten, Effect.flatMap(snapshotPasswordCredential));\n\n    return captured;\n  });\n\n  return {\n    findCredential: (uncaptured) =>\n      Effect.gen(function* () {\n        const input = { ...uncaptured, identifier: { ...uncaptured.identifier } };\n\n        yield* standalone;\n\n        const identifiers = yield* sqlMapping(\n          () => sql<Row>`select ${i.fields(\"i_\")} from ${i.name}\n          where ${i.column(mapping.identifier.namespace)} = ${i.value(mapping.identifier.namespace, input.identifier.namespace)}\n            and ${i.column(mapping.identifier.value)} = ${i.value(mapping.identifier.value, input.identifier.value)}`,\n        ).pipe(Effect.flatten);\n\n        const identifier =\n          identifiers.length === 1\n            ? yield* sqlMapping(() => i.decode(identifiers[0]!, \"i_\"))\n            : undefined;\n\n        if (\n          identifier === undefined ||\n          !(yield* sqlMapping(() => mapping.identifier.isCurrent(identifier)))\n        )\n          return Option.none();\n\n        const credential = yield* snapshot(\n          identifier[mapping.identifier.subjectId],\n          input.moduleId,\n          input.identifier,\n        );\n\n        return credential === undefined ||\n          (input.subjectId !== undefined && credential.revision.subjectId !== input.subjectId)\n          ? Option.none()\n          : Option.some(credential);\n      }).pipe(failure),\n    rehashIfCurrent: (input) =>\n      Effect.gen(function* () {\n        const nextVerifier = Redacted.make(\n          yield* Schema.decodeEffect(EncodedPasswordHash)(Redacted.value(input.nextVerifier)),\n        );\n\n        const credential = yield* snapshotPasswordCredential(input.credential);\n\n        yield* standalone;\n        const nativeId = yield* mapping.subjectId.toNative(credential.revision.subjectId);\n        const version = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);\n\n        if (version === credential.verifierVersion) return yield* unavailable();\n        yield* sqlMapping(() => {\n          const encoded = mapping.credential.encodeVerifier(nextVerifier, version);\n\n          // A custom encoder cannot turn maintenance into a semantic credential change.\n          const values = {\n            [mapping.credential.verifier]: encoded[mapping.credential.verifier],\n            [mapping.credential.verifierVersion]: encoded[mapping.credential.verifierVersion],\n          };\n\n          if (Object.values(values).some((value) => value === undefined)) throw unavailable();\n\n          // Ordinary identity predicates retain index use; the full CAS ignores text collation.\n          const exact = sql.and(\n            Object.entries({\n              [mapping.credential.moduleId]: credential.moduleId,\n              [mapping.credential.subjectId]: nativeId,\n              [mapping.credential.credentialId]: credential.credentialId,\n              [mapping.credential.credentialRevision]: credential.credentialRevision,\n              [mapping.credential.verifierVersion]: credential.verifierVersion,\n              [mapping.credential.verifier]: Redacted.value(credential.verifier),\n              [mapping.credential.normalization]: credential.normalization,\n            }).map(([key, value]) => {\n              const column = c.column(key),\n                bound = c.value(key, value);\n\n              if (typeof value !== \"string\") return sql`${column} = ${bound}`;\n\n              return sql.onDialectOrElse({\n                mysql: () => sql`binary ${column} = binary ${bound}`,\n                pg: () =>\n                  sql`convert_to(cast(${column} as text), 'UTF8') = convert_to(cast(${bound} as text), 'UTF8')`,\n                orElse: () => sql`cast(${column} as blob) = cast(${bound} as blob)`,\n              });\n            }),\n          );\n\n          return sql`${c.update(values)}\n          where ${c.column(mapping.credential.moduleId)} = ${c.value(mapping.credential.moduleId, credential.moduleId)}\n            and ${c.column(mapping.credential.subjectId)} = ${c.value(mapping.credential.subjectId, nativeId)}\n            and ${c.column(mapping.credential.credentialId)} = ${c.value(mapping.credential.credentialId, credential.credentialId)}\n            and ${exact}`;\n        }).pipe(Effect.flatten);\n      }).pipe(failure),\n  } satisfies Pick<PasswordPersistence[\"Service\"], \"findCredential\" | \"rehashIfCurrent\">;\n});\n"],"mappings":";;;;;;;AAmBA,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;AAErD,MAAM,WAAoB,WACxB,yBAAyB,QAAQ,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,KAC/D,OAAO,SAAS,WAAW,CAC7B;AAEF,MAAa,kCACX,GACA,MAEA,EAAE,aAAa,EAAE,YACjB,EAAE,SAAS,cAAc,EAAE,SAAS,aACpC,EAAE,SAAS,qBAAqB,EAAE,SAAS,oBAC3C,EAAE,SAAS,YAAY,WAAW,EAAE,SAAS,YAAY,UACzD,IAAI,IAAI,EAAE,SAAS,YAAY,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,SACjE,EAAE,SAAS,YAAY,UACzB,IAAI,IAAI,EAAE,SAAS,YAAY,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,SACjE,EAAE,SAAS,YAAY,UACzB,EAAE,SAAS,YAAY,OAAO,UAC5B,EAAE,SAAS,YAAY,MACpB,UAAU,MAAM,iBAAiB,MAAM,gBAAgB,MAAM,aAAa,MAAM,QACnF,CACF,KACA,EAAE,iBAAiB,EAAE,gBACrB,EAAE,uBAAuB,EAAE,sBAC3B,EAAE,oBAAoB,EAAE,mBACxB,SAAS,MAAM,EAAE,QAAQ,MAAM,SAAS,MAAM,EAAE,QAAQ,KACxD,EAAE,kBAAkB,EAAE,iBACtB,EAAE,WAAW,cAAc,EAAE,WAAW,aACxC,EAAE,WAAW,UAAU,EAAE,WAAW,SACpC,EAAE,8BAA8B,EAAE,6BAClC,EAAE,+BAA+B,EAAE;;AAGrC,MAAa,0BAA0B,OAAO,WAAW,WACvD,OACA,SACA,SAKA;CACA,MAAM,OAAO,OAAO,eAAA,CAAgB,QAAQ,kBAAkB;CAC9D,MAAM,SAAS,OAAO,OAAO,cAAc,oBAAoB;CAE/D,MAAM,CAAC,GAAG,GAAG,KAAK,OAAO,iBAErB;EACE,MAAM,QAAQ,QAAQ,KAAK;EAC3B,MAAM,QAAQ,WAAW,KAAK;EAC9B,MAAM,QAAQ,WAAW,KAAK;CAChC,CACJ,CAAC,CAAC,KAAK,OAAO;CAEd,MAAM,aAAa,OAAO,IAAI,aAAa;EACzC,IAAI,QAAQ,aAAa;GACvB,MAAM,UAAU,OAAO,OAAO,cAAc,oBAAoB;GAEhE,IAAI,OAAO,OAAO,MAAM,KAAK,OAAO,OAAO,OAAO,KAAK,OAAO,UAAU,QAAQ,OAC9E,OAAO,OAAO,YAAY;EAC9B,OAAO;GACL,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,QAAQ;EACjB;CACF,CAAC;CAED,MAAM,YACJ,cACA,SACG;EACH,IAAI,QAAQ,SAAS,iBAAiB,iBAAiB,KAAA,GAAW,OAAO;EAEzE,OAAO,SAAS,KAAA,IACZ,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GAAE,KAAK;GAAM,OAAO;EAAY,CAAC;CAClD;CAIA,MAAM,WAAW,OAAO,WAAW,WACjC,UACA,UACA,YACA;EACA,MAAM,eAAe,EAAE,GAAG,kBAAkB;EAC5C,MAAM,kBAAkB,EAAE,GAAG,qBAAqB;EAClD,MAAM,kBAAkB,EAAE,GAAG,qBAAqB;EAElD,MAAM,OAAO,OAAO,iBAEhB,GAAQ,UAAU,aAAa,OAAO,UAAU,EAAE,IAAI,gBAAgB,OAAO,aAAa,EAAE,IAAI,gBAAgB,OAAO,aAAa,EAAE;aACjI,aAAa,KAAK;mBACZ,gBAAgB,KAAK,MAAM,gBAAgB,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,WAAW,WAAW,SAAS,EAAE;cACpK,gBAAgB,OAAO,QAAQ,WAAW,KAAK,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,OAAO,WAAW,KAAK,EAAE;cACxH,gBAAgB,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;mBACnH,gBAAgB,KAAK,MAAM,gBAAgB,OAAO,QAAQ,WAAW,QAAQ,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,UAAU,QAAQ,EAAE;cACtJ,gBAAgB,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;cACxH,aAAa,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,aAAa,MAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE;OAExG,CAAC,CAAC,KAAK,OAAO,OAAO;EAErB,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAE9B,MAAM,CAAC,SAAS,eAAe,cAAc,OAAO,iBAEhD;GACE,EAAE,OAAO,KAAK,IAAK,UAAU;GAC7B,EAAE,OAAO,KAAK,IAAK,aAAa;GAChC,EAAE,OAAO,KAAK,IAAK,aAAa;EAClC,CACJ;EAEA,IACE,OAAO,iBAEH,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,CAAC,QAAQ,WAAW,UAAU,aAAa,KAC3C,CAAC,QAAQ,UAAU,OAAO,UAAU,cAAc,QAAQ,WAAW,UAAU,KAC/E,CAAC,QAAQ,UAAU,OAAO,UAAU,QAAQ,QAAQ,QAAQ,GAAG,KAC/D,CAAC,QAAQ,UAAU,OAAO,UAAU,WAAW,QAAQ,WAAW,UAAU,CAChF,GAEA,OAAO,KAAA;EAMT,OAAO,OAJiB,iBACtB,QAAQ,WAAW,OAAO;GAAE;GAAU;GAAS,YAAY;GAAe;EAAW,CAAC,CACxF,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,QAAQ,0BAA0B,CAAC;CAGnE,CAAC;CAED,OAAO;EACL,iBAAiB,eACf,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ;IAAE,GAAG;IAAY,YAAY,EAAE,GAAG,WAAW,WAAW;GAAE;GAExE,OAAO;GAEP,MAAM,cAAc,OAAO,iBACnB,GAAQ,UAAU,EAAE,OAAO,IAAI,EAAE,QAAQ,EAAE,KAAK;kBAC9C,EAAE,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,WAAW,MAAM,WAAW,SAAS,EAAE;kBAC9G,EAAE,OAAO,QAAQ,WAAW,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,OAAO,MAAM,WAAW,KAAK,GAC1G,CAAC,CAAC,KAAK,OAAO,OAAO;GAErB,MAAM,aACJ,YAAY,WAAW,IACnB,OAAO,iBAAiB,EAAE,OAAO,YAAY,IAAK,IAAI,CAAC,IACvD,KAAA;GAEN,IACE,eAAe,KAAA,KACf,EAAE,OAAO,iBAAiB,QAAQ,WAAW,UAAU,UAAU,CAAC,IAElE,OAAO,OAAO,KAAK;GAErB,MAAM,aAAa,OAAO,SACxB,WAAW,QAAQ,WAAW,YAC9B,MAAM,UACN,MAAM,UACR;GAEA,OAAO,eAAe,KAAA,KACnB,MAAM,cAAc,KAAA,KAAa,WAAW,SAAS,cAAc,MAAM,YACxE,OAAO,KAAK,IACZ,OAAO,KAAK,UAAU;EAC5B,CAAC,CAAC,CAAC,KAAK,OAAO;EACjB,kBAAkB,UAChB,OAAO,IAAI,aAAa;GACtB,MAAM,eAAe,SAAS,KAC5B,OAAO,OAAO,aAAa,mBAAmB,CAAC,CAAC,SAAS,MAAM,MAAM,YAAY,CAAC,CACpF;GAEA,MAAM,aAAa,OAAO,2BAA2B,MAAM,UAAU;GAErE,OAAO;GACP,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,WAAW,SAAS,SAAS;GAChF,MAAM,UAAU,OAAO,SAAS,QAAQ,kBAAkB,QAAQ,oBAAoB;GAEtF,IAAI,YAAY,WAAW,iBAAiB,OAAO,OAAO,YAAY;GACtE,OAAO,iBAAiB;IACtB,MAAM,UAAU,QAAQ,WAAW,eAAe,cAAc,OAAO;IAGvE,MAAM,SAAS;MACZ,QAAQ,WAAW,WAAW,QAAQ,QAAQ,WAAW;MACzD,QAAQ,WAAW,kBAAkB,QAAQ,QAAQ,WAAW;IACnE;IAEA,IAAI,OAAO,OAAO,MAAM,CAAC,CAAC,MAAM,UAAU,UAAU,KAAA,CAAS,GAAG,MAAM,YAAY;IAGlF,MAAM,QAAQ,IAAI,IAChB,OAAO,QAAQ;MACZ,QAAQ,WAAW,WAAW,WAAW;MACzC,QAAQ,WAAW,YAAY;MAC/B,QAAQ,WAAW,eAAe,WAAW;MAC7C,QAAQ,WAAW,qBAAqB,WAAW;MACnD,QAAQ,WAAW,kBAAkB,WAAW;MAChD,QAAQ,WAAW,WAAW,SAAS,MAAM,WAAW,QAAQ;MAChE,QAAQ,WAAW,gBAAgB,WAAW;IACjD,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;KACvB,MAAM,SAAS,EAAE,OAAO,GAAG,GACzB,QAAQ,EAAE,MAAM,KAAK,KAAK;KAE5B,IAAI,OAAO,UAAU,UAAU,OAAO,GAAG,GAAG,OAAO,KAAK;KAExD,OAAO,IAAI,gBAAgB;MACzB,aAAa,GAAG,UAAU,OAAO,YAAY;MAC7C,UACE,GAAG,mBAAmB,OAAO,uCAAuC,MAAM;MAC5E,cAAc,GAAG,QAAQ,OAAO,mBAAmB,MAAM;KAC3D,CAAC;IACH,CAAC,CACH;IAEA,OAAO,GAAG,GAAG,EAAE,OAAO,MAAM,EAAE;kBACtB,EAAE,OAAO,QAAQ,WAAW,QAAQ,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,UAAU,WAAW,QAAQ,EAAE;kBACrG,EAAE,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;kBAC5F,EAAE,OAAO,QAAQ,WAAW,YAAY,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,cAAc,WAAW,YAAY,EAAE;kBACjH;GACV,CAAC,CAAC,CAAC,KAAK,OAAO,OAAO;EACxB,CAAC,CAAC,CAAC,KAAK,OAAO;CACnB;AACF,CAAC"}
+{"version":3,"file":"password-credentials.mjs","names":[],"sources":["../../src/internal/password-credentials.ts"],"sourcesContent":["import { CurrentCommitJournal, hasCommitScope } from \"@yielded/auth/Hooks\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport {\n  EncodedPasswordHash,\n  type PasswordPersistence,\n  PasswordUnavailable,\n  snapshotPasswordCredential,\n  type PasswordCredentialSnapshot,\n} from \"@yielded/auth/Password\";\nimport { reportPersistenceFailure } from \"@yielded/auth/Persistence\";\nimport { SecurityRevision } from \"@yielded/auth/Sessions\";\nimport { Effect, Option, Redacted, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { AnyPasswordPersistenceMapping } from \"./models/password-model\";\nimport { sqlMapping, type SqlTable } from \"./native-sql-table\";\nimport type { PasswordWorkflowOptions } from \"./password-policy\";\n\ntype Row = Readonly<Record<string, unknown>>;\nconst unavailable = () => PasswordUnavailable.make({});\n\nconst failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n  reportPersistenceFailure(effect, Schema.is(PasswordUnavailable)).pipe(\n    Effect.mapError(unavailable),\n  );\n\nexport const samePasswordCredentialSnapshot = (\n  a: PasswordCredentialSnapshot,\n  b: PasswordCredentialSnapshot,\n) =>\n  a.moduleId === b.moduleId &&\n  a.revision.subjectId === b.revision.subjectId &&\n  a.revision.securityRevision === b.revision.securityRevision &&\n  a.revision.credentials.length === b.revision.credentials.length &&\n  new Set(a.revision.credentials.map((entry) => entry.credentialId)).size ===\n    a.revision.credentials.length &&\n  new Set(b.revision.credentials.map((entry) => entry.credentialId)).size ===\n    b.revision.credentials.length &&\n  a.revision.credentials.every((entry) =>\n    b.revision.credentials.some(\n      (other) => entry.credentialId === other.credentialId && entry.revision === other.revision,\n    ),\n  ) &&\n  a.credentialId === b.credentialId &&\n  a.credentialRevision === b.credentialRevision &&\n  a.verifierVersion === b.verifierVersion &&\n  Redacted.value(a.verifier) === Redacted.value(b.verifier) &&\n  a.normalization === b.normalization &&\n  a.identifier.namespace === b.identifier.namespace &&\n  a.identifier.value === b.identifier.value &&\n  a.identifierBindingRevision === b.identifierBindingRevision &&\n  a.identifierVerifiedAtMillis === b.identifierVerifiedAtMillis;\n\n/** Lookup is read-only; rehash is one conditional maintenance write, never authentication. */\nexport const makePasswordCredentials = Effect.fnUntraced(function* (\n  table: (table: object) => SqlTable,\n  mapping: AnyPasswordPersistenceMapping,\n  options: PasswordWorkflowOptions,\n): Effect.fn.Return<\n  Pick<PasswordPersistence[\"Service\"], \"findCredential\" | \"rehashIfCurrent\">,\n  PasswordUnavailable,\n  SqlClient.SqlClient\n> {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const parent = yield* Effect.serviceOption(CurrentCommitJournal);\n\n  const [s, i, c, a] = yield* sqlMapping(\n    () =>\n      [\n        table(mapping.subject.table),\n        table(mapping.identifier.table),\n        table(mapping.credential.table),\n        table(mapping.authorityCredential.table),\n      ] as const,\n  ).pipe(failure);\n\n  const standalone = Effect.gen(function* () {\n    if (options.coordinated) {\n      const current = yield* Effect.serviceOption(CurrentCommitJournal);\n\n      if (Option.isNone(parent) || Option.isNone(current) || parent.value !== current.value)\n        return yield* unavailable();\n    } else {\n      if (yield* hasCommitScope) return yield* unavailable();\n      yield* options.standaloneGuard;\n    }\n  });\n\n  const allocate = <A>(\n    asynchronous: Effect.Effect<A, PersistenceMappingError> | undefined,\n    sync: (() => A) | undefined,\n  ) => {\n    if (options.mode !== \"synchronous\" && asynchronous !== undefined) return asynchronous;\n\n    return sync === undefined\n      ? Effect.fail(unavailable())\n      : Effect.try({ try: sync, catch: unavailable });\n  };\n\n  // Bind each native ID through its own column codec. Physical encodings of the\n  // same application ID need not match across subject, identifier and password.\n  const snapshot = Effect.fnUntraced(function* (\n    nativeId: unknown,\n    moduleId: string,\n    identifier: LoginIdentifier,\n  ) {\n    const subjectTable = s.as(\"password_subject\");\n    const identifierTable = i.as(\"password_identifier\");\n    const credentialTable = c.as(\"password_credential\");\n    const authorityTable = a.as(\"password_authority\");\n    const authority = mapping.authorityCredential;\n\n    const rows = yield* sqlMapping(\n      () =>\n        sql<Row>`select ${subjectTable.fields(\"subject_\")}, ${identifierTable.fields(\"identifier_\")}, ${credentialTable.fields(\"credential_\")}, ${authorityTable.fields(\"authority_\")}\n      from ${subjectTable.name}\n      inner join ${identifierTable.name} on ${identifierTable.column(mapping.identifier.namespace)} = ${identifierTable.value(mapping.identifier.namespace, identifier.namespace)}\n        and ${identifierTable.column(mapping.identifier.value)} = ${identifierTable.value(mapping.identifier.value, identifier.value)}\n        and ${identifierTable.column(mapping.identifier.subjectId)} = ${identifierTable.value(mapping.identifier.subjectId, nativeId)}\n      inner join ${credentialTable.name} on ${credentialTable.column(mapping.credential.moduleId)} = ${credentialTable.value(mapping.credential.moduleId, moduleId)}\n        and ${credentialTable.column(mapping.credential.subjectId)} = ${credentialTable.value(mapping.credential.subjectId, nativeId)}\n      left join ${authorityTable.name} on ${authorityTable.column(authority.subjectId)} = ${authorityTable.value(authority.subjectId, nativeId)}\n        ${authority.status === undefined || authority.d1ActiveStatusValue === undefined ? sql`` : sql`and ${authorityTable.column(authority.status)} = ${authorityTable.value(authority.status, authority.d1ActiveStatusValue)}`}\n      where ${subjectTable.column(mapping.subject.id)} = ${subjectTable.value(mapping.subject.id, nativeId)} order by ${authorityTable.column(authority.credentialId)} limit 4097\n      `,\n    ).pipe(Effect.flatten);\n\n    if (rows.length === 0) return undefined;\n    if (rows.length > 4096) return yield* unavailable();\n\n    const [subject, identifierRow, credential] = yield* sqlMapping(\n      () =>\n        [\n          s.decode(rows[0]!, \"subject_\"),\n          i.decode(rows[0]!, \"identifier_\"),\n          c.decode(rows[0]!, \"credential_\"),\n        ] as const,\n    );\n\n    if (\n      yield* sqlMapping(\n        () =>\n          !mapping.subject.isActiveStatus(subject[mapping.subject.status]) ||\n          !mapping.identifier.isCurrent(identifierRow) ||\n          !mapping.subjectId.equals(nativeId, identifierRow[mapping.identifier.subjectId]) ||\n          !mapping.subjectId.equals(nativeId, subject[mapping.subject.id]) ||\n          !mapping.subjectId.equals(nativeId, credential[mapping.credential.subjectId]),\n      )\n    )\n      return undefined;\n\n    const captured = yield* sqlMapping(() =>\n      mapping.credential.decode({ moduleId, subject, identifier: identifierRow, credential }),\n    ).pipe(Effect.flatten, Effect.flatMap(snapshotPasswordCredential));\n\n    const factors = new Map<string, SecurityRevision>();\n\n    for (const row of rows) {\n      const factor = yield* sqlMapping(() => a.decode(row, \"authority_\"));\n\n      if (factor[authority.credentialId] === null || factor[authority.credentialId] === undefined)\n        continue;\n      if (!mapping.subjectId.equals(nativeId, factor[authority.subjectId]))\n        return yield* unavailable();\n      if (\n        authority.status !== undefined &&\n        authority.isActiveStatus?.(factor[authority.status]) !== true\n      )\n        continue;\n\n      const credentialId = yield* Schema.decodeUnknownEffect(Schema.String)(\n        factor[authority.credentialId],\n      );\n\n      const revision = yield* Schema.decodeUnknownEffect(SecurityRevision)(\n        factor[authority.revision],\n      );\n\n      if (factors.has(credentialId)) return yield* unavailable();\n      factors.set(credentialId, revision);\n    }\n    if (factors.size > 64 || factors.get(captured.credentialId) !== captured.credentialRevision)\n      return undefined;\n\n    return yield* snapshotPasswordCredential({\n      ...captured,\n      revision: {\n        ...captured.revision,\n        credentials: [...factors].map(([credentialId, revision]) => ({ credentialId, revision })),\n      },\n    });\n  });\n\n  return {\n    findCredential: (uncaptured) =>\n      Effect.gen(function* () {\n        const input = { ...uncaptured, identifier: { ...uncaptured.identifier } };\n\n        yield* standalone;\n\n        const identifiers = yield* sqlMapping(\n          () => sql<Row>`select ${i.fields(\"i_\")} from ${i.name}\n          where ${i.column(mapping.identifier.namespace)} = ${i.value(mapping.identifier.namespace, input.identifier.namespace)}\n            and ${i.column(mapping.identifier.value)} = ${i.value(mapping.identifier.value, input.identifier.value)}`,\n        ).pipe(Effect.flatten);\n\n        const identifier =\n          identifiers.length === 1\n            ? yield* sqlMapping(() => i.decode(identifiers[0]!, \"i_\"))\n            : undefined;\n\n        if (\n          identifier === undefined ||\n          !(yield* sqlMapping(() => mapping.identifier.isCurrent(identifier)))\n        )\n          return Option.none();\n\n        const credential = yield* snapshot(\n          identifier[mapping.identifier.subjectId],\n          input.moduleId,\n          input.identifier,\n        );\n\n        return credential === undefined ||\n          (input.subjectId !== undefined && credential.revision.subjectId !== input.subjectId)\n          ? Option.none()\n          : Option.some(credential);\n      }).pipe(failure),\n    rehashIfCurrent: (input) =>\n      Effect.gen(function* () {\n        const nextVerifier = Redacted.make(\n          yield* Schema.decodeEffect(EncodedPasswordHash)(Redacted.value(input.nextVerifier)),\n        );\n\n        const credential = yield* snapshotPasswordCredential(input.credential);\n\n        yield* standalone;\n        const nativeId = yield* mapping.subjectId.toNative(credential.revision.subjectId);\n        const version = yield* allocate(mapping.allocateRevision, mapping.allocateRevisionSync);\n\n        if (version === credential.verifierVersion) return yield* unavailable();\n        yield* sqlMapping(() => {\n          const encoded = mapping.credential.encodeVerifier(nextVerifier, version);\n\n          // A custom encoder cannot turn maintenance into a semantic credential change.\n          const values = {\n            [mapping.credential.verifier]: encoded[mapping.credential.verifier],\n            [mapping.credential.verifierVersion]: encoded[mapping.credential.verifierVersion],\n          };\n\n          if (Object.values(values).some((value) => value === undefined)) throw unavailable();\n\n          // Ordinary identity predicates retain index use; the full CAS ignores text collation.\n          const exact = sql.and(\n            Object.entries({\n              [mapping.credential.moduleId]: credential.moduleId,\n              [mapping.credential.subjectId]: nativeId,\n              [mapping.credential.credentialId]: credential.credentialId,\n              [mapping.credential.credentialRevision]: credential.credentialRevision,\n              [mapping.credential.verifierVersion]: credential.verifierVersion,\n              [mapping.credential.verifier]: Redacted.value(credential.verifier),\n              [mapping.credential.normalization]: credential.normalization,\n            }).map(([key, value]) => {\n              const column = c.column(key),\n                bound = c.value(key, value);\n\n              if (typeof value !== \"string\") return sql`${column} = ${bound}`;\n\n              return sql.onDialectOrElse({\n                mysql: () => sql`binary ${column} = binary ${bound}`,\n                pg: () =>\n                  sql`convert_to(cast(${column} as text), 'UTF8') = convert_to(cast(${bound} as text), 'UTF8')`,\n                orElse: () => sql`cast(${column} as blob) = cast(${bound} as blob)`,\n              });\n            }),\n          );\n\n          return sql`${c.update(values)}\n          where ${c.column(mapping.credential.moduleId)} = ${c.value(mapping.credential.moduleId, credential.moduleId)}\n            and ${c.column(mapping.credential.subjectId)} = ${c.value(mapping.credential.subjectId, nativeId)}\n            and ${c.column(mapping.credential.credentialId)} = ${c.value(mapping.credential.credentialId, credential.credentialId)}\n            and ${exact}`;\n        }).pipe(Effect.flatten);\n      }).pipe(failure),\n  } satisfies Pick<PasswordPersistence[\"Service\"], \"findCredential\" | \"rehashIfCurrent\">;\n});\n"],"mappings":";;;;;;;;AAoBA,MAAM,oBAAoB,oBAAoB,KAAK,CAAC,CAAC;AAErD,MAAM,WAAoB,WACxB,yBAAyB,QAAQ,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,KAC/D,OAAO,SAAS,WAAW,CAC7B;AAEF,MAAa,kCACX,GACA,MAEA,EAAE,aAAa,EAAE,YACjB,EAAE,SAAS,cAAc,EAAE,SAAS,aACpC,EAAE,SAAS,qBAAqB,EAAE,SAAS,oBAC3C,EAAE,SAAS,YAAY,WAAW,EAAE,SAAS,YAAY,UACzD,IAAI,IAAI,EAAE,SAAS,YAAY,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,SACjE,EAAE,SAAS,YAAY,UACzB,IAAI,IAAI,EAAE,SAAS,YAAY,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,SACjE,EAAE,SAAS,YAAY,UACzB,EAAE,SAAS,YAAY,OAAO,UAC5B,EAAE,SAAS,YAAY,MACpB,UAAU,MAAM,iBAAiB,MAAM,gBAAgB,MAAM,aAAa,MAAM,QACnF,CACF,KACA,EAAE,iBAAiB,EAAE,gBACrB,EAAE,uBAAuB,EAAE,sBAC3B,EAAE,oBAAoB,EAAE,mBACxB,SAAS,MAAM,EAAE,QAAQ,MAAM,SAAS,MAAM,EAAE,QAAQ,KACxD,EAAE,kBAAkB,EAAE,iBACtB,EAAE,WAAW,cAAc,EAAE,WAAW,aACxC,EAAE,WAAW,UAAU,EAAE,WAAW,SACpC,EAAE,8BAA8B,EAAE,6BAClC,EAAE,+BAA+B,EAAE;;AAGrC,MAAa,0BAA0B,OAAO,WAAW,WACvD,OACA,SACA,SAKA;CACA,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,SAAS,OAAO,OAAO,cAAc,oBAAoB;CAE/D,MAAM,CAAC,GAAG,GAAG,GAAG,KAAK,OAAO,iBAExB;EACE,MAAM,QAAQ,QAAQ,KAAK;EAC3B,MAAM,QAAQ,WAAW,KAAK;EAC9B,MAAM,QAAQ,WAAW,KAAK;EAC9B,MAAM,QAAQ,oBAAoB,KAAK;CACzC,CACJ,CAAC,CAAC,KAAK,OAAO;CAEd,MAAM,aAAa,OAAO,IAAI,aAAa;EACzC,IAAI,QAAQ,aAAa;GACvB,MAAM,UAAU,OAAO,OAAO,cAAc,oBAAoB;GAEhE,IAAI,OAAO,OAAO,MAAM,KAAK,OAAO,OAAO,OAAO,KAAK,OAAO,UAAU,QAAQ,OAC9E,OAAO,OAAO,YAAY;EAC9B,OAAO;GACL,IAAI,OAAO,gBAAgB,OAAO,OAAO,YAAY;GACrD,OAAO,QAAQ;EACjB;CACF,CAAC;CAED,MAAM,YACJ,cACA,SACG;EACH,IAAI,QAAQ,SAAS,iBAAiB,iBAAiB,KAAA,GAAW,OAAO;EAEzE,OAAO,SAAS,KAAA,IACZ,OAAO,KAAK,YAAY,CAAC,IACzB,OAAO,IAAI;GAAE,KAAK;GAAM,OAAO;EAAY,CAAC;CAClD;CAIA,MAAM,WAAW,OAAO,WAAW,WACjC,UACA,UACA,YACA;EACA,MAAM,eAAe,EAAE,GAAG,kBAAkB;EAC5C,MAAM,kBAAkB,EAAE,GAAG,qBAAqB;EAClD,MAAM,kBAAkB,EAAE,GAAG,qBAAqB;EAClD,MAAM,iBAAiB,EAAE,GAAG,oBAAoB;EAChD,MAAM,YAAY,QAAQ;EAE1B,MAAM,OAAO,OAAO,iBAEhB,GAAQ,UAAU,aAAa,OAAO,UAAU,EAAE,IAAI,gBAAgB,OAAO,aAAa,EAAE,IAAI,gBAAgB,OAAO,aAAa,EAAE,IAAI,eAAe,OAAO,YAAY,EAAE;aACzK,aAAa,KAAK;mBACZ,gBAAgB,KAAK,MAAM,gBAAgB,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,WAAW,WAAW,SAAS,EAAE;cACpK,gBAAgB,OAAO,QAAQ,WAAW,KAAK,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,OAAO,WAAW,KAAK,EAAE;cACxH,gBAAgB,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;mBACnH,gBAAgB,KAAK,MAAM,gBAAgB,OAAO,QAAQ,WAAW,QAAQ,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,UAAU,QAAQ,EAAE;cACtJ,gBAAgB,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,gBAAgB,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;kBACpH,eAAe,KAAK,MAAM,eAAe,OAAO,UAAU,SAAS,EAAE,KAAK,eAAe,MAAM,UAAU,WAAW,QAAQ,EAAE;UACtI,UAAU,WAAW,KAAA,KAAa,UAAU,wBAAwB,KAAA,IAAY,GAAG,KAAK,GAAG,OAAO,eAAe,OAAO,UAAU,MAAM,EAAE,KAAK,eAAe,MAAM,UAAU,QAAQ,UAAU,mBAAmB,IAAI;cACnN,aAAa,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,aAAa,MAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE,YAAY,eAAe,OAAO,UAAU,YAAY,EAAE;OAElK,CAAC,CAAC,KAAK,OAAO,OAAO;EAErB,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAC9B,IAAI,KAAK,SAAS,MAAM,OAAO,OAAO,YAAY;EAElD,MAAM,CAAC,SAAS,eAAe,cAAc,OAAO,iBAEhD;GACE,EAAE,OAAO,KAAK,IAAK,UAAU;GAC7B,EAAE,OAAO,KAAK,IAAK,aAAa;GAChC,EAAE,OAAO,KAAK,IAAK,aAAa;EAClC,CACJ;EAEA,IACE,OAAO,iBAEH,CAAC,QAAQ,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,OAAO,KAC/D,CAAC,QAAQ,WAAW,UAAU,aAAa,KAC3C,CAAC,QAAQ,UAAU,OAAO,UAAU,cAAc,QAAQ,WAAW,UAAU,KAC/E,CAAC,QAAQ,UAAU,OAAO,UAAU,QAAQ,QAAQ,QAAQ,GAAG,KAC/D,CAAC,QAAQ,UAAU,OAAO,UAAU,WAAW,QAAQ,WAAW,UAAU,CAChF,GAEA,OAAO,KAAA;EAET,MAAM,WAAW,OAAO,iBACtB,QAAQ,WAAW,OAAO;GAAE;GAAU;GAAS,YAAY;GAAe;EAAW,CAAC,CACxF,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,QAAQ,0BAA0B,CAAC;EAEjE,MAAM,0BAAU,IAAI,IAA8B;EAElD,KAAK,MAAM,OAAO,MAAM;GACtB,MAAM,SAAS,OAAO,iBAAiB,EAAE,OAAO,KAAK,YAAY,CAAC;GAElE,IAAI,OAAO,UAAU,kBAAkB,QAAQ,OAAO,UAAU,kBAAkB,KAAA,GAChF;GACF,IAAI,CAAC,QAAQ,UAAU,OAAO,UAAU,OAAO,UAAU,UAAU,GACjE,OAAO,OAAO,YAAY;GAC5B,IACE,UAAU,WAAW,KAAA,KACrB,UAAU,iBAAiB,OAAO,UAAU,OAAO,MAAM,MAEzD;GAEF,MAAM,eAAe,OAAO,OAAO,oBAAoB,OAAO,MAAM,CAAC,CACnE,OAAO,UAAU,aACnB;GAEA,MAAM,WAAW,OAAO,OAAO,oBAAoB,gBAAgB,CAAC,CAClE,OAAO,UAAU,SACnB;GAEA,IAAI,QAAQ,IAAI,YAAY,GAAG,OAAO,OAAO,YAAY;GACzD,QAAQ,IAAI,cAAc,QAAQ;EACpC;EACA,IAAI,QAAQ,OAAO,MAAM,QAAQ,IAAI,SAAS,YAAY,MAAM,SAAS,oBACvE,OAAO,KAAA;EAET,OAAO,OAAO,2BAA2B;GACvC,GAAG;GACH,UAAU;IACR,GAAG,SAAS;IACZ,aAAa,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,cAAc,eAAe;KAAE;KAAc;IAAS,EAAE;GAC1F;EACF,CAAC;CACH,CAAC;CAED,OAAO;EACL,iBAAiB,eACf,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ;IAAE,GAAG;IAAY,YAAY,EAAE,GAAG,WAAW,WAAW;GAAE;GAExE,OAAO;GAEP,MAAM,cAAc,OAAO,iBACnB,GAAQ,UAAU,EAAE,OAAO,IAAI,EAAE,QAAQ,EAAE,KAAK;kBAC9C,EAAE,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,WAAW,MAAM,WAAW,SAAS,EAAE;kBAC9G,EAAE,OAAO,QAAQ,WAAW,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,OAAO,MAAM,WAAW,KAAK,GAC1G,CAAC,CAAC,KAAK,OAAO,OAAO;GAErB,MAAM,aACJ,YAAY,WAAW,IACnB,OAAO,iBAAiB,EAAE,OAAO,YAAY,IAAK,IAAI,CAAC,IACvD,KAAA;GAEN,IACE,eAAe,KAAA,KACf,EAAE,OAAO,iBAAiB,QAAQ,WAAW,UAAU,UAAU,CAAC,IAElE,OAAO,OAAO,KAAK;GAErB,MAAM,aAAa,OAAO,SACxB,WAAW,QAAQ,WAAW,YAC9B,MAAM,UACN,MAAM,UACR;GAEA,OAAO,eAAe,KAAA,KACnB,MAAM,cAAc,KAAA,KAAa,WAAW,SAAS,cAAc,MAAM,YACxE,OAAO,KAAK,IACZ,OAAO,KAAK,UAAU;EAC5B,CAAC,CAAC,CAAC,KAAK,OAAO;EACjB,kBAAkB,UAChB,OAAO,IAAI,aAAa;GACtB,MAAM,eAAe,SAAS,KAC5B,OAAO,OAAO,aAAa,mBAAmB,CAAC,CAAC,SAAS,MAAM,MAAM,YAAY,CAAC,CACpF;GAEA,MAAM,aAAa,OAAO,2BAA2B,MAAM,UAAU;GAErE,OAAO;GACP,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,WAAW,SAAS,SAAS;GAChF,MAAM,UAAU,OAAO,SAAS,QAAQ,kBAAkB,QAAQ,oBAAoB;GAEtF,IAAI,YAAY,WAAW,iBAAiB,OAAO,OAAO,YAAY;GACtE,OAAO,iBAAiB;IACtB,MAAM,UAAU,QAAQ,WAAW,eAAe,cAAc,OAAO;IAGvE,MAAM,SAAS;MACZ,QAAQ,WAAW,WAAW,QAAQ,QAAQ,WAAW;MACzD,QAAQ,WAAW,kBAAkB,QAAQ,QAAQ,WAAW;IACnE;IAEA,IAAI,OAAO,OAAO,MAAM,CAAC,CAAC,MAAM,UAAU,UAAU,KAAA,CAAS,GAAG,MAAM,YAAY;IAGlF,MAAM,QAAQ,IAAI,IAChB,OAAO,QAAQ;MACZ,QAAQ,WAAW,WAAW,WAAW;MACzC,QAAQ,WAAW,YAAY;MAC/B,QAAQ,WAAW,eAAe,WAAW;MAC7C,QAAQ,WAAW,qBAAqB,WAAW;MACnD,QAAQ,WAAW,kBAAkB,WAAW;MAChD,QAAQ,WAAW,WAAW,SAAS,MAAM,WAAW,QAAQ;MAChE,QAAQ,WAAW,gBAAgB,WAAW;IACjD,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW;KACvB,MAAM,SAAS,EAAE,OAAO,GAAG,GACzB,QAAQ,EAAE,MAAM,KAAK,KAAK;KAE5B,IAAI,OAAO,UAAU,UAAU,OAAO,GAAG,GAAG,OAAO,KAAK;KAExD,OAAO,IAAI,gBAAgB;MACzB,aAAa,GAAG,UAAU,OAAO,YAAY;MAC7C,UACE,GAAG,mBAAmB,OAAO,uCAAuC,MAAM;MAC5E,cAAc,GAAG,QAAQ,OAAO,mBAAmB,MAAM;KAC3D,CAAC;IACH,CAAC,CACH;IAEA,OAAO,GAAG,GAAG,EAAE,OAAO,MAAM,EAAE;kBACtB,EAAE,OAAO,QAAQ,WAAW,QAAQ,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,UAAU,WAAW,QAAQ,EAAE;kBACrG,EAAE,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,WAAW,QAAQ,EAAE;kBAC5F,EAAE,OAAO,QAAQ,WAAW,YAAY,EAAE,KAAK,EAAE,MAAM,QAAQ,WAAW,cAAc,WAAW,YAAY,EAAE;kBACjH;GACV,CAAC,CAAC,CAAC,KAAK,OAAO,OAAO;EACxB,CAAC,CAAC,CAAC,KAAK,OAAO;CACnB;AACF,CAAC"}

package/dist/internal/password-native.d.mts

@@ -0,0 +1,14 @@
+import { AnyProofPersistenceMapping } from "./models/proof-model.mjs";
+import { AnyPasswordPersistenceMapping } from "./models/password-model.mjs";
+import { NativeSqlTables } from "./native-sql-table.mjs";
+import { SqlBatchCommit } from "./sql-commit.mjs";
+import { Crypto, Effect } from "effect";
+import { LifecycleHooks } from "@yielded/auth/Hooks";
+import * as P from "@yielded/auth/Password";
+import { SqlClient } from "effect/sql/SqlClient";
+//#region src/internal/password-native.d.ts
+export declare const makeNativePasswordServices: (tables: NativeSqlTables, mapping: AnyPasswordPersistenceMapping, proofs?: AnyProofPersistenceMapping | undefined) => Effect.Effect<{
+  readonly passwordPersistence: P.PasswordPersistence["Service"];
+}, P.PasswordUnavailable, Crypto.Crypto | LifecycleHooks | SqlBatchCommit | SqlClient>;
+//#endregion
+//# sourceMappingURL=password-native.d.mts.map