@yielded/auth-persistence 0.1.0-beta.31 → 0.1.0-beta.32

package/dist/internal/oauth-managed.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-managed.mjs","names":[],"sources":["../../src/internal/oauth-managed.ts"],"sourcesContent":["import type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { AuthenticationFlowId } from \"@yielded/auth/Sessions\";\nimport { Context, type Crypto, DateTime, Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport {\n  PersistenceConfigurationError,\n  type MappingInput,\n  type OAuthFeature,\n} from \"./configuration\";\nimport {\n  requiredOAuthConnectedConstraints,\n  requiredOAuthConnectedRevocationConstraints,\n  type OAuthConnectedPolicyInput,\n} from \"./models/oauth-connected-model\";\nimport { requiredOAuthSignInConstraints } from \"./models/oauth-model\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { makeNativeOAuthConnectedServices } from \"./oauth/native-connected\";\nimport type { OAuthNativeConnectedMapping } from \"./oauth/native-connected-state\";\nimport { makeNativeOAuthRevocationServices } from \"./oauth/native-revocations\";\nimport { makeNativeOAuthSignInServices } from \"./oauth/native-sign-in\";\nimport type { OAuthNativeReadMapping } from \"./oauth/native-state\";\nimport { sameRevision, satisfies } from \"./oauth/state\";\nimport { exactSqlText } from \"./sql-change\";\nimport { SqlBatchCommit } from \"./sql-commit\";\nimport { makeStorageClock } from \"./storage-clock\";\nimport { storageTables, type StorageRole } from \"./storage-tables\";\n\n// Removed provider grants retain revocation custody for 30 days; claims may extend it.\nconst revocationRetentionMillis = 30 * 24 * 60 * 60 * 1000;\nconst encodeProfile = Schema.encodeSync(Schema.fromJsonString(M.OAuthConnectedProfile));\nconst encodePolicy = Schema.encodeSync(Schema.fromJsonString(M.OAuthConnectedPolicy));\n\nconst configurationError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\n/** Managed tables use the same native OAuth operations as explicit mappings. */\nexport const makeManagedOAuth = Effect.fnUntraced(function* (\n  storage: MappingInput,\n  tables: NativeSqlTables,\n  features: ReadonlyArray<OAuthFeature>,\n): Effect.fn.Return<\n  Context.Context<never>,\n  PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient | SqlBatchCommit\n> {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const batch = yield* SqlBatchCommit;\n\n  const clock = yield* makeStorageClock(storage).pipe(\n    Effect.mapError(() => configurationError(\"Cannot configure the OAuth storage clock\")),\n  );\n\n  function mapped<Role extends StorageRole>(role: Role) {\n    const table = storage.tables[role];\n\n    if (table === undefined) throw configurationError(`Missing ${role} mapping`);\n\n    return {\n      table,\n      // Storage validation owns these logical column keys.\n      ...(Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key])) as {\n        readonly [Key in keyof (typeof storageTables)[Role][\"columns\"]]: Key;\n      }),\n    };\n  }\n\n  const s = storage.subjects;\n  const subject = tables(s.table);\n  const credential = mapped(\"oauthCredentials\");\n  const credentials = tables(credential.table);\n  const authority = mapped(\"credentials\");\n  const factors = tables(authority.table);\n  const now = tables.expression(clock.engineNowMillis);\n  const policies = new Map<string, M.OAuthConnectedPolicy>();\n\n  for (const feature of features) {\n    if (feature.connected === undefined) continue;\n\n    const policy = yield* M.snapshotOAuth(M.OAuthConnectedPolicy, feature.connected).pipe(\n      Effect.mapError(() => configurationError(`Invalid OAuth policy for ${feature.moduleId}`)),\n    );\n\n    const previous = policies.get(feature.moduleId);\n\n    if (previous !== undefined && encodePolicy(previous) !== encodePolicy(policy))\n      return yield* configurationError(`Conflicting OAuth policies for ${feature.moduleId}`);\n    policies.set(feature.moduleId, policy);\n  }\n\n  const shared = {\n    subject: {\n      table: s.table,\n      id: s.id,\n      status: s.status,\n      securityRevision: s.securityRevision,\n      isActiveStatus: (value: unknown) => Object.is(value, s.activeValue),\n      activeCondition: sql`${subject.column(s.status)} = ${subject.value(s.status, s.activeValue)}`,\n      decodeAuthenticationRequirement: s.requirements,\n    },\n    subjectId: { toSubject: s.toSubject, toNative: s.toNative, equals: Object.is },\n    ownership: {\n      ...mapped(\"oauthIdentities\"),\n      decodeSubjectId: (row: Record<string, unknown>) => row.subjectId,\n      encodeInsert: () => ({}),\n    },\n    credential: {\n      ...credential,\n      status: \"active\",\n      isActiveStatus: (value: unknown) => value === true,\n      activeCondition: sql`${credentials.column(\"active\")} = ${credentials.value(\"active\", true)}`,\n    },\n    authority: {\n      ...authority,\n      status: \"active\",\n      isActiveStatus: (value: unknown) => value === true,\n      activeCondition: sql`${factors.column(\"active\")} = ${factors.value(\"active\", true)}`,\n    },\n    clock,\n  };\n\n  function policyCondition(input: OAuthConnectedPolicyInput<unknown>): Fragment {\n    let moduleId: string;\n\n    switch (input.kind) {\n      case \"sign-in\":\n        moduleId = input.credential.moduleId;\n        break;\n      case \"action\":\n        moduleId = input.authorization.challenge.moduleId;\n        break;\n      case \"metadata\":\n      case \"use\":\n        moduleId = input.authorization.moduleId;\n    }\n    const policy = policies.get(moduleId);\n\n    if (policy === undefined) return sql`false`;\n    const grant = input.grant;\n\n    if (grant !== undefined) {\n      if (grant.moduleId !== moduleId || grant.subjectId !== input.revision.subjectId)\n        return sql`false`;\n      // Disconnect must remain possible after a profile is retired or removed.\n      if (input.kind !== \"action\" || input.operation !== \"disconnect\") {\n        const profile = policy.profiles.find(\n          (value) => value.key === grant.configuration.profile.key && value.issuance === \"active\",\n        );\n\n        if (\n          profile === undefined ||\n          encodeProfile(profile) !==\n            encodeProfile({\n              ...grant.configuration.profile,\n              issuance: \"active\",\n            })\n        )\n          return sql`false`;\n      }\n    }\n\n    const current = sql`exists(select 1 from ${subject.name} where ${subject.column(s.id)} = ${subject.value(s.id, input.subjectId)} and ${shared.subject.activeCondition} and ${exactSqlText(sql, subject.column(s.securityRevision), subject.value(s.securityRevision, input.revision.securityRevision))})`;\n\n    if (input.kind === \"sign-in\")\n      return features.some((feature) => feature.moduleId === moduleId && feature.signIn)\n        ? current\n        : sql`false`;\n    if (input.kind !== \"action\") {\n      // Mutable application policy shares the subject's guarded security revision.\n      return input.authorization.policyRevision === input.revision.securityRevision\n        ? current\n        : sql`false`;\n    }\n\n    const { authorization } = input;\n    const { challenge, evidence, requirement } = authorization;\n    const action = input.operation === \"settle\" ? \"connected-complete\" : \"connected-disconnect\";\n\n    if (\n      challenge.action !== action ||\n      !sameRevision(challenge.revision, input.revision) ||\n      !sameRevision(evidence.revision, input.revision) ||\n      evidence.flowId !== AuthenticationFlowId.make(challenge.flowId) ||\n      evidence.bindingDigest !== challenge.bindingDigest ||\n      !satisfies(evidence.proofs, requirement) ||\n      evidence.proofs.some(\n        (proof) =>\n          !input.revision.credentials.some((entry) => entry.credentialId === proof.credentialId),\n      )\n    )\n      return sql`false`;\n\n    const maximumAge = Math.min(requirement.maximumAgeMillis, policy.maximumEvidenceAgeMillis);\n    const verified = evidence.proofs.map((proof) => DateTime.toEpochMillis(proof.verifiedAt));\n\n    if (authorization.source._tag === \"Session\")\n      verified.push(DateTime.toEpochMillis(authorization.source.authenticatedAt));\n\n    return sql.and([\n      current,\n      sql`${now} < ${authorization.validUntilMillis}`,\n      ...verified.map((instant) => sql`${now} >= ${instant} and ${now} < ${instant + maximumAge}`),\n    ]);\n  }\n\n  let context: Context.Context<never> = Context.empty();\n\n  if (features.some((feature) => feature.signIn)) {\n    const mapping: OAuthNativeReadMapping = {\n      ...shared,\n      flow: { ...mapped(\"oauthSignInFlows\"), encodeInsert: () => ({}) },\n      constraints: requiredOAuthSignInConstraints,\n    };\n\n    const services = yield* makeNativeOAuthSignInServices(tables, mapping, batch).pipe(\n      Effect.mapError(() => configurationError(\"Cannot configure OAuth sign-in persistence\")),\n    );\n\n    context = Context.add(context, M.OAuthSignInPersistence, services.oauthSignInPersistence);\n  }\n  if (policies.size > 0) {\n    const job = { ...mapped(\"oauthConnectedRevocations\"), encodeInsert: () => ({}) };\n    const grant = { ...mapped(\"oauthConnectedGrants\"), encodeInsert: () => ({}) };\n\n    const mapping: OAuthNativeConnectedMapping = {\n      ...shared,\n      flow: { ...mapped(\"oauthConnectedFlows\"), encodeInsert: () => ({}) },\n      grant,\n      policy: { condition: policyCondition },\n      constraints: requiredOAuthConnectedConstraints,\n      revocation: {\n        mode: \"provider\",\n        job,\n        retentionMillis: revocationRetentionMillis,\n        constraints: requiredOAuthConnectedRevocationConstraints,\n      },\n      otherReferences: ({ identityKey, subjectId }) =>\n        sql`exists(select 1 from ${credentials.name} where ${credentials.column(\"subjectId\")} = ${credentials.value(\"subjectId\", subjectId)} and ${exactSqlText(sql, credentials.column(\"identityKey\"), credentials.value(\"identityKey\", identityKey))})`,\n    };\n\n    const connected = yield* makeNativeOAuthConnectedServices(tables, mapping, batch).pipe(\n      Effect.mapError(() => configurationError(\"Cannot configure OAuth connected persistence\")),\n    );\n\n    const revocations = yield* makeNativeOAuthRevocationServices(\n      tables,\n      {\n        ...mapping,\n        job,\n        constraints: requiredOAuthConnectedRevocationConstraints,\n      },\n      batch,\n    ).pipe(\n      Effect.mapError(() => configurationError(\"Cannot configure OAuth revocation persistence\")),\n    );\n\n    context = context.pipe(\n      Context.add(M.OAuthConnectedPersistence, {\n        ...connected.oauthConnectedPersistence,\n        read: (input) =>\n          connected.oauthConnectedPersistence\n            .read(input)\n            .pipe(\n              Effect.map((snapshot) =>\n                snapshot === undefined\n                  ? undefined\n                  : { ...snapshot, policyRevision: snapshot.revision.securityRevision },\n              ),\n            ),\n      }),\n      Context.add(M.OAuthConnectedRevocations, revocations.oauthConnectedRevocations),\n    );\n  }\n\n  return context;\n});\n"],"mappings":";;;;;;;;;;;;;;;;AA+BA,MAAM,4BAA4B;AAClC,MAAM,gBAAgB,OAAO,WAAW,OAAO,eAAe,EAAE,qBAAqB,CAAC;AACtF,MAAM,eAAe,OAAO,WAAW,OAAO,eAAe,EAAE,oBAAoB,CAAC;AAEpF,MAAM,sBAAsB,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;;AAG5F,MAAa,mBAAmB,OAAO,WAAW,WAChD,SACA,QACA,UAKA;CACA,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,QAAQ,OAAO;CAErB,MAAM,QAAQ,OAAO,iBAAiB,OAAO,CAAC,CAAC,KAC7C,OAAO,eAAe,mBAAmB,0CAA0C,CAAC,CACtF;CAEA,SAAS,OAAiC,MAAY;EACpD,MAAM,QAAQ,QAAQ,OAAO;EAE7B,IAAI,UAAU,KAAA,GAAW,MAAM,mBAAmB,WAAW,KAAK,SAAS;EAE3E,OAAO;GACL;GAEA,GAAI,OAAO,YAAY,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;EAG1F;CACF;CAEA,MAAM,IAAI,QAAQ;CAClB,MAAM,UAAU,OAAO,EAAE,KAAK;CAC9B,MAAM,aAAa,OAAO,kBAAkB;CAC5C,MAAM,cAAc,OAAO,WAAW,KAAK;CAC3C,MAAM,YAAY,OAAO,aAAa;CACtC,MAAM,UAAU,OAAO,UAAU,KAAK;CACtC,MAAM,MAAM,OAAO,WAAW,MAAM,eAAe;CACnD,MAAM,2BAAW,IAAI,IAAoC;CAEzD,KAAK,MAAM,WAAW,UAAU;EAC9B,IAAI,QAAQ,cAAc,KAAA,GAAW;EAErC,MAAM,SAAS,OAAO,EAAE,cAAc,EAAE,sBAAsB,QAAQ,SAAS,CAAC,CAAC,KAC/E,OAAO,eAAe,mBAAmB,4BAA4B,QAAQ,UAAU,CAAC,CAC1F;EAEA,MAAM,WAAW,SAAS,IAAI,QAAQ,QAAQ;EAE9C,IAAI,aAAa,KAAA,KAAa,aAAa,QAAQ,MAAM,aAAa,MAAM,GAC1E,OAAO,OAAO,mBAAmB,kCAAkC,QAAQ,UAAU;EACvF,SAAS,IAAI,QAAQ,UAAU,MAAM;CACvC;CAEA,MAAM,SAAS;EACb,SAAS;GACP,OAAO,EAAE;GACT,IAAI,EAAE;GACN,QAAQ,EAAE;GACV,kBAAkB,EAAE;GACpB,iBAAiB,UAAmB,OAAO,GAAG,OAAO,EAAE,WAAW;GAClE,iBAAiB,GAAG,GAAG,QAAQ,OAAO,EAAE,MAAM,EAAE,KAAK,QAAQ,MAAM,EAAE,QAAQ,EAAE,WAAW;GAC1F,iCAAiC,EAAE;EACrC;EACA,WAAW;GAAE,WAAW,EAAE;GAAW,UAAU,EAAE;GAAU,QAAQ,OAAO;EAAG;EAC7E,WAAW;GACT,GAAG,OAAO,iBAAiB;GAC3B,kBAAkB,QAAiC,IAAI;GACvD,qBAAqB,CAAC;EACxB;EACA,YAAY;GACV,GAAG;GACH,QAAQ;GACR,iBAAiB,UAAmB,UAAU;GAC9C,iBAAiB,GAAG,GAAG,YAAY,OAAO,QAAQ,EAAE,KAAK,YAAY,MAAM,UAAU,IAAI;EAC3F;EACA,WAAW;GACT,GAAG;GACH,QAAQ;GACR,iBAAiB,UAAmB,UAAU;GAC9C,iBAAiB,GAAG,GAAG,QAAQ,OAAO,QAAQ,EAAE,KAAK,QAAQ,MAAM,UAAU,IAAI;EACnF;EACA;CACF;CAEA,SAAS,gBAAgB,OAAqD;EAC5E,IAAI;EAEJ,QAAQ,MAAM,MAAd;GACE,KAAK;IACH,WAAW,MAAM,WAAW;IAC5B;GACF,KAAK;IACH,WAAW,MAAM,cAAc,UAAU;IACzC;GACF,KAAK;GACL,KAAK,OACH,WAAW,MAAM,cAAc;EACnC;EACA,MAAM,SAAS,SAAS,IAAI,QAAQ;EAEpC,IAAI,WAAW,KAAA,GAAW,OAAO,GAAG;EACpC,MAAM,QAAQ,MAAM;EAEpB,IAAI,UAAU,KAAA,GAAW;GACvB,IAAI,MAAM,aAAa,YAAY,MAAM,cAAc,MAAM,SAAS,WACpE,OAAO,GAAG;GAEZ,IAAI,MAAM,SAAS,YAAY,MAAM,cAAc,cAAc;IAC/D,MAAM,UAAU,OAAO,SAAS,MAC7B,UAAU,MAAM,QAAQ,MAAM,cAAc,QAAQ,OAAO,MAAM,aAAa,QACjF;IAEA,IACE,YAAY,KAAA,KACZ,cAAc,OAAO,MACnB,cAAc;KACZ,GAAG,MAAM,cAAc;KACvB,UAAU;IACZ,CAAC,GAEH,OAAO,GAAG;GACd;EACF;EAEA,MAAM,UAAU,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,EAAE,EAAE,EAAE,KAAK,QAAQ,MAAM,EAAE,IAAI,MAAM,SAAS,EAAE,OAAO,OAAO,QAAQ,gBAAgB,OAAO,aAAa,KAAK,QAAQ,OAAO,EAAE,gBAAgB,GAAG,QAAQ,MAAM,EAAE,kBAAkB,MAAM,SAAS,gBAAgB,CAAC,EAAE;EAEvS,IAAI,MAAM,SAAS,WACjB,OAAO,SAAS,MAAM,YAAY,QAAQ,aAAa,YAAY,QAAQ,MAAM,IAC7E,UACA,GAAG;EACT,IAAI,MAAM,SAAS,UAEjB,OAAO,MAAM,cAAc,mBAAmB,MAAM,SAAS,mBACzD,UACA,GAAG;EAGT,MAAM,EAAE,kBAAkB;EAC1B,MAAM,EAAE,WAAW,UAAU,gBAAgB;EAC7C,MAAM,SAAS,MAAM,cAAc,WAAW,uBAAuB;EAErE,IACE,UAAU,WAAW,UACrB,CAAC,aAAa,UAAU,UAAU,MAAM,QAAQ,KAChD,CAAC,aAAa,SAAS,UAAU,MAAM,QAAQ,KAC/C,SAAS,WAAW,qBAAqB,KAAK,UAAU,MAAM,KAC9D,SAAS,kBAAkB,UAAU,iBACrC,CAAC,UAAU,SAAS,QAAQ,WAAW,KACvC,SAAS,OAAO,MACb,UACC,CAAC,MAAM,SAAS,YAAY,MAAM,UAAU,MAAM,iBAAiB,MAAM,YAAY,CACzF,GAEA,OAAO,GAAG;EAEZ,MAAM,aAAa,KAAK,IAAI,YAAY,kBAAkB,OAAO,wBAAwB;EACzF,MAAM,WAAW,SAAS,OAAO,KAAK,UAAU,SAAS,cAAc,MAAM,UAAU,CAAC;EAExF,IAAI,cAAc,OAAO,SAAS,WAChC,SAAS,KAAK,SAAS,cAAc,cAAc,OAAO,eAAe,CAAC;EAE5E,OAAO,IAAI,IAAI;GACb;GACA,GAAG,GAAG,IAAI,KAAK,cAAc;GAC7B,GAAG,SAAS,KAAK,YAAY,GAAG,GAAG,IAAI,MAAM,QAAQ,OAAO,IAAI,KAAK,UAAU,YAAY;EAC7F,CAAC;CACH;CAEA,IAAI,UAAkC,QAAQ,MAAM;CAEpD,IAAI,SAAS,MAAM,YAAY,QAAQ,MAAM,GAAG;EAC9C,MAAM,UAAkC;GACtC,GAAG;GACH,MAAM;IAAE,GAAG,OAAO,kBAAkB;IAAG,qBAAqB,CAAC;GAAG;GAChE,aAAa;EACf;EAEA,MAAM,WAAW,OAAO,8BAA8B,QAAQ,SAAS,KAAK,CAAC,CAAC,KAC5E,OAAO,eAAe,mBAAmB,4CAA4C,CAAC,CACxF;EAEA,UAAU,QAAQ,IAAI,SAAS,EAAE,wBAAwB,SAAS,sBAAsB;CAC1F;CACA,IAAI,SAAS,OAAO,GAAG;EACrB,MAAM,MAAM;GAAE,GAAG,OAAO,2BAA2B;GAAG,qBAAqB,CAAC;EAAG;EAC/E,MAAM,QAAQ;GAAE,GAAG,OAAO,sBAAsB;GAAG,qBAAqB,CAAC;EAAG;EAE5E,MAAM,UAAuC;GAC3C,GAAG;GACH,MAAM;IAAE,GAAG,OAAO,qBAAqB;IAAG,qBAAqB,CAAC;GAAG;GACnE;GACA,QAAQ,EAAE,WAAW,gBAAgB;GACrC,aAAa;GACb,YAAY;IACV,MAAM;IACN;IACA,iBAAiB;IACjB,aAAa;GACf;GACA,kBAAkB,EAAE,aAAa,gBAC/B,GAAG,wBAAwB,YAAY,KAAK,SAAS,YAAY,OAAO,WAAW,EAAE,KAAK,YAAY,MAAM,aAAa,SAAS,EAAE,OAAO,aAAa,KAAK,YAAY,OAAO,aAAa,GAAG,YAAY,MAAM,eAAe,WAAW,CAAC,EAAE;EACnP;EAEA,MAAM,YAAY,OAAO,iCAAiC,QAAQ,SAAS,KAAK,CAAC,CAAC,KAChF,OAAO,eAAe,mBAAmB,8CAA8C,CAAC,CAC1F;EAEA,MAAM,cAAc,OAAO,kCACzB,QACA;GACE,GAAG;GACH;GACA,aAAa;EACf,GACA,KACF,CAAC,CAAC,KACA,OAAO,eAAe,mBAAmB,+CAA+C,CAAC,CAC3F;EAEA,UAAU,QAAQ,KAChB,QAAQ,IAAI,EAAE,2BAA2B;GACvC,GAAG,UAAU;GACb,OAAO,UACL,UAAU,0BACP,KAAK,KAAK,CAAC,CACX,KACC,OAAO,KAAK,aACV,aAAa,KAAA,IACT,KAAA,IACA;IAAE,GAAG;IAAU,gBAAgB,SAAS,SAAS;GAAiB,CACxE,CACF;EACN,CAAC,GACD,QAAQ,IAAI,EAAE,2BAA2B,YAAY,yBAAyB,CAChF;CACF;CAEA,OAAO;AACT,CAAC"}

package/dist/internal/passkey-managed.mjs

@@ -2,10 +2,10 @@ import { PersistenceConfigurationError } from "./configuration.mjs";
 import { PersistenceMappingError } from "./mapping-error.mjs";
 import { anySqlCondition } from "./sql-change.mjs";
 import { SqlBatchCommit } from "./sql-commit.mjs";
+import { storageTables } from "./storage-tables.mjs";
 import { requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "./models/passkey-model.mjs";
 import { makeBatchPasskeyServices, makeNativePasskeyServices } from "./passkey-native.mjs";
 import { makePasskeyNativeManagement } from "./passkey-native-write.mjs";
-import { storageTables } from "./storage-tables.mjs";
 import { Context, Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 import * as M from "@yielded/auth/Passkey";

package/dist/internal/passkey-native-registration.mjs

@@ -1,9 +1,9 @@
 import { sqlBatchAssertion } from "./d1-planning.mjs";
 import { appendSqlBatchStatement } from "./sql-commit.mjs";
+import { randomId } from "./crypto.mjs";
 import { passkeyMatchesAccess, validPasskeyCeremony } from "./passkey-policy.mjs";
 import { passkeyNativeInvariant } from "./passkey-native-state.mjs";
 import { preparePasskeyNative } from "./passkey-native.mjs";
-import { randomId } from "./crypto.mjs";
 import { passkeyCanonicalJson, passkeyDigest } from "./passkey-actions.mjs";
 import { makePasskeyNativeWrites } from "./passkey-native-write.mjs";
 import { Effect, Schema } from "effect";

package/dist/internal/passkey-native-state.mjs

@@ -1,10 +1,12 @@
 import { sqlMapping } from "./native-sql-table.mjs";
 import { exactSqlText } from "./sql-change.mjs";
+import { canJoinTextColumns } from "./storage-validation.mjs";
 import { passkeyCredentialKey } from "./passkey-policy.mjs";
 import { makePasskeyNativeFlow } from "./passkey-native-flow.mjs";
 import { Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 import * as M from "@yielded/auth/Passkey";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 //#region src/internal/passkey-native-state.ts
 const passkeyNativeInvariant = (value) => {
 	if (!value) throw M.PasskeyUnavailable.make({});
@@ -119,6 +121,11 @@ const makePasskeyNativeReadState = Effect.fnUntraced(function* (tables, read, cl
 	const selected = (kind, alias) => {
 		return sql`(select * from ${(kind === "subject" ? subject : kind === "authority" ? factor : credential).name} where ${active(kind)}) as ${sql(alias)}`;
 	};
+	const joinedIds = yield* canJoinTextColumns([
+		subject.unencodedTextColumn?.(read.subject.id),
+		credential.unencodedTextColumn?.(read.credential.subjectId),
+		factor.unencodedTextColumn?.(read.authority.subjectId)
+	]).pipe(Effect.mapError(() => M.PasskeyUnavailable.make({})));
 	return {
 		sql,
 		tables,
@@ -136,31 +143,32 @@ const makePasskeyNativeReadState = Effect.fnUntraced(function* (tables, read, cl
 		readAuthority,
 		lookup: Effect.fnUntraced(function* (rpId, protocolCredentialId) {
 			const key = yield* passkeyCredentialKey(rpId, protocolCredentialId);
-			if (subject.unencodedTextColumn?.(read.subject.id) !== void 0 && credential.unencodedTextColumn?.(read.credential.subjectId) !== void 0 && factor.unencodedTextColumn?.(read.authority.subjectId) !== void 0) {
-				const s = joinedSubject, c = joinedCredential, f = joinedFactor;
-				const rows = yield* sql`select ${s.fields("s_")}, ${c.fields("c_")}, ${f.fields("f_")}
-        from ${selected("credential", "passkey_credential")}
-        join ${selected("subject", "passkey_subject")} on ${exactSqlText(sql, s.column(read.subject.id), c.column(read.credential.subjectId))}
-        left join ${selected("authority", "passkey_factor")} on ${exactSqlText(sql, f.column(read.authority.subjectId), c.column(read.credential.subjectId))}
-        where ${exactSqlText(sql, c.column(read.credential.credentialKey), c.value(read.credential.credentialKey, key))} limit 65`;
-				if (rows.length === 0 || rows.length > 64) return void 0;
-				const row = c.decode(rows[0], "c_");
-				const subjectRow = s.decode(rows[0], "s_");
-				const owner = read.credential.decodeSubjectId(row);
+			let nativeId;
+			if (!joinedIds) {
+				const found = yield* sql`select ${credential.fields("c_")} from ${credential.name} where ${exactSqlText(sql, credential.column(read.credential.credentialKey), credential.value(read.credential.credentialKey, key))} and ${active("credential")}`;
+				if (found.length !== 1) return void 0;
+				const row = credential.decode(found[0], "c_");
 				invariant(row[read.credential.rpId] === rpId && row[read.credential.protocolCredentialId] === protocolCredentialId);
-				invariant(rows.every((selected) => {
-					const other = c.decode(selected, "c_");
-					const subjectValue = s.decode(selected, "s_");
-					return sameId(owner, read.credential.decodeSubjectId(other)) && sameId(owner, read.subject.decodeId(subjectValue)) && other[read.credential.credentialId] === row[read.credential.credentialId] && other[read.credential.credentialRevision] === row[read.credential.credentialRevision] && subjectValue[read.subject.securityRevision] === subjectRow[read.subject.securityRevision];
-				}));
-				return yield* decodeCredential(row, revision(subjectRow, rows.map((row) => f.decode(row, "f_"))), subjectRow);
+				nativeId = read.credential.decodeSubjectId(row);
 			}
-			const rows = yield* sql`select ${credential.fields("c_")} from ${credential.name} where ${credential.column(read.credential.credentialKey)} = ${credential.value(read.credential.credentialKey, key)} and ${active("credential")}`;
-			if (rows.length !== 1) return void 0;
-			const row = credential.decode(rows[0], "c_");
-			invariant(row[read.credential.rpId] === rpId && row[read.credential.protocolCredentialId] === protocolCredentialId);
-			const current = yield* readAuthority(read.credential.decodeSubjectId(row), false);
-			return current === void 0 ? void 0 : yield* decodeCredential(row, current.revision, current.row);
+			const s = joinedSubject, c = joinedCredential, f = joinedFactor;
+			const bindOwner = (table, key) => joinedIds ? exactSqlText(sql, table.column(key), c.column(read.credential.subjectId)) : sql`${table.column(key)} = ${table.value(key, nativeId)}`;
+			const rows = yield* sql`select ${s.fields("s_")}, ${c.fields("c_")}, ${f.fields("f_")}
+      from ${selected("credential", "passkey_credential")}
+      join ${selected("subject", "passkey_subject")} on ${bindOwner(s, read.subject.id)}
+      left join ${selected("authority", "passkey_factor")} on ${bindOwner(f, read.authority.subjectId)}
+      where ${exactSqlText(sql, c.column(read.credential.credentialKey), c.value(read.credential.credentialKey, key))}${joinedIds ? sql`` : sql` and ${bindOwner(c, read.credential.subjectId)}`} limit 65`;
+			if (rows.length === 0 || rows.length > 64) return void 0;
+			const row = c.decode(rows[0], "c_");
+			const subjectRow = s.decode(rows[0], "s_");
+			const owner = read.credential.decodeSubjectId(row);
+			invariant((joinedIds || sameId(owner, nativeId)) && row[read.credential.rpId] === rpId && row[read.credential.protocolCredentialId] === protocolCredentialId);
+			invariant(rows.every((selected) => {
+				const other = c.decode(selected, "c_");
+				const subjectValue = s.decode(selected, "s_");
+				return sameId(owner, read.credential.decodeSubjectId(other)) && sameId(owner, read.subject.decodeId(subjectValue)) && other[read.credential.credentialId] === row[read.credential.credentialId] && other[read.credential.credentialRevision] === row[read.credential.credentialRevision] && subjectValue[read.subject.securityRevision] === subjectRow[read.subject.securityRevision];
+			}));
+			return yield* decodeCredential(row, revision(subjectRow, rows.map((row) => f.decode(row, "f_"))), subjectRow);
 		}),
 		joinedSubject,
 		joinedFactor,
@@ -171,9 +179,11 @@ const makePasskeyNativeReadState = Effect.fnUntraced(function* (tables, read, cl
 });
 const makePasskeyNativeState = Effect.fnUntraced(function* (tables, mapping) {
 	const state = yield* makePasskeyNativeReadState(tables, mapping.read, mapping.clock);
+	const clockPolicy = yield* AuthenticationClock;
 	const ceremony = yield* makePasskeyNativeFlow(tables, mapping);
 	return {
 		...state,
+		clockPolicy,
 		mapping,
 		ceremony,
 		flow: ceremony.flow,

package/dist/internal/passkey-native-state.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-native-state.mjs","names":[],"sources":["../../src/internal/passkey-native-state.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- physical mapping generics are erased only at this shared adapter boundary. */\nimport * as M from \"@yielded/auth/Passkey\";\nimport { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport type { PasskeyCredentialMapping, PasskeyPersistenceMapping } from \"./models/passkey-model\";\nimport { sqlMapping, type NativeSqlTables } from \"./native-sql-table\";\nimport { makePasskeyNativeFlow } from \"./passkey-native-flow\";\nimport { passkeyCredentialKey } from \"./passkey-policy\";\nimport { exactSqlText } from \"./sql-change\";\nimport type { TableModel } from \"./table-model\";\n\n// Physical expression types are validated by NativeSqlTables at this boundary.\nexport type PasskeyNativeRead = PasskeyCredentialMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  any\n>;\n\nexport type PasskeyNativeMapping = PasskeyPersistenceMapping<\n  PasskeyNativeRead,\n  TableModel,\n  unknown,\n  any\n>;\n\nexport type PasskeyNativeRow = Readonly<Record<string, unknown>>;\n\nexport const passkeyNativeInvariant: (value: unknown) => asserts value = (value) => {\n  if (!value) throw M.PasskeyUnavailable.make({});\n};\n\nexport const makePasskeyNativeReadState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  read: PasskeyNativeRead,\n  clock?: PasskeyNativeMapping[\"clock\"],\n) {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const subject = tables(read.subject.table);\n  const credential = tables(read.credential.table);\n  const factor = tables(read.authority.table);\n  const now = clock === undefined ? sql`0` : tables.expression(clock.engineNowMillis);\n\n  const millis = (expression: Fragment) =>\n    clock === undefined ? expression : tables.expression(clock.toMillis(expression));\n\n  const storedNow =\n    clock === undefined ? sql`0` : tables.expression(clock.fromMillis(clock.engineNowMillis));\n\n  const active = (table: \"subject\" | \"credential\" | \"authority\") =>\n    tables.expression(read[table].activeCondition);\n\n  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;\n  const sameId = (nativeId: unknown, value: unknown) => read.subjectIds.equals(nativeId, value);\n\n  const native = (id: M.PasskeyCredential[\"revision\"][\"subjectId\"]) => {\n    const value = read.subjectIds.toNative(id);\n\n    invariant(read.subjectIds.toSubject(value) === id);\n\n    return value;\n  };\n\n  const revisions = (nativeId: unknown, rows: ReadonlyArray<PasskeyNativeRow>) => {\n    const entries = new Map<string, M.PasskeyCredential[\"revision\"][\"securityRevision\"]>();\n\n    for (const row of rows) {\n      if (row[read.authority.credentialId] === null) continue;\n      invariant(sameId(nativeId, row[read.authority.subjectId]));\n      if (!read.authority.isActiveStatus(row[read.authority.status])) continue;\n\n      const decoded = Schema.decodeUnknownSync(M.PasskeyRevision.fields.credentials)([\n        {\n          credentialId: row[read.authority.credentialId],\n          revision: row[read.authority.revision],\n        },\n      ]);\n\n      const entry = decoded[0];\n\n      invariant(entry !== undefined);\n      const previous = entries.get(entry.credentialId);\n\n      invariant(previous === undefined || previous === entry.revision);\n      entries.set(entry.credentialId, entry.revision);\n    }\n    invariant(entries.size <= 64);\n\n    return [...entries]\n      .sort(([a], [b]) => a.localeCompare(b))\n      .map(([credentialId, revision]) => ({ credentialId, revision }));\n  };\n\n  const revision = (row: PasskeyNativeRow, factors: ReadonlyArray<PasskeyNativeRow>) => {\n    const id = read.subject.decodeId(row);\n    const subjectId = read.subjectIds.toSubject(id);\n\n    invariant(sameId(native(subjectId), id));\n\n    return Schema.decodeUnknownSync(M.PasskeyRevision)({\n      subjectId,\n      securityRevision: row[read.subject.securityRevision],\n      credentials: revisions(id, factors),\n    });\n  };\n\n  const decodeCredential = Effect.fnUntraced(function* (\n    row: PasskeyNativeRow,\n    current: M.PasskeyCredential[\"revision\"],\n    subjectRow: PasskeyNativeRow,\n  ) {\n    const value = read.credential.decode(row);\n    const owned = current.credentials.find((entry) => entry.credentialId === value.credentialId);\n\n    if (\n      !read.credential.isActiveStatus(row[read.credential.status]) ||\n      owned?.revision !== row[read.credential.credentialRevision]\n    )\n      return undefined;\n    invariant(\n      read.subjectIds.toSubject(read.credential.decodeSubjectId(row)) === current.subjectId,\n    );\n\n    return M.snapshotPasskeySync(M.PasskeyCredential, {\n      ...value,\n      revision: current,\n      requirement: yield* read.subject.decodeRequirement(subjectRow),\n      active: true,\n    });\n  });\n\n  const readAuthority = Effect.fnUntraced(function* (\n    nativeId: unknown,\n    lock: boolean,\n    credentialId?: string,\n  ) {\n    // The subject lock is a distinct first statement; joined FOR UPDATE cannot\n    // establish the lock order required by coordinated application transactions.\n    if (lock) {\n      const locked =\n        yield* sql<PasskeyNativeRow>`select ${subject.fields(\"s_\")}, ${now} as \"engineNow\" from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${active(\"subject\")} ${sql.onDialectOrElse({ pg: () => sql`for update`, mysql: () => sql`for update`, orElse: () => sql`` })}`;\n\n      if (locked.length !== 1) return undefined;\n      const row = subject.decode(locked[0]!, \"s_\");\n\n      if (\n        !sameId(read.subject.decodeId(row), nativeId) ||\n        !read.subject.isActiveStatus(row[read.subject.status])\n      )\n        return undefined;\n\n      const lockedFactors = sql`select ${factor.fields(\"f_\")} from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${active(\"authority\")} order by ${factor.column(read.authority.credentialId)} limit 65 ${sql.onDialectOrElse({ pg: () => sql`for update`, mysql: () => sql`for update`, orElse: () => sql`` })}`;\n\n      const rows =\n        credentialId === undefined\n          ? yield* sql<PasskeyNativeRow>`${lockedFactors}`\n          : yield* sql<PasskeyNativeRow>`with locked_factors as ${sql.onDialectOrElse({ pg: () => sql`materialized`, orElse: () => sql`` })} (${lockedFactors})\n        select locked_factors.*, ${credential.fields(\"c_\")} from ${credential.name} left join locked_factors on 1 = 1\n        where ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${exactSqlText(sql, credential.column(read.credential.credentialId), credential.value(read.credential.credentialId, credentialId))} and ${active(\"credential\")}`;\n\n      invariant(rows.length <= 64);\n\n      return {\n        row,\n        credential:\n          credentialId === undefined || rows[0] === undefined\n            ? undefined\n            : credential.decode(rows[0], \"c_\"),\n        revision: revision(\n          row,\n          rows.map((row) => factor.decode(row, \"f_\")),\n        ),\n        nowMillis: yield* Schema.decodeEffect(Schema.Int)(Number(locked[0]!.engineNow)),\n      };\n    }\n\n    const observedSubject = joinedSubject,\n      observedFactor = joinedFactor;\n\n    const rows =\n      yield* sql<PasskeyNativeRow>`select ${observedSubject.fields(\"s_\")}, ${observedFactor.fields(\"f_\")}, ${now} as \"engineNow\" ${credentialId === undefined ? sql`` : sql`, ${joinedCredential.fields(\"c_\")}`} from ${selected(\"subject\", \"passkey_subject\")} left join ${selected(\"authority\", \"passkey_factor\")} on ${observedFactor.column(read.authority.subjectId)} = ${observedFactor.value(read.authority.subjectId, nativeId)} ${credentialId === undefined ? sql`` : sql`join ${selected(\"credential\", \"passkey_credential\")} on ${joinedCredential.column(read.credential.subjectId)} = ${joinedCredential.value(read.credential.subjectId, nativeId)} and ${exactSqlText(sql, joinedCredential.column(read.credential.credentialId), joinedCredential.value(read.credential.credentialId, credentialId))}`} where ${observedSubject.column(read.subject.id)} = ${observedSubject.value(read.subject.id, nativeId)} limit 65`;\n\n    if (rows.length === 0 || rows.length > 64) return undefined;\n    const row = observedSubject.decode(rows[0]!, \"s_\");\n\n    if (\n      !sameId(read.subject.decodeId(row), nativeId) ||\n      !read.subject.isActiveStatus(row[read.subject.status])\n    )\n      return undefined;\n    invariant(\n      rows.every((selected) => {\n        const other = observedSubject.decode(selected, \"s_\");\n\n        return (\n          sameId(read.subject.decodeId(other), nativeId) &&\n          other[read.subject.securityRevision] === row[read.subject.securityRevision] &&\n          read.subject.isActiveStatus(other[read.subject.status])\n        );\n      }),\n    );\n\n    return {\n      row,\n      credential: credentialId === undefined ? undefined : joinedCredential.decode(rows[0]!, \"c_\"),\n      revision: revision(\n        row,\n        rows.map((selected) => observedFactor.decode(selected, \"f_\")),\n      ),\n      nowMillis: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0]!.engineNow)),\n    };\n  });\n\n  // Active predicates retain their original table qualification inside each\n  // subquery; aliases allow applications to map several roles to one table.\n  const joinedSubject = subject.as(\"passkey_subject\");\n  const joinedFactor = factor.as(\"passkey_factor\");\n  const joinedCredential = credential.as(\"passkey_credential\");\n\n  const selected = (kind: \"subject\" | \"authority\" | \"credential\", alias: string) => {\n    const table = kind === \"subject\" ? subject : kind === \"authority\" ? factor : credential;\n\n    return sql`(select * from ${table.name} where ${active(kind)}) as ${sql(alias)}`;\n  };\n\n  const lookup = Effect.fnUntraced(function* (rpId: string, protocolCredentialId: string) {\n    const key = yield* passkeyCredentialKey(rpId, protocolCredentialId);\n\n    if (\n      subject.unencodedTextColumn?.(read.subject.id) !== undefined &&\n      credential.unencodedTextColumn?.(read.credential.subjectId) !== undefined &&\n      factor.unencodedTextColumn?.(read.authority.subjectId) !== undefined\n    ) {\n      const s = joinedSubject,\n        c = joinedCredential,\n        f = joinedFactor;\n\n      const rows =\n        yield* sql<PasskeyNativeRow>`select ${s.fields(\"s_\")}, ${c.fields(\"c_\")}, ${f.fields(\"f_\")}\n        from ${selected(\"credential\", \"passkey_credential\")}\n        join ${selected(\"subject\", \"passkey_subject\")} on ${exactSqlText(sql, s.column(read.subject.id), c.column(read.credential.subjectId))}\n        left join ${selected(\"authority\", \"passkey_factor\")} on ${exactSqlText(sql, f.column(read.authority.subjectId), c.column(read.credential.subjectId))}\n        where ${exactSqlText(sql, c.column(read.credential.credentialKey), c.value(read.credential.credentialKey, key))} limit 65`;\n\n      if (rows.length === 0 || rows.length > 64) return undefined;\n      const row = c.decode(rows[0]!, \"c_\");\n      const subjectRow = s.decode(rows[0]!, \"s_\");\n      const owner = read.credential.decodeSubjectId(row);\n\n      invariant(\n        row[read.credential.rpId] === rpId &&\n          row[read.credential.protocolCredentialId] === protocolCredentialId,\n      );\n      invariant(\n        rows.every((selected) => {\n          const other = c.decode(selected, \"c_\");\n          const subjectValue = s.decode(selected, \"s_\");\n\n          return (\n            sameId(owner, read.credential.decodeSubjectId(other)) &&\n            sameId(owner, read.subject.decodeId(subjectValue)) &&\n            other[read.credential.credentialId] === row[read.credential.credentialId] &&\n            other[read.credential.credentialRevision] === row[read.credential.credentialRevision] &&\n            subjectValue[read.subject.securityRevision] ===\n              subjectRow[read.subject.securityRevision]\n          );\n        }),\n      );\n\n      return yield* decodeCredential(\n        row,\n        revision(\n          subjectRow,\n          rows.map((row) => f.decode(row, \"f_\")),\n        ),\n        subjectRow,\n      );\n    }\n\n    const rows =\n      yield* sql<PasskeyNativeRow>`select ${credential.fields(\"c_\")} from ${credential.name} where ${credential.column(read.credential.credentialKey)} = ${credential.value(read.credential.credentialKey, key)} and ${active(\"credential\")}`;\n\n    if (rows.length !== 1) return undefined;\n    const row = credential.decode(rows[0]!, \"c_\");\n\n    invariant(\n      row[read.credential.rpId] === rpId &&\n        row[read.credential.protocolCredentialId] === protocolCredentialId,\n    );\n    const current = yield* readAuthority(read.credential.decodeSubjectId(row), false);\n\n    return current === undefined\n      ? undefined\n      : yield* decodeCredential(row, current.revision, current.row);\n  });\n\n  return {\n    sql,\n    tables,\n    subject,\n    credential,\n    factor,\n    now,\n    storedNow,\n    millis,\n    active,\n    native,\n    sameId,\n    revision,\n    decodeCredential,\n    readAuthority,\n    lookup,\n    joinedSubject,\n    joinedFactor,\n    joinedCredential,\n    selected,\n    mapped: sqlMapping,\n  };\n});\n\nexport const makePasskeyNativeState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: PasskeyNativeMapping,\n) {\n  const state = yield* makePasskeyNativeReadState(tables, mapping.read, mapping.clock);\n  const ceremony = yield* makePasskeyNativeFlow(tables, mapping);\n\n  return { ...state, mapping, ceremony, flow: ceremony.flow, access: ceremony.access };\n});\n\nexport type PasskeyNativeReadState = Effect.Success<ReturnType<typeof makePasskeyNativeReadState>>;\nexport type PasskeyNativeState = Effect.Success<ReturnType<typeof makePasskeyNativeState>>;\n"],"mappings":";;;;;;;;AA+BA,MAAa,0BAA6D,UAAU;CAClF,IAAI,CAAC,OAAO,MAAM,EAAE,mBAAmB,KAAK,CAAC,CAAC;AAChD;AAEA,MAAa,6BAA6B,OAAO,WAAW,WAC1D,QACA,MACA,OACA;CACA,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,UAAU,OAAO,KAAK,QAAQ,KAAK;CACzC,MAAM,aAAa,OAAO,KAAK,WAAW,KAAK;CAC/C,MAAM,SAAS,OAAO,KAAK,UAAU,KAAK;CAC1C,MAAM,MAAM,UAAU,KAAA,IAAY,GAAG,MAAM,OAAO,WAAW,MAAM,eAAe;CAElF,MAAM,UAAU,eACd,UAAU,KAAA,IAAY,aAAa,OAAO,WAAW,MAAM,SAAS,UAAU,CAAC;CAEjF,MAAM,YACJ,UAAU,KAAA,IAAY,GAAG,MAAM,OAAO,WAAW,MAAM,WAAW,MAAM,eAAe,CAAC;CAE1F,MAAM,UAAU,UACd,OAAO,WAAW,KAAK,MAAM,CAAC,eAAe;CAE/C,MAAM,YAA2C;CACjD,MAAM,UAAU,UAAmB,UAAmB,KAAK,WAAW,OAAO,UAAU,KAAK;CAE5F,MAAM,UAAU,OAAqD;EACnE,MAAM,QAAQ,KAAK,WAAW,SAAS,EAAE;EAEzC,UAAU,KAAK,WAAW,UAAU,KAAK,MAAM,EAAE;EAEjD,OAAO;CACT;CAEA,MAAM,aAAa,UAAmB,SAA0C;EAC9E,MAAM,0BAAU,IAAI,IAAiE;EAErF,KAAK,MAAM,OAAO,MAAM;GACtB,IAAI,IAAI,KAAK,UAAU,kBAAkB,MAAM;GAC/C,UAAU,OAAO,UAAU,IAAI,KAAK,UAAU,UAAU,CAAC;GACzD,IAAI,CAAC,KAAK,UAAU,eAAe,IAAI,KAAK,UAAU,OAAO,GAAG;GAShE,MAAM,QAPU,OAAO,kBAAkB,EAAE,gBAAgB,OAAO,WAAW,CAAC,CAAC,CAC7E;IACE,cAAc,IAAI,KAAK,UAAU;IACjC,UAAU,IAAI,KAAK,UAAU;GAC/B,CACF,CAEoB,CAAC,CAAC;GAEtB,UAAU,UAAU,KAAA,CAAS;GAC7B,MAAM,WAAW,QAAQ,IAAI,MAAM,YAAY;GAE/C,UAAU,aAAa,KAAA,KAAa,aAAa,MAAM,QAAQ;GAC/D,QAAQ,IAAI,MAAM,cAAc,MAAM,QAAQ;EAChD;EACA,UAAU,QAAQ,QAAQ,EAAE;EAE5B,OAAO,CAAC,GAAG,OAAO,CAAC,CAChB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CACtC,KAAK,CAAC,cAAc,eAAe;GAAE;GAAc;EAAS,EAAE;CACnE;CAEA,MAAM,YAAY,KAAuB,YAA6C;EACpF,MAAM,KAAK,KAAK,QAAQ,SAAS,GAAG;EACpC,MAAM,YAAY,KAAK,WAAW,UAAU,EAAE;EAE9C,UAAU,OAAO,OAAO,SAAS,GAAG,EAAE,CAAC;EAEvC,OAAO,OAAO,kBAAkB,EAAE,eAAe,CAAC,CAAC;GACjD;GACA,kBAAkB,IAAI,KAAK,QAAQ;GACnC,aAAa,UAAU,IAAI,OAAO;EACpC,CAAC;CACH;CAEA,MAAM,mBAAmB,OAAO,WAAW,WACzC,KACA,SACA,YACA;EACA,MAAM,QAAQ,KAAK,WAAW,OAAO,GAAG;EACxC,MAAM,QAAQ,QAAQ,YAAY,MAAM,UAAU,MAAM,iBAAiB,MAAM,YAAY;EAE3F,IACE,CAAC,KAAK,WAAW,eAAe,IAAI,KAAK,WAAW,OAAO,KAC3D,OAAO,aAAa,IAAI,KAAK,WAAW,qBAExC,OAAO,KAAA;EACT,UACE,KAAK,WAAW,UAAU,KAAK,WAAW,gBAAgB,GAAG,CAAC,MAAM,QAAQ,SAC9E;EAEA,OAAO,EAAE,oBAAoB,EAAE,mBAAmB;GAChD,GAAG;GACH,UAAU;GACV,aAAa,OAAO,KAAK,QAAQ,kBAAkB,UAAU;GAC7D,QAAQ;EACV,CAAC;CACH,CAAC;CAED,MAAM,gBAAgB,OAAO,WAAW,WACtC,UACA,MACA,cACA;EAGA,IAAI,MAAM;GACR,MAAM,SACJ,OAAO,GAAqB,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,IAAI,uBAAuB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,OAAO,SAAS,EAAE,GAAG,IAAI,gBAAgB;IAAE,UAAU,GAAG;IAAc,aAAa,GAAG;IAAc,cAAc,GAAG;GAAG,CAAC;GAEhU,IAAI,OAAO,WAAW,GAAG,OAAO,KAAA;GAChC,MAAM,MAAM,QAAQ,OAAO,OAAO,IAAK,IAAI;GAE3C,IACE,CAAC,OAAO,KAAK,QAAQ,SAAS,GAAG,GAAG,QAAQ,KAC5C,CAAC,KAAK,QAAQ,eAAe,IAAI,KAAK,QAAQ,OAAO,GAErD,OAAO,KAAA;GAET,MAAM,gBAAgB,GAAG,UAAU,OAAO,OAAO,IAAI,EAAE,QAAQ,OAAO,KAAK,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,OAAO,OAAO,WAAW,EAAE,YAAY,OAAO,OAAO,KAAK,UAAU,YAAY,EAAE,YAAY,IAAI,gBAAgB;IAAE,UAAU,GAAG;IAAc,aAAa,GAAG;IAAc,cAAc,GAAG;GAAG,CAAC;GAEpX,MAAM,OACJ,iBAAiB,KAAA,IACb,OAAO,GAAqB,GAAG,kBAC/B,OAAO,GAAqB,0BAA0B,IAAI,gBAAgB;IAAE,UAAU,GAAG;IAAgB,cAAc,GAAG;GAAG,CAAC,EAAE,IAAI,cAAc;mCAC3H,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK;gBACnE,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,KAAK,WAAW,YAAY,GAAG,WAAW,MAAM,KAAK,WAAW,cAAc,YAAY,CAAC,EAAE,OAAO,OAAO,YAAY;GAEpR,UAAU,KAAK,UAAU,EAAE;GAE3B,OAAO;IACL;IACA,YACE,iBAAiB,KAAA,KAAa,KAAK,OAAO,KAAA,IACtC,KAAA,IACA,WAAW,OAAO,KAAK,IAAI,IAAI;IACrC,UAAU,SACR,KACA,KAAK,KAAK,QAAQ,OAAO,OAAO,KAAK,IAAI,CAAC,CAC5C;IACA,WAAW,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,OAAO,EAAE,CAAE,SAAS,CAAC;GAChF;EACF;EAEA,MAAM,kBAAkB,eACtB,iBAAiB;EAEnB,MAAM,OACJ,OAAO,GAAqB,UAAU,gBAAgB,OAAO,IAAI,EAAE,IAAI,eAAe,OAAO,IAAI,EAAE,IAAI,IAAI,kBAAkB,iBAAiB,KAAA,IAAY,GAAG,KAAK,GAAG,KAAK,iBAAiB,OAAO,IAAI,IAAI,QAAQ,SAAS,WAAW,iBAAiB,EAAE,aAAa,SAAS,aAAa,gBAAgB,EAAE,MAAM,eAAe,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,eAAe,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,GAAG,iBAAiB,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,SAAS,cAAc,oBAAoB,EAAE,MAAM,iBAAiB,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,iBAAiB,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,aAAa,KAAK,iBAAiB,OAAO,KAAK,WAAW,YAAY,GAAG,iBAAiB,MAAM,KAAK,WAAW,cAAc,YAAY,CAAC,IAAI,SAAS,gBAAgB,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,gBAAgB,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE;EAE33B,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,IAAI,OAAO,KAAA;EAClD,MAAM,MAAM,gBAAgB,OAAO,KAAK,IAAK,IAAI;EAEjD,IACE,CAAC,OAAO,KAAK,QAAQ,SAAS,GAAG,GAAG,QAAQ,KAC5C,CAAC,KAAK,QAAQ,eAAe,IAAI,KAAK,QAAQ,OAAO,GAErD,OAAO,KAAA;EACT,UACE,KAAK,OAAO,aAAa;GACvB,MAAM,QAAQ,gBAAgB,OAAO,UAAU,IAAI;GAEnD,OACE,OAAO,KAAK,QAAQ,SAAS,KAAK,GAAG,QAAQ,KAC7C,MAAM,KAAK,QAAQ,sBAAsB,IAAI,KAAK,QAAQ,qBAC1D,KAAK,QAAQ,eAAe,MAAM,KAAK,QAAQ,OAAO;EAE1D,CAAC,CACH;EAEA,OAAO;GACL;GACA,YAAY,iBAAiB,KAAA,IAAY,KAAA,IAAY,iBAAiB,OAAO,KAAK,IAAK,IAAI;GAC3F,UAAU,SACR,KACA,KAAK,KAAK,aAAa,eAAe,OAAO,UAAU,IAAI,CAAC,CAC9D;GACA,WAAW,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAE,SAAS,CAAC;EAC9E;CACF,CAAC;CAID,MAAM,gBAAgB,QAAQ,GAAG,iBAAiB;CAClD,MAAM,eAAe,OAAO,GAAG,gBAAgB;CAC/C,MAAM,mBAAmB,WAAW,GAAG,oBAAoB;CAE3D,MAAM,YAAY,MAA8C,UAAkB;EAGhF,OAAO,GAAG,mBAFI,SAAS,YAAY,UAAU,SAAS,cAAc,SAAS,WAAA,CAE3C,KAAK,SAAS,OAAO,IAAI,EAAE,OAAO,IAAI,KAAK;CAC/E;CAyEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAtFa,OAAO,WAAW,WAAW,MAAc,sBAA8B;GACtF,MAAM,MAAM,OAAO,qBAAqB,MAAM,oBAAoB;GAElE,IACE,QAAQ,sBAAsB,KAAK,QAAQ,EAAE,MAAM,KAAA,KACnD,WAAW,sBAAsB,KAAK,WAAW,SAAS,MAAM,KAAA,KAChE,OAAO,sBAAsB,KAAK,UAAU,SAAS,MAAM,KAAA,GAC3D;IACA,MAAM,IAAI,eACR,IAAI,kBACJ,IAAI;IAEN,MAAM,OACJ,OAAO,GAAqB,UAAU,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE;eACpF,SAAS,cAAc,oBAAoB,EAAE;eAC7C,SAAS,WAAW,iBAAiB,EAAE,MAAM,aAAa,KAAK,EAAE,OAAO,KAAK,QAAQ,EAAE,GAAG,EAAE,OAAO,KAAK,WAAW,SAAS,CAAC,EAAE;oBAC1H,SAAS,aAAa,gBAAgB,EAAE,MAAM,aAAa,KAAK,EAAE,OAAO,KAAK,UAAU,SAAS,GAAG,EAAE,OAAO,KAAK,WAAW,SAAS,CAAC,EAAE;gBAC7I,aAAa,KAAK,EAAE,OAAO,KAAK,WAAW,aAAa,GAAG,EAAE,MAAM,KAAK,WAAW,eAAe,GAAG,CAAC,EAAE;IAElH,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,IAAI,OAAO,KAAA;IAClD,MAAM,MAAM,EAAE,OAAO,KAAK,IAAK,IAAI;IACnC,MAAM,aAAa,EAAE,OAAO,KAAK,IAAK,IAAI;IAC1C,MAAM,QAAQ,KAAK,WAAW,gBAAgB,GAAG;IAEjD,UACE,IAAI,KAAK,WAAW,UAAU,QAC5B,IAAI,KAAK,WAAW,0BAA0B,oBAClD;IACA,UACE,KAAK,OAAO,aAAa;KACvB,MAAM,QAAQ,EAAE,OAAO,UAAU,IAAI;KACrC,MAAM,eAAe,EAAE,OAAO,UAAU,IAAI;KAE5C,OACE,OAAO,OAAO,KAAK,WAAW,gBAAgB,KAAK,CAAC,KACpD,OAAO,OAAO,KAAK,QAAQ,SAAS,YAAY,CAAC,KACjD,MAAM,KAAK,WAAW,kBAAkB,IAAI,KAAK,WAAW,iBAC5D,MAAM,KAAK,WAAW,wBAAwB,IAAI,KAAK,WAAW,uBAClE,aAAa,KAAK,QAAQ,sBACxB,WAAW,KAAK,QAAQ;IAE9B,CAAC,CACH;IAEA,OAAO,OAAO,iBACZ,KACA,SACE,YACA,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,CACvC,GACA,UACF;GACF;GAEA,MAAM,OACJ,OAAO,GAAqB,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,WAAW,OAAO,KAAK,WAAW,aAAa,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,eAAe,GAAG,EAAE,OAAO,OAAO,YAAY;GAEtO,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;GAC9B,MAAM,MAAM,WAAW,OAAO,KAAK,IAAK,IAAI;GAE5C,UACE,IAAI,KAAK,WAAW,UAAU,QAC5B,IAAI,KAAK,WAAW,0BAA0B,oBAClD;GACA,MAAM,UAAU,OAAO,cAAc,KAAK,WAAW,gBAAgB,GAAG,GAAG,KAAK;GAEhF,OAAO,YAAY,KAAA,IACf,KAAA,IACA,OAAO,iBAAiB,KAAK,QAAQ,UAAU,QAAQ,GAAG;EAChE,CAiBO;EACL;EACA;EACA;EACA;EACA,QAAQ;CACV;AACF,CAAC;AAED,MAAa,yBAAyB,OAAO,WAAW,WACtD,QACA,SACA;CACA,MAAM,QAAQ,OAAO,2BAA2B,QAAQ,QAAQ,MAAM,QAAQ,KAAK;CACnF,MAAM,WAAW,OAAO,sBAAsB,QAAQ,OAAO;CAE7D,OAAO;EAAE,GAAG;EAAO;EAAS;EAAU,MAAM,SAAS;EAAM,QAAQ,SAAS;CAAO;AACrF,CAAC"}
+{"version":3,"file":"passkey-native-state.mjs","names":[],"sources":["../../src/internal/passkey-native-state.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- physical mapping generics are erased only at this shared adapter boundary. */\nimport { AuthenticationClock } from \"@yielded/auth/Operations\";\nimport * as M from \"@yielded/auth/Passkey\";\nimport { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport type { PasskeyCredentialMapping, PasskeyPersistenceMapping } from \"./models/passkey-model\";\nimport { sqlMapping, type NativeSqlTables } from \"./native-sql-table\";\nimport { makePasskeyNativeFlow } from \"./passkey-native-flow\";\nimport { passkeyCredentialKey } from \"./passkey-policy\";\nimport { exactSqlText } from \"./sql-change\";\nimport { canJoinTextColumns } from \"./storage-validation\";\nimport type { TableModel } from \"./table-model\";\n\n// Physical expression types are validated by NativeSqlTables at this boundary.\nexport type PasskeyNativeRead = PasskeyCredentialMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  any\n>;\n\nexport type PasskeyNativeMapping = PasskeyPersistenceMapping<\n  PasskeyNativeRead,\n  TableModel,\n  unknown,\n  any\n>;\n\nexport type PasskeyNativeRow = Readonly<Record<string, unknown>>;\n\nexport const passkeyNativeInvariant: (value: unknown) => asserts value = (value) => {\n  if (!value) throw M.PasskeyUnavailable.make({});\n};\n\nexport const makePasskeyNativeReadState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  read: PasskeyNativeRead,\n  clock?: PasskeyNativeMapping[\"clock\"],\n) {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const subject = tables(read.subject.table);\n  const credential = tables(read.credential.table);\n  const factor = tables(read.authority.table);\n  const now = clock === undefined ? sql`0` : tables.expression(clock.engineNowMillis);\n\n  const millis = (expression: Fragment) =>\n    clock === undefined ? expression : tables.expression(clock.toMillis(expression));\n\n  const storedNow =\n    clock === undefined ? sql`0` : tables.expression(clock.fromMillis(clock.engineNowMillis));\n\n  const active = (table: \"subject\" | \"credential\" | \"authority\") =>\n    tables.expression(read[table].activeCondition);\n\n  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;\n  const sameId = (nativeId: unknown, value: unknown) => read.subjectIds.equals(nativeId, value);\n\n  const native = (id: M.PasskeyCredential[\"revision\"][\"subjectId\"]) => {\n    const value = read.subjectIds.toNative(id);\n\n    invariant(read.subjectIds.toSubject(value) === id);\n\n    return value;\n  };\n\n  const revisions = (nativeId: unknown, rows: ReadonlyArray<PasskeyNativeRow>) => {\n    const entries = new Map<string, M.PasskeyCredential[\"revision\"][\"securityRevision\"]>();\n\n    for (const row of rows) {\n      if (row[read.authority.credentialId] === null) continue;\n      invariant(sameId(nativeId, row[read.authority.subjectId]));\n      if (!read.authority.isActiveStatus(row[read.authority.status])) continue;\n\n      const decoded = Schema.decodeUnknownSync(M.PasskeyRevision.fields.credentials)([\n        {\n          credentialId: row[read.authority.credentialId],\n          revision: row[read.authority.revision],\n        },\n      ]);\n\n      const entry = decoded[0];\n\n      invariant(entry !== undefined);\n      const previous = entries.get(entry.credentialId);\n\n      invariant(previous === undefined || previous === entry.revision);\n      entries.set(entry.credentialId, entry.revision);\n    }\n    invariant(entries.size <= 64);\n\n    return [...entries]\n      .sort(([a], [b]) => a.localeCompare(b))\n      .map(([credentialId, revision]) => ({ credentialId, revision }));\n  };\n\n  const revision = (row: PasskeyNativeRow, factors: ReadonlyArray<PasskeyNativeRow>) => {\n    const id = read.subject.decodeId(row);\n    const subjectId = read.subjectIds.toSubject(id);\n\n    invariant(sameId(native(subjectId), id));\n\n    return Schema.decodeUnknownSync(M.PasskeyRevision)({\n      subjectId,\n      securityRevision: row[read.subject.securityRevision],\n      credentials: revisions(id, factors),\n    });\n  };\n\n  const decodeCredential = Effect.fnUntraced(function* (\n    row: PasskeyNativeRow,\n    current: M.PasskeyCredential[\"revision\"],\n    subjectRow: PasskeyNativeRow,\n  ) {\n    const value = read.credential.decode(row);\n    const owned = current.credentials.find((entry) => entry.credentialId === value.credentialId);\n\n    if (\n      !read.credential.isActiveStatus(row[read.credential.status]) ||\n      owned?.revision !== row[read.credential.credentialRevision]\n    )\n      return undefined;\n    invariant(\n      read.subjectIds.toSubject(read.credential.decodeSubjectId(row)) === current.subjectId,\n    );\n\n    return M.snapshotPasskeySync(M.PasskeyCredential, {\n      ...value,\n      revision: current,\n      requirement: yield* read.subject.decodeRequirement(subjectRow),\n      active: true,\n    });\n  });\n\n  const readAuthority = Effect.fnUntraced(function* (\n    nativeId: unknown,\n    lock: boolean,\n    credentialId?: string,\n  ) {\n    // The subject lock is a distinct first statement; joined FOR UPDATE cannot\n    // establish the lock order required by coordinated application transactions.\n    if (lock) {\n      const locked =\n        yield* sql<PasskeyNativeRow>`select ${subject.fields(\"s_\")}, ${now} as \"engineNow\" from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${active(\"subject\")} ${sql.onDialectOrElse({ pg: () => sql`for update`, mysql: () => sql`for update`, orElse: () => sql`` })}`;\n\n      if (locked.length !== 1) return undefined;\n      const row = subject.decode(locked[0]!, \"s_\");\n\n      if (\n        !sameId(read.subject.decodeId(row), nativeId) ||\n        !read.subject.isActiveStatus(row[read.subject.status])\n      )\n        return undefined;\n\n      const lockedFactors = sql`select ${factor.fields(\"f_\")} from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${active(\"authority\")} order by ${factor.column(read.authority.credentialId)} limit 65 ${sql.onDialectOrElse({ pg: () => sql`for update`, mysql: () => sql`for update`, orElse: () => sql`` })}`;\n\n      const rows =\n        credentialId === undefined\n          ? yield* sql<PasskeyNativeRow>`${lockedFactors}`\n          : yield* sql<PasskeyNativeRow>`with locked_factors as ${sql.onDialectOrElse({ pg: () => sql`materialized`, orElse: () => sql`` })} (${lockedFactors})\n        select locked_factors.*, ${credential.fields(\"c_\")} from ${credential.name} left join locked_factors on 1 = 1\n        where ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${exactSqlText(sql, credential.column(read.credential.credentialId), credential.value(read.credential.credentialId, credentialId))} and ${active(\"credential\")}`;\n\n      invariant(rows.length <= 64);\n\n      return {\n        row,\n        credential:\n          credentialId === undefined || rows[0] === undefined\n            ? undefined\n            : credential.decode(rows[0], \"c_\"),\n        revision: revision(\n          row,\n          rows.map((row) => factor.decode(row, \"f_\")),\n        ),\n        nowMillis: yield* Schema.decodeEffect(Schema.Int)(Number(locked[0]!.engineNow)),\n      };\n    }\n\n    const observedSubject = joinedSubject,\n      observedFactor = joinedFactor;\n\n    const rows =\n      yield* sql<PasskeyNativeRow>`select ${observedSubject.fields(\"s_\")}, ${observedFactor.fields(\"f_\")}, ${now} as \"engineNow\" ${credentialId === undefined ? sql`` : sql`, ${joinedCredential.fields(\"c_\")}`} from ${selected(\"subject\", \"passkey_subject\")} left join ${selected(\"authority\", \"passkey_factor\")} on ${observedFactor.column(read.authority.subjectId)} = ${observedFactor.value(read.authority.subjectId, nativeId)} ${credentialId === undefined ? sql`` : sql`join ${selected(\"credential\", \"passkey_credential\")} on ${joinedCredential.column(read.credential.subjectId)} = ${joinedCredential.value(read.credential.subjectId, nativeId)} and ${exactSqlText(sql, joinedCredential.column(read.credential.credentialId), joinedCredential.value(read.credential.credentialId, credentialId))}`} where ${observedSubject.column(read.subject.id)} = ${observedSubject.value(read.subject.id, nativeId)} limit 65`;\n\n    if (rows.length === 0 || rows.length > 64) return undefined;\n    const row = observedSubject.decode(rows[0]!, \"s_\");\n\n    if (\n      !sameId(read.subject.decodeId(row), nativeId) ||\n      !read.subject.isActiveStatus(row[read.subject.status])\n    )\n      return undefined;\n    invariant(\n      rows.every((selected) => {\n        const other = observedSubject.decode(selected, \"s_\");\n\n        return (\n          sameId(read.subject.decodeId(other), nativeId) &&\n          other[read.subject.securityRevision] === row[read.subject.securityRevision] &&\n          read.subject.isActiveStatus(other[read.subject.status])\n        );\n      }),\n    );\n\n    return {\n      row,\n      credential: credentialId === undefined ? undefined : joinedCredential.decode(rows[0]!, \"c_\"),\n      revision: revision(\n        row,\n        rows.map((selected) => observedFactor.decode(selected, \"f_\")),\n      ),\n      nowMillis: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0]!.engineNow)),\n    };\n  });\n\n  // Active predicates retain their original table qualification inside each\n  // subquery; aliases allow applications to map several roles to one table.\n  const joinedSubject = subject.as(\"passkey_subject\");\n  const joinedFactor = factor.as(\"passkey_factor\");\n  const joinedCredential = credential.as(\"passkey_credential\");\n\n  const selected = (kind: \"subject\" | \"authority\" | \"credential\", alias: string) => {\n    const table = kind === \"subject\" ? subject : kind === \"authority\" ? factor : credential;\n\n    return sql`(select * from ${table.name} where ${active(kind)}) as ${sql(alias)}`;\n  };\n\n  const joinedIds = yield* canJoinTextColumns([\n    subject.unencodedTextColumn?.(read.subject.id),\n    credential.unencodedTextColumn?.(read.credential.subjectId),\n    factor.unencodedTextColumn?.(read.authority.subjectId),\n  ]).pipe(Effect.mapError(() => M.PasskeyUnavailable.make({})));\n\n  const lookup = Effect.fnUntraced(function* (rpId: string, protocolCredentialId: string) {\n    const key = yield* passkeyCredentialKey(rpId, protocolCredentialId);\n    let nativeId: unknown;\n\n    if (!joinedIds) {\n      const found =\n        yield* sql<PasskeyNativeRow>`select ${credential.fields(\"c_\")} from ${credential.name} where ${exactSqlText(sql, credential.column(read.credential.credentialKey), credential.value(read.credential.credentialKey, key))} and ${active(\"credential\")}`;\n\n      if (found.length !== 1) return undefined;\n      const row = credential.decode(found[0]!, \"c_\");\n\n      invariant(\n        row[read.credential.rpId] === rpId &&\n          row[read.credential.protocolCredentialId] === protocolCredentialId,\n      );\n      nativeId = read.credential.decodeSubjectId(row);\n    }\n\n    const s = joinedSubject,\n      c = joinedCredential,\n      f = joinedFactor;\n\n    const bindOwner = (table: typeof subject, key: string) =>\n      joinedIds\n        ? exactSqlText(sql, table.column(key), c.column(read.credential.subjectId))\n        : sql`${table.column(key)} = ${table.value(key, nativeId)}`;\n\n    const rows =\n      yield* sql<PasskeyNativeRow>`select ${s.fields(\"s_\")}, ${c.fields(\"c_\")}, ${f.fields(\"f_\")}\n      from ${selected(\"credential\", \"passkey_credential\")}\n      join ${selected(\"subject\", \"passkey_subject\")} on ${bindOwner(s, read.subject.id)}\n      left join ${selected(\"authority\", \"passkey_factor\")} on ${bindOwner(f, read.authority.subjectId)}\n      where ${exactSqlText(sql, c.column(read.credential.credentialKey), c.value(read.credential.credentialKey, key))}${joinedIds ? sql`` : sql` and ${bindOwner(c, read.credential.subjectId)}`} limit 65`;\n\n    if (rows.length === 0 || rows.length > 64) return undefined;\n    const row = c.decode(rows[0]!, \"c_\");\n    const subjectRow = s.decode(rows[0]!, \"s_\");\n    const owner = read.credential.decodeSubjectId(row);\n\n    invariant(\n      (joinedIds || sameId(owner, nativeId)) &&\n        row[read.credential.rpId] === rpId &&\n        row[read.credential.protocolCredentialId] === protocolCredentialId,\n    );\n    invariant(\n      rows.every((selected) => {\n        const other = c.decode(selected, \"c_\");\n        const subjectValue = s.decode(selected, \"s_\");\n\n        return (\n          sameId(owner, read.credential.decodeSubjectId(other)) &&\n          sameId(owner, read.subject.decodeId(subjectValue)) &&\n          other[read.credential.credentialId] === row[read.credential.credentialId] &&\n          other[read.credential.credentialRevision] === row[read.credential.credentialRevision] &&\n          subjectValue[read.subject.securityRevision] === subjectRow[read.subject.securityRevision]\n        );\n      }),\n    );\n\n    return yield* decodeCredential(\n      row,\n      revision(\n        subjectRow,\n        rows.map((row) => f.decode(row, \"f_\")),\n      ),\n      subjectRow,\n    );\n  });\n\n  return {\n    sql,\n    tables,\n    subject,\n    credential,\n    factor,\n    now,\n    storedNow,\n    millis,\n    active,\n    native,\n    sameId,\n    revision,\n    decodeCredential,\n    readAuthority,\n    lookup,\n    joinedSubject,\n    joinedFactor,\n    joinedCredential,\n    selected,\n    mapped: sqlMapping,\n  };\n});\n\nexport const makePasskeyNativeState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: PasskeyNativeMapping,\n) {\n  const state = yield* makePasskeyNativeReadState(tables, mapping.read, mapping.clock);\n  const clockPolicy = yield* AuthenticationClock;\n  const ceremony = yield* makePasskeyNativeFlow(tables, mapping);\n\n  return { ...state, clockPolicy, mapping, ceremony, flow: ceremony.flow, access: ceremony.access };\n});\n\nexport type PasskeyNativeReadState = Effect.Success<ReturnType<typeof makePasskeyNativeReadState>>;\nexport type PasskeyNativeState = Effect.Success<ReturnType<typeof makePasskeyNativeState>>;\n"],"mappings":";;;;;;;;;;AAiCA,MAAa,0BAA6D,UAAU;CAClF,IAAI,CAAC,OAAO,MAAM,EAAE,mBAAmB,KAAK,CAAC,CAAC;AAChD;AAEA,MAAa,6BAA6B,OAAO,WAAW,WAC1D,QACA,MACA,OACA;CACA,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,UAAU,OAAO,KAAK,QAAQ,KAAK;CACzC,MAAM,aAAa,OAAO,KAAK,WAAW,KAAK;CAC/C,MAAM,SAAS,OAAO,KAAK,UAAU,KAAK;CAC1C,MAAM,MAAM,UAAU,KAAA,IAAY,GAAG,MAAM,OAAO,WAAW,MAAM,eAAe;CAElF,MAAM,UAAU,eACd,UAAU,KAAA,IAAY,aAAa,OAAO,WAAW,MAAM,SAAS,UAAU,CAAC;CAEjF,MAAM,YACJ,UAAU,KAAA,IAAY,GAAG,MAAM,OAAO,WAAW,MAAM,WAAW,MAAM,eAAe,CAAC;CAE1F,MAAM,UAAU,UACd,OAAO,WAAW,KAAK,MAAM,CAAC,eAAe;CAE/C,MAAM,YAA2C;CACjD,MAAM,UAAU,UAAmB,UAAmB,KAAK,WAAW,OAAO,UAAU,KAAK;CAE5F,MAAM,UAAU,OAAqD;EACnE,MAAM,QAAQ,KAAK,WAAW,SAAS,EAAE;EAEzC,UAAU,KAAK,WAAW,UAAU,KAAK,MAAM,EAAE;EAEjD,OAAO;CACT;CAEA,MAAM,aAAa,UAAmB,SAA0C;EAC9E,MAAM,0BAAU,IAAI,IAAiE;EAErF,KAAK,MAAM,OAAO,MAAM;GACtB,IAAI,IAAI,KAAK,UAAU,kBAAkB,MAAM;GAC/C,UAAU,OAAO,UAAU,IAAI,KAAK,UAAU,UAAU,CAAC;GACzD,IAAI,CAAC,KAAK,UAAU,eAAe,IAAI,KAAK,UAAU,OAAO,GAAG;GAShE,MAAM,QAPU,OAAO,kBAAkB,EAAE,gBAAgB,OAAO,WAAW,CAAC,CAAC,CAC7E;IACE,cAAc,IAAI,KAAK,UAAU;IACjC,UAAU,IAAI,KAAK,UAAU;GAC/B,CACF,CAEoB,CAAC,CAAC;GAEtB,UAAU,UAAU,KAAA,CAAS;GAC7B,MAAM,WAAW,QAAQ,IAAI,MAAM,YAAY;GAE/C,UAAU,aAAa,KAAA,KAAa,aAAa,MAAM,QAAQ;GAC/D,QAAQ,IAAI,MAAM,cAAc,MAAM,QAAQ;EAChD;EACA,UAAU,QAAQ,QAAQ,EAAE;EAE5B,OAAO,CAAC,GAAG,OAAO,CAAC,CAChB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CACtC,KAAK,CAAC,cAAc,eAAe;GAAE;GAAc;EAAS,EAAE;CACnE;CAEA,MAAM,YAAY,KAAuB,YAA6C;EACpF,MAAM,KAAK,KAAK,QAAQ,SAAS,GAAG;EACpC,MAAM,YAAY,KAAK,WAAW,UAAU,EAAE;EAE9C,UAAU,OAAO,OAAO,SAAS,GAAG,EAAE,CAAC;EAEvC,OAAO,OAAO,kBAAkB,EAAE,eAAe,CAAC,CAAC;GACjD;GACA,kBAAkB,IAAI,KAAK,QAAQ;GACnC,aAAa,UAAU,IAAI,OAAO;EACpC,CAAC;CACH;CAEA,MAAM,mBAAmB,OAAO,WAAW,WACzC,KACA,SACA,YACA;EACA,MAAM,QAAQ,KAAK,WAAW,OAAO,GAAG;EACxC,MAAM,QAAQ,QAAQ,YAAY,MAAM,UAAU,MAAM,iBAAiB,MAAM,YAAY;EAE3F,IACE,CAAC,KAAK,WAAW,eAAe,IAAI,KAAK,WAAW,OAAO,KAC3D,OAAO,aAAa,IAAI,KAAK,WAAW,qBAExC,OAAO,KAAA;EACT,UACE,KAAK,WAAW,UAAU,KAAK,WAAW,gBAAgB,GAAG,CAAC,MAAM,QAAQ,SAC9E;EAEA,OAAO,EAAE,oBAAoB,EAAE,mBAAmB;GAChD,GAAG;GACH,UAAU;GACV,aAAa,OAAO,KAAK,QAAQ,kBAAkB,UAAU;GAC7D,QAAQ;EACV,CAAC;CACH,CAAC;CAED,MAAM,gBAAgB,OAAO,WAAW,WACtC,UACA,MACA,cACA;EAGA,IAAI,MAAM;GACR,MAAM,SACJ,OAAO,GAAqB,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,IAAI,uBAAuB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,OAAO,SAAS,EAAE,GAAG,IAAI,gBAAgB;IAAE,UAAU,GAAG;IAAc,aAAa,GAAG;IAAc,cAAc,GAAG;GAAG,CAAC;GAEhU,IAAI,OAAO,WAAW,GAAG,OAAO,KAAA;GAChC,MAAM,MAAM,QAAQ,OAAO,OAAO,IAAK,IAAI;GAE3C,IACE,CAAC,OAAO,KAAK,QAAQ,SAAS,GAAG,GAAG,QAAQ,KAC5C,CAAC,KAAK,QAAQ,eAAe,IAAI,KAAK,QAAQ,OAAO,GAErD,OAAO,KAAA;GAET,MAAM,gBAAgB,GAAG,UAAU,OAAO,OAAO,IAAI,EAAE,QAAQ,OAAO,KAAK,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,OAAO,OAAO,WAAW,EAAE,YAAY,OAAO,OAAO,KAAK,UAAU,YAAY,EAAE,YAAY,IAAI,gBAAgB;IAAE,UAAU,GAAG;IAAc,aAAa,GAAG;IAAc,cAAc,GAAG;GAAG,CAAC;GAEpX,MAAM,OACJ,iBAAiB,KAAA,IACb,OAAO,GAAqB,GAAG,kBAC/B,OAAO,GAAqB,0BAA0B,IAAI,gBAAgB;IAAE,UAAU,GAAG;IAAgB,cAAc,GAAG;GAAG,CAAC,EAAE,IAAI,cAAc;mCAC3H,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK;gBACnE,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,aAAa,KAAK,WAAW,OAAO,KAAK,WAAW,YAAY,GAAG,WAAW,MAAM,KAAK,WAAW,cAAc,YAAY,CAAC,EAAE,OAAO,OAAO,YAAY;GAEpR,UAAU,KAAK,UAAU,EAAE;GAE3B,OAAO;IACL;IACA,YACE,iBAAiB,KAAA,KAAa,KAAK,OAAO,KAAA,IACtC,KAAA,IACA,WAAW,OAAO,KAAK,IAAI,IAAI;IACrC,UAAU,SACR,KACA,KAAK,KAAK,QAAQ,OAAO,OAAO,KAAK,IAAI,CAAC,CAC5C;IACA,WAAW,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,OAAO,EAAE,CAAE,SAAS,CAAC;GAChF;EACF;EAEA,MAAM,kBAAkB,eACtB,iBAAiB;EAEnB,MAAM,OACJ,OAAO,GAAqB,UAAU,gBAAgB,OAAO,IAAI,EAAE,IAAI,eAAe,OAAO,IAAI,EAAE,IAAI,IAAI,kBAAkB,iBAAiB,KAAA,IAAY,GAAG,KAAK,GAAG,KAAK,iBAAiB,OAAO,IAAI,IAAI,QAAQ,SAAS,WAAW,iBAAiB,EAAE,aAAa,SAAS,aAAa,gBAAgB,EAAE,MAAM,eAAe,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,eAAe,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,GAAG,iBAAiB,KAAA,IAAY,GAAG,KAAK,GAAG,QAAQ,SAAS,cAAc,oBAAoB,EAAE,MAAM,iBAAiB,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,iBAAiB,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,aAAa,KAAK,iBAAiB,OAAO,KAAK,WAAW,YAAY,GAAG,iBAAiB,MAAM,KAAK,WAAW,cAAc,YAAY,CAAC,IAAI,SAAS,gBAAgB,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,gBAAgB,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE;EAE33B,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,IAAI,OAAO,KAAA;EAClD,MAAM,MAAM,gBAAgB,OAAO,KAAK,IAAK,IAAI;EAEjD,IACE,CAAC,OAAO,KAAK,QAAQ,SAAS,GAAG,GAAG,QAAQ,KAC5C,CAAC,KAAK,QAAQ,eAAe,IAAI,KAAK,QAAQ,OAAO,GAErD,OAAO,KAAA;EACT,UACE,KAAK,OAAO,aAAa;GACvB,MAAM,QAAQ,gBAAgB,OAAO,UAAU,IAAI;GAEnD,OACE,OAAO,KAAK,QAAQ,SAAS,KAAK,GAAG,QAAQ,KAC7C,MAAM,KAAK,QAAQ,sBAAsB,IAAI,KAAK,QAAQ,qBAC1D,KAAK,QAAQ,eAAe,MAAM,KAAK,QAAQ,OAAO;EAE1D,CAAC,CACH;EAEA,OAAO;GACL;GACA,YAAY,iBAAiB,KAAA,IAAY,KAAA,IAAY,iBAAiB,OAAO,KAAK,IAAK,IAAI;GAC3F,UAAU,SACR,KACA,KAAK,KAAK,aAAa,eAAe,OAAO,UAAU,IAAI,CAAC,CAC9D;GACA,WAAW,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAE,SAAS,CAAC;EAC9E;CACF,CAAC;CAID,MAAM,gBAAgB,QAAQ,GAAG,iBAAiB;CAClD,MAAM,eAAe,OAAO,GAAG,gBAAgB;CAC/C,MAAM,mBAAmB,WAAW,GAAG,oBAAoB;CAE3D,MAAM,YAAY,MAA8C,UAAkB;EAGhF,OAAO,GAAG,mBAFI,SAAS,YAAY,UAAU,SAAS,cAAc,SAAS,WAAA,CAE3C,KAAK,SAAS,OAAO,IAAI,EAAE,OAAO,IAAI,KAAK;CAC/E;CAEA,MAAM,YAAY,OAAO,mBAAmB;EAC1C,QAAQ,sBAAsB,KAAK,QAAQ,EAAE;EAC7C,WAAW,sBAAsB,KAAK,WAAW,SAAS;EAC1D,OAAO,sBAAsB,KAAK,UAAU,SAAS;CACvD,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,EAAE,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC;CAuE5D,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QApFa,OAAO,WAAW,WAAW,MAAc,sBAA8B;GACtF,MAAM,MAAM,OAAO,qBAAqB,MAAM,oBAAoB;GAClE,IAAI;GAEJ,IAAI,CAAC,WAAW;IACd,MAAM,QACJ,OAAO,GAAqB,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,aAAa,KAAK,WAAW,OAAO,KAAK,WAAW,aAAa,GAAG,WAAW,MAAM,KAAK,WAAW,eAAe,GAAG,CAAC,EAAE,OAAO,OAAO,YAAY;IAErP,IAAI,MAAM,WAAW,GAAG,OAAO,KAAA;IAC/B,MAAM,MAAM,WAAW,OAAO,MAAM,IAAK,IAAI;IAE7C,UACE,IAAI,KAAK,WAAW,UAAU,QAC5B,IAAI,KAAK,WAAW,0BAA0B,oBAClD;IACA,WAAW,KAAK,WAAW,gBAAgB,GAAG;GAChD;GAEA,MAAM,IAAI,eACR,IAAI,kBACJ,IAAI;GAEN,MAAM,aAAa,OAAuB,QACxC,YACI,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,EAAE,OAAO,KAAK,WAAW,SAAS,CAAC,IACxE,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,QAAQ;GAE5D,MAAM,OACJ,OAAO,GAAqB,UAAU,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE;aACpF,SAAS,cAAc,oBAAoB,EAAE;aAC7C,SAAS,WAAW,iBAAiB,EAAE,MAAM,UAAU,GAAG,KAAK,QAAQ,EAAE,EAAE;kBACtE,SAAS,aAAa,gBAAgB,EAAE,MAAM,UAAU,GAAG,KAAK,UAAU,SAAS,EAAE;cACzF,aAAa,KAAK,EAAE,OAAO,KAAK,WAAW,aAAa,GAAG,EAAE,MAAM,KAAK,WAAW,eAAe,GAAG,CAAC,IAAI,YAAY,GAAG,KAAK,GAAG,QAAQ,UAAU,GAAG,KAAK,WAAW,SAAS,IAAI;GAE7L,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,IAAI,OAAO,KAAA;GAClD,MAAM,MAAM,EAAE,OAAO,KAAK,IAAK,IAAI;GACnC,MAAM,aAAa,EAAE,OAAO,KAAK,IAAK,IAAI;GAC1C,MAAM,QAAQ,KAAK,WAAW,gBAAgB,GAAG;GAEjD,WACG,aAAa,OAAO,OAAO,QAAQ,MAClC,IAAI,KAAK,WAAW,UAAU,QAC9B,IAAI,KAAK,WAAW,0BAA0B,oBAClD;GACA,UACE,KAAK,OAAO,aAAa;IACvB,MAAM,QAAQ,EAAE,OAAO,UAAU,IAAI;IACrC,MAAM,eAAe,EAAE,OAAO,UAAU,IAAI;IAE5C,OACE,OAAO,OAAO,KAAK,WAAW,gBAAgB,KAAK,CAAC,KACpD,OAAO,OAAO,KAAK,QAAQ,SAAS,YAAY,CAAC,KACjD,MAAM,KAAK,WAAW,kBAAkB,IAAI,KAAK,WAAW,iBAC5D,MAAM,KAAK,WAAW,wBAAwB,IAAI,KAAK,WAAW,uBAClE,aAAa,KAAK,QAAQ,sBAAsB,WAAW,KAAK,QAAQ;GAE5E,CAAC,CACH;GAEA,OAAO,OAAO,iBACZ,KACA,SACE,YACA,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,CACvC,GACA,UACF;EACF,CAiBO;EACL;EACA;EACA;EACA;EACA,QAAQ;CACV;AACF,CAAC;AAED,MAAa,yBAAyB,OAAO,WAAW,WACtD,QACA,SACA;CACA,MAAM,QAAQ,OAAO,2BAA2B,QAAQ,QAAQ,MAAM,QAAQ,KAAK;CACnF,MAAM,cAAc,OAAO;CAC3B,MAAM,WAAW,OAAO,sBAAsB,QAAQ,OAAO;CAE7D,OAAO;EAAE,GAAG;EAAO;EAAa;EAAS;EAAU,MAAM,SAAS;EAAM,QAAQ,SAAS;CAAO;AAClG,CAAC"}

package/dist/internal/passkey-native-write.mjs

@@ -2,11 +2,11 @@ import { PersistenceMappingError } from "./mapping-error.mjs";
 import { sqlBatchAssertion } from "./d1-planning.mjs";
 import { exactSqlText } from "./sql-change.mjs";
 import { appendSqlBatchStatement, registerSqlBatchPostcondition, registerSqlPostcondition } from "./sql-commit.mjs";
+import { randomId } from "./crypto.mjs";
 import { passkeyManagementInputs } from "./passkey-inputs.mjs";
 import { assessPasskeyAction, passkeyCredentialKey, passkeyMatchesAccess, samePasskeyCredential, samePasskeyRevision } from "./passkey-policy.mjs";
 import { passkeyNativeInvariant } from "./passkey-native-state.mjs";
 import { preparePasskeyNative } from "./passkey-native.mjs";
-import { randomId } from "./crypto.mjs";
 import { passkeyEnrollmentDigest, passkeyRemoveDigest } from "./passkey-actions.mjs";
 import { Effect, Schema } from "effect";
 import { SqlClient } from "effect/sql";
@@ -185,7 +185,7 @@ const makePasskeyNativeManagement = (base, mapping) => {
 			if (current === void 0) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
 			const policy = M.snapshotPasskeySync(M.PasskeyManagementPolicy, mapping.write.policy.management(current.row));
 			const requirement = yield* mapping.write.policy.requirement(current.row, "enroll-begin");
-			const authority = assessPasskeyAction({
+			const authority = yield* assessPasskeyAction({
 				moduleId: mapping.moduleId,
 				revision: current.revision,
 				nowMillis: current.nowMillis,
@@ -254,7 +254,7 @@ const makePasskeyNativeManagement = (base, mapping) => {
 			const policy = M.snapshotPasskeySync(M.PasskeyManagementPolicy, mapping.write.policy.management(current.row));
 			if (captured === void 0 || !samePasskeyCredential(captured, input.credential) || !samePasskeyRevision(captured.revision, input.credential.revision) || (policy.requireImmediateInvalidation || input.management.requireImmediateInvalidation) && mapping.invalidation.window.existingSessions !== "immediate" || Schema.encodeSync(Schema.fromJsonString(M.PasskeyRemoved.fields.invalidation))(input.invalidation) !== Schema.encodeSync(Schema.fromJsonString(M.PasskeyRemoved.fields.invalidation))(mapping.invalidation.window)) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
 			const requirement = yield* mapping.write.policy.requirement(current.row, "remove");
-			const authority = assessPasskeyAction({
+			const authority = yield* assessPasskeyAction({
 				moduleId: mapping.moduleId,
 				revision: current.revision,
 				nowMillis: current.nowMillis,

package/dist/internal/passkey-native-write.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-native-write.mjs","names":[],"sources":["../../src/internal/passkey-native-write.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- physical mapping generics are erased only at this shared adapter boundary. */\nimport * as M from \"@yielded/auth/Passkey\";\nimport { SecurityRevision } from \"@yielded/auth/Sessions\";\nimport { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { randomId } from \"./crypto\";\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type {\n  PasskeyCredentialInsert,\n  PasskeyManagementMapping,\n} from \"./models/passkey-write-model\";\nimport type { SqlTable } from \"./native-sql-table\";\nimport { passkeyEnrollmentDigest, passkeyRemoveDigest } from \"./passkey-actions\";\nimport { passkeyManagementInputs } from \"./passkey-inputs\";\nimport { preparePasskeyNative, type NativePasskeyServices } from \"./passkey-native\";\nimport { passkeyNativeInvariant, type PasskeyNativeRow } from \"./passkey-native-state\";\nimport {\n  assessPasskeyAction,\n  passkeyCredentialKey,\n  passkeyMatchesAccess,\n  samePasskeyCredential,\n  samePasskeyRevision,\n} from \"./passkey-policy\";\nimport { exactSqlText } from \"./sql-change\";\nimport {\n  appendSqlBatchStatement,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n} from \"./sql-commit\";\nimport type { TableModel } from \"./table-model\";\n\n// Mapping callbacks retain concrete row/SQL types at the public driver boundary.\nexport type NativePasskeyManagementMapping = PasskeyManagementMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  any\n>;\n\nexport type NativePasskeyWriteMapping = Pick<\n  NativePasskeyManagementMapping,\n  \"moduleId\" | \"read\" | \"write\" | \"clock\" | \"telemetry\"\n>;\n\nexport const makePasskeyNativeWrites = (\n  base: NativePasskeyServices,\n  mapping: NativePasskeyWriteMapping,\n) => {\n  const { state } = base;\n  const { sql, tables, subject, credential, factor, ceremony: flow } = state;\n  const read = mapping.read;\n  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;\n  const expression = tables.expression;\n\n  const eq = (table: SqlTable, key: string, value: unknown) =>\n    typeof value === \"string\"\n      ? exactSqlText(sql, table.column(key), table.value(key, value))\n      : sql`${table.column(key)} = ${table.value(key, value)}`;\n\n  const match = (table: SqlTable, values: Readonly<Record<string, unknown>>) =>\n    sql.and(\n      Object.entries(values)\n        .filter(([, value]) => value !== undefined)\n        .map(([key, value]) =>\n          value === null ? sql`${table.column(key)} is null` : eq(table, key, value),\n        ),\n    );\n\n  const check = (condition: Fragment) =>\n    Effect.gen(function* () {\n      const current = (yield* SqlClient.SqlClient).withoutTransforms();\n      const rows = yield* current`select case when ${condition} then 1 else 0 end as valid`;\n\n      if (rows.length !== 1 || Number(rows[0]!.valid) !== 1)\n        return yield* PersistenceMappingError.make({\n          operation: \"mapping\",\n          cause: \"Passkey mutation postcondition failed\",\n        });\n    });\n\n  const postcondition = (name: string, condition: Fragment) =>\n    base.batch\n      ? registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) })\n      : registerSqlPostcondition({ name, check: check(condition) });\n\n  const write = (statement: Fragment, count: number) =>\n    base.batch\n      ? flow.stage(statement, count)\n      : flow.change(statement).pipe(\n          Effect.flatMap((changed) =>\n            changed === count\n              ? Effect.void\n              : Effect.fail(\n                  PersistenceMappingError.make({\n                    operation: \"mapping\",\n                    cause: \"Passkey conditional write did not match\",\n                  }),\n                ),\n          ),\n        );\n\n  const summary = (row: PasskeyNativeRow) =>\n    Schema.decodeUnknownSync(M.PasskeyCredentialSummary)({\n      credentialId: row[read.credential.credentialId],\n      name: row[mapping.write.credential.name],\n      primarySignIn: read.credential.decode(row).primarySignIn,\n      createdAtMillis: mapping.clock.decodeInstant(row[mapping.write.credential.createdAt]),\n      ...(row[mapping.telemetry.lastUsedAt] === null ||\n      row[mapping.telemetry.lastUsedAt] === undefined\n        ? {}\n        : { lastUsedAtMillis: mapping.clock.decodeInstant(row[mapping.telemetry.lastUsedAt]) }),\n    });\n\n  const owned = (nativeId: unknown, credentialId?: string) =>\n    sql.and([\n      sql`${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)}`,\n      ...(credentialId === undefined\n        ? []\n        : [eq(credential, read.credential.credentialId, credentialId)]),\n      state.active(\"credential\"),\n    ]);\n\n  const subjectCondition = (current: M.PasskeyCredential[\"revision\"]) => {\n    const id = state.native(current.subjectId);\n\n    return sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, id)} and ${eq(subject, read.subject.securityRevision, current.securityRevision)} and ${state.active(\"subject\")}) and ${sql.and(current.credentials.map((entry) => sql`exists(select 1 from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, id)} and ${eq(factor, read.authority.credentialId, entry.credentialId)} and ${eq(factor, read.authority.revision, entry.revision)} and ${state.active(\"authority\")})`))}`;\n  };\n\n  const insertCredential = Effect.fnUntraced(function* (\n    nativeId: unknown,\n    ceremony: M.PasskeyCeremony,\n    verified: M.PasskeyRegistrationVerified,\n    revision: M.PasskeyCredential[\"revision\"],\n    name: string,\n    nowMillis: number,\n    subjectRow: Readonly<Record<string, unknown>>,\n  ) {\n    invariant(ceremony.context._tag === \"Enrollment\" || ceremony.context._tag === \"Registration\");\n    const credentialId = yield* randomId;\n    const marker = yield* randomId;\n    const credentialRevision = SecurityRevision.make(marker);\n\n    const value = M.snapshotPasskeySync(M.PasskeyCredential, {\n      credentialId,\n      requirement: yield* read.subject.decodeRequirement(subjectRow),\n      rpId: ceremony.profile.rpId,\n      protocolCredentialId: verified.protocolCredentialId,\n      userHandle: ceremony.context.userHandle,\n      publicKey: verified.publicKey,\n      algorithm: verified.algorithm,\n      profile: ceremony.profile,\n      revision: {\n        ...revision,\n        credentials: [...revision.credentials, { credentialId, revision: credentialRevision }],\n      },\n      active: true,\n      primarySignIn: ceremony.profile.primarySignIn && verified.userVerified,\n      enrollmentUserVerified: verified.userVerified,\n      backupEligible: verified.backupEligible,\n      backupState: verified.backupState,\n      counter: verified.counter,\n    });\n\n    const details = M.snapshotPasskeySync(M.PasskeyCredentialSummary, {\n      credentialId,\n      name,\n      primarySignIn: value.primarySignIn,\n      createdAtMillis: nowMillis,\n    });\n\n    const input: PasskeyCredentialInsert<unknown> = {\n      subjectId: nativeId,\n      credential: value,\n      summary: details,\n      marker,\n    };\n\n    const values = {\n      ...mapping.write.credential.encodeInsert(input),\n      [read.credential.credentialKey]: yield* passkeyCredentialKey(\n        value.rpId,\n        value.protocolCredentialId,\n      ),\n    };\n\n    const authorityValues = mapping.write.authority.encodeInsert(input);\n\n    yield* write(credential.insert(values), 1);\n    yield* write(factor.insert(authorityValues), 1);\n\n    // Application work may change telemetry or names, but cannot replace the\n    // enrolled key, ownership, semantic revision, or its authority factor.\n    const semanticKeys = [\n      read.credential.credentialId,\n      read.credential.subjectId,\n      read.credential.rpId,\n      read.credential.protocolCredentialId,\n      read.credential.credentialKey,\n      read.credential.userHandle,\n      read.credential.publicKey,\n      read.credential.algorithm,\n      read.credential.profile,\n      read.credential.credentialRevision,\n      read.credential.status,\n      read.credential.primarySignIn,\n      read.credential.enrollmentUserVerified,\n      read.credential.backupEligible,\n    ];\n\n    const semantic = Object.fromEntries(semanticKeys.map((key) => [key, values[key]]));\n\n    const authority = Object.fromEntries(\n      [\n        read.authority.subjectId,\n        read.authority.credentialId,\n        read.authority.revision,\n        read.authority.status,\n      ].map((key) => [key, authorityValues[key]]),\n    );\n\n    return {\n      details,\n      condition: sql`exists(select 1 from ${credential.name} where ${match(credential, semantic)}) and exists(select 1 from ${factor.name} where ${match(factor, authority)})`,\n    };\n  });\n\n  return {\n    summary,\n    owned,\n    subjectCondition,\n    insertCredential,\n    postcondition,\n    write,\n    check,\n    eq,\n    expression,\n    match,\n  };\n};\n\nexport const makePasskeyNativeManagement = (\n  base: NativePasskeyServices,\n  mapping: NativePasskeyManagementMapping,\n) => {\n  const { state, run, advisory } = base;\n  const { sql, tables, subject, credential, factor, ceremony: flow } = state;\n  const read = mapping.read;\n  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;\n\n  const {\n    summary,\n    owned,\n    subjectCondition,\n    insertCredential,\n    postcondition,\n    write,\n    eq,\n    expression,\n    match,\n  } = makePasskeyNativeWrites(base, mapping);\n\n  const service: M.PasskeyManagementPersistence[\"Service\"] = {\n    list: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.list, original);\n\n          invariant(flow.validModule(input.moduleId));\n          const nativeId = state.native(input.subjectId);\n\n          const rows =\n            yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${owned(nativeId)} and ${expression(mapping.write.policy.metadata(nativeId))}\n        ${input.cursor === undefined ? sql`` : sql`and ${credential.column(read.credential.credentialId)} > ${credential.value(read.credential.credentialId, input.cursor)}`}\n        order by ${credential.column(read.credential.credentialId)} limit ${input.limit + 1}`;\n\n          const credentials = rows\n            .slice(0, input.limit)\n            .map((row) => summary(credential.decode(row, \"c_\")));\n\n          const cursor = rows.length > input.limit ? credentials.at(-1)?.credentialId : undefined;\n\n          return { credentials, ...(cursor === undefined ? {} : { cursor }) };\n        }),\n      ),\n    inspectRemove: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.inspectRemove, original);\n\n          if (!flow.validModule(input.moduleId)) return { _tag: \"Rejected\" } as const;\n          const nativeId = state.native(input.subjectId);\n          const current = yield* state.readAuthority(nativeId, false, input.credentialId);\n\n          if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n          const value =\n            current.credential === undefined\n              ? undefined\n              : yield* state.decodeCredential(current.credential, current.revision, current.row);\n\n          return value === undefined\n            ? ({ _tag: \"Rejected\" } as const)\n            : ({ _tag: \"Target\", credential: value } as const);\n        }),\n      ),\n    completeEnrollment: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.completeEnrollment, original);\n          const ceremony = input.ceremony;\n\n          if (\n            !flow.validModule(ceremony.moduleId) ||\n            ceremony.context._tag !== \"Enrollment\" ||\n            !passkeyMatchesAccess(ceremony, input.access)\n          )\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const context = ceremony.context;\n          const nativeId = state.native(context.revision.subjectId);\n          const current = yield* state.readAuthority(nativeId, !base.batch);\n\n          if (current === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const policy = M.snapshotPasskeySync(\n            M.PasskeyManagementPolicy,\n            mapping.write.policy.management(current.row),\n          );\n\n          const requirement = yield* mapping.write.policy.requirement(current.row, \"enroll-begin\");\n\n          const authority = assessPasskeyAction(\n            {\n              moduleId: mapping.moduleId,\n              revision: current.revision,\n              nowMillis: current.nowMillis,\n              currentRequirement: requirement,\n              expected: {\n                action: \"enroll-begin\",\n                commandId: ceremony.commandId,\n                flowId: ceremony.flowId,\n                bindingDigest: yield* passkeyEnrollmentDigest(ceremony),\n                revision: context.revision,\n              },\n            },\n            context.authorization,\n            {\n              ...policy,\n              maximumEvidenceAgeMillis: Math.min(\n                policy.maximumEvidenceAgeMillis,\n                input.management.maximumEvidenceAgeMillis,\n              ),\n            },\n          );\n\n          if (authority === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const cap = Math.min(policy.maximumCredentials, input.management.maximumCredentials);\n\n          const policyValues = Object.fromEntries(\n            mapping.write.policy.subjectColumns.map((key) => [key, current.row[key]]),\n          );\n\n          const policyUnchanged = sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${match(subject, policyValues)})`;\n\n          const condition = sql`${subjectCondition(current.revision)} and ${policyUnchanged} and ${expression(mapping.write.policy.action(nativeId, context.authorization))} and ${expression(mapping.write.policy.metadata(nativeId))}\n        and ${state.now} < ${authority.expiresBeforeMillis} and (select count(*) from ${credential.name} where ${owned(nativeId)}) < ${cap}`;\n\n          const statement = flow.consume(input.access, ceremony, condition);\n\n          if (base.batch) yield* flow.stage(statement, 1);\n          else if ((yield* flow.change(statement)) !== 1)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const enrolled = yield* insertCredential(\n            nativeId,\n            ceremony,\n            input.verified,\n            current.revision,\n            context.name,\n            current.nowMillis,\n            current.row,\n          );\n\n          yield* postcondition(\n            \"passkey-enrollment-authority\",\n            sql`${enrolled.condition} and ${flow.absent(input.access)} and ${subjectCondition(current.revision)} and ${policyUnchanged} and (select count(*) from ${credential.name} where ${owned(nativeId)}) <= ${cap} and ${expression(mapping.write.policy.action(nativeId, context.authorization))} and ${state.now} < ${authority.expiresBeforeMillis}`,\n          );\n\n          return yield* preparePasskeyNative(\n            { _tag: \"Enrolled\", credential: enrolled.details },\n            prepare,\n          );\n        }),\n      ),\n    rename: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.rename, original);\n\n          if (!flow.validModule(input.moduleId))\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const nativeId = state.native(input.subjectId);\n          const statement = sql`${credential.update({ [mapping.write.credential.name]: input.name })} where ${owned(nativeId, input.credentialId)} and ${expression(mapping.write.policy.metadata(nativeId))}`;\n          let rows: ReadonlyArray<PasskeyNativeRow>;\n\n          if (base.batch) {\n            rows =\n              yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${owned(nativeId, input.credentialId)} and ${expression(mapping.write.policy.metadata(nativeId))}`;\n            if (rows.length !== 1)\n              return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n            yield* flow.stage(statement, 1);\n          } else {\n            rows = yield* sql.onDialectOrElse({\n              mysql: () =>\n                Effect.gen(function* () {\n                  const changed = yield* flow.change(statement);\n\n                  if (changed > 1) return [];\n\n                  // With mysql2 -FOUND_ROWS an idempotent rename reports zero changes.\n                  return yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${owned(nativeId, input.credentialId)} and ${eq(credential, mapping.write.credential.name, input.name)} and ${expression(mapping.write.policy.metadata(nativeId))}`;\n                }),\n              orElse: () => sql`${statement} returning ${credential.fields(\"c_\")}`,\n            });\n          }\n          if (rows.length !== 1) return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const row = credential.decode(rows[0]!, \"c_\");\n\n          return yield* preparePasskeyNative(\n            {\n              _tag: \"Renamed\",\n              credential: summary({ ...row, [mapping.write.credential.name]: input.name }),\n            },\n            prepare,\n          );\n        }),\n        \"statement\",\n      ),\n    remove: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.remove, original);\n\n          if (!flow.validModule(input.moduleId))\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const nativeId = state.native(input.credential.revision.subjectId);\n\n          const current = yield* state.readAuthority(\n            nativeId,\n            !base.batch,\n            input.credential.credentialId,\n          );\n\n          if (current === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const captured =\n            current.credential === undefined\n              ? undefined\n              : yield* state.decodeCredential(current.credential, current.revision, current.row);\n\n          const policy = M.snapshotPasskeySync(\n            M.PasskeyManagementPolicy,\n            mapping.write.policy.management(current.row),\n          );\n\n          if (\n            captured === undefined ||\n            !samePasskeyCredential(captured, input.credential) ||\n            !samePasskeyRevision(captured.revision, input.credential.revision) ||\n            ((policy.requireImmediateInvalidation ||\n              input.management.requireImmediateInvalidation) &&\n              mapping.invalidation.window.existingSessions !== \"immediate\") ||\n            Schema.encodeSync(Schema.fromJsonString(M.PasskeyRemoved.fields.invalidation))(\n              input.invalidation,\n            ) !==\n              Schema.encodeSync(Schema.fromJsonString(M.PasskeyRemoved.fields.invalidation))(\n                mapping.invalidation.window,\n              )\n          )\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const requirement = yield* mapping.write.policy.requirement(current.row, \"remove\");\n\n          const authority = assessPasskeyAction(\n            {\n              moduleId: mapping.moduleId,\n              revision: current.revision,\n              nowMillis: current.nowMillis,\n              currentRequirement: requirement,\n              expected: {\n                action: \"remove\",\n                commandId: input.commandId,\n                flowId: input.commandId,\n                bindingDigest: yield* passkeyRemoveDigest(\n                  mapping.moduleId,\n                  input.commandId,\n                  input.credential,\n                ),\n                revision: input.credential.revision,\n              },\n            },\n            input.authorization,\n            {\n              ...policy,\n              maximumEvidenceAgeMillis: Math.min(\n                policy.maximumEvidenceAgeMillis,\n                input.management.maximumEvidenceAgeMillis,\n              ),\n            },\n          );\n\n          if (authority === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const remaining = expression(\n            yield* mapping.write.policy.remainingSignIn(\n              nativeId,\n              captured.credentialId,\n              current.row,\n            ),\n          );\n\n          const allowed = expression(mapping.write.policy.action(nativeId, input.authorization));\n\n          const classify = Effect.gen(function* () {\n            const rows =\n              yield* sql`select case when ${remaining} then 1 else 0 end as remaining, case when ${allowed} and ${state.now} < ${authority.expiresBeforeMillis} and ${subjectCondition(current.revision)} then 1 else 0 end as allowed`;\n\n            return Number(rows[0]?.allowed) !== 1\n              ? (\"Rejected\" as const)\n              : Number(rows[0]?.remaining) !== 1\n                ? (\"LastSignInMethod\" as const)\n                : undefined;\n          });\n\n          const next = SecurityRevision.make(yield* randomId);\n          const update = sql`${subject.update({ [read.subject.securityRevision]: next })} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${eq(subject, read.subject.securityRevision, current.revision.securityRevision)} and ${state.active(\"subject\")} and ${remaining} and ${allowed} and ${state.now} < ${authority.expiresBeforeMillis}`;\n\n          if (base.batch) {\n            const rejected = yield* classify;\n\n            if (rejected !== undefined)\n              return yield* preparePasskeyNative({ _tag: rejected }, prepare);\n            yield* write(update, 1);\n          } else if ((yield* flow.change(update)) !== 1) {\n            const rejected = yield* classify;\n\n            return yield* preparePasskeyNative({ _tag: rejected ?? \"Rejected\" }, prepare);\n          }\n          yield* write(\n            sql`${credential.update({ [read.credential.status]: mapping.write.credential.removedStatus, [read.credential.credentialRevision]: next })} where ${owned(nativeId, captured.credentialId)} and ${eq(credential, read.credential.credentialRevision, captured.revision.credentials.find((entry) => entry.credentialId === captured.credentialId)?.revision)}`,\n            1,\n          );\n          yield* write(\n            sql`${factor.update({ [read.authority.status]: mapping.write.authority.removedStatus, [read.authority.revision]: next })} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${eq(factor, read.authority.credentialId, captured.credentialId)}`,\n            1,\n          );\n\n          const policyValues = Object.fromEntries(\n            mapping.write.policy.subjectColumns.map((key) => [\n              key,\n              key === read.subject.securityRevision ? next : current.row[key],\n            ]),\n          );\n\n          const policyUnchanged = sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${match(subject, policyValues)})`;\n\n          const invalidation = {\n            subjectId: nativeId,\n            previousRevision: current.revision.securityRevision,\n            securityRevision: next,\n            invalidation: input.invalidation,\n          };\n\n          const finalConditions: Array<Fragment> = [];\n\n          for (const mutation of mapping.invalidation.mutations) {\n            const table = tables(mutation.table);\n            const query = sql`${table.update(mutation.values(invalidation))} where ${expression(mutation.where(invalidation))}`;\n\n            if (base.batch) yield* appendSqlBatchStatement(query);\n            else yield* query;\n            finalConditions.push(expression(mutation.postcondition(invalidation)));\n          }\n          finalConditions.push(\n            sql`exists(select 1 from ${credential.name} where ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${eq(credential, read.credential.credentialId, captured.credentialId)} and ${eq(credential, read.credential.credentialRevision, next)} and ${eq(credential, read.credential.status, mapping.write.credential.removedStatus)}) and exists(select 1 from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${eq(factor, read.authority.credentialId, captured.credentialId)} and ${eq(factor, read.authority.revision, next)} and ${eq(factor, read.authority.status, mapping.write.authority.removedStatus)})`,\n          );\n          finalConditions.push(\n            sql`${expression(mapping.invalidation.postcondition(invalidation))} and ${policyUnchanged} and ${remaining} and ${state.now} < ${authority.expiresBeforeMillis}`,\n          );\n          yield* postcondition(\"passkey-removal\", sql.and(finalConditions));\n\n          return yield* preparePasskeyNative(\n            {\n              _tag: \"Removed\",\n              result: { credentialId: captured.credentialId, invalidation: input.invalidation },\n            },\n            prepare,\n          );\n        }),\n      ),\n  };\n\n  return { passkeyManagementPersistence: service };\n};\n"],"mappings":";;;;;;;;;;;;;;;AAiDA,MAAa,2BACX,MACA,YACG;CACH,MAAM,EAAE,UAAU;CAClB,MAAM,EAAE,KAAK,QAAQ,SAAS,YAAY,QAAQ,UAAU,SAAS;CACrE,MAAM,OAAO,QAAQ;CACrB,MAAM,YAA2C;CACjD,MAAM,aAAa,OAAO;CAE1B,MAAM,MAAM,OAAiB,KAAa,UACxC,OAAO,UAAU,WACb,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,KAAK,KAAK,CAAC,IAC5D,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,KAAK;CAEzD,MAAM,SAAS,OAAiB,WAC9B,IAAI,IACF,OAAO,QAAQ,MAAM,CAAC,CACnB,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAAC,CAC1C,KAAK,CAAC,KAAK,WACV,UAAU,OAAO,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,YAAY,GAAG,OAAO,KAAK,KAAK,CAC3E,CACJ;CAEF,MAAM,SAAS,cACb,OAAO,IAAI,aAAa;EAEtB,MAAM,OAAO,OAAO,CADH,OAAO,UAAU,UAAA,CAAW,kBACnB,CAAC,oBAAoB,UAAU;EAEzD,IAAI,KAAK,WAAW,KAAK,OAAO,KAAK,EAAE,CAAE,KAAK,MAAM,GAClD,OAAO,OAAO,wBAAwB,KAAK;GACzC,WAAW;GACX,OAAO;EACT,CAAC;CACL,CAAC;CAEH,MAAM,iBAAiB,MAAc,cACnC,KAAK,QACD,8BAA8B;EAAE;EAAM,WAAW,kBAAkB,KAAK,SAAS;CAAE,CAAC,IACpF,yBAAyB;EAAE;EAAM,OAAO,MAAM,SAAS;CAAE,CAAC;CAEhE,MAAM,SAAS,WAAqB,UAClC,KAAK,QACD,KAAK,MAAM,WAAW,KAAK,IAC3B,KAAK,OAAO,SAAS,CAAC,CAAC,KACrB,OAAO,SAAS,YACd,YAAY,QACR,OAAO,OACP,OAAO,KACL,wBAAwB,KAAK;EAC3B,WAAW;EACX,OAAO;CACT,CAAC,CACH,CACN,CACF;CAEN,MAAM,WAAW,QACf,OAAO,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;EACnD,cAAc,IAAI,KAAK,WAAW;EAClC,MAAM,IAAI,QAAQ,MAAM,WAAW;EACnC,eAAe,KAAK,WAAW,OAAO,GAAG,CAAC,CAAC;EAC3C,iBAAiB,QAAQ,MAAM,cAAc,IAAI,QAAQ,MAAM,WAAW,UAAU;EACpF,GAAI,IAAI,QAAQ,UAAU,gBAAgB,QAC1C,IAAI,QAAQ,UAAU,gBAAgB,KAAA,IAClC,CAAC,IACD,EAAE,kBAAkB,QAAQ,MAAM,cAAc,IAAI,QAAQ,UAAU,WAAW,EAAE;CACzF,CAAC;CAEH,MAAM,SAAS,UAAmB,iBAChC,IAAI,IAAI;EACN,GAAG,GAAG,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ;EAC5G,GAAI,iBAAiB,KAAA,IACjB,CAAC,IACD,CAAC,GAAG,YAAY,KAAK,WAAW,cAAc,YAAY,CAAC;EAC/D,MAAM,OAAO,YAAY;CAC3B,CAAC;CAEH,MAAM,oBAAoB,YAA6C;EACrE,MAAM,KAAK,MAAM,OAAO,QAAQ,SAAS;EAEzC,OAAO,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,EAAE,EAAE,OAAO,GAAG,SAAS,KAAK,QAAQ,kBAAkB,QAAQ,gBAAgB,EAAE,OAAO,MAAM,OAAO,SAAS,EAAE,QAAQ,IAAI,IAAI,QAAQ,YAAY,KAAK,UAAU,GAAG,wBAAwB,OAAO,KAAK,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,EAAE,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,cAAc,MAAM,YAAY,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,UAAU,MAAM,QAAQ,EAAE,OAAO,MAAM,OAAO,WAAW,EAAE,EAAE,CAAC;CAC1kB;CAoGA,OAAO;EACL;EACA;EACA;EACA,kBAtGuB,OAAO,WAAW,WACzC,UACA,UACA,UACA,UACA,MACA,WACA,YACA;GACA,UAAU,SAAS,QAAQ,SAAS,gBAAgB,SAAS,QAAQ,SAAS,cAAc;GAC5F,MAAM,eAAe,OAAO;GAC5B,MAAM,SAAS,OAAO;GACtB,MAAM,qBAAqB,iBAAiB,KAAK,MAAM;GAEvD,MAAM,QAAQ,EAAE,oBAAoB,EAAE,mBAAmB;IACvD;IACA,aAAa,OAAO,KAAK,QAAQ,kBAAkB,UAAU;IAC7D,MAAM,SAAS,QAAQ;IACvB,sBAAsB,SAAS;IAC/B,YAAY,SAAS,QAAQ;IAC7B,WAAW,SAAS;IACpB,WAAW,SAAS;IACpB,SAAS,SAAS;IAClB,UAAU;KACR,GAAG;KACH,aAAa,CAAC,GAAG,SAAS,aAAa;MAAE;MAAc,UAAU;KAAmB,CAAC;IACvF;IACA,QAAQ;IACR,eAAe,SAAS,QAAQ,iBAAiB,SAAS;IAC1D,wBAAwB,SAAS;IACjC,gBAAgB,SAAS;IACzB,aAAa,SAAS;IACtB,SAAS,SAAS;GACpB,CAAC;GAED,MAAM,UAAU,EAAE,oBAAoB,EAAE,0BAA0B;IAChE;IACA;IACA,eAAe,MAAM;IACrB,iBAAiB;GACnB,CAAC;GAED,MAAM,QAA0C;IAC9C,WAAW;IACX,YAAY;IACZ,SAAS;IACT;GACF;GAEA,MAAM,SAAS;IACb,GAAG,QAAQ,MAAM,WAAW,aAAa,KAAK;KAC7C,KAAK,WAAW,gBAAgB,OAAO,qBACtC,MAAM,MACN,MAAM,oBACR;GACF;GAEA,MAAM,kBAAkB,QAAQ,MAAM,UAAU,aAAa,KAAK;GAElE,OAAO,MAAM,WAAW,OAAO,MAAM,GAAG,CAAC;GACzC,OAAO,MAAM,OAAO,OAAO,eAAe,GAAG,CAAC;GAI9C,MAAM,eAAe;IACnB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;GAClB;GAEA,MAAM,WAAW,OAAO,YAAY,aAAa,KAAK,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC;GAEjF,MAAM,YAAY,OAAO,YACvB;IACE,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;GACjB,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,gBAAgB,IAAI,CAAC,CAC5C;GAEA,OAAO;IACL;IACA,WAAW,GAAG,wBAAwB,WAAW,KAAK,SAAS,MAAM,YAAY,QAAQ,EAAE,6BAA6B,OAAO,KAAK,SAAS,MAAM,QAAQ,SAAS,EAAE;GACxK;EACF,CAMiB;EACf;EACA;EACA;EACA;EACA;EACA;CACF;AACF;AAEA,MAAa,+BACX,MACA,YACG;CACH,MAAM,EAAE,OAAO,KAAK,aAAa;CACjC,MAAM,EAAE,KAAK,QAAQ,SAAS,YAAY,QAAQ,UAAU,SAAS;CACrE,MAAM,OAAO,QAAQ;CACrB,MAAM,YAA2C;CAEjD,MAAM,EACJ,SACA,OACA,kBACA,kBACA,eACA,OACA,IACA,YACA,UACE,wBAAwB,MAAM,OAAO;CAyVzC,OAAO,EAAE,8BAA8B;EAtVrC,OAAO,aACL,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,MAAM,QAAQ;GAE1E,UAAU,KAAK,YAAY,MAAM,QAAQ,CAAC;GAC1C,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAE7C,MAAM,OACJ,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,MAAM,QAAQ,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC,EAAE;UAC1J,MAAM,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,OAAO,WAAW,OAAO,KAAK,WAAW,YAAY,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,cAAc,MAAM,MAAM,IAAI;mBAC1J,WAAW,OAAO,KAAK,WAAW,YAAY,EAAE,SAAS,MAAM,QAAQ;GAEhF,MAAM,cAAc,KACjB,MAAM,GAAG,MAAM,KAAK,CAAC,CACrB,KAAK,QAAQ,QAAQ,WAAW,OAAO,KAAK,IAAI,CAAC,CAAC;GAErD,MAAM,SAAS,KAAK,SAAS,MAAM,QAAQ,YAAY,GAAG,EAAE,CAAC,EAAE,eAAe,KAAA;GAE9E,OAAO;IAAE;IAAa,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GAAG;EACpE,CAAC,CACH;EACF,gBAAgB,aACd,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,eAAe,QAAQ;GAEnF,IAAI,CAAC,KAAK,YAAY,MAAM,QAAQ,GAAG,OAAO,EAAE,MAAM,WAAW;GACjE,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAC7C,MAAM,UAAU,OAAO,MAAM,cAAc,UAAU,OAAO,MAAM,YAAY;GAE9E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAErD,MAAM,QACJ,QAAQ,eAAe,KAAA,IACnB,KAAA,IACA,OAAO,MAAM,iBAAiB,QAAQ,YAAY,QAAQ,UAAU,QAAQ,GAAG;GAErF,OAAO,UAAU,KAAA,IACZ,EAAE,MAAM,WAAW,IACnB;IAAE,MAAM;IAAU,YAAY;GAAM;EAC3C,CAAC,CACH;EACF,qBAAqB,UAAU,YAC7B,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,oBAAoB,QAAQ;GACxF,MAAM,WAAW,MAAM;GAEvB,IACE,CAAC,KAAK,YAAY,SAAS,QAAQ,KACnC,SAAS,QAAQ,SAAS,gBAC1B,CAAC,qBAAqB,UAAU,MAAM,MAAM,GAE5C,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,UAAU,SAAS;GACzB,MAAM,WAAW,MAAM,OAAO,QAAQ,SAAS,SAAS;GACxD,MAAM,UAAU,OAAO,MAAM,cAAc,UAAU,CAAC,KAAK,KAAK;GAEhE,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,SAAS,EAAE,oBACf,EAAE,yBACF,QAAQ,MAAM,OAAO,WAAW,QAAQ,GAAG,CAC7C;GAEA,MAAM,cAAc,OAAO,QAAQ,MAAM,OAAO,YAAY,QAAQ,KAAK,cAAc;GAEvF,MAAM,YAAY,oBAChB;IACE,UAAU,QAAQ;IAClB,UAAU,QAAQ;IAClB,WAAW,QAAQ;IACnB,oBAAoB;IACpB,UAAU;KACR,QAAQ;KACR,WAAW,SAAS;KACpB,QAAQ,SAAS;KACjB,eAAe,OAAO,wBAAwB,QAAQ;KACtD,UAAU,QAAQ;IACpB;GACF,GACA,QAAQ,eACR;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,CACF;GAEA,IAAI,cAAc,KAAA,GAChB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,MAAM,KAAK,IAAI,OAAO,oBAAoB,MAAM,WAAW,kBAAkB;GAEnF,MAAM,eAAe,OAAO,YAC1B,QAAQ,MAAM,OAAO,eAAe,KAAK,QAAQ,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAC1E;GAEA,MAAM,kBAAkB,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,MAAM,SAAS,YAAY,EAAE;GAE3L,MAAM,YAAY,GAAG,GAAG,iBAAiB,QAAQ,QAAQ,EAAE,OAAO,gBAAgB,OAAO,WAAW,QAAQ,MAAM,OAAO,OAAO,UAAU,QAAQ,aAAa,CAAC,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC,EAAE;cACzN,MAAM,IAAI,KAAK,UAAU,oBAAoB,6BAA6B,WAAW,KAAK,SAAS,MAAM,QAAQ,EAAE,MAAM;GAE7H,MAAM,YAAY,KAAK,QAAQ,MAAM,QAAQ,UAAU,SAAS;GAEhE,IAAI,KAAK,OAAO,OAAO,KAAK,MAAM,WAAW,CAAC;QACzC,KAAK,OAAO,KAAK,OAAO,SAAS,OAAO,GAC3C,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,WAAW,OAAO,iBACtB,UACA,UACA,MAAM,UACN,QAAQ,UACR,QAAQ,MACR,QAAQ,WACR,QAAQ,GACV;GAEA,OAAO,cACL,gCACA,GAAG,GAAG,SAAS,UAAU,OAAO,KAAK,OAAO,MAAM,MAAM,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,EAAE,OAAO,gBAAgB,6BAA6B,WAAW,KAAK,SAAS,MAAM,QAAQ,EAAE,OAAO,IAAI,OAAO,WAAW,QAAQ,MAAM,OAAO,OAAO,UAAU,QAAQ,aAAa,CAAC,EAAE,OAAO,MAAM,IAAI,KAAK,UAAU,qBAC9T;GAEA,OAAO,OAAO,qBACZ;IAAE,MAAM;IAAY,YAAY,SAAS;GAAQ,GACjD,OACF;EACF,CAAC,CACH;EACF,SAAS,UAAU,YACjB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,QAAQ,QAAQ;GAE5E,IAAI,CAAC,KAAK,YAAY,MAAM,QAAQ,GAClC,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAC7C,MAAM,YAAY,GAAG,GAAG,WAAW,OAAO,GAAG,QAAQ,MAAM,WAAW,OAAO,MAAM,KAAK,CAAC,EAAE,SAAS,MAAM,UAAU,MAAM,YAAY,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC;GACjM,IAAI;GAEJ,IAAI,KAAK,OAAO;IACd,OACE,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,MAAM,UAAU,MAAM,YAAY,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC;IAC5K,IAAI,KAAK,WAAW,GAClB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;IAClE,OAAO,KAAK,MAAM,WAAW,CAAC;GAChC,OACE,OAAO,OAAO,IAAI,gBAAgB;IAChC,aACE,OAAO,IAAI,aAAa;KAGtB,KAAI,OAFmB,KAAK,OAAO,SAAS,KAE9B,GAAG,OAAO,CAAC;KAGzB,OAAO,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,MAAM,UAAU,MAAM,YAAY,EAAE,OAAO,GAAG,YAAY,QAAQ,MAAM,WAAW,MAAM,MAAM,IAAI,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC;IACpP,CAAC;IACH,cAAc,GAAG,GAAG,UAAU,aAAa,WAAW,OAAO,IAAI;GACnE,CAAC;GAEH,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GACvF,MAAM,MAAM,WAAW,OAAO,KAAK,IAAK,IAAI;GAE5C,OAAO,OAAO,qBACZ;IACE,MAAM;IACN,YAAY,QAAQ;KAAE,GAAG;MAAM,QAAQ,MAAM,WAAW,OAAO,MAAM;IAAK,CAAC;GAC7E,GACA,OACF;EACF,CAAC,GACD,WACF;EACF,SAAS,UAAU,YACjB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,QAAQ,QAAQ;GAE5E,IAAI,CAAC,KAAK,YAAY,MAAM,QAAQ,GAClC,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,WAAW,MAAM,OAAO,MAAM,WAAW,SAAS,SAAS;GAEjE,MAAM,UAAU,OAAO,MAAM,cAC3B,UACA,CAAC,KAAK,OACN,MAAM,WAAW,YACnB;GAEA,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,WACJ,QAAQ,eAAe,KAAA,IACnB,KAAA,IACA,OAAO,MAAM,iBAAiB,QAAQ,YAAY,QAAQ,UAAU,QAAQ,GAAG;GAErF,MAAM,SAAS,EAAE,oBACf,EAAE,yBACF,QAAQ,MAAM,OAAO,WAAW,QAAQ,GAAG,CAC7C;GAEA,IACE,aAAa,KAAA,KACb,CAAC,sBAAsB,UAAU,MAAM,UAAU,KACjD,CAAC,oBAAoB,SAAS,UAAU,MAAM,WAAW,QAAQ,MAC/D,OAAO,gCACP,MAAM,WAAW,iCACjB,QAAQ,aAAa,OAAO,qBAAqB,eACnD,OAAO,WAAW,OAAO,eAAe,EAAE,eAAe,OAAO,YAAY,CAAC,CAAC,CAC5E,MAAM,YACR,MACE,OAAO,WAAW,OAAO,eAAe,EAAE,eAAe,OAAO,YAAY,CAAC,CAAC,CAC5E,QAAQ,aAAa,MACvB,GAEF,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,cAAc,OAAO,QAAQ,MAAM,OAAO,YAAY,QAAQ,KAAK,QAAQ;GAEjF,MAAM,YAAY,oBAChB;IACE,UAAU,QAAQ;IAClB,UAAU,QAAQ;IAClB,WAAW,QAAQ;IACnB,oBAAoB;IACpB,UAAU;KACR,QAAQ;KACR,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,eAAe,OAAO,oBACpB,QAAQ,UACR,MAAM,WACN,MAAM,UACR;KACA,UAAU,MAAM,WAAW;IAC7B;GACF,GACA,MAAM,eACN;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,CACF;GAEA,IAAI,cAAc,KAAA,GAChB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,YAAY,WAChB,OAAO,QAAQ,MAAM,OAAO,gBAC1B,UACA,SAAS,cACT,QAAQ,GACV,CACF;GAEA,MAAM,UAAU,WAAW,QAAQ,MAAM,OAAO,OAAO,UAAU,MAAM,aAAa,CAAC;GAErF,MAAM,WAAW,OAAO,IAAI,aAAa;IACvC,MAAM,OACJ,OAAO,GAAG,oBAAoB,UAAU,6CAA6C,QAAQ,OAAO,MAAM,IAAI,KAAK,UAAU,oBAAoB,OAAO,iBAAiB,QAAQ,QAAQ,EAAE;IAE7L,OAAO,OAAO,KAAK,EAAE,EAAE,OAAO,MAAM,IAC/B,aACD,OAAO,KAAK,EAAE,EAAE,SAAS,MAAM,IAC5B,qBACD,KAAA;GACR,CAAC;GAED,MAAM,OAAO,iBAAiB,KAAK,OAAO,QAAQ;GAClD,MAAM,SAAS,GAAG,GAAG,QAAQ,OAAO,GAAG,KAAK,QAAQ,mBAAmB,KAAK,CAAC,EAAE,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,GAAG,SAAS,KAAK,QAAQ,kBAAkB,QAAQ,SAAS,gBAAgB,EAAE,OAAO,MAAM,OAAO,SAAS,EAAE,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,IAAI,KAAK,UAAU;GAE1V,IAAI,KAAK,OAAO;IACd,MAAM,WAAW,OAAO;IAExB,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,qBAAqB,EAAE,MAAM,SAAS,GAAG,OAAO;IAChE,OAAO,MAAM,QAAQ,CAAC;GACxB,OAAO,KAAK,OAAO,KAAK,OAAO,MAAM,OAAO,GAAG;IAC7C,MAAM,WAAW,OAAO;IAExB,OAAO,OAAO,qBAAqB,EAAE,MAAM,YAAY,WAAW,GAAG,OAAO;GAC9E;GACA,OAAO,MACL,GAAG,GAAG,WAAW,OAAO;KAAG,KAAK,WAAW,SAAS,QAAQ,MAAM,WAAW;KAAgB,KAAK,WAAW,qBAAqB;GAAK,CAAC,EAAE,SAAS,MAAM,UAAU,SAAS,YAAY,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,oBAAoB,SAAS,SAAS,YAAY,MAAM,UAAU,MAAM,iBAAiB,SAAS,YAAY,CAAC,EAAE,QAAQ,KACzV,CACF;GACA,OAAO,MACL,GAAG,GAAG,OAAO,OAAO;KAAG,KAAK,UAAU,SAAS,QAAQ,MAAM,UAAU;KAAgB,KAAK,UAAU,WAAW;GAAK,CAAC,EAAE,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,cAAc,SAAS,YAAY,KACpS,CACF;GAEA,MAAM,eAAe,OAAO,YAC1B,QAAQ,MAAM,OAAO,eAAe,KAAK,QAAQ,CAC/C,KACA,QAAQ,KAAK,QAAQ,mBAAmB,OAAO,QAAQ,IAAI,IAC7D,CAAC,CACH;GAEA,MAAM,kBAAkB,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,MAAM,SAAS,YAAY,EAAE;GAE3L,MAAM,eAAe;IACnB,WAAW;IACX,kBAAkB,QAAQ,SAAS;IACnC,kBAAkB;IAClB,cAAc,MAAM;GACtB;GAEA,MAAM,kBAAmC,CAAC;GAE1C,KAAK,MAAM,YAAY,QAAQ,aAAa,WAAW;IACrD,MAAM,QAAQ,OAAO,SAAS,KAAK;IACnC,MAAM,QAAQ,GAAG,GAAG,MAAM,OAAO,SAAS,OAAO,YAAY,CAAC,EAAE,SAAS,WAAW,SAAS,MAAM,YAAY,CAAC;IAEhH,IAAI,KAAK,OAAO,OAAO,wBAAwB,KAAK;SAC/C,OAAO;IACZ,gBAAgB,KAAK,WAAW,SAAS,cAAc,YAAY,CAAC,CAAC;GACvE;GACA,gBAAgB,KACd,GAAG,wBAAwB,WAAW,KAAK,SAAS,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,cAAc,SAAS,YAAY,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,oBAAoB,IAAI,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,QAAQ,QAAQ,MAAM,WAAW,aAAa,EAAE,6BAA6B,OAAO,KAAK,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,cAAc,SAAS,YAAY,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,UAAU,IAAI,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,QAAQ,QAAQ,MAAM,UAAU,aAAa,EAAE,EACttB;GACA,gBAAgB,KACd,GAAG,GAAG,WAAW,QAAQ,aAAa,cAAc,YAAY,CAAC,EAAE,OAAO,gBAAgB,OAAO,UAAU,OAAO,MAAM,IAAI,KAAK,UAAU,qBAC7I;GACA,OAAO,cAAc,mBAAmB,IAAI,IAAI,eAAe,CAAC;GAEhE,OAAO,OAAO,qBACZ;IACE,MAAM;IACN,QAAQ;KAAE,cAAc,SAAS;KAAc,cAAc,MAAM;IAAa;GAClF,GACA,OACF;EACF,CAAC,CACH;CAGyC,EAAE;AACjD"}
+{"version":3,"file":"passkey-native-write.mjs","names":[],"sources":["../../src/internal/passkey-native-write.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- physical mapping generics are erased only at this shared adapter boundary. */\nimport * as M from \"@yielded/auth/Passkey\";\nimport { SecurityRevision } from \"@yielded/auth/Sessions\";\nimport { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { randomId } from \"./crypto\";\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport type {\n  PasskeyCredentialInsert,\n  PasskeyManagementMapping,\n} from \"./models/passkey-write-model\";\nimport type { SqlTable } from \"./native-sql-table\";\nimport { passkeyEnrollmentDigest, passkeyRemoveDigest } from \"./passkey-actions\";\nimport { passkeyManagementInputs } from \"./passkey-inputs\";\nimport { preparePasskeyNative, type NativePasskeyServices } from \"./passkey-native\";\nimport { passkeyNativeInvariant, type PasskeyNativeRow } from \"./passkey-native-state\";\nimport {\n  assessPasskeyAction,\n  passkeyCredentialKey,\n  passkeyMatchesAccess,\n  samePasskeyCredential,\n  samePasskeyRevision,\n} from \"./passkey-policy\";\nimport { exactSqlText } from \"./sql-change\";\nimport {\n  appendSqlBatchStatement,\n  registerSqlBatchPostcondition,\n  registerSqlPostcondition,\n} from \"./sql-commit\";\nimport type { TableModel } from \"./table-model\";\n\n// Mapping callbacks retain concrete row/SQL types at the public driver boundary.\nexport type NativePasskeyManagementMapping = PasskeyManagementMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  any\n>;\n\nexport type NativePasskeyWriteMapping = Pick<\n  NativePasskeyManagementMapping,\n  \"moduleId\" | \"read\" | \"write\" | \"clock\" | \"telemetry\"\n>;\n\nexport const makePasskeyNativeWrites = (\n  base: NativePasskeyServices,\n  mapping: NativePasskeyWriteMapping,\n) => {\n  const { state } = base;\n  const { sql, tables, subject, credential, factor, ceremony: flow } = state;\n  const read = mapping.read;\n  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;\n  const expression = tables.expression;\n\n  const eq = (table: SqlTable, key: string, value: unknown) =>\n    typeof value === \"string\"\n      ? exactSqlText(sql, table.column(key), table.value(key, value))\n      : sql`${table.column(key)} = ${table.value(key, value)}`;\n\n  const match = (table: SqlTable, values: Readonly<Record<string, unknown>>) =>\n    sql.and(\n      Object.entries(values)\n        .filter(([, value]) => value !== undefined)\n        .map(([key, value]) =>\n          value === null ? sql`${table.column(key)} is null` : eq(table, key, value),\n        ),\n    );\n\n  const check = (condition: Fragment) =>\n    Effect.gen(function* () {\n      const current = (yield* SqlClient.SqlClient).withoutTransforms();\n      const rows = yield* current`select case when ${condition} then 1 else 0 end as valid`;\n\n      if (rows.length !== 1 || Number(rows[0]!.valid) !== 1)\n        return yield* PersistenceMappingError.make({\n          operation: \"mapping\",\n          cause: \"Passkey mutation postcondition failed\",\n        });\n    });\n\n  const postcondition = (name: string, condition: Fragment) =>\n    base.batch\n      ? registerSqlBatchPostcondition({ name, statement: sqlBatchAssertion(sql, condition) })\n      : registerSqlPostcondition({ name, check: check(condition) });\n\n  const write = (statement: Fragment, count: number) =>\n    base.batch\n      ? flow.stage(statement, count)\n      : flow.change(statement).pipe(\n          Effect.flatMap((changed) =>\n            changed === count\n              ? Effect.void\n              : Effect.fail(\n                  PersistenceMappingError.make({\n                    operation: \"mapping\",\n                    cause: \"Passkey conditional write did not match\",\n                  }),\n                ),\n          ),\n        );\n\n  const summary = (row: PasskeyNativeRow) =>\n    Schema.decodeUnknownSync(M.PasskeyCredentialSummary)({\n      credentialId: row[read.credential.credentialId],\n      name: row[mapping.write.credential.name],\n      primarySignIn: read.credential.decode(row).primarySignIn,\n      createdAtMillis: mapping.clock.decodeInstant(row[mapping.write.credential.createdAt]),\n      ...(row[mapping.telemetry.lastUsedAt] === null ||\n      row[mapping.telemetry.lastUsedAt] === undefined\n        ? {}\n        : { lastUsedAtMillis: mapping.clock.decodeInstant(row[mapping.telemetry.lastUsedAt]) }),\n    });\n\n  const owned = (nativeId: unknown, credentialId?: string) =>\n    sql.and([\n      sql`${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)}`,\n      ...(credentialId === undefined\n        ? []\n        : [eq(credential, read.credential.credentialId, credentialId)]),\n      state.active(\"credential\"),\n    ]);\n\n  const subjectCondition = (current: M.PasskeyCredential[\"revision\"]) => {\n    const id = state.native(current.subjectId);\n\n    return sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, id)} and ${eq(subject, read.subject.securityRevision, current.securityRevision)} and ${state.active(\"subject\")}) and ${sql.and(current.credentials.map((entry) => sql`exists(select 1 from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, id)} and ${eq(factor, read.authority.credentialId, entry.credentialId)} and ${eq(factor, read.authority.revision, entry.revision)} and ${state.active(\"authority\")})`))}`;\n  };\n\n  const insertCredential = Effect.fnUntraced(function* (\n    nativeId: unknown,\n    ceremony: M.PasskeyCeremony,\n    verified: M.PasskeyRegistrationVerified,\n    revision: M.PasskeyCredential[\"revision\"],\n    name: string,\n    nowMillis: number,\n    subjectRow: Readonly<Record<string, unknown>>,\n  ) {\n    invariant(ceremony.context._tag === \"Enrollment\" || ceremony.context._tag === \"Registration\");\n    const credentialId = yield* randomId;\n    const marker = yield* randomId;\n    const credentialRevision = SecurityRevision.make(marker);\n\n    const value = M.snapshotPasskeySync(M.PasskeyCredential, {\n      credentialId,\n      requirement: yield* read.subject.decodeRequirement(subjectRow),\n      rpId: ceremony.profile.rpId,\n      protocolCredentialId: verified.protocolCredentialId,\n      userHandle: ceremony.context.userHandle,\n      publicKey: verified.publicKey,\n      algorithm: verified.algorithm,\n      profile: ceremony.profile,\n      revision: {\n        ...revision,\n        credentials: [...revision.credentials, { credentialId, revision: credentialRevision }],\n      },\n      active: true,\n      primarySignIn: ceremony.profile.primarySignIn && verified.userVerified,\n      enrollmentUserVerified: verified.userVerified,\n      backupEligible: verified.backupEligible,\n      backupState: verified.backupState,\n      counter: verified.counter,\n    });\n\n    const details = M.snapshotPasskeySync(M.PasskeyCredentialSummary, {\n      credentialId,\n      name,\n      primarySignIn: value.primarySignIn,\n      createdAtMillis: nowMillis,\n    });\n\n    const input: PasskeyCredentialInsert<unknown> = {\n      subjectId: nativeId,\n      credential: value,\n      summary: details,\n      marker,\n    };\n\n    const values = {\n      ...mapping.write.credential.encodeInsert(input),\n      [read.credential.credentialKey]: yield* passkeyCredentialKey(\n        value.rpId,\n        value.protocolCredentialId,\n      ),\n    };\n\n    const authorityValues = mapping.write.authority.encodeInsert(input);\n\n    yield* write(credential.insert(values), 1);\n    yield* write(factor.insert(authorityValues), 1);\n\n    // Application work may change telemetry or names, but cannot replace the\n    // enrolled key, ownership, semantic revision, or its authority factor.\n    const semanticKeys = [\n      read.credential.credentialId,\n      read.credential.subjectId,\n      read.credential.rpId,\n      read.credential.protocolCredentialId,\n      read.credential.credentialKey,\n      read.credential.userHandle,\n      read.credential.publicKey,\n      read.credential.algorithm,\n      read.credential.profile,\n      read.credential.credentialRevision,\n      read.credential.status,\n      read.credential.primarySignIn,\n      read.credential.enrollmentUserVerified,\n      read.credential.backupEligible,\n    ];\n\n    const semantic = Object.fromEntries(semanticKeys.map((key) => [key, values[key]]));\n\n    const authority = Object.fromEntries(\n      [\n        read.authority.subjectId,\n        read.authority.credentialId,\n        read.authority.revision,\n        read.authority.status,\n      ].map((key) => [key, authorityValues[key]]),\n    );\n\n    return {\n      details,\n      condition: sql`exists(select 1 from ${credential.name} where ${match(credential, semantic)}) and exists(select 1 from ${factor.name} where ${match(factor, authority)})`,\n    };\n  });\n\n  return {\n    summary,\n    owned,\n    subjectCondition,\n    insertCredential,\n    postcondition,\n    write,\n    check,\n    eq,\n    expression,\n    match,\n  };\n};\n\nexport const makePasskeyNativeManagement = (\n  base: NativePasskeyServices,\n  mapping: NativePasskeyManagementMapping,\n) => {\n  const { state, run, advisory } = base;\n  const { sql, tables, subject, credential, factor, ceremony: flow } = state;\n  const read = mapping.read;\n  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;\n\n  const {\n    summary,\n    owned,\n    subjectCondition,\n    insertCredential,\n    postcondition,\n    write,\n    eq,\n    expression,\n    match,\n  } = makePasskeyNativeWrites(base, mapping);\n\n  const service: M.PasskeyManagementPersistence[\"Service\"] = {\n    list: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.list, original);\n\n          invariant(flow.validModule(input.moduleId));\n          const nativeId = state.native(input.subjectId);\n\n          const rows =\n            yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${owned(nativeId)} and ${expression(mapping.write.policy.metadata(nativeId))}\n        ${input.cursor === undefined ? sql`` : sql`and ${credential.column(read.credential.credentialId)} > ${credential.value(read.credential.credentialId, input.cursor)}`}\n        order by ${credential.column(read.credential.credentialId)} limit ${input.limit + 1}`;\n\n          const credentials = rows\n            .slice(0, input.limit)\n            .map((row) => summary(credential.decode(row, \"c_\")));\n\n          const cursor = rows.length > input.limit ? credentials.at(-1)?.credentialId : undefined;\n\n          return { credentials, ...(cursor === undefined ? {} : { cursor }) };\n        }),\n      ),\n    inspectRemove: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.inspectRemove, original);\n\n          if (!flow.validModule(input.moduleId)) return { _tag: \"Rejected\" } as const;\n          const nativeId = state.native(input.subjectId);\n          const current = yield* state.readAuthority(nativeId, false, input.credentialId);\n\n          if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n          const value =\n            current.credential === undefined\n              ? undefined\n              : yield* state.decodeCredential(current.credential, current.revision, current.row);\n\n          return value === undefined\n            ? ({ _tag: \"Rejected\" } as const)\n            : ({ _tag: \"Target\", credential: value } as const);\n        }),\n      ),\n    completeEnrollment: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.completeEnrollment, original);\n          const ceremony = input.ceremony;\n\n          if (\n            !flow.validModule(ceremony.moduleId) ||\n            ceremony.context._tag !== \"Enrollment\" ||\n            !passkeyMatchesAccess(ceremony, input.access)\n          )\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const context = ceremony.context;\n          const nativeId = state.native(context.revision.subjectId);\n          const current = yield* state.readAuthority(nativeId, !base.batch);\n\n          if (current === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const policy = M.snapshotPasskeySync(\n            M.PasskeyManagementPolicy,\n            mapping.write.policy.management(current.row),\n          );\n\n          const requirement = yield* mapping.write.policy.requirement(current.row, \"enroll-begin\");\n\n          const authority = yield* assessPasskeyAction(\n            {\n              moduleId: mapping.moduleId,\n              revision: current.revision,\n              nowMillis: current.nowMillis,\n              currentRequirement: requirement,\n              expected: {\n                action: \"enroll-begin\",\n                commandId: ceremony.commandId,\n                flowId: ceremony.flowId,\n                bindingDigest: yield* passkeyEnrollmentDigest(ceremony),\n                revision: context.revision,\n              },\n            },\n            context.authorization,\n            {\n              ...policy,\n              maximumEvidenceAgeMillis: Math.min(\n                policy.maximumEvidenceAgeMillis,\n                input.management.maximumEvidenceAgeMillis,\n              ),\n            },\n          );\n\n          if (authority === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const cap = Math.min(policy.maximumCredentials, input.management.maximumCredentials);\n\n          const policyValues = Object.fromEntries(\n            mapping.write.policy.subjectColumns.map((key) => [key, current.row[key]]),\n          );\n\n          const policyUnchanged = sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${match(subject, policyValues)})`;\n\n          const condition = sql`${subjectCondition(current.revision)} and ${policyUnchanged} and ${expression(mapping.write.policy.action(nativeId, context.authorization))} and ${expression(mapping.write.policy.metadata(nativeId))}\n        and ${state.now} < ${authority.expiresBeforeMillis} and (select count(*) from ${credential.name} where ${owned(nativeId)}) < ${cap}`;\n\n          const statement = flow.consume(input.access, ceremony, condition);\n\n          if (base.batch) yield* flow.stage(statement, 1);\n          else if ((yield* flow.change(statement)) !== 1)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const enrolled = yield* insertCredential(\n            nativeId,\n            ceremony,\n            input.verified,\n            current.revision,\n            context.name,\n            current.nowMillis,\n            current.row,\n          );\n\n          yield* postcondition(\n            \"passkey-enrollment-authority\",\n            sql`${enrolled.condition} and ${flow.absent(input.access)} and ${subjectCondition(current.revision)} and ${policyUnchanged} and (select count(*) from ${credential.name} where ${owned(nativeId)}) <= ${cap} and ${expression(mapping.write.policy.action(nativeId, context.authorization))} and ${state.now} < ${authority.expiresBeforeMillis}`,\n          );\n\n          return yield* preparePasskeyNative(\n            { _tag: \"Enrolled\", credential: enrolled.details },\n            prepare,\n          );\n        }),\n      ),\n    rename: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.rename, original);\n\n          if (!flow.validModule(input.moduleId))\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const nativeId = state.native(input.subjectId);\n          const statement = sql`${credential.update({ [mapping.write.credential.name]: input.name })} where ${owned(nativeId, input.credentialId)} and ${expression(mapping.write.policy.metadata(nativeId))}`;\n          let rows: ReadonlyArray<PasskeyNativeRow>;\n\n          if (base.batch) {\n            rows =\n              yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${owned(nativeId, input.credentialId)} and ${expression(mapping.write.policy.metadata(nativeId))}`;\n            if (rows.length !== 1)\n              return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n            yield* flow.stage(statement, 1);\n          } else {\n            rows = yield* sql.onDialectOrElse({\n              mysql: () =>\n                Effect.gen(function* () {\n                  const changed = yield* flow.change(statement);\n\n                  if (changed > 1) return [];\n\n                  // With mysql2 -FOUND_ROWS an idempotent rename reports zero changes.\n                  return yield* sql`select ${credential.fields(\"c_\")} from ${credential.name} where ${owned(nativeId, input.credentialId)} and ${eq(credential, mapping.write.credential.name, input.name)} and ${expression(mapping.write.policy.metadata(nativeId))}`;\n                }),\n              orElse: () => sql`${statement} returning ${credential.fields(\"c_\")}`,\n            });\n          }\n          if (rows.length !== 1) return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const row = credential.decode(rows[0]!, \"c_\");\n\n          return yield* preparePasskeyNative(\n            {\n              _tag: \"Renamed\",\n              credential: summary({ ...row, [mapping.write.credential.name]: input.name }),\n            },\n            prepare,\n          );\n        }),\n        \"statement\",\n      ),\n    remove: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyManagementInputs.remove, original);\n\n          if (!flow.validModule(input.moduleId))\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const nativeId = state.native(input.credential.revision.subjectId);\n\n          const current = yield* state.readAuthority(\n            nativeId,\n            !base.batch,\n            input.credential.credentialId,\n          );\n\n          if (current === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const captured =\n            current.credential === undefined\n              ? undefined\n              : yield* state.decodeCredential(current.credential, current.revision, current.row);\n\n          const policy = M.snapshotPasskeySync(\n            M.PasskeyManagementPolicy,\n            mapping.write.policy.management(current.row),\n          );\n\n          if (\n            captured === undefined ||\n            !samePasskeyCredential(captured, input.credential) ||\n            !samePasskeyRevision(captured.revision, input.credential.revision) ||\n            ((policy.requireImmediateInvalidation ||\n              input.management.requireImmediateInvalidation) &&\n              mapping.invalidation.window.existingSessions !== \"immediate\") ||\n            Schema.encodeSync(Schema.fromJsonString(M.PasskeyRemoved.fields.invalidation))(\n              input.invalidation,\n            ) !==\n              Schema.encodeSync(Schema.fromJsonString(M.PasskeyRemoved.fields.invalidation))(\n                mapping.invalidation.window,\n              )\n          )\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const requirement = yield* mapping.write.policy.requirement(current.row, \"remove\");\n\n          const authority = yield* assessPasskeyAction(\n            {\n              moduleId: mapping.moduleId,\n              revision: current.revision,\n              nowMillis: current.nowMillis,\n              currentRequirement: requirement,\n              expected: {\n                action: \"remove\",\n                commandId: input.commandId,\n                flowId: input.commandId,\n                bindingDigest: yield* passkeyRemoveDigest(\n                  mapping.moduleId,\n                  input.commandId,\n                  input.credential,\n                ),\n                revision: input.credential.revision,\n              },\n            },\n            input.authorization,\n            {\n              ...policy,\n              maximumEvidenceAgeMillis: Math.min(\n                policy.maximumEvidenceAgeMillis,\n                input.management.maximumEvidenceAgeMillis,\n              ),\n            },\n          );\n\n          if (authority === undefined)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const remaining = expression(\n            yield* mapping.write.policy.remainingSignIn(\n              nativeId,\n              captured.credentialId,\n              current.row,\n            ),\n          );\n\n          const allowed = expression(mapping.write.policy.action(nativeId, input.authorization));\n\n          const classify = Effect.gen(function* () {\n            const rows =\n              yield* sql`select case when ${remaining} then 1 else 0 end as remaining, case when ${allowed} and ${state.now} < ${authority.expiresBeforeMillis} and ${subjectCondition(current.revision)} then 1 else 0 end as allowed`;\n\n            return Number(rows[0]?.allowed) !== 1\n              ? (\"Rejected\" as const)\n              : Number(rows[0]?.remaining) !== 1\n                ? (\"LastSignInMethod\" as const)\n                : undefined;\n          });\n\n          const next = SecurityRevision.make(yield* randomId);\n          const update = sql`${subject.update({ [read.subject.securityRevision]: next })} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${eq(subject, read.subject.securityRevision, current.revision.securityRevision)} and ${state.active(\"subject\")} and ${remaining} and ${allowed} and ${state.now} < ${authority.expiresBeforeMillis}`;\n\n          if (base.batch) {\n            const rejected = yield* classify;\n\n            if (rejected !== undefined)\n              return yield* preparePasskeyNative({ _tag: rejected }, prepare);\n            yield* write(update, 1);\n          } else if ((yield* flow.change(update)) !== 1) {\n            const rejected = yield* classify;\n\n            return yield* preparePasskeyNative({ _tag: rejected ?? \"Rejected\" }, prepare);\n          }\n          yield* write(\n            sql`${credential.update({ [read.credential.status]: mapping.write.credential.removedStatus, [read.credential.credentialRevision]: next })} where ${owned(nativeId, captured.credentialId)} and ${eq(credential, read.credential.credentialRevision, captured.revision.credentials.find((entry) => entry.credentialId === captured.credentialId)?.revision)}`,\n            1,\n          );\n          yield* write(\n            sql`${factor.update({ [read.authority.status]: mapping.write.authority.removedStatus, [read.authority.revision]: next })} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${eq(factor, read.authority.credentialId, captured.credentialId)}`,\n            1,\n          );\n\n          const policyValues = Object.fromEntries(\n            mapping.write.policy.subjectColumns.map((key) => [\n              key,\n              key === read.subject.securityRevision ? next : current.row[key],\n            ]),\n          );\n\n          const policyUnchanged = sql`exists(select 1 from ${subject.name} where ${subject.column(read.subject.id)} = ${subject.value(read.subject.id, nativeId)} and ${match(subject, policyValues)})`;\n\n          const invalidation = {\n            subjectId: nativeId,\n            previousRevision: current.revision.securityRevision,\n            securityRevision: next,\n            invalidation: input.invalidation,\n          };\n\n          const finalConditions: Array<Fragment> = [];\n\n          for (const mutation of mapping.invalidation.mutations) {\n            const table = tables(mutation.table);\n            const query = sql`${table.update(mutation.values(invalidation))} where ${expression(mutation.where(invalidation))}`;\n\n            if (base.batch) yield* appendSqlBatchStatement(query);\n            else yield* query;\n            finalConditions.push(expression(mutation.postcondition(invalidation)));\n          }\n          finalConditions.push(\n            sql`exists(select 1 from ${credential.name} where ${credential.column(read.credential.subjectId)} = ${credential.value(read.credential.subjectId, nativeId)} and ${eq(credential, read.credential.credentialId, captured.credentialId)} and ${eq(credential, read.credential.credentialRevision, next)} and ${eq(credential, read.credential.status, mapping.write.credential.removedStatus)}) and exists(select 1 from ${factor.name} where ${factor.column(read.authority.subjectId)} = ${factor.value(read.authority.subjectId, nativeId)} and ${eq(factor, read.authority.credentialId, captured.credentialId)} and ${eq(factor, read.authority.revision, next)} and ${eq(factor, read.authority.status, mapping.write.authority.removedStatus)})`,\n          );\n          finalConditions.push(\n            sql`${expression(mapping.invalidation.postcondition(invalidation))} and ${policyUnchanged} and ${remaining} and ${state.now} < ${authority.expiresBeforeMillis}`,\n          );\n          yield* postcondition(\"passkey-removal\", sql.and(finalConditions));\n\n          return yield* preparePasskeyNative(\n            {\n              _tag: \"Removed\",\n              result: { credentialId: captured.credentialId, invalidation: input.invalidation },\n            },\n            prepare,\n          );\n        }),\n      ),\n  };\n\n  return { passkeyManagementPersistence: service };\n};\n"],"mappings":";;;;;;;;;;;;;;;AAiDA,MAAa,2BACX,MACA,YACG;CACH,MAAM,EAAE,UAAU;CAClB,MAAM,EAAE,KAAK,QAAQ,SAAS,YAAY,QAAQ,UAAU,SAAS;CACrE,MAAM,OAAO,QAAQ;CACrB,MAAM,YAA2C;CACjD,MAAM,aAAa,OAAO;CAE1B,MAAM,MAAM,OAAiB,KAAa,UACxC,OAAO,UAAU,WACb,aAAa,KAAK,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,KAAK,KAAK,CAAC,IAC5D,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,KAAK;CAEzD,MAAM,SAAS,OAAiB,WAC9B,IAAI,IACF,OAAO,QAAQ,MAAM,CAAC,CACnB,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAAC,CAC1C,KAAK,CAAC,KAAK,WACV,UAAU,OAAO,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,YAAY,GAAG,OAAO,KAAK,KAAK,CAC3E,CACJ;CAEF,MAAM,SAAS,cACb,OAAO,IAAI,aAAa;EAEtB,MAAM,OAAO,OAAO,CADH,OAAO,UAAU,UAAA,CAAW,kBACnB,CAAC,oBAAoB,UAAU;EAEzD,IAAI,KAAK,WAAW,KAAK,OAAO,KAAK,EAAE,CAAE,KAAK,MAAM,GAClD,OAAO,OAAO,wBAAwB,KAAK;GACzC,WAAW;GACX,OAAO;EACT,CAAC;CACL,CAAC;CAEH,MAAM,iBAAiB,MAAc,cACnC,KAAK,QACD,8BAA8B;EAAE;EAAM,WAAW,kBAAkB,KAAK,SAAS;CAAE,CAAC,IACpF,yBAAyB;EAAE;EAAM,OAAO,MAAM,SAAS;CAAE,CAAC;CAEhE,MAAM,SAAS,WAAqB,UAClC,KAAK,QACD,KAAK,MAAM,WAAW,KAAK,IAC3B,KAAK,OAAO,SAAS,CAAC,CAAC,KACrB,OAAO,SAAS,YACd,YAAY,QACR,OAAO,OACP,OAAO,KACL,wBAAwB,KAAK;EAC3B,WAAW;EACX,OAAO;CACT,CAAC,CACH,CACN,CACF;CAEN,MAAM,WAAW,QACf,OAAO,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;EACnD,cAAc,IAAI,KAAK,WAAW;EAClC,MAAM,IAAI,QAAQ,MAAM,WAAW;EACnC,eAAe,KAAK,WAAW,OAAO,GAAG,CAAC,CAAC;EAC3C,iBAAiB,QAAQ,MAAM,cAAc,IAAI,QAAQ,MAAM,WAAW,UAAU;EACpF,GAAI,IAAI,QAAQ,UAAU,gBAAgB,QAC1C,IAAI,QAAQ,UAAU,gBAAgB,KAAA,IAClC,CAAC,IACD,EAAE,kBAAkB,QAAQ,MAAM,cAAc,IAAI,QAAQ,UAAU,WAAW,EAAE;CACzF,CAAC;CAEH,MAAM,SAAS,UAAmB,iBAChC,IAAI,IAAI;EACN,GAAG,GAAG,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ;EAC5G,GAAI,iBAAiB,KAAA,IACjB,CAAC,IACD,CAAC,GAAG,YAAY,KAAK,WAAW,cAAc,YAAY,CAAC;EAC/D,MAAM,OAAO,YAAY;CAC3B,CAAC;CAEH,MAAM,oBAAoB,YAA6C;EACrE,MAAM,KAAK,MAAM,OAAO,QAAQ,SAAS;EAEzC,OAAO,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,EAAE,EAAE,OAAO,GAAG,SAAS,KAAK,QAAQ,kBAAkB,QAAQ,gBAAgB,EAAE,OAAO,MAAM,OAAO,SAAS,EAAE,QAAQ,IAAI,IAAI,QAAQ,YAAY,KAAK,UAAU,GAAG,wBAAwB,OAAO,KAAK,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,EAAE,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,cAAc,MAAM,YAAY,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,UAAU,MAAM,QAAQ,EAAE,OAAO,MAAM,OAAO,WAAW,EAAE,EAAE,CAAC;CAC1kB;CAoGA,OAAO;EACL;EACA;EACA;EACA,kBAtGuB,OAAO,WAAW,WACzC,UACA,UACA,UACA,UACA,MACA,WACA,YACA;GACA,UAAU,SAAS,QAAQ,SAAS,gBAAgB,SAAS,QAAQ,SAAS,cAAc;GAC5F,MAAM,eAAe,OAAO;GAC5B,MAAM,SAAS,OAAO;GACtB,MAAM,qBAAqB,iBAAiB,KAAK,MAAM;GAEvD,MAAM,QAAQ,EAAE,oBAAoB,EAAE,mBAAmB;IACvD;IACA,aAAa,OAAO,KAAK,QAAQ,kBAAkB,UAAU;IAC7D,MAAM,SAAS,QAAQ;IACvB,sBAAsB,SAAS;IAC/B,YAAY,SAAS,QAAQ;IAC7B,WAAW,SAAS;IACpB,WAAW,SAAS;IACpB,SAAS,SAAS;IAClB,UAAU;KACR,GAAG;KACH,aAAa,CAAC,GAAG,SAAS,aAAa;MAAE;MAAc,UAAU;KAAmB,CAAC;IACvF;IACA,QAAQ;IACR,eAAe,SAAS,QAAQ,iBAAiB,SAAS;IAC1D,wBAAwB,SAAS;IACjC,gBAAgB,SAAS;IACzB,aAAa,SAAS;IACtB,SAAS,SAAS;GACpB,CAAC;GAED,MAAM,UAAU,EAAE,oBAAoB,EAAE,0BAA0B;IAChE;IACA;IACA,eAAe,MAAM;IACrB,iBAAiB;GACnB,CAAC;GAED,MAAM,QAA0C;IAC9C,WAAW;IACX,YAAY;IACZ,SAAS;IACT;GACF;GAEA,MAAM,SAAS;IACb,GAAG,QAAQ,MAAM,WAAW,aAAa,KAAK;KAC7C,KAAK,WAAW,gBAAgB,OAAO,qBACtC,MAAM,MACN,MAAM,oBACR;GACF;GAEA,MAAM,kBAAkB,QAAQ,MAAM,UAAU,aAAa,KAAK;GAElE,OAAO,MAAM,WAAW,OAAO,MAAM,GAAG,CAAC;GACzC,OAAO,MAAM,OAAO,OAAO,eAAe,GAAG,CAAC;GAI9C,MAAM,eAAe;IACnB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;IAChB,KAAK,WAAW;GAClB;GAEA,MAAM,WAAW,OAAO,YAAY,aAAa,KAAK,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC;GAEjF,MAAM,YAAY,OAAO,YACvB;IACE,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;GACjB,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,gBAAgB,IAAI,CAAC,CAC5C;GAEA,OAAO;IACL;IACA,WAAW,GAAG,wBAAwB,WAAW,KAAK,SAAS,MAAM,YAAY,QAAQ,EAAE,6BAA6B,OAAO,KAAK,SAAS,MAAM,QAAQ,SAAS,EAAE;GACxK;EACF,CAMiB;EACf;EACA;EACA;EACA;EACA;EACA;CACF;AACF;AAEA,MAAa,+BACX,MACA,YACG;CACH,MAAM,EAAE,OAAO,KAAK,aAAa;CACjC,MAAM,EAAE,KAAK,QAAQ,SAAS,YAAY,QAAQ,UAAU,SAAS;CACrE,MAAM,OAAO,QAAQ;CACrB,MAAM,YAA2C;CAEjD,MAAM,EACJ,SACA,OACA,kBACA,kBACA,eACA,OACA,IACA,YACA,UACE,wBAAwB,MAAM,OAAO;CAyVzC,OAAO,EAAE,8BAA8B;EAtVrC,OAAO,aACL,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,MAAM,QAAQ;GAE1E,UAAU,KAAK,YAAY,MAAM,QAAQ,CAAC;GAC1C,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAE7C,MAAM,OACJ,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,MAAM,QAAQ,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC,EAAE;UAC1J,MAAM,WAAW,KAAA,IAAY,GAAG,KAAK,GAAG,OAAO,WAAW,OAAO,KAAK,WAAW,YAAY,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,cAAc,MAAM,MAAM,IAAI;mBAC1J,WAAW,OAAO,KAAK,WAAW,YAAY,EAAE,SAAS,MAAM,QAAQ;GAEhF,MAAM,cAAc,KACjB,MAAM,GAAG,MAAM,KAAK,CAAC,CACrB,KAAK,QAAQ,QAAQ,WAAW,OAAO,KAAK,IAAI,CAAC,CAAC;GAErD,MAAM,SAAS,KAAK,SAAS,MAAM,QAAQ,YAAY,GAAG,EAAE,CAAC,EAAE,eAAe,KAAA;GAE9E,OAAO;IAAE;IAAa,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GAAG;EACpE,CAAC,CACH;EACF,gBAAgB,aACd,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,eAAe,QAAQ;GAEnF,IAAI,CAAC,KAAK,YAAY,MAAM,QAAQ,GAAG,OAAO,EAAE,MAAM,WAAW;GACjE,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAC7C,MAAM,UAAU,OAAO,MAAM,cAAc,UAAU,OAAO,MAAM,YAAY;GAE9E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAErD,MAAM,QACJ,QAAQ,eAAe,KAAA,IACnB,KAAA,IACA,OAAO,MAAM,iBAAiB,QAAQ,YAAY,QAAQ,UAAU,QAAQ,GAAG;GAErF,OAAO,UAAU,KAAA,IACZ,EAAE,MAAM,WAAW,IACnB;IAAE,MAAM;IAAU,YAAY;GAAM;EAC3C,CAAC,CACH;EACF,qBAAqB,UAAU,YAC7B,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,oBAAoB,QAAQ;GACxF,MAAM,WAAW,MAAM;GAEvB,IACE,CAAC,KAAK,YAAY,SAAS,QAAQ,KACnC,SAAS,QAAQ,SAAS,gBAC1B,CAAC,qBAAqB,UAAU,MAAM,MAAM,GAE5C,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,UAAU,SAAS;GACzB,MAAM,WAAW,MAAM,OAAO,QAAQ,SAAS,SAAS;GACxD,MAAM,UAAU,OAAO,MAAM,cAAc,UAAU,CAAC,KAAK,KAAK;GAEhE,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,SAAS,EAAE,oBACf,EAAE,yBACF,QAAQ,MAAM,OAAO,WAAW,QAAQ,GAAG,CAC7C;GAEA,MAAM,cAAc,OAAO,QAAQ,MAAM,OAAO,YAAY,QAAQ,KAAK,cAAc;GAEvF,MAAM,YAAY,OAAO,oBACvB;IACE,UAAU,QAAQ;IAClB,UAAU,QAAQ;IAClB,WAAW,QAAQ;IACnB,oBAAoB;IACpB,UAAU;KACR,QAAQ;KACR,WAAW,SAAS;KACpB,QAAQ,SAAS;KACjB,eAAe,OAAO,wBAAwB,QAAQ;KACtD,UAAU,QAAQ;IACpB;GACF,GACA,QAAQ,eACR;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,CACF;GAEA,IAAI,cAAc,KAAA,GAChB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,MAAM,KAAK,IAAI,OAAO,oBAAoB,MAAM,WAAW,kBAAkB;GAEnF,MAAM,eAAe,OAAO,YAC1B,QAAQ,MAAM,OAAO,eAAe,KAAK,QAAQ,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAC1E;GAEA,MAAM,kBAAkB,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,MAAM,SAAS,YAAY,EAAE;GAE3L,MAAM,YAAY,GAAG,GAAG,iBAAiB,QAAQ,QAAQ,EAAE,OAAO,gBAAgB,OAAO,WAAW,QAAQ,MAAM,OAAO,OAAO,UAAU,QAAQ,aAAa,CAAC,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC,EAAE;cACzN,MAAM,IAAI,KAAK,UAAU,oBAAoB,6BAA6B,WAAW,KAAK,SAAS,MAAM,QAAQ,EAAE,MAAM;GAE7H,MAAM,YAAY,KAAK,QAAQ,MAAM,QAAQ,UAAU,SAAS;GAEhE,IAAI,KAAK,OAAO,OAAO,KAAK,MAAM,WAAW,CAAC;QACzC,KAAK,OAAO,KAAK,OAAO,SAAS,OAAO,GAC3C,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,WAAW,OAAO,iBACtB,UACA,UACA,MAAM,UACN,QAAQ,UACR,QAAQ,MACR,QAAQ,WACR,QAAQ,GACV;GAEA,OAAO,cACL,gCACA,GAAG,GAAG,SAAS,UAAU,OAAO,KAAK,OAAO,MAAM,MAAM,EAAE,OAAO,iBAAiB,QAAQ,QAAQ,EAAE,OAAO,gBAAgB,6BAA6B,WAAW,KAAK,SAAS,MAAM,QAAQ,EAAE,OAAO,IAAI,OAAO,WAAW,QAAQ,MAAM,OAAO,OAAO,UAAU,QAAQ,aAAa,CAAC,EAAE,OAAO,MAAM,IAAI,KAAK,UAAU,qBAC9T;GAEA,OAAO,OAAO,qBACZ;IAAE,MAAM;IAAY,YAAY,SAAS;GAAQ,GACjD,OACF;EACF,CAAC,CACH;EACF,SAAS,UAAU,YACjB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,QAAQ,QAAQ;GAE5E,IAAI,CAAC,KAAK,YAAY,MAAM,QAAQ,GAClC,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,WAAW,MAAM,OAAO,MAAM,SAAS;GAC7C,MAAM,YAAY,GAAG,GAAG,WAAW,OAAO,GAAG,QAAQ,MAAM,WAAW,OAAO,MAAM,KAAK,CAAC,EAAE,SAAS,MAAM,UAAU,MAAM,YAAY,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC;GACjM,IAAI;GAEJ,IAAI,KAAK,OAAO;IACd,OACE,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,MAAM,UAAU,MAAM,YAAY,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC;IAC5K,IAAI,KAAK,WAAW,GAClB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;IAClE,OAAO,KAAK,MAAM,WAAW,CAAC;GAChC,OACE,OAAO,OAAO,IAAI,gBAAgB;IAChC,aACE,OAAO,IAAI,aAAa;KAGtB,KAAI,OAFmB,KAAK,OAAO,SAAS,KAE9B,GAAG,OAAO,CAAC;KAGzB,OAAO,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK,SAAS,MAAM,UAAU,MAAM,YAAY,EAAE,OAAO,GAAG,YAAY,QAAQ,MAAM,WAAW,MAAM,MAAM,IAAI,EAAE,OAAO,WAAW,QAAQ,MAAM,OAAO,SAAS,QAAQ,CAAC;IACpP,CAAC;IACH,cAAc,GAAG,GAAG,UAAU,aAAa,WAAW,OAAO,IAAI;GACnE,CAAC;GAEH,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GACvF,MAAM,MAAM,WAAW,OAAO,KAAK,IAAK,IAAI;GAE5C,OAAO,OAAO,qBACZ;IACE,MAAM;IACN,YAAY,QAAQ;KAAE,GAAG;MAAM,QAAQ,MAAM,WAAW,OAAO,MAAM;IAAK,CAAC;GAC7E,GACA,OACF;EACF,CAAC,GACD,WACF;EACF,SAAS,UAAU,YACjB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,oBAAoB,wBAAwB,QAAQ,QAAQ;GAE5E,IAAI,CAAC,KAAK,YAAY,MAAM,QAAQ,GAClC,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,WAAW,MAAM,OAAO,MAAM,WAAW,SAAS,SAAS;GAEjE,MAAM,UAAU,OAAO,MAAM,cAC3B,UACA,CAAC,KAAK,OACN,MAAM,WAAW,YACnB;GAEA,IAAI,YAAY,KAAA,GACd,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,WACJ,QAAQ,eAAe,KAAA,IACnB,KAAA,IACA,OAAO,MAAM,iBAAiB,QAAQ,YAAY,QAAQ,UAAU,QAAQ,GAAG;GAErF,MAAM,SAAS,EAAE,oBACf,EAAE,yBACF,QAAQ,MAAM,OAAO,WAAW,QAAQ,GAAG,CAC7C;GAEA,IACE,aAAa,KAAA,KACb,CAAC,sBAAsB,UAAU,MAAM,UAAU,KACjD,CAAC,oBAAoB,SAAS,UAAU,MAAM,WAAW,QAAQ,MAC/D,OAAO,gCACP,MAAM,WAAW,iCACjB,QAAQ,aAAa,OAAO,qBAAqB,eACnD,OAAO,WAAW,OAAO,eAAe,EAAE,eAAe,OAAO,YAAY,CAAC,CAAC,CAC5E,MAAM,YACR,MACE,OAAO,WAAW,OAAO,eAAe,EAAE,eAAe,OAAO,YAAY,CAAC,CAAC,CAC5E,QAAQ,aAAa,MACvB,GAEF,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,cAAc,OAAO,QAAQ,MAAM,OAAO,YAAY,QAAQ,KAAK,QAAQ;GAEjF,MAAM,YAAY,OAAO,oBACvB;IACE,UAAU,QAAQ;IAClB,UAAU,QAAQ;IAClB,WAAW,QAAQ;IACnB,oBAAoB;IACpB,UAAU;KACR,QAAQ;KACR,WAAW,MAAM;KACjB,QAAQ,MAAM;KACd,eAAe,OAAO,oBACpB,QAAQ,UACR,MAAM,WACN,MAAM,UACR;KACA,UAAU,MAAM,WAAW;IAC7B;GACF,GACA,MAAM,eACN;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,CACF;GAEA,IAAI,cAAc,KAAA,GAChB,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,YAAY,WAChB,OAAO,QAAQ,MAAM,OAAO,gBAC1B,UACA,SAAS,cACT,QAAQ,GACV,CACF;GAEA,MAAM,UAAU,WAAW,QAAQ,MAAM,OAAO,OAAO,UAAU,MAAM,aAAa,CAAC;GAErF,MAAM,WAAW,OAAO,IAAI,aAAa;IACvC,MAAM,OACJ,OAAO,GAAG,oBAAoB,UAAU,6CAA6C,QAAQ,OAAO,MAAM,IAAI,KAAK,UAAU,oBAAoB,OAAO,iBAAiB,QAAQ,QAAQ,EAAE;IAE7L,OAAO,OAAO,KAAK,EAAE,EAAE,OAAO,MAAM,IAC/B,aACD,OAAO,KAAK,EAAE,EAAE,SAAS,MAAM,IAC5B,qBACD,KAAA;GACR,CAAC;GAED,MAAM,OAAO,iBAAiB,KAAK,OAAO,QAAQ;GAClD,MAAM,SAAS,GAAG,GAAG,QAAQ,OAAO,GAAG,KAAK,QAAQ,mBAAmB,KAAK,CAAC,EAAE,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,GAAG,SAAS,KAAK,QAAQ,kBAAkB,QAAQ,SAAS,gBAAgB,EAAE,OAAO,MAAM,OAAO,SAAS,EAAE,OAAO,UAAU,OAAO,QAAQ,OAAO,MAAM,IAAI,KAAK,UAAU;GAE1V,IAAI,KAAK,OAAO;IACd,MAAM,WAAW,OAAO;IAExB,IAAI,aAAa,KAAA,GACf,OAAO,OAAO,qBAAqB,EAAE,MAAM,SAAS,GAAG,OAAO;IAChE,OAAO,MAAM,QAAQ,CAAC;GACxB,OAAO,KAAK,OAAO,KAAK,OAAO,MAAM,OAAO,GAAG;IAC7C,MAAM,WAAW,OAAO;IAExB,OAAO,OAAO,qBAAqB,EAAE,MAAM,YAAY,WAAW,GAAG,OAAO;GAC9E;GACA,OAAO,MACL,GAAG,GAAG,WAAW,OAAO;KAAG,KAAK,WAAW,SAAS,QAAQ,MAAM,WAAW;KAAgB,KAAK,WAAW,qBAAqB;GAAK,CAAC,EAAE,SAAS,MAAM,UAAU,SAAS,YAAY,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,oBAAoB,SAAS,SAAS,YAAY,MAAM,UAAU,MAAM,iBAAiB,SAAS,YAAY,CAAC,EAAE,QAAQ,KACzV,CACF;GACA,OAAO,MACL,GAAG,GAAG,OAAO,OAAO;KAAG,KAAK,UAAU,SAAS,QAAQ,MAAM,UAAU;KAAgB,KAAK,UAAU,WAAW;GAAK,CAAC,EAAE,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,cAAc,SAAS,YAAY,KACpS,CACF;GAEA,MAAM,eAAe,OAAO,YAC1B,QAAQ,MAAM,OAAO,eAAe,KAAK,QAAQ,CAC/C,KACA,QAAQ,KAAK,QAAQ,mBAAmB,OAAO,QAAQ,IAAI,IAC7D,CAAC,CACH;GAEA,MAAM,kBAAkB,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,KAAK,QAAQ,IAAI,QAAQ,EAAE,OAAO,MAAM,SAAS,YAAY,EAAE;GAE3L,MAAM,eAAe;IACnB,WAAW;IACX,kBAAkB,QAAQ,SAAS;IACnC,kBAAkB;IAClB,cAAc,MAAM;GACtB;GAEA,MAAM,kBAAmC,CAAC;GAE1C,KAAK,MAAM,YAAY,QAAQ,aAAa,WAAW;IACrD,MAAM,QAAQ,OAAO,SAAS,KAAK;IACnC,MAAM,QAAQ,GAAG,GAAG,MAAM,OAAO,SAAS,OAAO,YAAY,CAAC,EAAE,SAAS,WAAW,SAAS,MAAM,YAAY,CAAC;IAEhH,IAAI,KAAK,OAAO,OAAO,wBAAwB,KAAK;SAC/C,OAAO;IACZ,gBAAgB,KAAK,WAAW,SAAS,cAAc,YAAY,CAAC,CAAC;GACvE;GACA,gBAAgB,KACd,GAAG,wBAAwB,WAAW,KAAK,SAAS,WAAW,OAAO,KAAK,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,KAAK,WAAW,WAAW,QAAQ,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,cAAc,SAAS,YAAY,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,oBAAoB,IAAI,EAAE,OAAO,GAAG,YAAY,KAAK,WAAW,QAAQ,QAAQ,MAAM,WAAW,aAAa,EAAE,6BAA6B,OAAO,KAAK,SAAS,OAAO,OAAO,KAAK,UAAU,SAAS,EAAE,KAAK,OAAO,MAAM,KAAK,UAAU,WAAW,QAAQ,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,cAAc,SAAS,YAAY,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,UAAU,IAAI,EAAE,OAAO,GAAG,QAAQ,KAAK,UAAU,QAAQ,QAAQ,MAAM,UAAU,aAAa,EAAE,EACttB;GACA,gBAAgB,KACd,GAAG,GAAG,WAAW,QAAQ,aAAa,cAAc,YAAY,CAAC,EAAE,OAAO,gBAAgB,OAAO,UAAU,OAAO,MAAM,IAAI,KAAK,UAAU,qBAC7I;GACA,OAAO,cAAc,mBAAmB,IAAI,IAAI,eAAe,CAAC;GAEhE,OAAO,OAAO,qBACZ;IACE,MAAM;IACN,QAAQ;KAAE,cAAc,SAAS;KAAc,cAAc,MAAM;IAAa;GAClF,GACA,OACF;EACF,CAAC,CACH;CAGyC,EAAE;AACjD"}

package/dist/internal/passkey-native.d.mts

@@ -144,12 +144,15 @@ export declare const makeNativePasskeyServices: (tables: NativeSqlTables, mappin
       readonly backupEligible: boolean;
       readonly backupState: boolean;
       readonly counter: number;
-    } | undefined, PersistenceMappingError | import("effect/PlatformError").PlatformError | Schema.SchemaError | SqlError, Crypto.Crypto>;
+    } | undefined, PersistenceMappingError | import("effect/PlatformError").PlatformError | SqlError, Crypto.Crypto>;
     joinedSubject: SqlTable;
     joinedFactor: SqlTable;
     joinedCredential: SqlTable;
     selected: (kind: "subject" | "authority" | "credential", alias: string) => import("effect/sql/Statement").Statement<import("effect/sql/SqlConnection").Row>;
     mapped: typeof sqlMapping;
+    clockPolicy: {
+      readonly futureToleranceMillis: number;
+    };
     mapping: PasskeyNativeMapping;
     ceremony: {
       sql: import("effect/sql/SqlClient").SqlClient;
@@ -233,6 +236,7 @@ export declare const makeNativePasskeyServices: (tables: NativeSqlTables, mappin
             };
             readonly evidence: {
               readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+              readonly completionExpiresAt?: import("effect/DateTime").Utc;
               readonly revision: {
                 readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
                 readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
@@ -382,7 +386,7 @@ export declare const makeNativePasskeyServices: (tables: NativeSqlTables, mappin
     access: (input: M.PasskeyAccess, ceremony?: M.PasskeyCeremony) => import("effect/sql/Statement").Fragment;
   };
   executor: SqlCommitExecutor<M.PasskeyUnavailable>;
-  run: <A, E, R>(effect: Effect.Effect<A, E, R>, mode?: "transaction" | "statement") => Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<Exclude<Exclude<R, Crypto.Crypto>, CurrentSqlCommit>, CurrentCommitJournal>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>> | Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<R, Crypto.Crypto>, CurrentSqlCommit>, CurrentCommitJournal>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>, SqlBatchCommit>>;
+  run: <A, E, R>(effect: Effect.Effect<A, E, R>, mode?: "transaction" | "statement") => never;
   advisory: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<R, Crypto.Crypto>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>>;
   passkeyPersistence: {
     readonly issue: <A>(input: {
@@ -411,7 +415,7 @@ export declare const makeNativePasskeyServices: (tables: NativeSqlTables, mappin
       readonly protocolCredentialId: M.PasskeyProtocolCredentialId;
     }) => Effect.Effect<M.PasskeyCredential | undefined, M.PasskeyUnavailable>;
   };
-}, never, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("effect/sql/SqlClient").SqlClient>;
+}, M.PasskeyUnavailable, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("effect/sql/SqlClient").SqlClient>;
 export declare const makeBatchPasskeyServices: (tables: NativeSqlTables, mapping: PasskeyNativeMapping) => Effect.Effect<{
   batch: boolean;
   state: {
@@ -549,12 +553,15 @@ export declare const makeBatchPasskeyServices: (tables: NativeSqlTables, mapping
       readonly backupEligible: boolean;
       readonly backupState: boolean;
       readonly counter: number;
-    } | undefined, PersistenceMappingError | import("effect/PlatformError").PlatformError | Schema.SchemaError | SqlError, Crypto.Crypto>;
+    } | undefined, PersistenceMappingError | import("effect/PlatformError").PlatformError | SqlError, Crypto.Crypto>;
     joinedSubject: SqlTable;
     joinedFactor: SqlTable;
     joinedCredential: SqlTable;
     selected: (kind: "subject" | "authority" | "credential", alias: string) => import("effect/sql/Statement").Statement<import("effect/sql/SqlConnection").Row>;
     mapped: typeof sqlMapping;
+    clockPolicy: {
+      readonly futureToleranceMillis: number;
+    };
     mapping: PasskeyNativeMapping;
     ceremony: {
       sql: import("effect/sql/SqlClient").SqlClient;
@@ -638,6 +645,7 @@ export declare const makeBatchPasskeyServices: (tables: NativeSqlTables, mapping
             };
             readonly evidence: {
               readonly bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
+              readonly completionExpiresAt?: import("effect/DateTime").Utc;
               readonly revision: {
                 readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
                 readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
@@ -787,7 +795,7 @@ export declare const makeBatchPasskeyServices: (tables: NativeSqlTables, mapping
     access: (input: M.PasskeyAccess, ceremony?: M.PasskeyCeremony) => import("effect/sql/Statement").Fragment;
   };
   executor: SqlCommitExecutor<M.PasskeyUnavailable>;
-  run: <A, E, R>(effect: Effect.Effect<A, E, R>, mode?: "transaction" | "statement") => Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<Exclude<Exclude<R, Crypto.Crypto>, CurrentSqlCommit>, CurrentCommitJournal>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>> | Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<Exclude<Exclude<Exclude<R, Crypto.Crypto>, CurrentSqlCommit>, CurrentCommitJournal>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>, SqlBatchCommit>>;
+  run: <A, E, R>(effect: Effect.Effect<A, E, R>, mode?: "transaction" | "statement") => never;
   advisory: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, M.PasskeyUnavailable, Exclude<Exclude<Exclude<R, Crypto.Crypto>, import("effect/sql/SqlClient").SqlClient>, import("@yielded/auth/Hooks").LifecycleHooks>>;
   passkeyPersistence: {
     readonly issue: <A>(input: {
@@ -816,7 +824,7 @@ export declare const makeBatchPasskeyServices: (tables: NativeSqlTables, mapping
       readonly protocolCredentialId: M.PasskeyProtocolCredentialId;
     }) => Effect.Effect<M.PasskeyCredential | undefined, M.PasskeyUnavailable>;
   };
-}, never, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | SqlBatchCommit | import("effect/sql/SqlClient").SqlClient>;
+}, M.PasskeyUnavailable, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | SqlBatchCommit | import("effect/sql/SqlClient").SqlClient>;
 export type NativePasskeyServices = Effect.Success<ReturnType<typeof makeNativePasskeyServices>>;
 export declare const makeNativePasskeyCredentialServices: (tables: NativeSqlTables, mapping: PasskeyNativeRead) => Effect.Effect<{
   passkeyCredentials: {
@@ -830,6 +838,6 @@ export declare const makeNativePasskeyCredentialServices: (tables: NativeSqlTabl
       readonly protocolCredentialId: M.PasskeyProtocolCredentialId;
     }) => Effect.Effect<M.PasskeyCredential | undefined, M.PasskeyUnavailable>;
   };
-}, never, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("effect/sql/SqlClient").SqlClient>;
+}, M.PasskeyUnavailable, Crypto.Crypto | import("@yielded/auth/Hooks").LifecycleHooks | import("effect/sql/SqlClient").SqlClient>;
 //#endregion
 //# sourceMappingURL=passkey-native.d.mts.map