@yielded/auth-persistence 0.1.0-beta.7

package/dist/internal/passkey/registration-write.mjs

@@ -0,0 +1,211 @@
+import { CurrentPasskeyTransaction } from "./state.mjs";
+import { Effect, Schema } from "effect";
+import { PasskeyLabel, PasskeyRevision } from "@yielded/auth/Passkey";
+import { SubjectId } from "@yielded/auth/Schema";
+//#region src/internal/passkey/registration-write.ts
+const makePasskeyRegistrationWriteKernel = (operations, admission, credentials, flow, registrationCustody, state, writeState, transactions) => {
+	const { sql } = operations;
+	const { lockAdmission, readCharges, guardChargeSet } = admission;
+	const { readModule, readPolicyGuards } = credentials;
+	const { compatiblePolicy, exactClaim, issueAssertion, liveCondition, readFlow, terminalFlow } = flow;
+	const { releaseRegistrationCustody } = registrationCustody;
+	const { ceremonyStorage, credentialKey, equal, handleKey } = state;
+	const invariant = state.invariant;
+	const { digest, insertCredential, jsonStorage, validRegistration } = writeState;
+	const { both } = transactions;
+	const registrationData = (mapping, registration) => {
+		const codec = jsonStorage(mapping.registration.schema);
+		const encoded = codec.encode(registration);
+		invariant(new TextEncoder().encode(encoded).length <= 1048576);
+		return {
+			encoded,
+			registration: codec.decode(encoded),
+			fingerprint: digest(mapping.registration.schema, registration)
+		};
+	};
+	const describe = (mapping, registration) => {
+		const data = registrationData(mapping, registration);
+		const labels = Schema.decodeSync(Schema.Struct({
+			name: PasskeyLabel,
+			displayName: PasskeyLabel
+		}))(mapping.registration.describe(data.registration));
+		return {
+			...data,
+			...labels
+		};
+	};
+	return {
+		inspectRegistration: Effect.fn("passkey.inspectRegistration")(function* (mapping, registration) {
+			const owner = yield* CurrentPasskeyTransaction;
+			const value = describe(mapping, registration);
+			const current = yield* readModule(mapping);
+			yield* readPolicyGuards(mapping);
+			const eligible = current !== void 0 && (yield* owner.check(mapping.registration.eligible(value.registration)));
+			return {
+				fingerprint: value.fingerprint,
+				name: value.name,
+				displayName: value.displayName,
+				eligible
+			};
+		}),
+		issueRegistration: Effect.fn("passkey.issueRegistration")(function* (mapping, input) {
+			const owner = yield* CurrentPasskeyTransaction;
+			const ceremony = input.ceremony;
+			if (ceremony.moduleId !== mapping.moduleId || ceremony.purpose !== "registration" || ceremony.context._tag !== "Registration" || !ceremony.profile.primarySignIn || ceremony.profile.userVerification !== "required" || ceremony.profile.residentKey !== "required" || ceremony.allowedCredentials.length !== 0) return { _tag: "Rejected" };
+			const value = describe(mapping, input.registration);
+			if (value.fingerprint !== ceremony.context.fingerprint || value.name !== ceremony.context.name || value.displayName !== ceremony.context.displayName) return { _tag: "Rejected" };
+			if ((yield* readModule(mapping)) === void 0) return { _tag: "Rejected" };
+			yield* lockAdmission(mapping);
+			yield* readPolicyGuards(mapping);
+			const eligible = mapping.registration.eligible(value.registration);
+			if (!(yield* owner.check(eligible))) return { _tag: "Rejected" };
+			const handle = mapping.handle;
+			const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
+			const absentHandle = yield* owner.read(handle.table, equal(handle.table, { [handle.handleKey]: hashed }), { limit: 1 });
+			const intent = mapping.intent;
+			const absentCommand = yield* owner.read(intent.table, equal(intent.table, {
+				[intent.moduleId]: mapping.moduleId,
+				[intent.commandId]: ceremony.commandId
+			}), { limit: 1 });
+			const absentFlow = yield* owner.read(intent.table, equal(intent.table, {
+				[intent.moduleId]: mapping.moduleId,
+				[intent.flowId]: ceremony.flowId
+			}), { limit: 1 });
+			if (absentHandle.rows.length !== 0 || absentCommand.rows.length !== 0 || absentFlow.rows.length !== 0) return { _tag: "Rejected" };
+			const issued = yield* issueAssertion(mapping, ceremony, input.policy);
+			if (issued._tag !== "Issued") return issued;
+			absentHandle.rows = (yield* owner.insert(handle.table, {
+				...handle.encodeInsert({
+					ceremony,
+					reservationId: owner.marker
+				}),
+				[handle.handleKey]: hashed,
+				[handle.rpId]: ceremony.profile.rpId,
+				[handle.userHandle]: ceremony.context.userHandle,
+				[handle.state]: handle.reservedState,
+				[handle.version]: owner.marker,
+				[handle.reservationId]: owner.marker,
+				[mapping.read.handleOwnership.subjectId]: null
+			}, { [handle.handleKey]: hashed })).rows;
+			const inserted = yield* owner.insert(intent.table, {
+				...intent.encodeInsert({
+					ceremony,
+					registration: value.registration,
+					reservationId: owner.marker
+				}),
+				[intent.moduleId]: mapping.moduleId,
+				[intent.flowId]: ceremony.flowId,
+				[intent.commandId]: ceremony.commandId,
+				[intent.state]: intent.pendingState,
+				[intent.version]: owner.marker,
+				[intent.fingerprint]: value.fingerprint,
+				[intent.handleKey]: hashed,
+				[intent.reservationId]: owner.marker,
+				[intent.ceremonySnapshot]: ceremonyStorage.encode(ceremony),
+				[intent.applicationSnapshot]: value.encoded
+			}, {
+				[intent.moduleId]: mapping.moduleId,
+				[intent.flowId]: ceremony.flowId
+			});
+			absentCommand.rows = inserted.rows;
+			absentFlow.rows = inserted.rows;
+			owner.postconditions.push(eligible);
+			return issued;
+		}),
+		completeRegistration: Effect.fn("passkey.completeRegistration")(function* (mapping, input) {
+			const owner = yield* CurrentPasskeyTransaction;
+			const ceremony = input.claim.ceremony;
+			if (ceremony.moduleId !== mapping.moduleId || ceremony.purpose !== "registration" || ceremony.context._tag !== "Registration") return { _tag: "Rejected" };
+			const current = yield* readModule(mapping);
+			if (current === void 0) return { _tag: "Rejected" };
+			yield* lockAdmission(mapping);
+			yield* readPolicyGuards(mapping);
+			const tuple = mapping.read.credentialOwnership;
+			const absentCredential = yield* owner.read(tuple.table, equal(tuple.table, { [tuple.credentialKey]: credentialKey(ceremony.profile.rpId, input.verified.protocolCredentialId) }), {
+				limit: 1,
+				observe: false
+			});
+			const handle = mapping.handle;
+			const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
+			const held = (yield* owner.read(handle.table, equal(handle.table, { [handle.handleKey]: hashed }), { limit: 1 })).rows[0];
+			const intent = mapping.intent;
+			const row = (yield* owner.read(intent.table, equal(intent.table, {
+				[intent.moduleId]: mapping.moduleId,
+				[intent.flowId]: ceremony.flowId
+			}), { limit: 1 })).rows[0];
+			const read = yield* readFlow(mapping, ceremony.flowId);
+			if (read === void 0 || !exactClaim(read, input.claim)) return { _tag: "Rejected" };
+			const reject = Effect.gen(function* () {
+				yield* releaseRegistrationCustody(mapping, ceremony);
+				yield* terminalFlow(mapping, read, "Rejected");
+				return { _tag: "Rejected" };
+			});
+			if (absentCredential.rows.length !== 0 || held === void 0 || row === void 0 || !handle.isReservedState(held[handle.state]) || !intent.isPendingState(row[intent.state]) || row[intent.commandId] !== ceremony.commandId || row[intent.ceremonySnapshot] !== ceremonyStorage.encode(ceremony) || row[intent.fingerprint] !== ceremony.context.fingerprint || row[intent.handleKey] !== hashed || held[handle.reservationId] !== row[intent.reservationId] || held[handle.rpId] !== ceremony.profile.rpId || held[handle.userHandle] !== ceremony.context.userHandle || !compatiblePolicy(ceremony, read.policy, current) || !validRegistration(ceremony, input.verified) || !input.verified.userVerified || !ceremony.profile.primarySignIn || !(yield* owner.check(liveCondition(mapping, ceremony, input.claim)))) return yield* reject;
+			const data = describe(mapping, jsonStorage(mapping.registration.schema).decode(row[intent.applicationSnapshot]));
+			if (data.encoded !== row[intent.applicationSnapshot] || data.fingerprint !== ceremony.context.fingerprint || data.name !== ceremony.context.name || data.displayName !== ceremony.context.displayName) return yield* reject;
+			const eligible = mapping.registration.eligible(data.registration);
+			if (!(yield* owner.check(eligible))) return yield* reject;
+			const provision = mapping.registration.subject({
+				registration: data.registration,
+				ceremony,
+				marker: owner.marker
+			});
+			const nativeId = provision.subjectId;
+			const subjectId = SubjectId.make(mapping.read.subjectIds.toSubject(nativeId));
+			invariant(mapping.read.subjectIds.equals(mapping.read.subjectIds.toNative(subjectId), nativeId));
+			const table = mapping.read.subject;
+			const absentSubject = yield* owner.read(table.table, equal(table.table, { [table.id]: nativeId }), { limit: 1 });
+			if (absentSubject.rows.length !== 0) return yield* reject;
+			const values = {
+				...provision.values,
+				[table.id]: nativeId,
+				[table.status]: mapping.registration.activeStatus,
+				[table.securityRevision]: owner.marker
+			};
+			absentSubject.rows = (yield* owner.insert(table.table, values, { [table.id]: nativeId })).rows;
+			const subject = {
+				subjectId,
+				nativeId,
+				row: values,
+				revision: PasskeyRevision.make({
+					subjectId,
+					securityRevision: PasskeyRevision.fields.securityRevision.make(owner.marker),
+					credentials: []
+				})
+			};
+			yield* owner.update(handle.table, { [handle.handleKey]: hashed }, {
+				[mapping.read.handleOwnership.subjectId]: nativeId,
+				[handle.state]: mapping.write.handleOwnership.ownedState,
+				[handle.version]: owner.marker,
+				[handle.reservationId]: null
+			});
+			yield* readCharges(mapping, ceremony, read.policy);
+			yield* guardChargeSet(mapping, ceremony);
+			yield* insertCredential(mapping, subject, ceremony, input.verified, yield* owner.now(mapping.clock));
+			yield* owner.update(intent.table, {
+				[intent.moduleId]: mapping.moduleId,
+				[intent.flowId]: ceremony.flowId
+			}, {
+				[intent.state]: intent.acceptedState,
+				[intent.version]: owner.marker
+			});
+			const flow = mapping.flow;
+			yield* owner.update(flow.table, {
+				[flow.moduleId]: mapping.moduleId,
+				[flow.flowId]: ceremony.flowId
+			}, {
+				[flow.state]: flow.states.RegistrationAccepted,
+				[flow.version]: owner.marker
+			});
+			owner.postconditions.push(liveCondition(mapping, ceremony, input.claim), mapping.registration.finalEligibility({
+				registration: data.registration,
+				subjectId: nativeId
+			}), sql`exists(select 1 from ${table.table} where ${both(owner.exact(table.table, values), table.activeCondition)})`);
+			return { _tag: "RegistrationAccepted" };
+		})
+	};
+};
+//#endregion
+export { makePasskeyRegistrationWriteKernel };
+
+//# sourceMappingURL=registration-write.mjs.map

package/dist/internal/passkey/registration-write.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-write.mjs","names":[],"sources":["../../../src/internal/passkey/registration-write.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport {\n  PasskeyLabel,\n  PasskeyRevision,\n  type PasskeyCeremony,\n  type PasskeyClaim,\n  type PasskeyRegistrationVerified,\n  type PasskeyMethodPolicy,\n} from \"@yielded/auth/Passkey\";\nimport { SubjectId } from \"@yielded/auth/Schema\";\nimport { Effect, Schema } from \"effect\";\n\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport type { makePasskeyAdmissionKernel } from \"./admission\";\nimport type { makePasskeyCredentialsKernel } from \"./credentials\";\nimport type { makePasskeyFlowKernel } from \"./flow\";\nimport type { makePasskeyRegistrationCustodyKernel } from \"./registration-custody\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\nimport type { makePasskeyWriteStateKernel } from \"./write-state\";\n\nexport const makePasskeyRegistrationWriteKernel = (\n  operations: QueryOperations,\n  admission: Pick<\n    ReturnType<typeof makePasskeyAdmissionKernel>,\n    \"lockAdmission\" | \"readCharges\" | \"guardChargeSet\"\n  >,\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"readModule\" | \"readPolicyGuards\"\n  >,\n  flow: Pick<\n    ReturnType<typeof makePasskeyFlowKernel>,\n    | \"compatiblePolicy\"\n    | \"exactClaim\"\n    | \"issueAssertion\"\n    | \"liveCondition\"\n    | \"readFlow\"\n    | \"terminalFlow\"\n  >,\n  registrationCustody: Pick<\n    ReturnType<typeof makePasskeyRegistrationCustodyKernel>,\n    \"releaseRegistrationCustody\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    \"ceremonyStorage\" | \"credentialKey\" | \"equal\" | \"handleKey\" | \"invariant\"\n  >,\n  writeState: Pick<\n    ReturnType<typeof makePasskeyWriteStateKernel>,\n    \"digest\" | \"insertCredential\" | \"jsonStorage\" | \"validRegistration\"\n  >,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n  const { sql } = operations;\n  const { lockAdmission, readCharges, guardChargeSet } = admission;\n  const { readModule, readPolicyGuards } = credentials;\n\n  const { compatiblePolicy, exactClaim, issueAssertion, liveCondition, readFlow, terminalFlow } =\n    flow;\n\n  const { releaseRegistrationCustody } = registrationCustody;\n  const { ceremonyStorage, credentialKey, equal, handleKey } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n  const { digest, insertCredential, jsonStorage, validRegistration } = writeState;\n  const { both } = transactions;\n\n  const registrationData = (mapping: any, registration: any) => {\n    const codec = jsonStorage(mapping.registration.schema);\n    const encoded = codec.encode(registration);\n\n    invariant(new TextEncoder().encode(encoded).length <= 1048576);\n\n    return {\n      encoded,\n      registration: codec.decode(encoded),\n      fingerprint: digest(mapping.registration.schema, registration),\n    };\n  };\n\n  const describe = (mapping: any, registration: any) => {\n    const data = registrationData(mapping, registration);\n\n    const labels = Schema.decodeSync(\n      Schema.Struct({ name: PasskeyLabel, displayName: PasskeyLabel }),\n    )(mapping.registration.describe(data.registration));\n\n    return { ...data, ...labels };\n  };\n\n  const inspectRegistration = Effect.fn(\"passkey.inspectRegistration\")(function* (\n    mapping: any,\n    registration: any,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const value = describe(mapping, registration);\n    const current = yield* readModule(mapping);\n\n    yield* readPolicyGuards(mapping);\n\n    const eligible =\n      current !== undefined &&\n      (yield* owner.check(mapping.registration.eligible(value.registration)));\n\n    return {\n      fingerprint: value.fingerprint,\n      name: value.name,\n      displayName: value.displayName,\n      eligible,\n    };\n  });\n\n  const issueRegistration = Effect.fn(\"passkey.issueRegistration\")(function* (\n    mapping: any,\n    input: {\n      readonly ceremony: PasskeyCeremony;\n      readonly policy: PasskeyMethodPolicy;\n      readonly registration: any;\n    },\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const ceremony = input.ceremony;\n\n    if (\n      ceremony.moduleId !== mapping.moduleId ||\n      ceremony.purpose !== \"registration\" ||\n      ceremony.context._tag !== \"Registration\" ||\n      !ceremony.profile.primarySignIn ||\n      ceremony.profile.userVerification !== \"required\" ||\n      ceremony.profile.residentKey !== \"required\" ||\n      ceremony.allowedCredentials.length !== 0\n    )\n      return { _tag: \"Rejected\" } as const;\n    const value = describe(mapping, input.registration);\n\n    if (\n      value.fingerprint !== ceremony.context.fingerprint ||\n      value.name !== ceremony.context.name ||\n      value.displayName !== ceremony.context.displayName\n    )\n      return { _tag: \"Rejected\" } as const;\n    if ((yield* readModule(mapping)) === undefined) return { _tag: \"Rejected\" } as const;\n    yield* lockAdmission(mapping);\n    yield* readPolicyGuards(mapping);\n    const eligible = mapping.registration.eligible(value.registration);\n\n    if (!(yield* owner.check(eligible))) return { _tag: \"Rejected\" } as const;\n    const handle = mapping.handle;\n    const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);\n\n    const absentHandle = yield* owner.read(\n      handle.table,\n      equal(handle.table, { [handle.handleKey]: hashed }),\n      { limit: 1 },\n    );\n\n    const intent = mapping.intent;\n\n    const absentCommand = yield* owner.read(\n      intent.table,\n      equal(intent.table, {\n        [intent.moduleId]: mapping.moduleId,\n        [intent.commandId]: ceremony.commandId,\n      }),\n      { limit: 1 },\n    );\n\n    const absentFlow = yield* owner.read(\n      intent.table,\n      equal(intent.table, {\n        [intent.moduleId]: mapping.moduleId,\n        [intent.flowId]: ceremony.flowId,\n      }),\n      { limit: 1 },\n    );\n\n    if (\n      absentHandle.rows.length !== 0 ||\n      absentCommand.rows.length !== 0 ||\n      absentFlow.rows.length !== 0\n    )\n      return { _tag: \"Rejected\" } as const;\n    const issued = yield* issueAssertion(mapping, ceremony, input.policy);\n\n    if (issued._tag !== \"Issued\") return issued;\n\n    const reserved = yield* owner.insert(\n      handle.table,\n      {\n        ...handle.encodeInsert({ ceremony, reservationId: owner.marker }),\n        [handle.handleKey]: hashed,\n        [handle.rpId]: ceremony.profile.rpId,\n        [handle.userHandle]: ceremony.context.userHandle,\n        [handle.state]: handle.reservedState,\n        [handle.version]: owner.marker,\n        [handle.reservationId]: owner.marker,\n        [mapping.read.handleOwnership.subjectId]: null,\n      },\n      { [handle.handleKey]: hashed },\n    );\n\n    absentHandle.rows = reserved.rows;\n\n    const inserted = yield* owner.insert(\n      intent.table,\n      {\n        ...intent.encodeInsert({\n          ceremony,\n          registration: value.registration,\n          reservationId: owner.marker,\n        }),\n        [intent.moduleId]: mapping.moduleId,\n        [intent.flowId]: ceremony.flowId,\n        [intent.commandId]: ceremony.commandId,\n        [intent.state]: intent.pendingState,\n        [intent.version]: owner.marker,\n        [intent.fingerprint]: value.fingerprint,\n        [intent.handleKey]: hashed,\n        [intent.reservationId]: owner.marker,\n        [intent.ceremonySnapshot]: ceremonyStorage.encode(ceremony),\n        [intent.applicationSnapshot]: value.encoded,\n      },\n      { [intent.moduleId]: mapping.moduleId, [intent.flowId]: ceremony.flowId },\n    );\n\n    absentCommand.rows = inserted.rows;\n    absentFlow.rows = inserted.rows;\n    owner.postconditions.push(eligible);\n\n    return issued;\n  });\n\n  const completeRegistration = Effect.fn(\"passkey.completeRegistration\")(function* (\n    mapping: any,\n    input: {\n      readonly claim: PasskeyClaim;\n      readonly verified: PasskeyRegistrationVerified;\n      readonly nowMillis: number;\n    },\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const ceremony = input.claim.ceremony;\n\n    if (\n      ceremony.moduleId !== mapping.moduleId ||\n      ceremony.purpose !== \"registration\" ||\n      ceremony.context._tag !== \"Registration\"\n    )\n      return { _tag: \"Rejected\" } as const;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined) return { _tag: \"Rejected\" } as const;\n    yield* lockAdmission(mapping);\n    yield* readPolicyGuards(mapping);\n    const tuple = mapping.read.credentialOwnership;\n\n    const absentCredential = yield* owner.read(\n      tuple.table,\n      equal(tuple.table, {\n        [tuple.credentialKey]: credentialKey(\n          ceremony.profile.rpId,\n          input.verified.protocolCredentialId,\n        ),\n      }),\n      { limit: 1, observe: false },\n    );\n\n    const handle = mapping.handle;\n    const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);\n\n    const held = (yield* owner.read(\n      handle.table,\n      equal(handle.table, { [handle.handleKey]: hashed }),\n      { limit: 1 },\n    )).rows[0];\n\n    const intent = mapping.intent;\n\n    const row = (yield* owner.read(\n      intent.table,\n      equal(intent.table, {\n        [intent.moduleId]: mapping.moduleId,\n        [intent.flowId]: ceremony.flowId,\n      }),\n      { limit: 1 },\n    )).rows[0];\n\n    const read = yield* readFlow(mapping, ceremony.flowId);\n\n    if (read === undefined || !exactClaim(read, input.claim)) return { _tag: \"Rejected\" } as const;\n\n    const reject = Effect.gen(function* () {\n      yield* releaseRegistrationCustody(mapping, ceremony);\n      yield* terminalFlow(mapping, read, \"Rejected\");\n\n      return { _tag: \"Rejected\" } as const;\n    });\n\n    if (\n      absentCredential.rows.length !== 0 ||\n      held === undefined ||\n      row === undefined ||\n      !handle.isReservedState(held[handle.state]) ||\n      !intent.isPendingState(row[intent.state]) ||\n      row[intent.commandId] !== ceremony.commandId ||\n      row[intent.ceremonySnapshot] !== ceremonyStorage.encode(ceremony) ||\n      row[intent.fingerprint] !== ceremony.context.fingerprint ||\n      row[intent.handleKey] !== hashed ||\n      held[handle.reservationId] !== row[intent.reservationId] ||\n      held[handle.rpId] !== ceremony.profile.rpId ||\n      held[handle.userHandle] !== ceremony.context.userHandle ||\n      !compatiblePolicy(ceremony, read.policy, current) ||\n      !validRegistration(ceremony, input.verified) ||\n      !input.verified.userVerified ||\n      !ceremony.profile.primarySignIn ||\n      !(yield* owner.check(liveCondition(mapping, ceremony, input.claim)))\n    )\n      return yield* reject;\n\n    const data = describe(\n      mapping,\n      jsonStorage(mapping.registration.schema).decode(row[intent.applicationSnapshot]),\n    );\n\n    if (\n      data.encoded !== row[intent.applicationSnapshot] ||\n      data.fingerprint !== ceremony.context.fingerprint ||\n      data.name !== ceremony.context.name ||\n      data.displayName !== ceremony.context.displayName\n    )\n      return yield* reject;\n    const eligible = mapping.registration.eligible(data.registration);\n\n    if (!(yield* owner.check(eligible))) return yield* reject;\n\n    const provision = mapping.registration.subject({\n      registration: data.registration,\n      ceremony,\n      marker: owner.marker,\n    });\n\n    const nativeId = provision.subjectId;\n    const subjectId = SubjectId.make(mapping.read.subjectIds.toSubject(nativeId));\n\n    invariant(\n      mapping.read.subjectIds.equals(mapping.read.subjectIds.toNative(subjectId), nativeId),\n    );\n    const table = mapping.read.subject;\n\n    const absentSubject = yield* owner.read(\n      table.table,\n      equal(table.table, { [table.id]: nativeId }),\n      { limit: 1 },\n    );\n\n    if (absentSubject.rows.length !== 0) return yield* reject;\n\n    const values = {\n      ...provision.values,\n      [table.id]: nativeId,\n      [table.status]: mapping.registration.activeStatus,\n      [table.securityRevision]: owner.marker,\n    };\n\n    const inserted = yield* owner.insert(table.table, values, { [table.id]: nativeId });\n\n    absentSubject.rows = inserted.rows;\n\n    const subject = {\n      subjectId,\n      nativeId,\n      row: values,\n      revision: PasskeyRevision.make({\n        subjectId,\n        securityRevision: PasskeyRevision.fields.securityRevision.make(owner.marker),\n        credentials: [],\n      }),\n    };\n\n    yield* owner.update(\n      handle.table,\n      { [handle.handleKey]: hashed },\n      {\n        [mapping.read.handleOwnership.subjectId]: nativeId,\n        [handle.state]: mapping.write.handleOwnership.ownedState,\n        [handle.version]: owner.marker,\n        [handle.reservationId]: null,\n      },\n    );\n    yield* readCharges(mapping, ceremony, read.policy);\n    yield* guardChargeSet(mapping, ceremony);\n    yield* insertCredential(\n      mapping,\n      subject,\n      ceremony,\n      input.verified,\n      yield* owner.now(mapping.clock),\n    );\n    yield* owner.update(\n      intent.table,\n      { [intent.moduleId]: mapping.moduleId, [intent.flowId]: ceremony.flowId },\n      { [intent.state]: intent.acceptedState, [intent.version]: owner.marker },\n    );\n    const flow = mapping.flow;\n\n    yield* owner.update(\n      flow.table,\n      { [flow.moduleId]: mapping.moduleId, [flow.flowId]: ceremony.flowId },\n      { [flow.state]: flow.states.RegistrationAccepted, [flow.version]: owner.marker },\n    );\n    owner.postconditions.push(\n      liveCondition(mapping, ceremony, input.claim),\n      mapping.registration.finalEligibility({\n        registration: data.registration,\n        subjectId: nativeId,\n      }),\n      sql`exists(select 1 from ${table.table} where ${both(owner.exact(table.table, values), table.activeCondition)})`,\n    );\n\n    return { _tag: \"RegistrationAccepted\" } as const;\n  });\n\n  return { inspectRegistration, issueRegistration, completeRegistration };\n};\n"],"mappings":";;;;;AAuBA,MAAa,sCACX,YACA,WAIA,aAIA,MASA,qBAIA,OAIA,YAIA,iBACG;CACH,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,eAAe,aAAa,mBAAmB;CACvD,MAAM,EAAE,YAAY,qBAAqB;CAEzC,MAAM,EAAE,kBAAkB,YAAY,gBAAgB,eAAe,UAAU,iBAC7E;CAEF,MAAM,EAAE,+BAA+B;CACvC,MAAM,EAAE,iBAAiB,eAAe,OAAO,cAAc;CAC7D,MAAM,YAA+C,MAAM;CAC3D,MAAM,EAAE,QAAQ,kBAAkB,aAAa,sBAAsB;CACrE,MAAM,EAAE,SAAS;CAEjB,MAAM,oBAAoB,SAAc,iBAAsB;EAC5D,MAAM,QAAQ,YAAY,QAAQ,aAAa,MAAM;EACrD,MAAM,UAAU,MAAM,OAAO,YAAY;EAEzC,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,OAAO;EAE7D,OAAO;GACL;GACA,cAAc,MAAM,OAAO,OAAO;GAClC,aAAa,OAAO,QAAQ,aAAa,QAAQ,YAAY;EAC/D;CACF;CAEA,MAAM,YAAY,SAAc,iBAAsB;EACpD,MAAM,OAAO,iBAAiB,SAAS,YAAY;EAEnD,MAAM,SAAS,OAAO,WACpB,OAAO,OAAO;GAAE,MAAM;GAAc,aAAa;EAAa,CAAC,CACjE,CAAC,CAAC,QAAQ,aAAa,SAAS,KAAK,YAAY,CAAC;EAElD,OAAO;GAAE,GAAG;GAAM,GAAG;EAAO;CAC9B;CA8UA,OAAO;EAAE,qBA5UmB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACnE,SACA,cACA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,QAAQ,SAAS,SAAS,YAAY;GAC5C,MAAM,UAAU,OAAO,WAAW,OAAO;GAEzC,OAAO,iBAAiB,OAAO;GAE/B,MAAM,WACJ,YAAY,KAAA,MACX,OAAO,MAAM,MAAM,QAAQ,aAAa,SAAS,MAAM,YAAY,CAAC;GAEvE,OAAO;IACL,aAAa,MAAM;IACnB,MAAM,MAAM;IACZ,aAAa,MAAM;IACnB;GACF;EACF,CAwT2B;EAAG,mBAtTJ,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,OAKA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,WAAW,MAAM;GAEvB,IACE,SAAS,aAAa,QAAQ,YAC9B,SAAS,YAAY,kBACrB,SAAS,QAAQ,SAAS,kBAC1B,CAAC,SAAS,QAAQ,iBAClB,SAAS,QAAQ,qBAAqB,cACtC,SAAS,QAAQ,gBAAgB,cACjC,SAAS,mBAAmB,WAAW,GAEvC,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,QAAQ,SAAS,SAAS,MAAM,YAAY;GAElD,IACE,MAAM,gBAAgB,SAAS,QAAQ,eACvC,MAAM,SAAS,SAAS,QAAQ,QAChC,MAAM,gBAAgB,SAAS,QAAQ,aAEvC,OAAO,EAAE,MAAM,WAAW;GAC5B,KAAK,OAAO,WAAW,OAAO,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAC1E,OAAO,cAAc,OAAO;GAC5B,OAAO,iBAAiB,OAAO;GAC/B,MAAM,WAAW,QAAQ,aAAa,SAAS,MAAM,YAAY;GAEjE,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;GAC/D,MAAM,SAAS,QAAQ;GACvB,MAAM,SAAS,UAAU,SAAS,QAAQ,MAAM,SAAS,QAAQ,UAAU;GAE3E,MAAM,eAAe,OAAO,MAAM,KAChC,OAAO,OACP,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,OAAO,CAAC,GAClD,EAAE,OAAO,EAAE,CACb;GAEA,MAAM,SAAS,QAAQ;GAEvB,MAAM,gBAAgB,OAAO,MAAM,KACjC,OAAO,OACP,MAAM,OAAO,OAAO;KACjB,OAAO,WAAW,QAAQ;KAC1B,OAAO,YAAY,SAAS;GAC/B,CAAC,GACD,EAAE,OAAO,EAAE,CACb;GAEA,MAAM,aAAa,OAAO,MAAM,KAC9B,OAAO,OACP,MAAM,OAAO,OAAO;KACjB,OAAO,WAAW,QAAQ;KAC1B,OAAO,SAAS,SAAS;GAC5B,CAAC,GACD,EAAE,OAAO,EAAE,CACb;GAEA,IACE,aAAa,KAAK,WAAW,KAC7B,cAAc,KAAK,WAAW,KAC9B,WAAW,KAAK,WAAW,GAE3B,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,SAAS,OAAO,eAAe,SAAS,UAAU,MAAM,MAAM;GAEpE,IAAI,OAAO,SAAS,UAAU,OAAO;GAiBrC,aAAa,QAAO,OAfI,MAAM,OAC5B,OAAO,OACP;IACE,GAAG,OAAO,aAAa;KAAE;KAAU,eAAe,MAAM;IAAO,CAAC;KAC/D,OAAO,YAAY;KACnB,OAAO,OAAO,SAAS,QAAQ;KAC/B,OAAO,aAAa,SAAS,QAAQ;KACrC,OAAO,QAAQ,OAAO;KACtB,OAAO,UAAU,MAAM;KACvB,OAAO,gBAAgB,MAAM;KAC7B,QAAQ,KAAK,gBAAgB,YAAY;GAC5C,GACA,GAAG,OAAO,YAAY,OAAO,CAC/B,EAAA,CAE6B;GAE7B,MAAM,WAAW,OAAO,MAAM,OAC5B,OAAO,OACP;IACE,GAAG,OAAO,aAAa;KACrB;KACA,cAAc,MAAM;KACpB,eAAe,MAAM;IACvB,CAAC;KACA,OAAO,WAAW,QAAQ;KAC1B,OAAO,SAAS,SAAS;KACzB,OAAO,YAAY,SAAS;KAC5B,OAAO,QAAQ,OAAO;KACtB,OAAO,UAAU,MAAM;KACvB,OAAO,cAAc,MAAM;KAC3B,OAAO,YAAY;KACnB,OAAO,gBAAgB,MAAM;KAC7B,OAAO,mBAAmB,gBAAgB,OAAO,QAAQ;KACzD,OAAO,sBAAsB,MAAM;GACtC,GACA;KAAG,OAAO,WAAW,QAAQ;KAAW,OAAO,SAAS,SAAS;GAAO,CAC1E;GAEA,cAAc,OAAO,SAAS;GAC9B,WAAW,OAAO,SAAS;GAC3B,MAAM,eAAe,KAAK,QAAQ;GAElC,OAAO;EACT,CAgM8C;EAAG,sBA9LpB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACrE,SACA,OAKA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,WAAW,MAAM,MAAM;GAE7B,IACE,SAAS,aAAa,QAAQ,YAC9B,SAAS,YAAY,kBACrB,SAAS,QAAQ,SAAS,gBAE1B,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,UAAU,OAAO,WAAW,OAAO;GAEzC,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACrD,OAAO,cAAc,OAAO;GAC5B,OAAO,iBAAiB,OAAO;GAC/B,MAAM,QAAQ,QAAQ,KAAK;GAE3B,MAAM,mBAAmB,OAAO,MAAM,KACpC,MAAM,OACN,MAAM,MAAM,OAAO,GAChB,MAAM,gBAAgB,cACrB,SAAS,QAAQ,MACjB,MAAM,SAAS,oBACjB,EACF,CAAC,GACD;IAAE,OAAO;IAAG,SAAS;GAAM,CAC7B;GAEA,MAAM,SAAS,QAAQ;GACvB,MAAM,SAAS,UAAU,SAAS,QAAQ,MAAM,SAAS,QAAQ,UAAU;GAE3E,MAAM,QAAQ,OAAO,MAAM,KACzB,OAAO,OACP,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,OAAO,CAAC,GAClD,EAAE,OAAO,EAAE,CACb,EAAA,CAAG,KAAK;GAER,MAAM,SAAS,QAAQ;GAEvB,MAAM,OAAO,OAAO,MAAM,KACxB,OAAO,OACP,MAAM,OAAO,OAAO;KACjB,OAAO,WAAW,QAAQ;KAC1B,OAAO,SAAS,SAAS;GAC5B,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAAG,KAAK;GAER,MAAM,OAAO,OAAO,SAAS,SAAS,SAAS,MAAM;GAErD,IAAI,SAAS,KAAA,KAAa,CAAC,WAAW,MAAM,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,WAAW;GAEpF,MAAM,SAAS,OAAO,IAAI,aAAa;IACrC,OAAO,2BAA2B,SAAS,QAAQ;IACnD,OAAO,aAAa,SAAS,MAAM,UAAU;IAE7C,OAAO,EAAE,MAAM,WAAW;GAC5B,CAAC;GAED,IACE,iBAAiB,KAAK,WAAW,KACjC,SAAS,KAAA,KACT,QAAQ,KAAA,KACR,CAAC,OAAO,gBAAgB,KAAK,OAAO,MAAM,KAC1C,CAAC,OAAO,eAAe,IAAI,OAAO,MAAM,KACxC,IAAI,OAAO,eAAe,SAAS,aACnC,IAAI,OAAO,sBAAsB,gBAAgB,OAAO,QAAQ,KAChE,IAAI,OAAO,iBAAiB,SAAS,QAAQ,eAC7C,IAAI,OAAO,eAAe,UAC1B,KAAK,OAAO,mBAAmB,IAAI,OAAO,kBAC1C,KAAK,OAAO,UAAU,SAAS,QAAQ,QACvC,KAAK,OAAO,gBAAgB,SAAS,QAAQ,cAC7C,CAAC,iBAAiB,UAAU,KAAK,QAAQ,OAAO,KAChD,CAAC,kBAAkB,UAAU,MAAM,QAAQ,KAC3C,CAAC,MAAM,SAAS,gBAChB,CAAC,SAAS,QAAQ,iBAClB,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,UAAU,MAAM,KAAK,CAAC,IAElE,OAAO,OAAO;GAEhB,MAAM,OAAO,SACX,SACA,YAAY,QAAQ,aAAa,MAAM,CAAC,CAAC,OAAO,IAAI,OAAO,oBAAoB,CACjF;GAEA,IACE,KAAK,YAAY,IAAI,OAAO,wBAC5B,KAAK,gBAAgB,SAAS,QAAQ,eACtC,KAAK,SAAS,SAAS,QAAQ,QAC/B,KAAK,gBAAgB,SAAS,QAAQ,aAEtC,OAAO,OAAO;GAChB,MAAM,WAAW,QAAQ,aAAa,SAAS,KAAK,YAAY;GAEhE,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,OAAO;GAEnD,MAAM,YAAY,QAAQ,aAAa,QAAQ;IAC7C,cAAc,KAAK;IACnB;IACA,QAAQ,MAAM;GAChB,CAAC;GAED,MAAM,WAAW,UAAU;GAC3B,MAAM,YAAY,UAAU,KAAK,QAAQ,KAAK,WAAW,UAAU,QAAQ,CAAC;GAE5E,UACE,QAAQ,KAAK,WAAW,OAAO,QAAQ,KAAK,WAAW,SAAS,SAAS,GAAG,QAAQ,CACtF;GACA,MAAM,QAAQ,QAAQ,KAAK;GAE3B,MAAM,gBAAgB,OAAO,MAAM,KACjC,MAAM,OACN,MAAM,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,GAC3C,EAAE,OAAO,EAAE,CACb;GAEA,IAAI,cAAc,KAAK,WAAW,GAAG,OAAO,OAAO;GAEnD,MAAM,SAAS;IACb,GAAG,UAAU;KACZ,MAAM,KAAK;KACX,MAAM,SAAS,QAAQ,aAAa;KACpC,MAAM,mBAAmB,MAAM;GAClC;GAIA,cAAc,QAAO,OAFG,MAAM,OAAO,MAAM,OAAO,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,EAAA,CAEpD;GAE9B,MAAM,UAAU;IACd;IACA;IACA,KAAK;IACL,UAAU,gBAAgB,KAAK;KAC7B;KACA,kBAAkB,gBAAgB,OAAO,iBAAiB,KAAK,MAAM,MAAM;KAC3E,aAAa,CAAC;IAChB,CAAC;GACH;GAEA,OAAO,MAAM,OACX,OAAO,OACP,GAAG,OAAO,YAAY,OAAO,GAC7B;KACG,QAAQ,KAAK,gBAAgB,YAAY;KACzC,OAAO,QAAQ,QAAQ,MAAM,gBAAgB;KAC7C,OAAO,UAAU,MAAM;KACvB,OAAO,gBAAgB;GAC1B,CACF;GACA,OAAO,YAAY,SAAS,UAAU,KAAK,MAAM;GACjD,OAAO,eAAe,SAAS,QAAQ;GACvC,OAAO,iBACL,SACA,SACA,UACA,MAAM,UACN,OAAO,MAAM,IAAI,QAAQ,KAAK,CAChC;GACA,OAAO,MAAM,OACX,OAAO,OACP;KAAG,OAAO,WAAW,QAAQ;KAAW,OAAO,SAAS,SAAS;GAAO,GACxE;KAAG,OAAO,QAAQ,OAAO;KAAgB,OAAO,UAAU,MAAM;GAAO,CACzE;GACA,MAAM,OAAO,QAAQ;GAErB,OAAO,MAAM,OACX,KAAK,OACL;KAAG,KAAK,WAAW,QAAQ;KAAW,KAAK,SAAS,SAAS;GAAO,GACpE;KAAG,KAAK,QAAQ,KAAK,OAAO;KAAuB,KAAK,UAAU,MAAM;GAAO,CACjF;GACA,MAAM,eAAe,KACnB,cAAc,SAAS,UAAU,MAAM,KAAK,GAC5C,QAAQ,aAAa,iBAAiB;IACpC,cAAc,KAAK;IACnB,WAAW;GACb,CAAC,GACD,GAAG,wBAAwB,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,MAAM,OAAO,MAAM,GAAG,MAAM,eAAe,EAAE,EAChH;GAEA,OAAO,EAAE,MAAM,uBAAuB;EACxC,CAEoE;CAAE;AACxE"}

package/dist/internal/passkey/state.d.mts

@@ -0,0 +1,5 @@
+import "../query-operations.mjs";
+import "../transaction-kernel.mjs";
+import { Context, Effect } from "effect";
+import { PasskeyCeremony, PasskeyCredential, PasskeyRevision, PasskeyUnavailable } from "@yielded/auth/Passkey";
+import { SQL } from "drizzle-orm";

package/dist/internal/passkey/state.mjs

@@ -0,0 +1,234 @@
+import { requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "../../drizzle/passkey-model.mjs";
+import { requiredPasskeyRegistrationCeremonyConstraints } from "../../drizzle/passkey-registration-ceremony-model.mjs";
+import { Context, Effect, Encoding, Schema } from "effect";
+import { PasskeyCeremony, PasskeyConfigurationError, PasskeyCredential, PasskeyMethodPolicy, PasskeyModuleId, PasskeyProfile, PasskeyRevision, PasskeyUnavailable, snapshotPasskeySync } from "@yielded/auth/Passkey";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { randomBytes } from "@noble/hashes/utils.js";
+//#region src/internal/passkey/state.ts
+var CurrentPasskeyTransaction = class extends Context.Service()("effect-auth/drizzle/CurrentPasskeyTransaction") {};
+const makePasskeyStateKernel = (operations, transactions) => {
+	const { getTableColumns, sql } = operations;
+	const { both, makeTransactionRows } = transactions;
+	const unavailable = () => PasskeyUnavailable.make({});
+	const invariant = (value) => {
+		if (!value) throw unavailable();
+	};
+	const { col, equal, copiedRow, matchesNativeRow } = makeTransactionRows(unavailable);
+	const nonce = () => Encoding.encodeBase64Url(randomBytes(32));
+	const encoder = new TextEncoder();
+	const decoder = new TextDecoder("utf-8", { fatal: true });
+	/** RP tuples and admission scopes have no collation-dependent string identity. */
+	const key = (kind, fields) => {
+		const values = ["effect-auth/passkey/" + kind + "/v1", ...fields].map((field) => {
+			const bytes = encoder.encode(field);
+			invariant(decoder.decode(bytes) === field);
+			return bytes;
+		});
+		const packed = new Uint8Array(values.reduce((size, bytes) => size + 4 + bytes.length, 0));
+		const view = new DataView(packed.buffer);
+		let offset = 0;
+		for (const bytes of values) {
+			view.setUint32(offset, bytes.length, false);
+			packed.set(bytes, offset + 4);
+			offset += 4 + bytes.length;
+		}
+		return "v1:" + Array.from(sha256(packed), (value) => value.toString(16).padStart(2, "0")).join("");
+	};
+	const credentialKey = (rpId, id) => key("credential", [rpId, id]);
+	const handleKey = (rpId, handle) => key("handle", [rpId, handle]);
+	const subjectScope = (subjectId) => key("subject", [subjectId]);
+	const targetScope = (ceremony) => {
+		const context = ceremony.context;
+		if (!("target" in context)) return null;
+		const target = context.target;
+		return key("target", [
+			target.moduleId,
+			target.kind,
+			target.flowId,
+			target.commandId,
+			target.bindingDigest,
+			target.revision.subjectId
+		]);
+	};
+	/** Private storage is decoded Type data, never a consumer wire transform. */
+	const storage = (schema, maximumBytes) => {
+		const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));
+		const encode = (value) => {
+			const text = "v1:" + Schema.encodeSync(codec)(snapshotPasskeySync(schema, value));
+			invariant(encoder.encode(text).length <= maximumBytes);
+			return text;
+		};
+		return {
+			encode,
+			decode: (text) => {
+				invariant(typeof text === "string" && text.startsWith("v1:"));
+				invariant(encoder.encode(text).length <= maximumBytes);
+				const value = snapshotPasskeySync(schema, Schema.decodeSync(codec)(text.slice(3)));
+				invariant(encode(value) === text);
+				return value;
+			}
+		};
+	};
+	const policyStorage = storage(PasskeyMethodPolicy, 8388608);
+	const ceremonyStorage = storage(PasskeyCeremony, 524288);
+	const credentialStorage = storage(PasskeyCredential, 524288);
+	const profileStorage = storage(PasskeyProfile, 262144);
+	const revisionStorage = storage(PasskeyRevision, 262144);
+	const sameCredential = (left, right) => {
+		const semantic = (value) => ({
+			...value,
+			counter: 0,
+			maximumCounter: 0,
+			backupState: false,
+			revision: {
+				...value.revision,
+				credentials: []
+			}
+		});
+		return credentialStorage.encode(semantic(left)) === credentialStorage.encode(semantic(right));
+	};
+	const sameRevision = (left, right) => {
+		const pairs = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));
+		return left.subjectId === right.subjectId && left.securityRevision === right.securityRevision && pairs.size === left.credentials.length && new Set(right.credentials.map((item) => item.credentialId)).size === right.credentials.length && pairs.size === right.credentials.length && right.credentials.every((item) => pairs.get(item.credentialId) === item.revision);
+	};
+	const semanticCredentialColumns = (mapping) => [
+		"credentialId",
+		"subjectId",
+		"rpId",
+		"protocolCredentialId",
+		"credentialKey",
+		"handleKey",
+		"userHandle",
+		"publicKey",
+		"algorithm",
+		"profile",
+		"credentialRevision",
+		"status",
+		"primarySignIn",
+		"enrollmentUserVerified",
+		"backupEligible"
+	].map((name) => mapping[name]);
+	const mappedColumns = (mapping) => Object.entries(mapping).filter(([name, value]) => ![
+		"table",
+		"reservedState",
+		"pendingState",
+		"acceptedState",
+		"rejectedState"
+	].includes(name) && typeof value === "string").map(([, value]) => value);
+	const observeSemantic = (mapping, where, row) => Effect.map(CurrentPasskeyTransaction, (owner) => {
+		owner.observations.push({
+			table: mapping.table,
+			where,
+			rows: [Object.fromEntries(semanticCredentialColumns(mapping).map((column) => [column, row[column]]))]
+		});
+	});
+	/** Capture descriptor graphs, preserving native SQL expressions and table objects. */
+	const captureMapping = (input) => {
+		const seen = /* @__PURE__ */ new Map();
+		const copy = (value) => {
+			if (value === null || typeof value !== "object" || Effect.isEffect(value)) return value;
+			if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return value;
+			const prior = seen.get(value);
+			if (prior !== void 0) return prior;
+			const result = Array.isArray(value) ? [] : {};
+			seen.set(value, result);
+			for (const [name, child] of Object.entries(value)) result[name] = copy(child);
+			return Object.freeze(result);
+		};
+		return copy(input);
+	};
+	const constraints = (actual, expected) => {
+		for (const [name, columns] of Object.entries(expected)) invariant(JSON.stringify(actual?.[name]) === JSON.stringify(columns));
+	};
+	const descriptor = (value) => {
+		const columns = getTableColumns(value.table);
+		for (const name of mappedColumns(value)) invariant(columns[name] !== void 0);
+	};
+	const validateMapping = (mapping, kind) => {
+		try {
+			const read = kind === "read" ? mapping : kind !== "registration" ? mapping.read : void 0;
+			if (read !== void 0) {
+				for (const name of [
+					"subject",
+					"credential",
+					"authority",
+					"credentialOwnership",
+					"handleOwnership"
+				]) descriptor(read[name]);
+				constraints(read.constraints, requiredPasskeyCredentialConstraints);
+			}
+			if (kind === "read") return;
+			Schema.decodeUnknownSync(PasskeyModuleId)(mapping.moduleId);
+			descriptor(mapping.module);
+			invariant(mapping.module.policyColumns.length > 0);
+			for (const name of mapping.module.policyColumns) col(mapping.module.table, name);
+			const scopes = /* @__PURE__ */ new Set();
+			for (const guard of mapping.module.guards ?? []) {
+				invariant(typeof guard.scope === "string" && guard.scope.length > 0 && guard.scope.length <= 256);
+				invariant(!scopes.has(guard.scope) && guard.columns.length > 0);
+				scopes.add(guard.scope);
+				for (const name of guard.columns) col(guard.table, name);
+			}
+			invariant(scopes.size <= 32);
+			if (kind === "context") return;
+			invariant(typeof mapping.authorityScope === "string" && mapping.authorityScope.length > 0 && mapping.authorityScope.length <= 256);
+			for (const name of [
+				"flow",
+				"admission",
+				"charge"
+			]) descriptor(mapping[name]);
+			if (kind === "registration") {
+				descriptor(mapping.intent);
+				descriptor(mapping.handle);
+			} else col(mapping.read.credential.table, mapping.telemetry.lastUsedAt);
+			constraints(mapping.constraints, kind === "registration" ? requiredPasskeyRegistrationCeremonyConstraints : requiredPasskeyPersistenceConstraints);
+			const states = Object.values(mapping.flow.states);
+			invariant(states.length === 7 && new Set(states.map((value) => JSON.stringify(value))).size === 7);
+			for (const value of [
+				0,
+				1,
+				123456789,
+				864e10
+			]) invariant(mapping.clock.decodeInstant(mapping.clock.encodeInstant(value)) === value);
+		} catch {
+			throw PasskeyConfigurationError.make({});
+		}
+	};
+	const assertNow = (condition) => Effect.flatMap(CurrentPasskeyTransaction, (owner) => Effect.gen(function* () {
+		invariant(yield* owner.check(condition));
+		owner.postconditions.push(condition);
+	}));
+	const existsExact = (table, values, condition) => Effect.map(CurrentPasskeyTransaction, (owner) => sql`exists(select 1 from ${table} where ${both(owner.exact(table, values), condition)})`);
+	return {
+		unavailable,
+		invariant,
+		col,
+		equal,
+		copiedRow,
+		matchesNativeRow,
+		nonce,
+		key,
+		credentialKey,
+		handleKey,
+		subjectScope,
+		targetScope,
+		policyStorage,
+		ceremonyStorage,
+		credentialStorage,
+		profileStorage,
+		revisionStorage,
+		sameCredential,
+		sameRevision,
+		semanticCredentialColumns,
+		mappedColumns,
+		observeSemantic,
+		captureMapping,
+		validateMapping,
+		assertNow,
+		existsExact
+	};
+};
+//#endregion
+export { CurrentPasskeyTransaction, makePasskeyStateKernel };
+
+//# sourceMappingURL=state.mjs.map

package/dist/internal/passkey/state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.mjs","names":[],"sources":["../../../src/internal/passkey/state.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\n// oxlint-disable-next-line import/extensions -- Noble exposes its explicit .js subpaths.\nimport { sha256 } from \"@noble/hashes/sha2.js\";\n// oxlint-disable-next-line import/extensions -- Noble exposes its explicit .js subpaths.\nimport { randomBytes } from \"@noble/hashes/utils.js\";\nimport {\n  PasskeyConfigurationError,\n  PasskeyUnavailable,\n  PasskeyCeremony,\n  PasskeyCredential,\n  PasskeyModuleId,\n  PasskeyProfile,\n  PasskeyRevision,\n  PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport type { SQL } from \"drizzle-orm\";\nimport { Context, Effect, Encoding, Schema } from \"effect\";\n\nimport {\n  requiredPasskeyCredentialConstraints,\n  requiredPasskeyPersistenceConstraints,\n} from \"../../drizzle/passkey-model\";\nimport { requiredPasskeyRegistrationCeremonyConstraints } from \"../../drizzle/passkey-registration-ceremony-model\";\nimport type { QueryOperations } from \"../query-operations\";\nimport type { TransactionOwner, makeTransactionKernel } from \"../transaction-kernel\";\n\nexport type PasskeyOwner = TransactionOwner<PasskeyUnavailable>;\n\nexport class CurrentPasskeyTransaction extends Context.Service<\n  CurrentPasskeyTransaction,\n  PasskeyOwner\n>()(\"effect-auth/drizzle/CurrentPasskeyTransaction\") {}\n\nexport const makePasskeyStateKernel = (\n  operations: QueryOperations,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\" | \"makeTransactionRows\">,\n) => {\n  const { getTableColumns, sql } = operations;\n  const { both, makeTransactionRows } = transactions;\n\n  const unavailable = () => PasskeyUnavailable.make({});\n\n  const invariant: (value: unknown) => asserts value = (value) => {\n    if (!value) throw unavailable();\n  };\n\n  const { col, equal, copiedRow, matchesNativeRow } = makeTransactionRows(unavailable);\n\n  const nonce = () => Encoding.encodeBase64Url(randomBytes(32));\n\n  const encoder = new TextEncoder();\n\n  const decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\n  /** RP tuples and admission scopes have no collation-dependent string identity. */\n  const key = (kind: string, fields: ReadonlyArray<string>) => {\n    const values = [\"effect-auth/passkey/\" + kind + \"/v1\", ...fields].map((field) => {\n      const bytes = encoder.encode(field);\n\n      invariant(decoder.decode(bytes) === field);\n\n      return bytes;\n    });\n\n    const packed = new Uint8Array(values.reduce((size, bytes) => size + 4 + bytes.length, 0));\n    const view = new DataView(packed.buffer);\n    let offset = 0;\n\n    for (const bytes of values) {\n      view.setUint32(offset, bytes.length, false);\n      packed.set(bytes, offset + 4);\n      offset += 4 + bytes.length;\n    }\n\n    return (\n      \"v1:\" + Array.from(sha256(packed), (value) => value.toString(16).padStart(2, \"0\")).join(\"\")\n    );\n  };\n\n  const credentialKey = (rpId: string, id: string) => key(\"credential\", [rpId, id]);\n\n  const handleKey = (rpId: string, handle: string) => key(\"handle\", [rpId, handle]);\n\n  const subjectScope = (subjectId: string) => key(\"subject\", [subjectId]);\n\n  const targetScope = (ceremony: PasskeyCeremony) => {\n    const context = ceremony.context;\n\n    if (!(\"target\" in context)) return null;\n    const target = context.target;\n\n    return key(\"target\", [\n      target.moduleId,\n      target.kind,\n      target.flowId,\n      target.commandId,\n      target.bindingDigest,\n      target.revision.subjectId,\n    ]);\n  };\n\n  /** Private storage is decoded Type data, never a consumer wire transform. */\n  const storage = <S extends Schema.Codec<unknown, unknown, never, never>>(\n    schema: S,\n    maximumBytes: number,\n  ) => {\n    const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n\n    const encode = (value: S[\"Type\"]) => {\n      const text = \"v1:\" + Schema.encodeSync(codec)(snapshotPasskeySync(schema, value));\n\n      invariant(encoder.encode(text).length <= maximumBytes);\n\n      return text;\n    };\n\n    return {\n      encode,\n      decode: (text: unknown): S[\"Type\"] => {\n        invariant(typeof text === \"string\" && text.startsWith(\"v1:\"));\n        invariant(encoder.encode(text).length <= maximumBytes);\n        const value = snapshotPasskeySync(schema, Schema.decodeSync(codec)(text.slice(3)));\n\n        invariant(encode(value) === text);\n\n        return value;\n      },\n    };\n  };\n\n  // Legal 32 x 16 x 2048 origins require more than one MiB before JSON escaping.\n  const policyStorage = storage(PasskeyMethodPolicy, 8 * 1024 * 1024);\n\n  const ceremonyStorage = storage(PasskeyCeremony, 512 * 1024);\n\n  const credentialStorage = storage(PasskeyCredential, 512 * 1024);\n\n  const profileStorage = storage(PasskeyProfile, 256 * 1024);\n\n  const revisionStorage = storage(PasskeyRevision, 256 * 1024);\n\n  const sameCredential = (left: PasskeyCredential, right: PasskeyCredential) => {\n    const semantic = (value: PasskeyCredential) => ({\n      ...value,\n      counter: 0,\n      maximumCounter: 0,\n      backupState: false,\n      revision: { ...value.revision, credentials: [] },\n    });\n\n    return credentialStorage.encode(semantic(left)) === credentialStorage.encode(semantic(right));\n  };\n\n  const sameRevision = (left: typeof PasskeyRevision.Type, right: typeof PasskeyRevision.Type) => {\n    const pairs = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));\n\n    return (\n      left.subjectId === right.subjectId &&\n      left.securityRevision === right.securityRevision &&\n      pairs.size === left.credentials.length &&\n      new Set(right.credentials.map((item) => item.credentialId)).size ===\n        right.credentials.length &&\n      pairs.size === right.credentials.length &&\n      right.credentials.every((item) => pairs.get(item.credentialId) === item.revision)\n    );\n  };\n\n  const semanticCredentialColumns = (mapping: any): string[] =>\n    [\n      \"credentialId\",\n      \"subjectId\",\n      \"rpId\",\n      \"protocolCredentialId\",\n      \"credentialKey\",\n      \"handleKey\",\n      \"userHandle\",\n      \"publicKey\",\n      \"algorithm\",\n      \"profile\",\n      \"credentialRevision\",\n      \"status\",\n      \"primarySignIn\",\n      \"enrollmentUserVerified\",\n      \"backupEligible\",\n    ].map((name) => mapping[name]);\n\n  const mappedColumns = (mapping: any): string[] =>\n    Object.entries(mapping)\n      .filter(\n        ([name, value]) =>\n          ![\"table\", \"reservedState\", \"pendingState\", \"acceptedState\", \"rejectedState\"].includes(\n            name,\n          ) && typeof value === \"string\",\n      )\n      .map(([, value]) => value as string);\n\n  const observeSemantic = (mapping: any, where: SQL, row: any) =>\n    Effect.map(CurrentPasskeyTransaction, (owner) => {\n      owner.observations.push({\n        table: mapping.table,\n        where,\n        rows: [\n          Object.fromEntries(\n            semanticCredentialColumns(mapping).map((column) => [column, row[column]]),\n          ),\n        ],\n      });\n    });\n\n  /** Capture descriptor graphs, preserving native SQL expressions and table objects. */\n  const captureMapping = <A>(input: A): A => {\n    const seen = new Map<object, unknown>();\n\n    const copy = (value: unknown): unknown => {\n      if (value === null || typeof value !== \"object\" || Effect.isEffect(value)) return value;\n      if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return value;\n      const prior = seen.get(value);\n\n      if (prior !== undefined) return prior;\n      const result: any = Array.isArray(value) ? [] : {};\n\n      seen.set(value, result);\n      for (const [name, child] of Object.entries(value)) result[name] = copy(child);\n\n      return Object.freeze(result);\n    };\n\n    return copy(input) as A;\n  };\n\n  const constraints = (actual: any, expected: any) => {\n    for (const [name, columns] of Object.entries(expected))\n      // oxlint-disable-next-line no-restricted-properties -- exact configured constraint descriptor fingerprint.\n      invariant(JSON.stringify(actual?.[name]) === JSON.stringify(columns));\n  };\n\n  const descriptor = (value: any) => {\n    const columns = getTableColumns(value.table);\n\n    for (const name of mappedColumns(value)) invariant(columns[name] !== undefined);\n  };\n\n  const validateMapping = (\n    mapping: any,\n    kind: \"read\" | \"context\" | \"assertion\" | \"registration\",\n  ) => {\n    try {\n      const read = kind === \"read\" ? mapping : kind !== \"registration\" ? mapping.read : undefined;\n\n      if (read !== undefined) {\n        for (const name of [\n          \"subject\",\n          \"credential\",\n          \"authority\",\n          \"credentialOwnership\",\n          \"handleOwnership\",\n        ])\n          descriptor(read[name]);\n        constraints(read.constraints, requiredPasskeyCredentialConstraints);\n      }\n      if (kind === \"read\") return;\n      // oxlint-disable-next-line no-restricted-properties -- validate the untyped captured configuration boundary.\n      Schema.decodeUnknownSync(PasskeyModuleId)(mapping.moduleId);\n      descriptor(mapping.module);\n      invariant(mapping.module.policyColumns.length > 0);\n      for (const name of mapping.module.policyColumns) col(mapping.module.table, name);\n      const scopes = new Set<string>();\n\n      for (const guard of mapping.module.guards ?? []) {\n        invariant(\n          typeof guard.scope === \"string\" && guard.scope.length > 0 && guard.scope.length <= 256,\n        );\n        invariant(!scopes.has(guard.scope) && guard.columns.length > 0);\n        scopes.add(guard.scope);\n        for (const name of guard.columns) col(guard.table, name);\n      }\n      invariant(scopes.size <= 32);\n      if (kind === \"context\") return;\n      invariant(\n        typeof mapping.authorityScope === \"string\" &&\n          mapping.authorityScope.length > 0 &&\n          mapping.authorityScope.length <= 256,\n      );\n      for (const name of [\"flow\", \"admission\", \"charge\"]) descriptor(mapping[name]);\n      if (kind === \"registration\") {\n        descriptor(mapping.intent);\n        descriptor(mapping.handle);\n      } else col(mapping.read.credential.table, mapping.telemetry.lastUsedAt);\n      constraints(\n        mapping.constraints,\n        kind === \"registration\"\n          ? requiredPasskeyRegistrationCeremonyConstraints\n          : requiredPasskeyPersistenceConstraints,\n      );\n      const states = Object.values(mapping.flow.states);\n\n      // oxlint-disable-next-line no-restricted-properties -- configured native state identity fingerprints.\n      invariant(\n        // oxlint-disable-next-line no-restricted-properties -- configured native state identity fingerprints.\n        states.length === 7 && new Set(states.map((value) => JSON.stringify(value))).size === 7,\n      );\n      for (const value of [0, 1, 123456789, 8640000000000])\n        invariant(mapping.clock.decodeInstant(mapping.clock.encodeInstant(value)) === value);\n    } catch {\n      throw PasskeyConfigurationError.make({});\n    }\n  };\n\n  const assertNow = (condition: SQL) =>\n    Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n      Effect.gen(function* () {\n        invariant(yield* owner.check(condition));\n        owner.postconditions.push(condition);\n      }),\n    );\n\n  const existsExact = (table: any, values: any, condition?: SQL) =>\n    Effect.map(\n      CurrentPasskeyTransaction,\n      (owner) =>\n        sql`exists(select 1 from ${table} where ${both(owner.exact(table, values), condition)})`,\n    );\n\n  return {\n    unavailable,\n    invariant,\n    col,\n    equal,\n    copiedRow,\n    matchesNativeRow,\n    nonce,\n    key,\n    credentialKey,\n    handleKey,\n    subjectScope,\n    targetScope,\n    policyStorage,\n    ceremonyStorage,\n    credentialStorage,\n    profileStorage,\n    revisionStorage,\n    sameCredential,\n    sameRevision,\n    semanticCredentialColumns,\n    mappedColumns,\n    observeSemantic,\n    captureMapping,\n    validateMapping,\n    assertNow,\n    existsExact,\n  };\n};\n"],"mappings":";;;;;;;AA8BA,IAAa,4BAAb,cAA+C,QAAQ,QAGrD,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC;AAEtD,MAAa,0BACX,YACA,iBACG;CACH,MAAM,EAAE,iBAAiB,QAAQ;CACjC,MAAM,EAAE,MAAM,wBAAwB;CAEtC,MAAM,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;CAEpD,MAAM,aAAgD,UAAU;EAC9D,IAAI,CAAC,OAAO,MAAM,YAAY;CAChC;CAEA,MAAM,EAAE,KAAK,OAAO,WAAW,qBAAqB,oBAAoB,WAAW;CAEnF,MAAM,cAAc,SAAS,gBAAgB,YAAY,EAAE,CAAC;CAE5D,MAAM,UAAU,IAAI,YAAY;CAEhC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;;CAGxD,MAAM,OAAO,MAAc,WAAkC;EAC3D,MAAM,SAAS,CAAC,yBAAyB,OAAO,OAAO,GAAG,MAAM,CAAC,CAAC,KAAK,UAAU;GAC/E,MAAM,QAAQ,QAAQ,OAAO,KAAK;GAElC,UAAU,QAAQ,OAAO,KAAK,MAAM,KAAK;GAEzC,OAAO;EACT,CAAC;EAED,MAAM,SAAS,IAAI,WAAW,OAAO,QAAQ,MAAM,UAAU,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC;EACxF,MAAM,OAAO,IAAI,SAAS,OAAO,MAAM;EACvC,IAAI,SAAS;EAEb,KAAK,MAAM,SAAS,QAAQ;GAC1B,KAAK,UAAU,QAAQ,MAAM,QAAQ,KAAK;GAC1C,OAAO,IAAI,OAAO,SAAS,CAAC;GAC5B,UAAU,IAAI,MAAM;EACtB;EAEA,OACE,QAAQ,MAAM,KAAK,OAAO,MAAM,IAAI,UAAU,MAAM,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;CAE9F;CAEA,MAAM,iBAAiB,MAAc,OAAe,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;CAEhF,MAAM,aAAa,MAAc,WAAmB,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC;CAEhF,MAAM,gBAAgB,cAAsB,IAAI,WAAW,CAAC,SAAS,CAAC;CAEtE,MAAM,eAAe,aAA8B;EACjD,MAAM,UAAU,SAAS;EAEzB,IAAI,EAAE,YAAY,UAAU,OAAO;EACnC,MAAM,SAAS,QAAQ;EAEvB,OAAO,IAAI,UAAU;GACnB,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO,SAAS;EAClB,CAAC;CACH;;CAGA,MAAM,WACJ,QACA,iBACG;EACH,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;EAE7E,MAAM,UAAU,UAAqB;GACnC,MAAM,OAAO,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,oBAAoB,QAAQ,KAAK,CAAC;GAEhF,UAAU,QAAQ,OAAO,IAAI,CAAC,CAAC,UAAU,YAAY;GAErD,OAAO;EACT;EAEA,OAAO;GACL;GACA,SAAS,SAA6B;IACpC,UAAU,OAAO,SAAS,YAAY,KAAK,WAAW,KAAK,CAAC;IAC5D,UAAU,QAAQ,OAAO,IAAI,CAAC,CAAC,UAAU,YAAY;IACrD,MAAM,QAAQ,oBAAoB,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;IAEjF,UAAU,OAAO,KAAK,MAAM,IAAI;IAEhC,OAAO;GACT;EACF;CACF;CAGA,MAAM,gBAAgB,QAAQ,qBAAqB,OAAe;CAElE,MAAM,kBAAkB,QAAQ,iBAAiB,MAAU;CAE3D,MAAM,oBAAoB,QAAQ,mBAAmB,MAAU;CAE/D,MAAM,iBAAiB,QAAQ,gBAAgB,MAAU;CAEzD,MAAM,kBAAkB,QAAQ,iBAAiB,MAAU;CAE3D,MAAM,kBAAkB,MAAyB,UAA6B;EAC5E,MAAM,YAAY,WAA8B;GAC9C,GAAG;GACH,SAAS;GACT,gBAAgB;GAChB,aAAa;GACb,UAAU;IAAE,GAAG,MAAM;IAAU,aAAa,CAAC;GAAE;EACjD;EAEA,OAAO,kBAAkB,OAAO,SAAS,IAAI,CAAC,MAAM,kBAAkB,OAAO,SAAS,KAAK,CAAC;CAC9F;CAEA,MAAM,gBAAgB,MAAmC,UAAuC;EAC9F,MAAM,QAAQ,IAAI,IAAI,KAAK,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAAC;EAExF,OACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,MAAM,SAAS,KAAK,YAAY,UAChC,IAAI,IAAI,MAAM,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAC1D,MAAM,YAAY,UACpB,MAAM,SAAS,MAAM,YAAY,UACjC,MAAM,YAAY,OAAO,SAAS,MAAM,IAAI,KAAK,YAAY,MAAM,KAAK,QAAQ;CAEpF;CAEA,MAAM,6BAA6B,YACjC;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,KAAK,SAAS,QAAQ,KAAK;CAE/B,MAAM,iBAAiB,YACrB,OAAO,QAAQ,OAAO,CAAC,CACpB,QACE,CAAC,MAAM,WACN,CAAC;EAAC;EAAS;EAAiB;EAAgB;EAAiB;CAAe,CAAC,CAAC,SAC5E,IACF,KAAK,OAAO,UAAU,QAC1B,CAAC,CACA,KAAK,GAAG,WAAW,KAAe;CAEvC,MAAM,mBAAmB,SAAc,OAAY,QACjD,OAAO,IAAI,4BAA4B,UAAU;EAC/C,MAAM,aAAa,KAAK;GACtB,OAAO,QAAQ;GACf;GACA,MAAM,CACJ,OAAO,YACL,0BAA0B,OAAO,CAAC,CAAC,KAAK,WAAW,CAAC,QAAQ,IAAI,OAAO,CAAC,CAC1E,CACF;EACF,CAAC;CACH,CAAC;;CAGH,MAAM,kBAAqB,UAAgB;EACzC,MAAM,uBAAO,IAAI,IAAqB;EAEtC,MAAM,QAAQ,UAA4B;GACxC,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG,OAAO;GAClF,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,eAAe,KAAK,MAAM,OAAO,WAAW,OAAO;GACvF,MAAM,QAAQ,KAAK,IAAI,KAAK;GAE5B,IAAI,UAAU,KAAA,GAAW,OAAO;GAChC,MAAM,SAAc,MAAM,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC;GAEjD,KAAK,IAAI,OAAO,MAAM;GACtB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,GAAG,OAAO,QAAQ,KAAK,KAAK;GAE5E,OAAO,OAAO,OAAO,MAAM;EAC7B;EAEA,OAAO,KAAK,KAAK;CACnB;CAEA,MAAM,eAAe,QAAa,aAAkB;EAClD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,QAAQ,GAEnD,UAAU,KAAK,UAAU,SAAS,KAAK,MAAM,KAAK,UAAU,OAAO,CAAC;CACxE;CAEA,MAAM,cAAc,UAAe;EACjC,MAAM,UAAU,gBAAgB,MAAM,KAAK;EAE3C,KAAK,MAAM,QAAQ,cAAc,KAAK,GAAG,UAAU,QAAQ,UAAU,KAAA,CAAS;CAChF;CAEA,MAAM,mBACJ,SACA,SACG;EACH,IAAI;GACF,MAAM,OAAO,SAAS,SAAS,UAAU,SAAS,iBAAiB,QAAQ,OAAO,KAAA;GAElF,IAAI,SAAS,KAAA,GAAW;IACtB,KAAK,MAAM,QAAQ;KACjB;KACA;KACA;KACA;KACA;IACF,GACE,WAAW,KAAK,KAAK;IACvB,YAAY,KAAK,aAAa,oCAAoC;GACpE;GACA,IAAI,SAAS,QAAQ;GAErB,OAAO,kBAAkB,eAAe,CAAC,CAAC,QAAQ,QAAQ;GAC1D,WAAW,QAAQ,MAAM;GACzB,UAAU,QAAQ,OAAO,cAAc,SAAS,CAAC;GACjD,KAAK,MAAM,QAAQ,QAAQ,OAAO,eAAe,IAAI,QAAQ,OAAO,OAAO,IAAI;GAC/E,MAAM,yBAAS,IAAI,IAAY;GAE/B,KAAK,MAAM,SAAS,QAAQ,OAAO,UAAU,CAAC,GAAG;IAC/C,UACE,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,UAAU,GACrF;IACA,UAAU,CAAC,OAAO,IAAI,MAAM,KAAK,KAAK,MAAM,QAAQ,SAAS,CAAC;IAC9D,OAAO,IAAI,MAAM,KAAK;IACtB,KAAK,MAAM,QAAQ,MAAM,SAAS,IAAI,MAAM,OAAO,IAAI;GACzD;GACA,UAAU,OAAO,QAAQ,EAAE;GAC3B,IAAI,SAAS,WAAW;GACxB,UACE,OAAO,QAAQ,mBAAmB,YAChC,QAAQ,eAAe,SAAS,KAChC,QAAQ,eAAe,UAAU,GACrC;GACA,KAAK,MAAM,QAAQ;IAAC;IAAQ;IAAa;GAAQ,GAAG,WAAW,QAAQ,KAAK;GAC5E,IAAI,SAAS,gBAAgB;IAC3B,WAAW,QAAQ,MAAM;IACzB,WAAW,QAAQ,MAAM;GAC3B,OAAO,IAAI,QAAQ,KAAK,WAAW,OAAO,QAAQ,UAAU,UAAU;GACtE,YACE,QAAQ,aACR,SAAS,iBACL,iDACA,qCACN;GACA,MAAM,SAAS,OAAO,OAAO,QAAQ,KAAK,MAAM;GAGhD,UAEE,OAAO,WAAW,KAAK,IAAI,IAAI,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CACxF;GACA,KAAK,MAAM,SAAS;IAAC;IAAG;IAAG;IAAW;GAAa,GACjD,UAAU,QAAQ,MAAM,cAAc,QAAQ,MAAM,cAAc,KAAK,CAAC,MAAM,KAAK;EACvF,QAAQ;GACN,MAAM,0BAA0B,KAAK,CAAC,CAAC;EACzC;CACF;CAEA,MAAM,aAAa,cACjB,OAAO,QAAQ,4BAA4B,UACzC,OAAO,IAAI,aAAa;EACtB,UAAU,OAAO,MAAM,MAAM,SAAS,CAAC;EACvC,MAAM,eAAe,KAAK,SAAS;CACrC,CAAC,CACH;CAEF,MAAM,eAAe,OAAY,QAAa,cAC5C,OAAO,IACL,4BACC,UACC,GAAG,wBAAwB,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,MAAM,GAAG,SAAS,EAAE,EAC1F;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/internal/passkey/target.d.mts

@@ -0,0 +1,19 @@
+import { PersistenceMappingError } from "../mapping-error.mjs";
+import "../../drizzle/passkey-model.mjs";
+import "../../drizzle/passkey-registration-ceremony-model.mjs";
+import "../transaction-kernel.mjs";
+import { TransactionCoordinatorError, TransactionTargetConfiguration } from "../transaction-execution-kernel.mjs";
+import "./state.mjs";
+import "./credentials.mjs";
+import "./flow.mjs";
+import "./registration-ceremony.mjs";
+import { Effect, Schema } from "effect";
+import { PasskeyConfigurationError, PasskeyPersistence, PasskeyUnavailable, PreparePasskeyCommit } from "@yielded/auth/Passkey";
+import { LifecycleHooks, PreparedCommit } from "@yielded/auth/Hooks";
+import { Statement } from "effect/unstable/sql/Statement";
+//#region src/internal/passkey/target.d.ts
+type PasskeyTargetConfiguration = TransactionTargetConfiguration<PasskeyUnavailable>;
+type PasskeyCoordinatorError<E> = TransactionCoordinatorError<E, PasskeyUnavailable> | PasskeyConfigurationError | PersistenceMappingError;
+//#endregion
+export { PasskeyCoordinatorError, PasskeyTargetConfiguration };
+//# sourceMappingURL=target.d.mts.map