@yielded/auth-persistence 0.1.0-beta.7

package/src/internal/passkey/management.ts

@@ -0,0 +1,422 @@
+/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */
+
+import {
+  PasskeyCredentialSummary,
+  PasskeyRemoved,
+  type PasskeyManagementPersistence,
+} from "@yielded/auth/Passkey";
+import type { SQL } from "drizzle-orm";
+import { Effect, Schema } from "effect";
+
+import type { PersistenceMappingError } from "../mapping-error";
+import type { QueryOperations } from "../query-operations";
+import type { makeTransactionKernel } from "../transaction-kernel";
+import type { makePasskeyAdmissionKernel } from "./admission";
+import type { makePasskeyCredentialsKernel } from "./credentials";
+import { CurrentPasskeyTransaction } from "./state";
+import type { makePasskeyStateKernel } from "./state";
+import type { WriteSubject, makePasskeyWriteStateKernel } from "./write-state";
+
+type Port = PasskeyManagementPersistence["Service"];
+
+export const makePasskeyManagementKernel = (
+  operations: QueryOperations,
+  admission: Pick<ReturnType<typeof makePasskeyAdmissionKernel>, "lockAdmission">,
+  credentials: Pick<
+    ReturnType<typeof makePasskeyCredentialsKernel>,
+    "readModule" | "readPolicyGuards"
+  >,
+  state: Pick<
+    ReturnType<typeof makePasskeyStateKernel>,
+    "credentialKey" | "copiedRow" | "equal" | "invariant" | "sameCredential" | "sameRevision"
+  >,
+  writeState: Pick<
+    ReturnType<typeof makePasskeyWriteStateKernel>,
+    | "authorizeAction"
+    | "credentialRows"
+    | "currentSubject"
+    | "invalidate"
+    | "invalidationMatches"
+    | "jsonStorage"
+    | "managementPolicy"
+    | "metadataAllowed"
+    | "ownedCredential"
+    | "removeDigest"
+    | "summary"
+  >,
+  transactions: Pick<ReturnType<typeof makeTransactionKernel>, "both">,
+) => {
+  const { sql } = operations;
+  const { lockAdmission } = admission;
+  const { readModule, readPolicyGuards } = credentials;
+  const { credentialKey, copiedRow, equal, sameCredential, sameRevision } = state;
+  const invariant: (value: unknown) => asserts value = state.invariant;
+
+  const {
+    authorizeAction,
+    credentialRows,
+    currentSubject,
+    invalidate,
+    invalidationMatches,
+    jsonStorage,
+    managementPolicy,
+    metadataAllowed,
+    ownedCredential,
+    removeDigest,
+    summary,
+  } = writeState;
+
+  const { both } = transactions;
+
+  const decisionCodec = jsonStorage(
+    Schema.Union([
+      Schema.TaggedStruct("Renamed", { credential: PasskeyCredentialSummary }),
+      Schema.TaggedStruct("Removed", { result: PasskeyRemoved }),
+    ]),
+  );
+
+  const intentCodec = jsonStorage(
+    Schema.Struct({
+      operation: Schema.Literals(["rename", "remove"]),
+      credentialId: Schema.String,
+      name: Schema.optionalKey(Schema.String),
+    }),
+  );
+
+  const command = Effect.fn("passkey.managementCommand")(function* (
+    mapping: any,
+    subject: WriteSubject,
+    commandId: string,
+    credentialId: string,
+    intent: string,
+  ) {
+    const owner = yield* CurrentPasskeyTransaction;
+    const table = mapping.command;
+
+    const observation = yield* owner.read(
+      table.table,
+      equal(table.table, { [table.moduleId]: mapping.moduleId, [table.commandId]: commandId }),
+      { limit: 1 },
+    );
+
+    const row = observation.rows[0];
+
+    if (row === undefined) return { _tag: "New", observation } as const;
+    if (
+      !mapping.read.subjectIds.equals(row[table.subjectId], subject.nativeId) ||
+      row[table.credentialId] !== credentialId ||
+      row[table.intent] !== intent
+    )
+      return { _tag: "Rejected" } as const;
+
+    return { _tag: "Replay", decision: decisionCodec.decode(row[table.decision]) } as const;
+  });
+
+  const record = Effect.fn("passkey.recordManagementCommand")(function* (
+    mapping: any,
+    subject: WriteSubject,
+    commandId: string,
+    credentialId: string,
+    intent: string,
+    decision: Parameters<typeof decisionCodec.encode>[0],
+    retentionUntilMillis: number,
+    observation: any,
+  ) {
+    const owner = yield* CurrentPasskeyTransaction;
+    const table = mapping.command;
+
+    const inserted = yield* owner.insert(
+      table.table,
+      {
+        ...table.encodeInsert({
+          moduleId: mapping.moduleId,
+          subjectId: subject.nativeId,
+          commandId,
+          credentialId,
+        }),
+        [table.moduleId]: mapping.moduleId,
+        [table.commandId]: commandId,
+        [table.subjectId]: subject.nativeId,
+        [table.credentialId]: credentialId,
+        [table.intent]: intent,
+        [table.decision]: decisionCodec.encode(decision),
+        [table.retentionUntil]: mapping.clock.encodeInstant(retentionUntilMillis),
+        [table.version]: owner.marker,
+      },
+      { [table.moduleId]: mapping.moduleId, [table.commandId]: commandId },
+    );
+
+    observation.rows = inserted.rows;
+  });
+
+  const access = Effect.fn("passkey.managementAccess")(function* (
+    mapping: any,
+    moduleId: string,
+    subjectId: Parameters<Port["list"]>[0]["subjectId"],
+    mutation: boolean,
+  ) {
+    if (moduleId !== mapping.moduleId || (yield* readModule(mapping)) === undefined)
+      return undefined;
+    if (mutation) yield* lockAdmission(mapping);
+    const subject = yield* currentSubject(mapping, subjectId);
+
+    if (subject === undefined) return undefined;
+    yield* readPolicyGuards(mapping);
+
+    return (yield* metadataAllowed(mapping, subject)) ? subject : undefined;
+  });
+
+  const listCredentials = Effect.fn("passkey.listCredentials")(function* (
+    mapping: any,
+    input: Parameters<Port["list"]>[0],
+  ) {
+    const subject = yield* access(mapping, input.moduleId, input.subjectId, false);
+
+    invariant(subject !== undefined);
+    const rows = [...(yield* credentialRows(mapping, subject))];
+
+    rows.sort((left, right) => {
+      const a = left[mapping.read.credential.credentialId],
+        b = right[mapping.read.credential.credentialId];
+
+      return a < b ? -1 : a > b ? 1 : 0;
+    });
+
+    const eligible = rows.filter(
+      (row) =>
+        input.cursor === undefined || row[mapping.read.credential.credentialId] > input.cursor,
+    );
+
+    const page = eligible.slice(0, input.limit);
+    const credentials = [];
+
+    for (const row of page) {
+      invariant((yield* ownedCredential(mapping, subject, row)) !== undefined);
+      credentials.push(summary(mapping, row));
+    }
+
+    return {
+      credentials,
+      ...(eligible.length > input.limit ? { cursor: credentials.at(-1)!.credentialId } : {}),
+    };
+  });
+
+  const renameCredential = Effect.fn("passkey.renameCredential")(function* (
+    mapping: any,
+    input: Parameters<Port["rename"]>[0],
+  ) {
+    const subject = yield* access(mapping, input.moduleId, input.subjectId, true);
+
+    if (subject === undefined) return { _tag: "Rejected" } as const;
+
+    const intent = intentCodec.encode({
+      operation: "rename",
+      credentialId: input.credentialId,
+      name: input.name,
+    });
+
+    const prior = yield* command(mapping, subject, input.commandId, input.credentialId, intent);
+
+    if (prior._tag === "Rejected") return prior;
+    const rows = yield* credentialRows(mapping, subject);
+
+    const row = rows.find(
+      (item) => item[mapping.read.credential.credentialId] === input.credentialId,
+    );
+
+    if (row === undefined || (yield* ownedCredential(mapping, subject, row)) === undefined)
+      return { _tag: "Rejected" } as const;
+    if (prior._tag === "Replay")
+      return prior.decision._tag === "Renamed"
+        ? { ...prior.decision, replayed: true }
+        : ({ _tag: "Rejected" } as const);
+    const owner = yield* CurrentPasskeyTransaction;
+    const table = mapping.read.credential;
+
+    yield* owner.update(
+      table.table,
+      { [table.credentialId]: input.credentialId, [table.subjectId]: subject.nativeId },
+      { [mapping.write.credential.name]: input.name },
+    );
+    const credential = summary(mapping, { ...row, [mapping.write.credential.name]: input.name });
+
+    yield* record(
+      mapping,
+      subject,
+      input.commandId,
+      input.credentialId,
+      intent,
+      { _tag: "Renamed", credential },
+      input.retentionUntilMillis,
+      prior.observation,
+    );
+
+    return { _tag: "Renamed", credential, replayed: false } as const;
+  });
+
+  const inspectRemove = Effect.fn("passkey.inspectRemove")(function* (
+    mapping: any,
+    input: Parameters<Port["inspectRemove"]>[0],
+  ) {
+    const subject = yield* access(mapping, input.moduleId, input.subjectId, false);
+
+    if (subject === undefined) return { _tag: "Rejected" } as const;
+
+    const prior = yield* command(
+      mapping,
+      subject,
+      input.commandId,
+      input.credentialId,
+      intentCodec.encode({ operation: "remove", credentialId: input.credentialId }),
+    );
+
+    if (prior._tag === "Rejected") return prior;
+    if (prior._tag === "Replay")
+      return prior.decision._tag === "Removed"
+        ? ({ _tag: "Replay", result: { ...prior.decision.result, replayed: true } } as const)
+        : ({ _tag: "Rejected" } as const);
+
+    const row = (yield* credentialRows(mapping, subject)).find(
+      (item) => item[mapping.read.credential.credentialId] === input.credentialId,
+    );
+
+    const credential =
+      row === undefined ? undefined : yield* ownedCredential(mapping, subject, row);
+
+    return credential === undefined
+      ? ({ _tag: "Rejected" } as const)
+      : ({ _tag: "Target", credential } as const);
+  });
+
+  const removeCredential = Effect.fn("passkey.removeCredential")(function* (
+    mapping: any,
+    input: Parameters<Port["remove"]>[0],
+  ) {
+    const subject = yield* access(
+      mapping,
+      input.moduleId,
+      input.credential.revision.subjectId,
+      true,
+    );
+
+    if (subject === undefined) return { _tag: "Rejected" } as const;
+    const id = input.credential.credentialId;
+    const intent = intentCodec.encode({ operation: "remove", credentialId: id });
+    const prior = yield* command(mapping, subject, input.commandId, id, intent);
+
+    if (prior._tag === "Rejected") return prior;
+    if (prior._tag === "Replay")
+      return prior.decision._tag === "Removed"
+        ? ({ _tag: "Removed", result: { ...prior.decision.result, replayed: true } } as const)
+        : ({ _tag: "Rejected" } as const);
+
+    const row = (yield* credentialRows(mapping, subject)).find(
+      (item) => item[mapping.read.credential.credentialId] === id,
+    );
+
+    const credential =
+      row === undefined ? undefined : yield* ownedCredential(mapping, subject, row);
+
+    const policy = managementPolicy(mapping, subject);
+
+    if (
+      credential === undefined ||
+      !sameCredential(input.credential, credential) ||
+      !sameRevision(input.credential.revision, credential.revision) ||
+      !invalidationMatches(mapping, input.invalidation, policy) ||
+      !invalidationMatches(mapping, input.invalidation, input.management)
+    )
+      return { _tag: "Rejected" } as const;
+    if (
+      !(yield* authorizeAction(
+        mapping,
+        subject,
+        input.authorization,
+        {
+          action: "remove",
+          commandId: input.commandId,
+          flowId: input.commandId,
+          bindingDigest: removeDigest(mapping.moduleId, input.commandId, input.credential),
+          revision: input.credential.revision,
+        },
+        {
+          ...policy,
+          maximumEvidenceAgeMillis: Math.min(
+            policy.maximumEvidenceAgeMillis,
+            input.management.maximumEvidenceAgeMillis,
+          ),
+        },
+      ))
+    )
+      return { _tag: "Rejected" } as const;
+    const owner = yield* CurrentPasskeyTransaction;
+
+    const remainingEffect: Effect.Effect<SQL, PersistenceMappingError> =
+      mapping.write.policy.remainingSignIn(subject.nativeId, id, copiedRow(subject.row));
+
+    const remaining = yield* remainingEffect;
+
+    if (!(yield* owner.check(remaining))) return { _tag: "LastSignInMethod" } as const;
+    const read = mapping.read;
+    const table = read.credential;
+
+    yield* owner.update(
+      table.table,
+      { [table.credentialId]: id, [table.subjectId]: subject.nativeId },
+      {
+        [table.status]: mapping.write.credential.removedStatus,
+        [table.credentialRevision]: owner.marker,
+      },
+    );
+    const factor = read.authority;
+
+    yield* owner.update(
+      factor.table,
+      { [factor.subjectId]: subject.nativeId, [factor.credentialId]: id },
+      { [factor.status]: mapping.write.authority.removedStatus, [factor.revision]: owner.marker },
+    );
+    for (const observation of owner.observations) {
+      if (observation.table === table.table)
+        observation.rows = observation.rows.filter((item) => item[table.credentialId] !== id);
+      if (observation.table === factor.table)
+        observation.rows = observation.rows.filter((item) => item[factor.credentialId] !== id);
+    }
+    const tuple = read.credentialOwnership;
+
+    yield* owner.update(
+      tuple.table,
+      { [tuple.credentialKey]: credentialKey(credential.rpId, credential.protocolCredentialId) },
+      {
+        [tuple.state]: mapping.write.credentialOwnership.removedState,
+        [tuple.version]: owner.marker,
+      },
+    );
+    yield* invalidate(mapping, subject, input.invalidation);
+    owner.postconditions.push(
+      remaining,
+      sql`not exists(select 1 from ${table.table} where ${both(equal(table.table, { [table.credentialId]: id }), table.activeCondition)})`,
+      sql`not exists(select 1 from ${factor.table} where ${both(equal(factor.table, { [factor.subjectId]: subject.nativeId, [factor.credentialId]: id }), factor.activeCondition)})`,
+    );
+
+    const result = {
+      credentialId: credential.credentialId,
+      replayed: false,
+      invalidation: input.invalidation,
+    };
+
+    yield* record(
+      mapping,
+      subject,
+      input.commandId,
+      id,
+      intent,
+      { _tag: "Removed", result },
+      input.retentionUntilMillis,
+      prior.observation,
+    );
+
+    return { _tag: "Removed", result } as const;
+  });
+
+  return { listCredentials, renameCredential, inspectRemove, removeCredential };
+};

package/src/internal/passkey/registration-ceremony.ts

@@ -0,0 +1,283 @@
+/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */
+
+import {
+  PasskeyClaim,
+  type PasskeyAccess,
+  type PasskeyCeremony,
+  type PasskeyMethodPolicy,
+  snapshotPasskeySync,
+} from "@yielded/auth/Passkey";
+import { Effect } from "effect";
+
+import type { QueryOperations } from "../query-operations";
+import type { makeTransactionKernel } from "../transaction-kernel";
+import type { makePasskeyAdmissionKernel } from "./admission";
+import type { makePasskeyCredentialsKernel } from "./credentials";
+import type { makePasskeyFlowKernel } from "./flow";
+import type { makePasskeyRegistrationCustodyKernel } from "./registration-custody";
+import { CurrentPasskeyTransaction } from "./state";
+import type { makePasskeyStateKernel } from "./state";
+
+export const makePasskeyRegistrationCeremonyKernel = (
+  operations: QueryOperations,
+  admission: Pick<
+    ReturnType<typeof makePasskeyAdmissionKernel>,
+    "admissionCondition" | "guardAdmission" | "guardChargeSet" | "lockAdmission" | "readCharges"
+  >,
+  credentials: Pick<
+    ReturnType<typeof makePasskeyCredentialsKernel>,
+    "readModule" | "readPolicyGuards"
+  >,
+  flow: Pick<
+    ReturnType<typeof makePasskeyFlowKernel>,
+    "compatiblePolicy" | "liveCondition" | "matchesAccess" | "readFlow" | "terminalFlow"
+  >,
+  registrationCustody: Pick<
+    ReturnType<typeof makePasskeyRegistrationCustodyKernel>,
+    "releaseRegistrationCustody"
+  >,
+  state: Pick<
+    ReturnType<typeof makePasskeyStateKernel>,
+    "ceremonyStorage" | "equal" | "handleKey" | "invariant" | "mappedColumns" | "policyStorage"
+  >,
+  transactions: Pick<ReturnType<typeof makeTransactionKernel>, "both">,
+) => {
+  const { sql } = operations;
+
+  const { admissionCondition, guardAdmission, guardChargeSet, lockAdmission, readCharges } =
+    admission;
+
+  const { readModule, readPolicyGuards } = credentials;
+  const { compatiblePolicy, liveCondition, matchesAccess, readFlow, terminalFlow } = flow;
+  const { releaseRegistrationCustody } = registrationCustody;
+  const { ceremonyStorage, equal, handleKey, mappedColumns, policyStorage } = state;
+  const invariant: (value: unknown) => asserts value = state.invariant;
+  const { both } = transactions;
+
+  /** The issuing registration authority owns the application value and reservation.
+   * This facet only compares its opaque custody and cannot issue or provision. */
+  const custody = Effect.fn("passkey.registrationCustody")(function* (
+    mapping: any,
+    ceremony: PasskeyCeremony,
+    pending: boolean,
+  ) {
+    const owner = yield* CurrentPasskeyTransaction;
+
+    invariant(ceremony.context._tag === "Registration");
+
+    const context = ceremony.context,
+      intent = mapping.intent,
+      handle = mapping.handle;
+
+    const identity = { [intent.moduleId]: mapping.moduleId, [intent.flowId]: ceremony.flowId };
+
+    const advisory = (yield* owner.read(intent.table, equal(intent.table, identity), {
+      limit: 1,
+      lock: false,
+      observe: false,
+    })).rows[0];
+
+    if (advisory === undefined) return false;
+    const hashedHandle = handleKey(ceremony.profile.rpId, context.userHandle);
+
+    const held = (yield* owner.read(
+      handle.table,
+      equal(handle.table, { [handle.handleKey]: hashedHandle }),
+      { limit: 1, columns: mappedColumns(handle) },
+    )).rows[0];
+
+    if (
+      held === undefined ||
+      !handle.isReservedState(held[handle.state]) ||
+      held[handle.handleKey] !== hashedHandle ||
+      held[handle.rpId] !== ceremony.profile.rpId ||
+      held[handle.userHandle] !== context.userHandle ||
+      held[handle.reservationId] !== advisory[intent.reservationId]
+    )
+      return false;
+    const heldCondition = sql`exists (select 1 from ${handle.table} where ${both(owner.exact(handle.table, held), handle.reservedCondition)})`;
+
+    if (!(yield* owner.check(heldCondition))) return false;
+
+    const row = (yield* owner.read(intent.table, equal(intent.table, identity), {
+      limit: 1,
+      columns: mappedColumns(intent),
+    })).rows[0];
+
+    if (
+      row === undefined ||
+      row[intent.commandId] !== ceremony.commandId ||
+      row[intent.fingerprint] !== context.fingerprint ||
+      row[intent.handleKey] !== hashedHandle ||
+      row[intent.reservationId] !== held[handle.reservationId] ||
+      row[intent.ceremonySnapshot] !== ceremonyStorage.encode(ceremony) ||
+      typeof row[intent.applicationSnapshot] !== "string" ||
+      new TextEncoder().encode(row[intent.applicationSnapshot]).length > 1048576 ||
+      (pending && !intent.isPendingState(row[intent.state]))
+    )
+      return false;
+    const condition = pending ? intent.pendingCondition : intent.custodyCondition;
+
+    if (
+      !(yield* owner.check(
+        sql`exists (select 1 from ${intent.table} where ${both(owner.exact(intent.table, row), condition)})`,
+      ))
+    )
+      return false;
+
+    return [
+      heldCondition,
+      sql`exists (select 1 from ${intent.table} where ${both(owner.exact(intent.table, row), condition)})`,
+    ];
+  });
+
+  const contextRegistration = Effect.fn("passkey.contextRegistration")(function* (
+    mapping: any,
+    access: PasskeyAccess,
+  ) {
+    const owner = yield* CurrentPasskeyTransaction;
+
+    if (access.moduleId !== mapping.moduleId) return undefined;
+    const current = yield* readModule(mapping);
+
+    if (current === undefined) return undefined;
+    yield* readPolicyGuards(mapping);
+    const table = mapping.flow;
+
+    const advisory = (yield* owner.read(
+      table.table,
+      equal(table.table, { [table.moduleId]: mapping.moduleId, [table.flowId]: access.flowId }),
+      { limit: 1, lock: false, observe: false },
+    )).rows[0];
+
+    if (advisory === undefined) return undefined;
+    const ceremony = ceremonyStorage.decode(advisory[table.snapshot]);
+
+    if (ceremony.purpose !== "registration" || !matchesAccess(ceremony, access)) return undefined;
+    const held = yield* custody(mapping, ceremony, true);
+
+    if (!held) return undefined;
+    const read = yield* readFlow(mapping, access.flowId);
+
+    if (
+      read === undefined ||
+      read.state !== "Pending" ||
+      ceremonyStorage.encode(read.ceremony) !== ceremonyStorage.encode(ceremony) ||
+      !compatiblePolicy(read.ceremony, read.policy, current) ||
+      !(yield* owner.check(liveCondition(mapping, ceremony)))
+    )
+      return undefined;
+    owner.postconditions.push(...held, liveCondition(mapping, ceremony));
+
+    return read.ceremony;
+  });
+
+  const claimRegistration = Effect.fn("passkey.claimRegistration")(function* (
+    mapping: any,
+    input: {
+      readonly access: PasskeyAccess;
+      readonly policy: PasskeyMethodPolicy;
+      readonly ceremony: PasskeyCeremony;
+      readonly claimId: string;
+    },
+  ) {
+    const owner = yield* CurrentPasskeyTransaction;
+    const current = yield* readModule(mapping);
+
+    if (current === undefined || input.access.moduleId !== mapping.moduleId)
+      return { _tag: "Rejected" } as const;
+    yield* lockAdmission(mapping);
+    yield* readPolicyGuards(mapping);
+    const held = yield* custody(mapping, input.ceremony, true);
+    const read = yield* readFlow(mapping, input.access.flowId);
+
+    if (
+      read === undefined ||
+      read.state !== "Pending" ||
+      !matchesAccess(read.ceremony, input.access)
+    )
+      return { _tag: "Rejected" } as const;
+    invariant(ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(input.ceremony));
+    if (
+      !held ||
+      !compatiblePolicy(read.ceremony, read.policy, current) ||
+      policyStorage.encode(current) !== policyStorage.encode(input.policy) ||
+      !(yield* owner.check(liveCondition(mapping, read.ceremony))) ||
+      !(yield* owner.check(
+        admissionCondition(
+          mapping,
+          [read.policy, current],
+          read.ceremony,
+          undefined,
+          [],
+          false,
+          false,
+        ),
+      ))
+    ) {
+      if (held) yield* releaseRegistrationCustody(mapping, read.ceremony);
+      yield* terminalFlow(mapping, read, "Rejected");
+
+      return { _tag: "Rejected" } as const;
+    }
+    yield* readCharges(mapping, read.ceremony, read.policy, undefined);
+    const claimedAtMillis = yield* owner.now(mapping.clock);
+
+    const claim = snapshotPasskeySync(PasskeyClaim, {
+      ceremony: read.ceremony,
+      claimId: input.claimId,
+      claimedAtMillis,
+      claimExpiresAtMillis: Math.min(
+        claimedAtMillis + read.ceremony.claimLifetimeMillis,
+        read.ceremony.expiresAtMillis,
+      ),
+    });
+
+    const table = mapping.flow;
+
+    yield* owner.update(
+      table.table,
+      { [table.moduleId]: mapping.moduleId, [table.flowId]: read.ceremony.flowId },
+      {
+        [table.state]: table.states.Claimed,
+        [table.version]: owner.marker,
+        [table.claimId]: claim.claimId,
+        [table.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),
+        [table.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),
+      },
+    );
+    yield* guardChargeSet(mapping, read.ceremony, undefined);
+    yield* guardAdmission(mapping, [read.policy, current], read.ceremony, undefined);
+    owner.postconditions.push(...held, liveCondition(mapping, read.ceremony, claim));
+
+    return { _tag: "Claimed", claim } as const;
+  });
+
+  const settleRegistration = Effect.fn("passkey.settleRegistration")(function* (
+    mapping: any,
+    claim: PasskeyClaim,
+    outcome: "Rejected" | "Ambiguous",
+  ) {
+    yield* readModule(mapping);
+    yield* lockAdmission(mapping);
+    yield* readPolicyGuards(mapping);
+    const read = yield* readFlow(mapping, claim.ceremony.flowId);
+
+    if (
+      read === undefined ||
+      read.state !== "Claimed" ||
+      read.claim === undefined ||
+      read.claim.claimId !== claim.claimId ||
+      read.claim.claimedAtMillis !== claim.claimedAtMillis ||
+      read.claim.claimExpiresAtMillis !== claim.claimExpiresAtMillis ||
+      ceremonyStorage.encode(read.ceremony) !== ceremonyStorage.encode(claim.ceremony)
+    )
+      return "Rejected" as const;
+
+    if (outcome === "Rejected") yield* releaseRegistrationCustody(mapping, claim.ceremony);
+
+    return yield* terminalFlow(mapping, read, outcome);
+  });
+
+  return { contextRegistration, claimRegistration, settleRegistration };
+};