@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/src/internal/models/passkey-model.ts

@@ -1,15 +1,14 @@
 import {
   type PasskeyCeremony,
   type PasskeyCredential,
-  type PasskeyMethodPolicy,
   PasskeyCredentials,
-  PasskeyEnrollmentContext,
   PasskeyPersistence,
 } from "@yielded/auth/Passkey";
 import type { SubjectId } from "@yielded/auth/Schema";
+import type { AuthenticationRequirement } from "@yielded/auth/Sessions";
 import { Effect, Layer } from "effect";
 
-import type { TableModel as Table, SqlExpression } from "../query-operations";
+import type { TableModel as Table, SqlExpression } from "../table-model";
 import type { PersistenceMappingError } from "./common";
 
 export type PasskeyColumn<T extends Table> = T["column"];
@@ -26,10 +25,6 @@ export interface PasskeyPersistenceServices {
   readonly passkeyPersistence: PasskeyPersistence["Service"];
 }
 
-export interface PasskeyEnrollmentContextServices {
-  readonly passkeyEnrollmentContext: PasskeyEnrollmentContext["Service"];
-}
-
 export const passkeyCredentialsLayer = <E, R>(
   services: Effect.Effect<PasskeyCredentialServices, E, R>,
 ): Layer.Layer<PasskeyCredentials, E, R> =>
@@ -46,14 +41,6 @@ export const passkeyPersistenceLayer = <E, R>(
     Effect.map(services, (value) => value.passkeyPersistence),
   );
 
-export const passkeyEnrollmentContextLayer = <E, R>(
-  services: Effect.Effect<PasskeyEnrollmentContextServices, E, R>,
-): Layer.Layer<PasskeyEnrollmentContext, E, R> =>
-  Layer.effect(
-    PasskeyEnrollmentContext,
-    Effect.map(services, (value) => value.passkeyEnrollmentContext),
-  );
-
 /** Native IDs roundtrip exactly; protocol IDs and authentication references are
  * different identities. These callbacks never suspend inside an owner. */
 export interface PasskeySubjectIdCodec<N> {
@@ -79,6 +66,9 @@ export interface PasskeySubjectReadTable<
   readonly id: PasskeyColumn<T>;
   readonly status: PasskeyColumn<T>;
   readonly securityRevision: PasskeyColumn<T>;
+  readonly decodeRequirement: (
+    row: T["select"],
+  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;
   readonly decodeId: (row: Readonly<Partial<T["select"]>>) => N;
   readonly isActiveStatus: (value: unknown) => boolean;
   readonly activeCondition: Expression;
@@ -110,7 +100,6 @@ export interface PasskeyCredentialReadTable<
   readonly rpId: PasskeyColumn<T>;
   readonly protocolCredentialId: PasskeyColumn<T>;
   readonly credentialKey: PasskeyColumn<T>;
-  readonly handleKey: PasskeyColumn<T>;
   readonly userHandle: PasskeyColumn<T>;
   readonly publicKey: PasskeyColumn<T>;
   readonly algorithm: PasskeyColumn<T>;
@@ -122,269 +111,83 @@ export interface PasskeyCredentialReadTable<
   readonly backupEligible: PasskeyColumn<T>;
   readonly backupState: PasskeyColumn<T>;
   readonly counter: PasskeyColumn<T>;
-  readonly maximumCounter: PasskeyColumn<T>;
   readonly decode: (
     row: Readonly<Partial<T["select"]>>,
-  ) => Omit<PasskeyCredential, "revision" | "active">;
+  ) => Omit<PasskeyCredential, "revision" | "active" | "requirement">;
   readonly decodeSubjectId: (row: Readonly<Partial<T["select"]>>) => N;
   readonly isActiveStatus: (value: unknown) => boolean;
   readonly activeCondition: Expression;
 }
 
-export interface PasskeyCredentialOwnershipTable<
-  T extends Table,
-  N,
-  Expression extends SqlExpression = SqlExpression,
-> {
-  readonly table: T["table"];
-  readonly credentialKey: PasskeyColumn<T>;
-  readonly rpId: PasskeyColumn<T>;
-  readonly protocolCredentialId: PasskeyColumn<T>;
-  readonly subjectId: PasskeyColumn<T>;
-  readonly credentialId: PasskeyColumn<T>;
-  readonly state: PasskeyColumn<T>;
-  readonly version: PasskeyColumn<T>;
-  readonly reservationId: PasskeyColumn<T>;
-  readonly ownedCondition: Expression;
-  readonly isOwnedState: (value: unknown) => boolean;
-  readonly decodeSubjectId: (row: Readonly<Partial<T["select"]>>) => N;
-}
-
-/** Reservations do not manufacture a subject; bound handles are RP-global. */
-export interface PasskeyHandleReadTable<T extends Table> {
-  readonly table: T["table"];
-  readonly handleKey: PasskeyColumn<T>;
-  readonly rpId: PasskeyColumn<T>;
-  readonly userHandle: PasskeyColumn<T>;
-  readonly state: PasskeyColumn<T>;
-  readonly version: PasskeyColumn<T>;
-  readonly reservationId: PasskeyColumn<T>;
-}
-
-export interface PasskeyHandleReservationTable<
-  T extends Table,
-  Expression extends SqlExpression = SqlExpression,
-> extends PasskeyHandleReadTable<T> {
-  readonly reservedCondition: Expression;
-  readonly isReservedState: (value: unknown) => boolean;
-}
-
-export interface PasskeyHandleOwnershipTable<
-  T extends Table,
-  N,
-  Expression extends SqlExpression = SqlExpression,
-> extends PasskeyHandleReadTable<T> {
-  readonly subjectId: PasskeyColumn<T>;
-  readonly ownedCondition: Expression;
-  readonly isOwnedState: (value: unknown) => boolean;
-  readonly decodeSubjectId: (row: Readonly<Partial<T["select"]>>) => N;
-}
-
 export const requiredPasskeyCredentialConstraints = {
   credentialId: ["credentialId"],
+  credentialKey: ["credentialKey"],
   factor: ["subjectId", "credentialId"],
-  credentialOwnership: ["credentialKey"],
-  handleOwnership: ["handleKey"],
-  boundSubjectHandle: ["rpId", "subjectId"],
 } as const;
 
 export interface PasskeyCredentialMapping<
   S extends Table,
   C extends Table,
   F extends Table,
-  Ownership extends Table,
-  Handle extends Table,
   N,
   Expression extends SqlExpression = SqlExpression,
 > {
   readonly subject: PasskeySubjectReadTable<S, N, Expression>;
   readonly credential: PasskeyCredentialReadTable<C, N, Expression>;
   readonly authority: PasskeyFactorReadTable<F, Expression>;
-  readonly credentialOwnership: PasskeyCredentialOwnershipTable<Ownership, N, Expression>;
-  readonly handleOwnership: PasskeyHandleOwnershipTable<Handle, N, Expression>;
   readonly subjectIds: PasskeySubjectIdCodec<N>;
   readonly constraints: typeof requiredPasskeyCredentialConstraints;
 }
 
-/** A stable additional policy row, acquired before RP/credential locks. The
- * factory checks column names without erasing the consumer table at its input. */
-const PasskeyPolicyGuardTypeId: unique symbol = Symbol("effect-auth/drizzle/PasskeyPolicyGuard");
-
-export interface PasskeyPolicyGuard<Expression extends SqlExpression = SqlExpression> {
-  readonly [PasskeyPolicyGuardTypeId]: true;
-  readonly scope: string;
-  readonly table: object;
-  readonly columns: ReadonlyArray<string>;
-  readonly where: (moduleId: string) => Expression;
-  readonly condition: (moduleId: string) => Expression;
-}
-
-export const passkeyPolicyGuard = <
-  T extends Table,
-  Expression extends SqlExpression = SqlExpression,
->(input: {
-  readonly scope: string;
-  readonly table: T["table"];
-  readonly columns: ReadonlyArray<PasskeyColumn<T>>;
-  readonly where: (moduleId: string) => Expression;
-  readonly condition: (moduleId: string) => Expression;
-}): PasskeyPolicyGuard<Expression> => ({ ...input, [PasskeyPolicyGuardTypeId]: true });
-
-export interface PasskeyModuleTable<
-  T extends Table,
-  Expression extends SqlExpression = SqlExpression,
-> {
-  readonly table: T["table"];
-  readonly moduleId: PasskeyColumn<T>;
-  readonly status: PasskeyColumn<T>;
-  readonly policyRevision: PasskeyColumn<T>;
-  /** All physical fields used by decodeMethodPolicy, including policyRevision. */
-  readonly policyColumns: ReadonlyArray<PasskeyColumn<T>>;
-  readonly isActiveStatus: (value: unknown) => boolean;
-  readonly activeCondition: Expression;
-  readonly decodeMethodPolicy: (row: Readonly<Partial<T["select"]>>) => PasskeyMethodPolicy;
-  readonly guards?: ReadonlyArray<PasskeyPolicyGuard<Expression>>;
-}
-
-export type PasskeyFlowState =
-  | "Pending"
-  | "Claimed"
-  | "Verified"
-  | "Rejected"
-  | "Ambiguous"
-  | "RegistrationAccepted"
-  | "ProvisioningPending";
-
 export interface PasskeyFlowInsert {
   readonly ceremony: PasskeyCeremony;
-  readonly policy: PasskeyMethodPolicy;
-  readonly marker: string;
 }
 
+/** An immutable, single-use challenge. Consuming or expiring it deletes the row. */
 export interface PasskeyFlowTable<T extends Table> {
   readonly table: T["table"];
   readonly moduleId: PasskeyColumn<T>;
   readonly flowId: PasskeyColumn<T>;
-  readonly commandId: PasskeyColumn<T>;
   readonly purpose: PasskeyColumn<T>;
-  readonly state: PasskeyColumn<T>;
-  readonly version: PasskeyColumn<T>;
-  readonly generation: PasskeyColumn<T>;
   readonly snapshot: PasskeyColumn<T>;
-  readonly policySnapshot: PasskeyColumn<T>;
   readonly requestBindingVerifier: PasskeyColumn<T>;
   readonly requestBindingExpiresAt: PasskeyColumn<T>;
   readonly issuedAt: PasskeyColumn<T>;
   readonly expiresAt: PasskeyColumn<T>;
-  readonly retentionUntil: PasskeyColumn<T>;
-  readonly claimId: PasskeyColumn<T>;
-  readonly claimedAt: PasskeyColumn<T>;
-  readonly claimExpiresAt: PasskeyColumn<T>;
-  readonly credentialSnapshot: PasskeyColumn<T>;
-  /** Core SubjectId scope text, not a consumer's native subject ID. */
-  readonly subjectScope: PasskeyColumn<T>;
-  readonly targetScope: PasskeyColumn<T>;
-  readonly states: Readonly<Record<PasskeyFlowState, unknown>>;
   readonly encodeInsert: (input: PasskeyFlowInsert) => T["insert"];
 }
 
-export interface PasskeyAdmissionTable<T extends Table> {
-  readonly table: T["table"];
-  readonly authorityScope: PasskeyColumn<T>;
-  readonly moduleId: PasskeyColumn<T>;
-  readonly version: PasskeyColumn<T>;
-  readonly ownerMarker: PasskeyColumn<T>;
-  /** One physical clock sample, reused by every charge of this decision. */
-  readonly admittedAt: PasskeyColumn<T>;
-}
-
-export type PasskeyChargeKind = "global" | "subject" | "target";
-
-export interface PasskeyChargeInsert {
-  readonly moduleId: string;
-  readonly flowId: string;
-  readonly purpose: PasskeyCeremony["purpose"];
-  readonly kind: PasskeyChargeKind;
-  readonly scope: string;
-  readonly originalWindowMillis: number;
-  readonly marker: string;
-}
-
-/** Charge scope is canonical core identity text; this subject-free descriptor
- * can count all purposes without decoding any unrelated native subject. */
-export interface PasskeyChargeTable<T extends Table> {
-  readonly table: T["table"];
-  readonly moduleId: PasskeyColumn<T>;
-  readonly flowId: PasskeyColumn<T>;
-  readonly purpose: PasskeyColumn<T>;
-  readonly kind: PasskeyColumn<T>;
-  readonly scope: PasskeyColumn<T>;
-  readonly originalWindowMillis: PasskeyColumn<T>;
-  readonly admittedAt: PasskeyColumn<T>;
-  readonly retainUntil: PasskeyColumn<T>;
-  readonly version: PasskeyColumn<T>;
-  readonly ownerMarker: PasskeyColumn<T>;
-  readonly encodeInsert: (input: PasskeyChargeInsert) => T["insert"];
-}
-
 export const requiredPasskeyPersistenceConstraints = {
   flow: ["moduleId", "flowId"],
-  command: ["moduleId", "commandId"],
-  admission: ["authorityScope", "moduleId"],
-  charge: ["moduleId", "flowId", "kind"],
 } as const;
 
 export interface PasskeyCeremonyMapping<
-  Module extends Table,
   Flow extends Table,
-  Admission extends Table,
-  Charge extends Table,
   Expression extends SqlExpression = SqlExpression,
 > {
   readonly moduleId: string;
-  readonly authorityScope: string;
-  readonly module: PasskeyModuleTable<Module, Expression>;
   readonly flow: PasskeyFlowTable<Flow>;
-  readonly admission: PasskeyAdmissionTable<Admission>;
-  readonly charge: PasskeyChargeTable<Charge>;
   readonly clock: PasskeyClock<Expression>;
   readonly constraints: typeof requiredPasskeyPersistenceConstraints;
 }
 
 export interface PasskeyPersistenceMapping<
   Read,
-  Module extends Table,
   Flow extends Table,
-  Admission extends Table,
-  Charge extends Table,
   N,
   Expression extends SqlExpression = SqlExpression,
   Credential extends Table = Table,
-> extends PasskeyCeremonyMapping<Module, Flow, Admission, Charge, Expression> {
+> extends PasskeyCeremonyMapping<Flow, Expression> {
   readonly read: Read & {
     readonly subjectIds: PasskeySubjectIdCodec<N>;
   };
   readonly telemetry: {
     readonly lastUsedAt: PasskeyColumn<Credential>;
+    readonly encodeBackupEligible: (value: boolean) => unknown;
     readonly encodeBackupState: (value: boolean) => unknown;
   };
 }
 
-export interface PasskeyEnrollmentContextMapping<
-  Read,
-  Module extends Table,
-  N,
-  Expression extends SqlExpression = SqlExpression,
-> {
-  readonly moduleId: string;
-  readonly read: Read & {
-    readonly subjectIds: PasskeySubjectIdCodec<N>;
-  };
-  readonly module: PasskeyModuleTable<Module, Expression>;
-}
-
 export interface D1PasskeyMapping {
-  readonly d1: {
-    readonly primary: true;
-  };
+  readonly d1: { readonly primary: true };
 }

package/src/internal/models/passkey-registration-ceremony-model.ts

@@ -1,72 +1,18 @@
-import type { TableModel as Table, SqlExpression } from "../query-operations";
-import type {
-  PasskeyCeremonyMapping,
-  PasskeyChargeTable,
-  PasskeyColumn,
-  PasskeyFlowTable,
-  PasskeyHandleReservationTable,
-  PasskeyPersistenceServices,
-} from "./passkey-model";
+import type { TableModel as Table, SqlExpression } from "../table-model";
+import type { PasskeyCeremonyMapping, PasskeyPersistenceServices } from "./passkey-model";
 
 export interface PasskeyRegistrationCeremonyCapabilities {
   readonly purposes: readonly ["registration"];
   readonly issue: "registration-authority";
-  readonly assertionSettlement: false;
+  readonly assertionConsumption: false;
 }
 
 export interface PasskeyRegistrationCeremonyServices extends PasskeyPersistenceServices {
   readonly capabilities: PasskeyRegistrationCeremonyCapabilities;
 }
 
-/** Read-only custody supplied by a separate registration issuance authority.
- * No application payload codec, subject codec or provisioning callback runs here. */
-export interface PasskeyRegistrationIntentReadTable<
-  T extends Table,
-  Expression extends SqlExpression = SqlExpression,
-> {
-  readonly table: T["table"];
-  readonly moduleId: PasskeyColumn<T>;
-  readonly flowId: PasskeyColumn<T>;
-  readonly commandId: PasskeyColumn<T>;
-  readonly state: PasskeyColumn<T>;
-  readonly version: PasskeyColumn<T>;
-  readonly fingerprint: PasskeyColumn<T>;
-  readonly handleKey: PasskeyColumn<T>;
-  readonly reservationId: PasskeyColumn<T>;
-  readonly ceremonySnapshot: PasskeyColumn<T>;
-  /** Already validated by the issuing authority; compare opaque bytes only. */
-  readonly applicationSnapshot: PasskeyColumn<T>;
-  readonly pendingCondition: Expression;
-  readonly isPendingState: (value: unknown) => boolean;
-  /** Any unresolved initial intent or provisioning job; cleanup never releases it. */
-  readonly custodyCondition: Expression;
-}
-
-export const requiredPasskeyRegistrationCeremonyConstraints = {
-  flow: ["moduleId", "flowId"],
-  command: ["moduleId", "commandId"],
-  admission: ["authorityScope", "moduleId"],
-  charge: ["moduleId", "flowId", "kind"],
-  intentFlow: ["moduleId", "flowId"],
-  intentCommand: ["moduleId", "commandId"],
-  handle: ["handleKey"],
-} as const;
-
-export interface PasskeyRegistrationCeremonyMapping<
-  Module extends Table,
+/** The registration authority owns insertion and consumption of the challenge. */
+export type PasskeyRegistrationCeremonyMapping<
   Flow extends Table,
-  Admission extends Table,
-  Charge extends Table,
-  Intent extends Table,
-  Handle extends Table,
   Expression extends SqlExpression = SqlExpression,
-> extends Omit<
-  PasskeyCeremonyMapping<Module, Flow, Admission, Charge, Expression>,
-  "constraints" | "flow" | "charge"
-> {
-  readonly flow: Omit<PasskeyFlowTable<Flow>, "encodeInsert">;
-  readonly charge: Omit<PasskeyChargeTable<Charge>, "encodeInsert">;
-  readonly intent: PasskeyRegistrationIntentReadTable<Intent, Expression>;
-  readonly handle: PasskeyHandleReservationTable<Handle, Expression>;
-  readonly constraints: typeof requiredPasskeyRegistrationCeremonyConstraints;
-}
+> = PasskeyCeremonyMapping<Flow, Expression>;

package/src/internal/models/passkey-write-model.ts

@@ -3,7 +3,7 @@ import type {
   PasskeyUnavailable,
   PasskeyActionAuthorization,
   PasskeyCeremony,
-  PasskeyClaim,
+  PasskeyAccess,
   PasskeyCredential,
   PasskeyCredentialSummary,
   PasskeyIssueDecision,
@@ -14,23 +14,20 @@ import type {
   PasskeyManagementPersistence,
   PreparePasskeyCommit,
   PasskeyManagementPolicy,
-  PasskeyMethodPolicy,
 } from "@yielded/auth/Passkey";
 import type { TokenDigest } from "@yielded/auth/Schema";
 import type { SessionInvalidationWindow } from "@yielded/auth/Sessions";
 import type { Effect, Schema } from "effect";
 
-import type { TableModel as Table, SqlExpression } from "../query-operations";
+import type { TableModel as Table, SqlExpression } from "../table-model";
 import type { PersistenceMappingError } from "./common";
 import type {
   PasskeyColumn,
   PasskeyCredentialMapping,
   PasskeyFlowTable,
-  PasskeyHandleReservationTable,
   PasskeyPersistenceMapping,
   PasskeyPersistenceServices,
 } from "./passkey-model";
-import type { PasskeyRegistrationIntentReadTable } from "./passkey-registration-ceremony-model";
 
 export interface PasskeyCredentialInsert<N> {
   readonly subjectId: N;
@@ -43,8 +40,6 @@ export interface PasskeyWriteTables<
   S extends Table,
   C extends Table,
   F extends Table,
-  O extends Table,
-  H extends Table,
   N,
   Expression extends SqlExpression = SqlExpression,
 > {
@@ -63,21 +58,7 @@ export interface PasskeyWriteTables<
     readonly activeStatus: unknown;
     readonly removedStatus: unknown;
   };
-  readonly credentialOwnership: {
-    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => O["insert"];
-    readonly ownedState: unknown;
-    readonly removedState: unknown;
-  };
-  readonly handleOwnership: {
-    readonly encodeInsert: (input: {
-      readonly subjectId: N;
-      readonly rpId: string;
-      readonly userHandle: string;
-      readonly marker: string;
-    }) => H["insert"];
-    readonly ownedState: unknown;
-  };
-  /** All mutable policy dependencies must be subject columns or declared module guards. */
+  /** Mutable management policy dependencies belong to the locked subject row. */
   readonly policy: {
     readonly subjectColumns: ReadonlyArray<PasskeyColumn<S>>;
     readonly management: (row: Readonly<Partial<S["select"]>>) => PasskeyManagementPolicy;
@@ -122,50 +103,21 @@ export const passkeyInvalidationMutation = <
   readonly postcondition: (input: PasskeyInvalidationInput<N>) => Expression;
 }): PasskeyInvalidationMutation<N, Expression> => input;
 
-export interface PasskeyCommandTable<T extends Table, N> {
-  readonly table: T["table"];
-  readonly moduleId: PasskeyColumn<T>;
-  readonly commandId: PasskeyColumn<T>;
-  readonly subjectId: PasskeyColumn<T>;
-  readonly credentialId: PasskeyColumn<T>;
-  readonly intent: PasskeyColumn<T>;
-  readonly decision: PasskeyColumn<T>;
-  readonly retentionUntil: PasskeyColumn<T>;
-  readonly version: PasskeyColumn<T>;
-  readonly encodeInsert: (input: {
-    readonly moduleId: string;
-    readonly commandId: string;
-    readonly subjectId: N;
-    readonly credentialId: string;
-  }) => T["insert"];
-}
-
 export interface PasskeyManagementMapping<
   S extends Table,
   C extends Table,
   F extends Table,
-  O extends Table,
-  H extends Table,
-  M extends Table,
   Flow extends Table,
-  A extends Table,
-  Charge extends Table,
-  Command extends Table,
   N,
   Expression extends SqlExpression = SqlExpression,
 > extends PasskeyPersistenceMapping<
-  PasskeyCredentialMapping<S, C, F, O, H, N, Expression>,
-  M,
+  PasskeyCredentialMapping<S, C, F, N, Expression>,
   Flow,
-  A,
-  Charge,
   N,
   Expression,
   C
 > {
-  readonly write: PasskeyWriteTables<S, C, F, O, H, N, Expression>;
-  readonly command: PasskeyCommandTable<Command, N>;
-  readonly managementConstraints: typeof requiredPasskeyManagementConstraints;
+  readonly write: PasskeyWriteTables<S, C, F, N, Expression>;
   /** Removal must match the installed session strategy and change the subject revision; immediate sessions must consult that authority or be updated here. Enrollment preserves existing authentication. */
   readonly invalidation: {
     readonly window: SessionInvalidationWindow;
@@ -174,8 +126,6 @@ export interface PasskeyManagementMapping<
   };
 }
 
-export const requiredPasskeyManagementConstraints = { command: ["moduleId", "commandId"] } as const;
-
 export interface PasskeyManagementServices extends PasskeyPersistenceServices {
   readonly passkeyManagementPersistence: PasskeyManagementPersistence["Service"];
 }
@@ -193,16 +143,15 @@ export interface PasskeyRegistrationWriter<R> {
   readonly issueRegistration: <A>(
     input: {
       readonly ceremony: PasskeyCeremony;
-      readonly policy: PasskeyMethodPolicy;
       readonly registration: R;
     },
     prepare: PreparePasskeyCommit<PasskeyIssueDecision, A>,
   ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
   readonly completeRegistration: <A>(
     input: {
-      readonly claim: PasskeyClaim;
+      readonly access: PasskeyAccess;
+      readonly ceremony: PasskeyCeremony;
       readonly verified: PasskeyRegistrationVerified;
-      readonly nowMillis: number;
     },
     prepare: PreparePasskeyCommit<
       | PasskeyRegistrationResult
@@ -222,45 +171,21 @@ export interface PasskeyRegistrationMapping<
   S extends Table,
   C extends Table,
   F extends Table,
-  O extends Table,
-  H extends Table,
-  M extends Table,
   Flow extends Table,
-  A extends Table,
-  Charge extends Table,
-  Intent extends Table,
   N,
   R,
   Expression extends SqlExpression = SqlExpression,
 > extends PasskeyPersistenceMapping<
-  PasskeyCredentialMapping<S, C, F, O, H, N, Expression>,
-  M,
+  PasskeyCredentialMapping<S, C, F, N, Expression>,
   Flow,
-  A,
-  Charge,
   N,
   Expression,
   C
 > {
-  readonly write: PasskeyWriteTables<S, C, F, O, H, N, Expression>;
+  readonly write: PasskeyWriteTables<S, C, F, N, Expression>;
   readonly flow: PasskeyFlowTable<Flow>;
-  readonly handle: PasskeyHandleReservationTable<H, Expression> & {
-    readonly reservedState: unknown;
-    readonly encodeInsert: (input: {
-      readonly ceremony: PasskeyCeremony;
-      readonly reservationId: string;
-    }) => H["insert"];
-  };
-  readonly intent: PasskeyRegistrationIntentReadTable<Intent, Expression> & {
-    readonly pendingState: unknown;
-    readonly acceptedState: unknown;
-    readonly rejectedState: unknown;
-    readonly encodeInsert: (input: {
-      readonly ceremony: PasskeyCeremony;
-      readonly registration: R;
-      readonly reservationId: string;
-    }) => Intent["insert"];
-  };
+  /** Schema-encoded original registration payload on the same immutable flow row. */
+  readonly applicationSnapshot: PasskeyColumn<Flow>;
   /** Consumer-owned data and identity, synchronously encoded inside the owner. A SQL-local registration creates no session and needs no email address. */
   readonly registration: {
     readonly schema: Schema.Codec<R, unknown, never, never>;
@@ -271,12 +196,13 @@ export interface PasskeyRegistrationMapping<
     readonly eligible: (registration: R) => Expression;
     /** Commit-time application policy after provisioning. Unlike `eligible`, this
      * must permit the newly created subject and retain every mutable prerequisite.
-     * Declare mutable external policy rows in module.guards so native locking
-     * owners serialize revocation through commit; this predicate alone is not a lock. */
+     * Subject-local prerequisites are checked under its lock. */
     readonly finalEligibility: (input: {
       readonly registration: R;
       readonly subjectId: N;
     }) => Expression;
+    /** D1 plans require explicit subject identity, status, and security revision
+     * values; they cannot read database defaults before the atomic batch runs. */
     readonly subject: (input: {
       readonly registration: R;
       readonly ceremony: PasskeyCeremony;
@@ -287,11 +213,4 @@ export interface PasskeyRegistrationMapping<
     };
     readonly activeStatus: unknown;
   };
-  readonly registrationConstraints: typeof requiredPasskeyRegistrationWriteConstraints;
 }
-
-export const requiredPasskeyRegistrationWriteConstraints = {
-  intentFlow: ["moduleId", "flowId"],
-  intentCommand: ["moduleId", "commandId"],
-  handle: ["handleKey"],
-} as const;