@yielded/auth 0.1.0-beta.1

package/src/drizzle/passkey-model.ts

@@ -0,0 +1,350 @@
+import type { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+import { Effect, Layer } from "effect";
+
+import type { PasskeyCeremony, PasskeyCredential } from "../passkey/models";
+import { PasskeyCredentials } from "../passkey/PasskeyCredentials";
+import { PasskeyEnrollmentContext } from "../passkey/PasskeyEnrollmentContext";
+import { PasskeyPersistence } from "../passkey/PasskeyPersistence";
+import type { PasskeyMethodPolicy } from "../passkey/policy";
+import type { SubjectId } from "../Schema";
+import type { DrizzleMappingError } from "./model";
+
+export type PasskeyColumn<T extends Table> = Extract<keyof T["_"]["columns"], string>;
+
+export type PasskeyMappingSource<M, RSetup = never> =
+  | M
+  | Effect.Effect<M, DrizzleMappingError, RSetup>;
+
+export interface PasskeyCredentialServices {
+  readonly passkeyCredentials: PasskeyCredentials["Service"];
+}
+
+export interface PasskeyPersistenceServices {
+  readonly passkeyPersistence: PasskeyPersistence["Service"];
+}
+
+export interface PasskeyEnrollmentContextServices {
+  readonly passkeyEnrollmentContext: PasskeyEnrollmentContext["Service"];
+}
+
+export const passkeyCredentialsLayer = <E, R>(
+  services: Effect.Effect<PasskeyCredentialServices, E, R>,
+): Layer.Layer<PasskeyCredentials, E, R> =>
+  Layer.effect(
+    PasskeyCredentials,
+    Effect.map(services, (value) => value.passkeyCredentials),
+  );
+
+export const passkeyPersistenceLayer = <E, R>(
+  services: Effect.Effect<PasskeyPersistenceServices, E, R>,
+): Layer.Layer<PasskeyPersistence, E, R> =>
+  Layer.effect(
+    PasskeyPersistence,
+    Effect.map(services, (value) => value.passkeyPersistence),
+  );
+
+export const passkeyEnrollmentContextLayer = <E, R>(
+  services: Effect.Effect<PasskeyEnrollmentContextServices, E, R>,
+): Layer.Layer<PasskeyEnrollmentContext, E, R> =>
+  Layer.effect(
+    PasskeyEnrollmentContext,
+    Effect.map(services, (value) => value.passkeyEnrollmentContext),
+  );
+
+/** Native IDs roundtrip exactly; protocol IDs and authentication references are
+ * different identities. These callbacks never suspend inside an owner. */
+export interface PasskeySubjectIdCodec<N> {
+  readonly toNative: (id: SubjectId) => N;
+  readonly toSubject: (id: N) => SubjectId;
+  readonly equals: (left: N, right: N) => boolean;
+}
+
+export interface PasskeyClock {
+  readonly encodeInstant: (millis: number) => unknown;
+  readonly decodeInstant: (value: unknown) => number;
+  readonly engineNowMillis: SQL;
+  readonly toMillis: (expression: SQL) => SQL;
+  readonly fromMillis: (expression: SQL) => SQL;
+}
+
+export interface PasskeySubjectReadTable<T extends Table, N> {
+  readonly table: T;
+  readonly id: PasskeyColumn<T>;
+  readonly status: PasskeyColumn<T>;
+  readonly securityRevision: PasskeyColumn<T>;
+  readonly decodeId: (row: Readonly<Partial<InferSelectModel<T>>>) => N;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: SQL;
+}
+
+export interface PasskeyFactorReadTable<T extends Table> {
+  readonly table: T;
+  readonly subjectId: PasskeyColumn<T>;
+  readonly credentialId: PasskeyColumn<T>;
+  readonly revision: PasskeyColumn<T>;
+  readonly status: PasskeyColumn<T>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: SQL;
+}
+
+/** decode uses only these declared columns. Counter columns are native integral
+ * numbers; BS may use a consumer enum. Name/creation metadata is not required. */
+export interface PasskeyCredentialReadTable<T extends Table, N> {
+  readonly table: T;
+  readonly credentialId: PasskeyColumn<T>;
+  readonly subjectId: PasskeyColumn<T>;
+  readonly rpId: PasskeyColumn<T>;
+  readonly protocolCredentialId: PasskeyColumn<T>;
+  readonly credentialKey: PasskeyColumn<T>;
+  readonly handleKey: PasskeyColumn<T>;
+  readonly userHandle: PasskeyColumn<T>;
+  readonly publicKey: PasskeyColumn<T>;
+  readonly algorithm: PasskeyColumn<T>;
+  readonly profile: PasskeyColumn<T>;
+  readonly credentialRevision: PasskeyColumn<T>;
+  readonly status: PasskeyColumn<T>;
+  readonly primarySignIn: PasskeyColumn<T>;
+  readonly enrollmentUserVerified: PasskeyColumn<T>;
+  readonly backupEligible: PasskeyColumn<T>;
+  readonly backupState: PasskeyColumn<T>;
+  readonly counter: PasskeyColumn<T>;
+  readonly maximumCounter: PasskeyColumn<T>;
+  readonly decode: (
+    row: Readonly<Partial<InferSelectModel<T>>>,
+  ) => Omit<PasskeyCredential, "revision" | "active">;
+  readonly decodeSubjectId: (row: Readonly<Partial<InferSelectModel<T>>>) => N;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: SQL;
+}
+
+export interface PasskeyCredentialOwnershipTable<T extends Table, N> {
+  readonly table: T;
+  readonly credentialKey: PasskeyColumn<T>;
+  readonly rpId: PasskeyColumn<T>;
+  readonly protocolCredentialId: PasskeyColumn<T>;
+  readonly subjectId: PasskeyColumn<T>;
+  readonly credentialId: PasskeyColumn<T>;
+  readonly state: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly reservationId: PasskeyColumn<T>;
+  readonly ownedCondition: SQL;
+  readonly isOwnedState: (value: unknown) => boolean;
+  readonly decodeSubjectId: (row: Readonly<Partial<InferSelectModel<T>>>) => N;
+}
+
+/** Reservations do not manufacture a subject; bound handles are RP-global. */
+export interface PasskeyHandleReadTable<T extends Table> {
+  readonly table: T;
+  readonly handleKey: PasskeyColumn<T>;
+  readonly rpId: PasskeyColumn<T>;
+  readonly userHandle: PasskeyColumn<T>;
+  readonly state: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly reservationId: PasskeyColumn<T>;
+}
+
+export interface PasskeyHandleReservationTable<T extends Table> extends PasskeyHandleReadTable<T> {
+  readonly reservedCondition: SQL;
+  readonly isReservedState: (value: unknown) => boolean;
+}
+
+export interface PasskeyHandleOwnershipTable<T extends Table, N> extends PasskeyHandleReadTable<T> {
+  readonly subjectId: PasskeyColumn<T>;
+  readonly ownedCondition: SQL;
+  readonly isOwnedState: (value: unknown) => boolean;
+  readonly decodeSubjectId: (row: Readonly<Partial<InferSelectModel<T>>>) => N;
+}
+
+export const requiredPasskeyCredentialConstraints = {
+  credentialId: ["credentialId"],
+  factor: ["subjectId", "credentialId"],
+  credentialOwnership: ["credentialKey"],
+  handleOwnership: ["handleKey"],
+  boundSubjectHandle: ["rpId", "subjectId"],
+} as const;
+
+export interface PasskeyCredentialMapping<
+  S extends Table,
+  C extends Table,
+  F extends Table,
+  Ownership extends Table,
+  Handle extends Table,
+  N,
+> {
+  readonly subject: PasskeySubjectReadTable<S, N>;
+  readonly credential: PasskeyCredentialReadTable<C, N>;
+  readonly authority: PasskeyFactorReadTable<F>;
+  readonly credentialOwnership: PasskeyCredentialOwnershipTable<Ownership, N>;
+  readonly handleOwnership: PasskeyHandleOwnershipTable<Handle, N>;
+  readonly subjectIds: PasskeySubjectIdCodec<N>;
+  readonly constraints: typeof requiredPasskeyCredentialConstraints;
+}
+
+/** A stable additional policy row, acquired before RP/credential locks. The
+ * factory checks column names without erasing the consumer table at its input. */
+const PasskeyPolicyGuardTypeId: unique symbol = Symbol("effect-auth/drizzle/PasskeyPolicyGuard");
+
+export interface PasskeyPolicyGuard {
+  readonly [PasskeyPolicyGuardTypeId]: true;
+  readonly scope: string;
+  readonly table: Table;
+  readonly columns: ReadonlyArray<string>;
+  readonly where: (moduleId: string) => SQL;
+  readonly condition: (moduleId: string) => SQL;
+}
+
+export const passkeyPolicyGuard = <T extends Table>(input: {
+  readonly scope: string;
+  readonly table: T;
+  readonly columns: ReadonlyArray<PasskeyColumn<T>>;
+  readonly where: (moduleId: string) => SQL;
+  readonly condition: (moduleId: string) => SQL;
+}): PasskeyPolicyGuard => ({ ...input, [PasskeyPolicyGuardTypeId]: true });
+
+export interface PasskeyModuleTable<T extends Table> {
+  readonly table: T;
+  readonly moduleId: PasskeyColumn<T>;
+  readonly status: PasskeyColumn<T>;
+  readonly policyRevision: PasskeyColumn<T>;
+  /** All physical fields used by decodeMethodPolicy, including policyRevision. */
+  readonly policyColumns: ReadonlyArray<PasskeyColumn<T>>;
+  readonly isActiveStatus: (value: unknown) => boolean;
+  readonly activeCondition: SQL;
+  readonly decodeMethodPolicy: (row: Readonly<Partial<InferSelectModel<T>>>) => PasskeyMethodPolicy;
+  readonly guards?: ReadonlyArray<PasskeyPolicyGuard>;
+}
+
+export type PasskeyFlowState =
+  | "Pending"
+  | "Claimed"
+  | "Verified"
+  | "Rejected"
+  | "Ambiguous"
+  | "RegistrationAccepted"
+  | "ProvisioningPending";
+
+export interface PasskeyFlowInsert {
+  readonly ceremony: PasskeyCeremony;
+  readonly policy: PasskeyMethodPolicy;
+  readonly marker: string;
+}
+
+export interface PasskeyFlowTable<T extends Table> {
+  readonly table: T;
+  readonly moduleId: PasskeyColumn<T>;
+  readonly flowId: PasskeyColumn<T>;
+  readonly commandId: PasskeyColumn<T>;
+  readonly purpose: PasskeyColumn<T>;
+  readonly state: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly generation: PasskeyColumn<T>;
+  readonly snapshot: PasskeyColumn<T>;
+  readonly policySnapshot: PasskeyColumn<T>;
+  readonly requestBindingVerifier: PasskeyColumn<T>;
+  readonly requestBindingExpiresAt: PasskeyColumn<T>;
+  readonly issuedAt: PasskeyColumn<T>;
+  readonly expiresAt: PasskeyColumn<T>;
+  readonly retentionUntil: PasskeyColumn<T>;
+  readonly claimId: PasskeyColumn<T>;
+  readonly claimedAt: PasskeyColumn<T>;
+  readonly claimExpiresAt: PasskeyColumn<T>;
+  readonly credentialSnapshot: PasskeyColumn<T>;
+  /** Core SubjectId scope text, not a consumer's native subject ID. */
+  readonly subjectScope: PasskeyColumn<T>;
+  readonly targetScope: PasskeyColumn<T>;
+  readonly states: Readonly<Record<PasskeyFlowState, unknown>>;
+  readonly encodeInsert: (input: PasskeyFlowInsert) => InferInsertModel<T>;
+}
+
+export interface PasskeyAdmissionTable<T extends Table> {
+  readonly table: T;
+  readonly authorityScope: PasskeyColumn<T>;
+  readonly moduleId: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly ownerMarker: PasskeyColumn<T>;
+  /** One physical clock sample, reused by every charge of this decision. */
+  readonly admittedAt: PasskeyColumn<T>;
+}
+
+export type PasskeyChargeKind = "global" | "subject" | "target";
+
+export interface PasskeyChargeInsert {
+  readonly moduleId: string;
+  readonly flowId: string;
+  readonly purpose: PasskeyCeremony["purpose"];
+  readonly kind: PasskeyChargeKind;
+  readonly scope: string;
+  readonly originalWindowMillis: number;
+  readonly marker: string;
+}
+
+/** Charge scope is canonical core identity text; this subject-free descriptor
+ * can count all purposes without decoding any unrelated native subject. */
+export interface PasskeyChargeTable<T extends Table> {
+  readonly table: T;
+  readonly moduleId: PasskeyColumn<T>;
+  readonly flowId: PasskeyColumn<T>;
+  readonly purpose: PasskeyColumn<T>;
+  readonly kind: PasskeyColumn<T>;
+  readonly scope: PasskeyColumn<T>;
+  readonly originalWindowMillis: PasskeyColumn<T>;
+  readonly admittedAt: PasskeyColumn<T>;
+  readonly retainUntil: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly ownerMarker: PasskeyColumn<T>;
+  readonly encodeInsert: (input: PasskeyChargeInsert) => InferInsertModel<T>;
+}
+
+export const requiredPasskeyPersistenceConstraints = {
+  flow: ["moduleId", "flowId"],
+  command: ["moduleId", "commandId"],
+  admission: ["authorityScope", "moduleId"],
+  charge: ["moduleId", "flowId", "kind"],
+} as const;
+
+export interface PasskeyCeremonyMapping<
+  Module extends Table,
+  Flow extends Table,
+  Admission extends Table,
+  Charge extends Table,
+> {
+  readonly moduleId: string;
+  readonly authorityScope: string;
+  readonly module: PasskeyModuleTable<Module>;
+  readonly flow: PasskeyFlowTable<Flow>;
+  readonly admission: PasskeyAdmissionTable<Admission>;
+  readonly charge: PasskeyChargeTable<Charge>;
+  readonly clock: PasskeyClock;
+  readonly constraints: typeof requiredPasskeyPersistenceConstraints;
+}
+
+type CredentialTable<Read> = Read extends {
+  readonly credential: { readonly table: infer T extends Table };
+}
+  ? T
+  : never;
+
+export interface PasskeyPersistenceMapping<
+  Read,
+  Module extends Table,
+  Flow extends Table,
+  Admission extends Table,
+  Charge extends Table,
+  N,
+> extends PasskeyCeremonyMapping<Module, Flow, Admission, Charge> {
+  readonly read: Read & { readonly subjectIds: PasskeySubjectIdCodec<N> };
+  readonly telemetry: {
+    readonly lastUsedAt: PasskeyColumn<CredentialTable<Read>>;
+    readonly encodeBackupState: (value: boolean) => unknown;
+  };
+}
+
+export interface PasskeyEnrollmentContextMapping<Read, Module extends Table, N> {
+  readonly moduleId: string;
+  readonly read: Read & { readonly subjectIds: PasskeySubjectIdCodec<N> };
+  readonly module: PasskeyModuleTable<Module>;
+}
+
+export interface D1PasskeyMapping {
+  readonly d1: { readonly primary: true };
+}

package/src/drizzle/passkey-registration-ceremony-model.ts

@@ -0,0 +1,69 @@
+import type { SQL, Table } from "drizzle-orm";
+
+import type {
+  PasskeyCeremonyMapping,
+  PasskeyChargeTable,
+  PasskeyColumn,
+  PasskeyFlowTable,
+  PasskeyHandleReservationTable,
+  PasskeyPersistenceServices,
+} from "./passkey-model";
+
+export interface PasskeyRegistrationCeremonyCapabilities {
+  readonly purposes: readonly ["registration"];
+  readonly issue: "registration-authority";
+  readonly assertionSettlement: false;
+}
+
+export interface PasskeyRegistrationCeremonyServices extends PasskeyPersistenceServices {
+  readonly capabilities: PasskeyRegistrationCeremonyCapabilities;
+}
+
+/** Read-only custody supplied by a separate registration issuance authority.
+ * No application payload codec, subject codec or provisioning callback runs here. */
+export interface PasskeyRegistrationIntentReadTable<T extends Table> {
+  readonly table: T;
+  readonly moduleId: PasskeyColumn<T>;
+  readonly flowId: PasskeyColumn<T>;
+  readonly commandId: PasskeyColumn<T>;
+  readonly state: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly fingerprint: PasskeyColumn<T>;
+  readonly handleKey: PasskeyColumn<T>;
+  readonly reservationId: PasskeyColumn<T>;
+  readonly ceremonySnapshot: PasskeyColumn<T>;
+  /** Already validated by the issuing authority; compare opaque bytes only. */
+  readonly applicationSnapshot: PasskeyColumn<T>;
+  readonly pendingCondition: SQL;
+  readonly isPendingState: (value: unknown) => boolean;
+  /** Any unresolved initial intent or provisioning job; cleanup never releases it. */
+  readonly custodyCondition: SQL;
+}
+
+export const requiredPasskeyRegistrationCeremonyConstraints = {
+  flow: ["moduleId", "flowId"],
+  command: ["moduleId", "commandId"],
+  admission: ["authorityScope", "moduleId"],
+  charge: ["moduleId", "flowId", "kind"],
+  intentFlow: ["moduleId", "flowId"],
+  intentCommand: ["moduleId", "commandId"],
+  handle: ["handleKey"],
+} as const;
+
+export interface PasskeyRegistrationCeremonyMapping<
+  Module extends Table,
+  Flow extends Table,
+  Admission extends Table,
+  Charge extends Table,
+  Intent extends Table,
+  Handle extends Table,
+> extends Omit<
+  PasskeyCeremonyMapping<Module, Flow, Admission, Charge>,
+  "constraints" | "flow" | "charge"
+> {
+  readonly flow: Omit<PasskeyFlowTable<Flow>, "encodeInsert">;
+  readonly charge: Omit<PasskeyChargeTable<Charge>, "encodeInsert">;
+  readonly intent: PasskeyRegistrationIntentReadTable<Intent>;
+  readonly handle: PasskeyHandleReservationTable<Handle>;
+  readonly constraints: typeof requiredPasskeyRegistrationCeremonyConstraints;
+}

package/src/drizzle/passkey-registration-ceremony.ts

@@ -0,0 +1,254 @@
+/* oxlint-disable no-explicit-any -- private mapped-row kernel; public descriptors retain concrete tables. */
+import { sql } from "drizzle-orm";
+import { Effect } from "effect";
+
+import { PasskeyClaim, type PasskeyAccess, type PasskeyCeremony } from "../passkey/models";
+import type { PasskeyMethodPolicy } from "../passkey/policy";
+import { snapshotPasskeySync } from "../passkey/snapshot";
+import {
+  admissionCondition,
+  guardAdmission,
+  guardChargeSet,
+  lockAdmission,
+  readCharges,
+} from "./passkey-admission";
+import { readModule, readPolicyGuards } from "./passkey-credentials";
+import {
+  compatiblePolicy,
+  liveCondition,
+  matchesAccess,
+  readFlow,
+  terminalFlow,
+} from "./passkey-flow";
+import { releaseRegistrationCustody } from "./passkey-registration-custody";
+import {
+  ceremonyStorage,
+  equal,
+  handleKey,
+  invariant,
+  mappedColumns,
+  policyStorage,
+  CurrentPasskeyTransaction,
+} from "./passkey-state";
+import { both } from "./transaction-owner";
+
+/** The issuing registration authority owns the application value and reservation.
+ * This facet only compares its opaque custody and cannot issue or provision. */
+const custody = Effect.fn("passkey.registrationCustody")(function* (
+  mapping: any,
+  ceremony: PasskeyCeremony,
+  pending: boolean,
+) {
+  const owner = yield* CurrentPasskeyTransaction;
+
+  invariant(ceremony.context._tag === "Registration");
+
+  const context = ceremony.context,
+    intent = mapping.intent,
+    handle = mapping.handle;
+
+  const identity = { [intent.moduleId]: mapping.moduleId, [intent.flowId]: ceremony.flowId };
+
+  const advisory = (yield* owner.read(intent.table, equal(intent.table, identity), {
+    limit: 1,
+    lock: false,
+    observe: false,
+  })).rows[0];
+
+  if (advisory === undefined) return false;
+  const hashedHandle = handleKey(ceremony.profile.rpId, context.userHandle);
+
+  const held = (yield* owner.read(
+    handle.table,
+    equal(handle.table, { [handle.handleKey]: hashedHandle }),
+    { limit: 1, columns: mappedColumns(handle) },
+  )).rows[0];
+
+  if (
+    held === undefined ||
+    !handle.isReservedState(held[handle.state]) ||
+    held[handle.handleKey] !== hashedHandle ||
+    held[handle.rpId] !== ceremony.profile.rpId ||
+    held[handle.userHandle] !== context.userHandle ||
+    held[handle.reservationId] !== advisory[intent.reservationId]
+  )
+    return false;
+  const heldCondition = sql`exists (select 1 from ${handle.table} where ${both(owner.exact(handle.table, held), handle.reservedCondition)})`;
+
+  if (!(yield* owner.check(heldCondition))) return false;
+
+  const row = (yield* owner.read(intent.table, equal(intent.table, identity), {
+    limit: 1,
+    columns: mappedColumns(intent),
+  })).rows[0];
+
+  if (
+    row === undefined ||
+    row[intent.commandId] !== ceremony.commandId ||
+    row[intent.fingerprint] !== context.fingerprint ||
+    row[intent.handleKey] !== hashedHandle ||
+    row[intent.reservationId] !== held[handle.reservationId] ||
+    row[intent.ceremonySnapshot] !== ceremonyStorage.encode(ceremony) ||
+    typeof row[intent.applicationSnapshot] !== "string" ||
+    new TextEncoder().encode(row[intent.applicationSnapshot]).length > 1048576 ||
+    (pending && !intent.isPendingState(row[intent.state]))
+  )
+    return false;
+  const condition = pending ? intent.pendingCondition : intent.custodyCondition;
+
+  if (
+    !(yield* owner.check(
+      sql`exists (select 1 from ${intent.table} where ${both(owner.exact(intent.table, row), condition)})`,
+    ))
+  )
+    return false;
+
+  return [
+    heldCondition,
+    sql`exists (select 1 from ${intent.table} where ${both(owner.exact(intent.table, row), condition)})`,
+  ];
+});
+
+export const contextRegistration = Effect.fn("passkey.contextRegistration")(function* (
+  mapping: any,
+  access: PasskeyAccess,
+) {
+  const owner = yield* CurrentPasskeyTransaction;
+
+  if (access.moduleId !== mapping.moduleId) return undefined;
+  const current = yield* readModule(mapping);
+
+  if (current === undefined) return undefined;
+  yield* readPolicyGuards(mapping);
+  const table = mapping.flow;
+
+  const advisory = (yield* owner.read(
+    table.table,
+    equal(table.table, { [table.moduleId]: mapping.moduleId, [table.flowId]: access.flowId }),
+    { limit: 1, lock: false, observe: false },
+  )).rows[0];
+
+  if (advisory === undefined) return undefined;
+  const ceremony = ceremonyStorage.decode(advisory[table.snapshot]);
+
+  if (ceremony.purpose !== "registration" || !matchesAccess(ceremony, access)) return undefined;
+  const held = yield* custody(mapping, ceremony, true);
+
+  if (!held) return undefined;
+  const read = yield* readFlow(mapping, access.flowId);
+
+  if (
+    read === undefined ||
+    read.state !== "Pending" ||
+    ceremonyStorage.encode(read.ceremony) !== ceremonyStorage.encode(ceremony) ||
+    !compatiblePolicy(read.ceremony, read.policy, current) ||
+    !(yield* owner.check(liveCondition(mapping, ceremony)))
+  )
+    return undefined;
+  owner.postconditions.push(...held, liveCondition(mapping, ceremony));
+
+  return read.ceremony;
+});
+
+export const claimRegistration = Effect.fn("passkey.claimRegistration")(function* (
+  mapping: any,
+  input: {
+    readonly access: PasskeyAccess;
+    readonly policy: PasskeyMethodPolicy;
+    readonly ceremony: PasskeyCeremony;
+    readonly claimId: string;
+  },
+) {
+  const owner = yield* CurrentPasskeyTransaction;
+  const current = yield* readModule(mapping);
+
+  if (current === undefined || input.access.moduleId !== mapping.moduleId)
+    return { _tag: "Rejected" } as const;
+  yield* lockAdmission(mapping);
+  yield* readPolicyGuards(mapping);
+  const held = yield* custody(mapping, input.ceremony, true);
+  const read = yield* readFlow(mapping, input.access.flowId);
+
+  if (read === undefined || read.state !== "Pending" || !matchesAccess(read.ceremony, input.access))
+    return { _tag: "Rejected" } as const;
+  invariant(ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(input.ceremony));
+  if (
+    !held ||
+    !compatiblePolicy(read.ceremony, read.policy, current) ||
+    policyStorage.encode(current) !== policyStorage.encode(input.policy) ||
+    !(yield* owner.check(liveCondition(mapping, read.ceremony))) ||
+    !(yield* owner.check(
+      admissionCondition(
+        mapping,
+        [read.policy, current],
+        read.ceremony,
+        undefined,
+        [],
+        false,
+        false,
+      ),
+    ))
+  ) {
+    if (held) yield* releaseRegistrationCustody(mapping, read.ceremony);
+    yield* terminalFlow(mapping, read, "Rejected");
+
+    return { _tag: "Rejected" } as const;
+  }
+  yield* readCharges(mapping, read.ceremony, read.policy, undefined);
+  const claimedAtMillis = yield* owner.now(mapping.clock);
+
+  const claim = snapshotPasskeySync(PasskeyClaim, {
+    ceremony: read.ceremony,
+    claimId: input.claimId,
+    claimedAtMillis,
+    claimExpiresAtMillis: Math.min(
+      claimedAtMillis + read.ceremony.claimLifetimeMillis,
+      read.ceremony.expiresAtMillis,
+    ),
+  });
+
+  const table = mapping.flow;
+
+  yield* owner.update(
+    table.table,
+    { [table.moduleId]: mapping.moduleId, [table.flowId]: read.ceremony.flowId },
+    {
+      [table.state]: table.states.Claimed,
+      [table.version]: owner.marker,
+      [table.claimId]: claim.claimId,
+      [table.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),
+      [table.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),
+    },
+  );
+  yield* guardChargeSet(mapping, read.ceremony, undefined);
+  yield* guardAdmission(mapping, [read.policy, current], read.ceremony, undefined);
+  owner.postconditions.push(...held, liveCondition(mapping, read.ceremony, claim));
+
+  return { _tag: "Claimed", claim } as const;
+});
+
+export const settleRegistration = Effect.fn("passkey.settleRegistration")(function* (
+  mapping: any,
+  claim: PasskeyClaim,
+  outcome: "Rejected" | "Ambiguous",
+) {
+  yield* readModule(mapping);
+  yield* lockAdmission(mapping);
+  yield* readPolicyGuards(mapping);
+  const read = yield* readFlow(mapping, claim.ceremony.flowId);
+
+  if (
+    read === undefined ||
+    read.state !== "Claimed" ||
+    read.claim === undefined ||
+    read.claim.claimId !== claim.claimId ||
+    read.claim.claimedAtMillis !== claim.claimedAtMillis ||
+    read.claim.claimExpiresAtMillis !== claim.claimExpiresAtMillis ||
+    ceremonyStorage.encode(read.ceremony) !== ceremonyStorage.encode(claim.ceremony)
+  )
+    return "Rejected" as const;
+
+  if (outcome === "Rejected") yield* releaseRegistrationCustody(mapping, claim.ceremony);
+
+  return yield* terminalFlow(mapping, read, outcome);
+});