@yielded/auth 0.1.0-beta.1

package/dist/drizzle/passkey-admission.mjs

@@ -0,0 +1,203 @@
+import { both } from "./transaction-owner.mjs";
+import { CurrentPasskeyTransaction, col, equal, existsExact, invariant, key, mappedColumns, subjectScope, targetScope } from "./passkey-state.mjs";
+import { Effect } from "effect";
+import { sql } from "drizzle-orm";
+//#region src/drizzle/passkey-admission.ts
+const chargeRetentionMillis = 864e5;
+const chargeScopes = (ceremony, subjectId) => {
+	const scopes = [{
+		kind: "global",
+		scope: key("global", [ceremony.moduleId])
+	}];
+	if (subjectId !== void 0) scopes.push({
+		kind: "subject",
+		scope: subjectScope(subjectId)
+	});
+	const target = targetScope(ceremony);
+	if (target !== null) scopes.push({
+		kind: "target",
+		scope: target
+	});
+	return scopes;
+};
+const lockAdmission = Effect.fn("passkey.lockAdmission")(function* (mapping) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const table = mapping.admission;
+	const identity = {
+		[table.authorityScope]: mapping.authorityScope,
+		[table.moduleId]: mapping.moduleId
+	};
+	const found = yield* owner.read(table.table, equal(table.table, identity), {
+		limit: 1,
+		observe: false,
+		columns: [table.authorityScope, table.moduleId]
+	});
+	invariant(found.rows.length === 1);
+	invariant(found.rows[0][table.authorityScope] === mapping.authorityScope && found.rows[0][table.moduleId] === mapping.moduleId);
+	const marked = {
+		...identity,
+		[table.version]: owner.marker,
+		[table.ownerMarker]: owner.marker
+	};
+	yield* owner.updateGuarded(table.table, owner.exact(table.table, identity), {
+		[table.version]: owner.marker,
+		[table.ownerMarker]: owner.marker,
+		[table.admittedAt]: null
+	}, {
+		rows: 1,
+		postcondition: yield* existsExact(table.table, marked)
+	});
+});
+const pendingCount = (mapping, scope) => {
+	const table = mapping.flow;
+	return sql`(select count(*) from ${table.table} where ${both(equal(table.table, { [table.moduleId]: mapping.moduleId }), sql`${col(table.table, table.state)} in (${table.states.Pending}, ${table.states.Claimed})`, scope === void 0 ? void 0 : equal(table.table, { [table.subjectScope]: scope }))})`;
+};
+const chargedCount = (mapping, kind, scope, window) => {
+	const table = mapping.charge;
+	const clock = mapping.clock;
+	return sql`(select count(*) from ${table.table} where ${both(equal(table.table, {
+		[table.moduleId]: mapping.moduleId,
+		[table.kind]: kind
+	}), kind === "global" ? void 0 : equal(table.table, { [table.scope]: scope }), sql`${col(table.table, table.admittedAt)} is not null`, sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} > ${clock.engineNowMillis} - ${window}`)})`;
+};
+const admissionCondition = (mapping, policies, ceremony, subjectId, added, newFlow, resolvedSubject) => both(...policies.flatMap((policy) => [
+	sql`${pendingCount(mapping)} + ${newFlow ? 1 : 0} <= ${policy.maximumPending}`,
+	subjectId === void 0 ? void 0 : sql`${pendingCount(mapping, subjectScope(subjectId))} + ${newFlow || resolvedSubject ? 1 : 0} <= ${policy.maximumPendingPerSubject}`,
+	...chargeScopes(ceremony, subjectId).map(({ kind, scope }) => sql`${chargedCount(mapping, kind, scope, policy.admission[kind].windowMillis)} + ${added.includes(kind) ? 1 : 0} <= ${policy.admission[kind].limit}`)
+]));
+const guardAdmission = (mapping, policies, ceremony, subjectId) => Effect.map(CurrentPasskeyTransaction, (owner) => {
+	owner.postconditions.push(admissionCondition(mapping, policies, ceremony, subjectId, [], false, false));
+});
+const readCharges = Effect.fn("passkey.readCharges")(function* (mapping, ceremony, policy, subjectId) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const table = mapping.charge;
+	const where = equal(table.table, {
+		[table.moduleId]: ceremony.moduleId,
+		[table.flowId]: ceremony.flowId
+	});
+	const found = yield* owner.read(table.table, where, {
+		limit: 3,
+		observe: false,
+		columns: mappedColumns(table)
+	});
+	const scopes = chargeScopes(ceremony, subjectId);
+	invariant(found.rows.length === scopes.length);
+	for (const { kind, scope } of scopes) {
+		const rows = found.rows.filter((row) => row[table.kind] === kind);
+		invariant(rows.length === 1);
+		const row = rows[0];
+		const admitted = mapping.clock.decodeInstant(row[table.admittedAt]);
+		const retained = mapping.clock.decodeInstant(row[table.retainUntil]);
+		invariant(Number.isSafeInteger(admitted) && admitted >= 0 && retained === admitted + 864e5);
+		invariant(row[table.moduleId] === ceremony.moduleId && row[table.flowId] === ceremony.flowId && row[table.purpose] === ceremony.purpose);
+		invariant(row[table.scope] === scope && row[table.originalWindowMillis] === policy.admission[kind].windowMillis);
+		owner.observations.push({
+			table: table.table,
+			where: equal(table.table, {
+				[table.moduleId]: ceremony.moduleId,
+				[table.flowId]: ceremony.flowId,
+				[table.kind]: kind
+			}),
+			rows: [row]
+		});
+	}
+});
+const guardChargeSet = (mapping, ceremony, subjectId) => Effect.flatMap(CurrentPasskeyTransaction, (owner) => Effect.gen(function* () {
+	const table = mapping.charge;
+	const scopes = chargeScopes(ceremony, subjectId);
+	const where = equal(table.table, {
+		[table.moduleId]: ceremony.moduleId,
+		[table.flowId]: ceremony.flowId
+	});
+	owner.postconditions.push(sql`(select count(*) from ${table.table} where ${where}) = ${scopes.length}`);
+	for (const { kind, scope } of scopes) owner.postconditions.push(yield* existsExact(table.table, {
+		[table.moduleId]: ceremony.moduleId,
+		[table.flowId]: ceremony.flowId,
+		[table.purpose]: ceremony.purpose,
+		[table.kind]: kind,
+		[table.scope]: scope
+	}));
+}));
+const insertCharges = Effect.fn("passkey.insertCharges")(function* (mapping, ceremony, policy, kinds, subjectId) {
+	const owner = yield* CurrentPasskeyTransaction;
+	if (kinds.length === 0) return;
+	const table = mapping.charge;
+	const anchor = mapping.admission;
+	const clock = mapping.clock;
+	const earliest = yield* owner.now(clock);
+	const identities = [];
+	for (const { kind, scope } of chargeScopes(ceremony, subjectId).filter((item) => kinds.includes(item.kind))) {
+		const identity = {
+			[table.moduleId]: ceremony.moduleId,
+			[table.flowId]: ceremony.flowId,
+			[table.kind]: kind
+		};
+		const values = {
+			...table.encodeInsert({
+				moduleId: ceremony.moduleId,
+				flowId: ceremony.flowId,
+				purpose: ceremony.purpose,
+				kind,
+				scope,
+				originalWindowMillis: policy.admission[kind].windowMillis,
+				marker: owner.marker
+			}),
+			...identity,
+			[table.purpose]: ceremony.purpose,
+			[table.scope]: scope,
+			[table.originalWindowMillis]: policy.admission[kind].windowMillis,
+			[table.admittedAt]: null,
+			[table.retainUntil]: null,
+			[table.version]: owner.marker,
+			[table.ownerMarker]: owner.marker
+		};
+		const observation = yield* owner.insert(table.table, values, identity);
+		observation.rows = observation.rows.map((row) => Object.fromEntries(Object.entries(row).filter(([name]) => name !== table.admittedAt && name !== table.retainUntil)));
+		identities.push(identity);
+	}
+	invariant(identities.length === kinds.length);
+	const anchorIdentity = {
+		[anchor.authorityScope]: mapping.authorityScope,
+		[anchor.moduleId]: mapping.moduleId,
+		[anchor.version]: owner.marker,
+		[anchor.ownerMarker]: owner.marker
+	};
+	const stamp = sql`(select ${col(anchor.table, anchor.admittedAt)} from ${anchor.table} where ${owner.exact(anchor.table, anchorIdentity)})`;
+	const stampMillis = clock.toMillis(stamp);
+	const validStamp = both(yield* existsExact(anchor.table, anchorIdentity), sql`${stamp} is not null`, sql`${stampMillis} >= ${earliest}`, sql`${stampMillis} <= ${clock.engineNowMillis}`, sql`${stampMillis} <= ${86399999136e5}`);
+	yield* owner.finalUpdate(anchor.table, owner.exact(anchor.table, {
+		...anchorIdentity,
+		[anchor.admittedAt]: null
+	}), { [anchor.admittedAt]: clock.fromMillis(clock.engineNowMillis) }, {
+		rows: 1,
+		postcondition: validStamp
+	});
+	for (const identity of identities) {
+		const expected = {
+			...identity,
+			[table.version]: owner.marker,
+			[table.ownerMarker]: owner.marker
+		};
+		const postcondition = yield* existsExact(table.table, expected, both(sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} = ${stampMillis}`, sql`${clock.toMillis(sql`${col(table.table, table.retainUntil)}`)} = ${stampMillis} + ${chargeRetentionMillis}`));
+		yield* owner.finalUpdate(table.table, owner.exact(table.table, {
+			...expected,
+			[table.admittedAt]: null,
+			[table.retainUntil]: null
+		}), {
+			[table.admittedAt]: stamp,
+			[table.retainUntil]: clock.fromMillis(sql`${stampMillis} + ${chargeRetentionMillis}`)
+		}, {
+			rows: 1,
+			postcondition
+		});
+	}
+	owner.postconditions.push(sql`(select count(*) from ${table.table} where ${owner.exact(table.table, {
+		[table.moduleId]: ceremony.moduleId,
+		[table.flowId]: ceremony.flowId,
+		[table.ownerMarker]: owner.marker
+	})}) = ${identities.length}`);
+});
+//#endregion
+export { admissionCondition, chargeRetentionMillis, chargeScopes, guardAdmission, guardChargeSet, insertCharges, lockAdmission, readCharges };
+
+//# sourceMappingURL=passkey-admission.mjs.map

package/dist/drizzle/passkey-admission.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-admission.mjs","names":[],"sources":["../../src/drizzle/passkey-admission.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- private typed-mapping execution bridge. */\nimport { sql, type SQL } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport type { PasskeyCeremony } from \"../passkey/models\";\nimport type { PasskeyMethodPolicy } from \"../passkey/policy\";\nimport type { PasskeyChargeKind } from \"./passkey-model\";\nimport {\n  col,\n  equal,\n  existsExact,\n  invariant,\n  key,\n  mappedColumns,\n  subjectScope,\n  targetScope,\n  CurrentPasskeyTransaction,\n} from \"./passkey-state\";\nimport { both } from \"./transaction-owner\";\n\nexport const chargeRetentionMillis = 86_400_000;\n\nexport const chargeScopes = (ceremony: PasskeyCeremony, subjectId?: string) => {\n  const scopes: { kind: PasskeyChargeKind; scope: string }[] = [\n    { kind: \"global\", scope: key(\"global\", [ceremony.moduleId]) },\n  ];\n\n  if (subjectId !== undefined) scopes.push({ kind: \"subject\", scope: subjectScope(subjectId) });\n  const target = targetScope(ceremony);\n\n  if (target !== null) scopes.push({ kind: \"target\", scope: target });\n\n  return scopes;\n};\n\nexport const lockAdmission = Effect.fn(\"passkey.lockAdmission\")(function* (mapping: any) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const table = mapping.admission;\n\n  const identity = {\n    [table.authorityScope]: mapping.authorityScope,\n    [table.moduleId]: mapping.moduleId,\n  };\n\n  // The previous marker/time is telemetry, not an authentication CAS. Actual\n  // engine predicates serialize admission, including separately planned D1 batches.\n  const found = yield* owner.read(table.table, equal(table.table, identity), {\n    limit: 1,\n    observe: false,\n    columns: [table.authorityScope, table.moduleId],\n  });\n\n  invariant(found.rows.length === 1);\n  invariant(\n    found.rows[0]![table.authorityScope] === mapping.authorityScope &&\n      found.rows[0]![table.moduleId] === mapping.moduleId,\n  );\n  const marked = { ...identity, [table.version]: owner.marker, [table.ownerMarker]: owner.marker };\n\n  yield* owner.updateGuarded(\n    table.table,\n    owner.exact(table.table, identity),\n    {\n      [table.version]: owner.marker,\n      [table.ownerMarker]: owner.marker,\n      [table.admittedAt]: null,\n    },\n    { rows: 1, postcondition: yield* existsExact(table.table, marked) },\n  );\n});\n\nconst pendingCount = (mapping: any, scope?: string) => {\n  const table = mapping.flow;\n\n  return sql`(select count(*) from ${table.table} where ${both(\n    equal(table.table, { [table.moduleId]: mapping.moduleId }),\n    sql`${col(table.table, table.state)} in (${table.states.Pending}, ${table.states.Claimed})`,\n    scope === undefined ? undefined : equal(table.table, { [table.subjectScope]: scope }),\n  )})`;\n};\n\nconst chargedCount = (mapping: any, kind: PasskeyChargeKind, scope: string, window: number) => {\n  const table = mapping.charge;\n  const clock = mapping.clock;\n\n  return sql`(select count(*) from ${table.table} where ${both(\n    equal(table.table, { [table.moduleId]: mapping.moduleId, [table.kind]: kind }),\n    kind === \"global\" ? undefined : equal(table.table, { [table.scope]: scope }),\n    sql`${col(table.table, table.admittedAt)} is not null`,\n    sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} > ${clock.engineNowMillis} - ${window}`,\n  )})`;\n};\n\nexport const admissionCondition = (\n  mapping: any,\n  policies: ReadonlyArray<PasskeyMethodPolicy>,\n  ceremony: PasskeyCeremony,\n  subjectId: string | undefined,\n  added: ReadonlyArray<PasskeyChargeKind>,\n  newFlow: boolean,\n  resolvedSubject: boolean,\n) =>\n  both(\n    ...policies.flatMap((policy) => [\n      sql`${pendingCount(mapping)} + ${newFlow ? 1 : 0} <= ${policy.maximumPending}`,\n      subjectId === undefined\n        ? undefined\n        : sql`${pendingCount(mapping, subjectScope(subjectId))} + ${newFlow || resolvedSubject ? 1 : 0} <= ${policy.maximumPendingPerSubject}`,\n      ...chargeScopes(ceremony, subjectId).map(\n        ({ kind, scope }) =>\n          sql`${chargedCount(mapping, kind, scope, policy.admission[kind].windowMillis)} + ${added.includes(kind) ? 1 : 0} <= ${policy.admission[kind].limit}`,\n      ),\n    ]),\n  );\n\nexport const guardAdmission = (\n  mapping: any,\n  policies: ReadonlyArray<PasskeyMethodPolicy>,\n  ceremony: PasskeyCeremony,\n  subjectId?: string,\n) =>\n  Effect.map(CurrentPasskeyTransaction, (owner) => {\n    owner.postconditions.push(\n      admissionCondition(mapping, policies, ceremony, subjectId, [], false, false),\n    );\n  });\n\nexport const readCharges = Effect.fn(\"passkey.readCharges\")(function* (\n  mapping: any,\n  ceremony: PasskeyCeremony,\n  policy: PasskeyMethodPolicy,\n  subjectId?: string,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const table = mapping.charge;\n\n  const where = equal(table.table, {\n    [table.moduleId]: ceremony.moduleId,\n    [table.flowId]: ceremony.flowId,\n  });\n\n  const found = yield* owner.read(table.table, where, {\n    limit: 3,\n    observe: false,\n    columns: mappedColumns(table),\n  });\n\n  const scopes = chargeScopes(ceremony, subjectId);\n\n  invariant(found.rows.length === scopes.length);\n  for (const { kind, scope } of scopes) {\n    const rows = found.rows.filter((row) => row[table.kind] === kind);\n\n    invariant(rows.length === 1);\n    const row = rows[0]!;\n    const admitted = mapping.clock.decodeInstant(row[table.admittedAt]);\n    const retained = mapping.clock.decodeInstant(row[table.retainUntil]);\n\n    invariant(\n      Number.isSafeInteger(admitted) &&\n        admitted >= 0 &&\n        retained === admitted + chargeRetentionMillis,\n    );\n    invariant(\n      row[table.moduleId] === ceremony.moduleId &&\n        row[table.flowId] === ceremony.flowId &&\n        row[table.purpose] === ceremony.purpose,\n    );\n    invariant(\n      row[table.scope] === scope &&\n        row[table.originalWindowMillis] === policy.admission[kind].windowMillis,\n    );\n    owner.observations.push({\n      table: table.table,\n      where: equal(table.table, {\n        [table.moduleId]: ceremony.moduleId,\n        [table.flowId]: ceremony.flowId,\n        [table.kind]: kind,\n      }),\n      rows: [row],\n    });\n  }\n});\n\nexport const guardChargeSet = (mapping: any, ceremony: PasskeyCeremony, subjectId?: string) =>\n  Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n    Effect.gen(function* () {\n      const table = mapping.charge;\n      const scopes = chargeScopes(ceremony, subjectId);\n\n      const where = equal(table.table, {\n        [table.moduleId]: ceremony.moduleId,\n        [table.flowId]: ceremony.flowId,\n      });\n\n      owner.postconditions.push(\n        sql`(select count(*) from ${table.table} where ${where}) = ${scopes.length}`,\n      );\n      for (const { kind, scope } of scopes)\n        owner.postconditions.push(\n          yield* existsExact(table.table, {\n            [table.moduleId]: ceremony.moduleId,\n            [table.flowId]: ceremony.flowId,\n            [table.purpose]: ceremony.purpose,\n            [table.kind]: kind,\n            [table.scope]: scope,\n          }),\n        );\n    }),\n  );\n\nexport const insertCharges = Effect.fn(\"passkey.insertCharges\")(function* (\n  mapping: any,\n  ceremony: PasskeyCeremony,\n  policy: PasskeyMethodPolicy,\n  kinds: ReadonlyArray<PasskeyChargeKind>,\n  subjectId?: string,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n\n  if (kinds.length === 0) return;\n  const table = mapping.charge;\n  const anchor = mapping.admission;\n  const clock = mapping.clock;\n  const earliest = yield* owner.now(clock);\n  const identities: Record<string, unknown>[] = [];\n\n  for (const { kind, scope } of chargeScopes(ceremony, subjectId).filter((item) =>\n    kinds.includes(item.kind),\n  )) {\n    const identity = {\n      [table.moduleId]: ceremony.moduleId,\n      [table.flowId]: ceremony.flowId,\n      [table.kind]: kind,\n    };\n\n    const values = {\n      ...table.encodeInsert({\n        moduleId: ceremony.moduleId,\n        flowId: ceremony.flowId,\n        purpose: ceremony.purpose,\n        kind,\n        scope,\n        originalWindowMillis: policy.admission[kind].windowMillis,\n        marker: owner.marker,\n      }),\n      ...identity,\n      [table.purpose]: ceremony.purpose,\n      [table.scope]: scope,\n      [table.originalWindowMillis]: policy.admission[kind].windowMillis,\n      [table.admittedAt]: null,\n      [table.retainUntil]: null,\n      [table.version]: owner.marker,\n      [table.ownerMarker]: owner.marker,\n    };\n\n    const observation = yield* owner.insert(table.table, values, identity);\n\n    observation.rows = observation.rows.map((row) =>\n      Object.fromEntries(\n        Object.entries(row).filter(\n          ([name]) => name !== table.admittedAt && name !== table.retainUntil,\n        ),\n      ),\n    );\n    identities.push(identity);\n  }\n  invariant(identities.length === kinds.length);\n\n  const anchorIdentity = {\n    [anchor.authorityScope]: mapping.authorityScope,\n    [anchor.moduleId]: mapping.moduleId,\n    [anchor.version]: owner.marker,\n    [anchor.ownerMarker]: owner.marker,\n  };\n\n  const stamp = sql`(select ${col(anchor.table, anchor.admittedAt)} from ${anchor.table} where ${owner.exact(anchor.table, anchorIdentity)})`;\n  const stampMillis = clock.toMillis(stamp);\n\n  const validStamp: SQL = both(\n    yield* existsExact(anchor.table, anchorIdentity),\n    sql`${stamp} is not null`,\n    sql`${stampMillis} >= ${earliest}`,\n    sql`${stampMillis} <= ${clock.engineNowMillis}`,\n    sql`${stampMillis} <= ${8640000000000000 - chargeRetentionMillis}`,\n  );\n\n  yield* owner.finalUpdate(\n    anchor.table,\n    owner.exact(anchor.table, { ...anchorIdentity, [anchor.admittedAt]: null }),\n    {\n      [anchor.admittedAt]: clock.fromMillis(clock.engineNowMillis),\n    },\n    { rows: 1, postcondition: validStamp },\n  );\n  for (const identity of identities) {\n    const expected = {\n      ...identity,\n      [table.version]: owner.marker,\n      [table.ownerMarker]: owner.marker,\n    };\n\n    const postcondition = yield* existsExact(\n      table.table,\n      expected,\n      both(\n        sql`${clock.toMillis(sql`${col(table.table, table.admittedAt)}`)} = ${stampMillis}`,\n        sql`${clock.toMillis(sql`${col(table.table, table.retainUntil)}`)} = ${stampMillis} + ${chargeRetentionMillis}`,\n      ),\n    );\n\n    yield* owner.finalUpdate(\n      table.table,\n      owner.exact(table.table, {\n        ...expected,\n        [table.admittedAt]: null,\n        [table.retainUntil]: null,\n      }),\n      {\n        [table.admittedAt]: stamp,\n        [table.retainUntil]: clock.fromMillis(sql`${stampMillis} + ${chargeRetentionMillis}`),\n      },\n      { rows: 1, postcondition },\n    );\n  }\n  owner.postconditions.push(\n    sql`(select count(*) from ${table.table} where ${owner.exact(table.table, {\n      [table.moduleId]: ceremony.moduleId,\n      [table.flowId]: ceremony.flowId,\n      [table.ownerMarker]: owner.marker,\n    })}) = ${identities.length}`,\n  );\n});\n"],"mappings":";;;;;AAoBA,MAAa,wBAAwB;AAErC,MAAa,gBAAgB,UAA2B,cAAuB;CAC7E,MAAM,SAAuD,CAC3D;EAAE,MAAM;EAAU,OAAO,IAAI,UAAU,CAAC,SAAS,QAAQ,CAAC;CAAE,CAC9D;CAEA,IAAI,cAAc,KAAA,GAAW,OAAO,KAAK;EAAE,MAAM;EAAW,OAAO,aAAa,SAAS;CAAE,CAAC;CAC5F,MAAM,SAAS,YAAY,QAAQ;CAEnC,IAAI,WAAW,MAAM,OAAO,KAAK;EAAE,MAAM;EAAU,OAAO;CAAO,CAAC;CAElE,OAAO;AACT;AAEA,MAAa,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAAW,SAAc;CACvF,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,QAAQ;CAEtB,MAAM,WAAW;GACd,MAAM,iBAAiB,QAAQ;GAC/B,MAAM,WAAW,QAAQ;CAC5B;CAIA,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,OAAO,QAAQ,GAAG;EACzE,OAAO;EACP,SAAS;EACT,SAAS,CAAC,MAAM,gBAAgB,MAAM,QAAQ;CAChD,CAAC;CAED,UAAU,MAAM,KAAK,WAAW,CAAC;CACjC,UACE,MAAM,KAAK,EAAE,CAAE,MAAM,oBAAoB,QAAQ,kBAC/C,MAAM,KAAK,EAAE,CAAE,MAAM,cAAc,QAAQ,QAC/C;CACA,MAAM,SAAS;EAAE,GAAG;GAAW,MAAM,UAAU,MAAM;GAAS,MAAM,cAAc,MAAM;CAAO;CAE/F,OAAO,MAAM,cACX,MAAM,OACN,MAAM,MAAM,MAAM,OAAO,QAAQ,GACjC;GACG,MAAM,UAAU,MAAM;GACtB,MAAM,cAAc,MAAM;GAC1B,MAAM,aAAa;CACtB,GACA;EAAE,MAAM;EAAG,eAAe,OAAO,YAAY,MAAM,OAAO,MAAM;CAAE,CACpE;AACF,CAAC;AAED,MAAM,gBAAgB,SAAc,UAAmB;CACrD,MAAM,QAAQ,QAAQ;CAEtB,OAAO,GAAG,yBAAyB,MAAM,MAAM,SAAS,KACtD,MAAM,MAAM,OAAO,GAAG,MAAM,WAAW,QAAQ,SAAS,CAAC,GACzD,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,OAAO,QAAQ,IAAI,MAAM,OAAO,QAAQ,IACzF,UAAU,KAAA,IAAY,KAAA,IAAY,MAAM,MAAM,OAAO,GAAG,MAAM,eAAe,MAAM,CAAC,CACtF,EAAE;AACJ;AAEA,MAAM,gBAAgB,SAAc,MAAyB,OAAe,WAAmB;CAC7F,MAAM,QAAQ,QAAQ;CACtB,MAAM,QAAQ,QAAQ;CAEtB,OAAO,GAAG,yBAAyB,MAAM,MAAM,SAAS,KACtD,MAAM,MAAM,OAAO;GAAG,MAAM,WAAW,QAAQ;GAAW,MAAM,OAAO;CAAK,CAAC,GAC7E,SAAS,WAAW,KAAA,IAAY,MAAM,MAAM,OAAO,GAAG,MAAM,QAAQ,MAAM,CAAC,GAC3E,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,UAAU,EAAE,eACzC,GAAG,GAAG,MAAM,SAAS,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,UAAU,GAAG,EAAE,KAAK,MAAM,gBAAgB,KAAK,QACnG,EAAE;AACJ;AAEA,MAAa,sBACX,SACA,UACA,UACA,WACA,OACA,SACA,oBAEA,KACE,GAAG,SAAS,SAAS,WAAW;CAC9B,GAAG,GAAG,aAAa,OAAO,EAAE,KAAK,UAAU,IAAI,EAAE,MAAM,OAAO;CAC9D,cAAc,KAAA,IACV,KAAA,IACA,GAAG,GAAG,aAAa,SAAS,aAAa,SAAS,CAAC,EAAE,KAAK,WAAW,kBAAkB,IAAI,EAAE,MAAM,OAAO;CAC9G,GAAG,aAAa,UAAU,SAAS,CAAC,CAAC,KAClC,EAAE,MAAM,YACP,GAAG,GAAG,aAAa,SAAS,MAAM,OAAO,OAAO,UAAU,KAAK,CAAC,YAAY,EAAE,KAAK,MAAM,SAAS,IAAI,IAAI,IAAI,EAAE,MAAM,OAAO,UAAU,KAAK,CAAC,OACjJ;AACF,CAAC,CACH;AAEF,MAAa,kBACX,SACA,UACA,UACA,cAEA,OAAO,IAAI,4BAA4B,UAAU;CAC/C,MAAM,eAAe,KACnB,mBAAmB,SAAS,UAAU,UAAU,WAAW,CAAC,GAAG,OAAO,KAAK,CAC7E;AACF,CAAC;AAEH,MAAa,cAAc,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAC1D,SACA,UACA,QACA,WACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,QAAQ;CAEtB,MAAM,QAAQ,MAAM,MAAM,OAAO;GAC9B,MAAM,WAAW,SAAS;GAC1B,MAAM,SAAS,SAAS;CAC3B,CAAC;CAED,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM,OAAO,OAAO;EAClD,OAAO;EACP,SAAS;EACT,SAAS,cAAc,KAAK;CAC9B,CAAC;CAED,MAAM,SAAS,aAAa,UAAU,SAAS;CAE/C,UAAU,MAAM,KAAK,WAAW,OAAO,MAAM;CAC7C,KAAK,MAAM,EAAE,MAAM,WAAW,QAAQ;EACpC,MAAM,OAAO,MAAM,KAAK,QAAQ,QAAQ,IAAI,MAAM,UAAU,IAAI;EAEhE,UAAU,KAAK,WAAW,CAAC;EAC3B,MAAM,MAAM,KAAK;EACjB,MAAM,WAAW,QAAQ,MAAM,cAAc,IAAI,MAAM,WAAW;EAClE,MAAM,WAAW,QAAQ,MAAM,cAAc,IAAI,MAAM,YAAY;EAEnE,UACE,OAAO,cAAc,QAAQ,KAC3B,YAAY,KACZ,aAAa,WAAA,KACjB;EACA,UACE,IAAI,MAAM,cAAc,SAAS,YAC/B,IAAI,MAAM,YAAY,SAAS,UAC/B,IAAI,MAAM,aAAa,SAAS,OACpC;EACA,UACE,IAAI,MAAM,WAAW,SACnB,IAAI,MAAM,0BAA0B,OAAO,UAAU,KAAK,CAAC,YAC/D;EACA,MAAM,aAAa,KAAK;GACtB,OAAO,MAAM;GACb,OAAO,MAAM,MAAM,OAAO;KACvB,MAAM,WAAW,SAAS;KAC1B,MAAM,SAAS,SAAS;KACxB,MAAM,OAAO;GAChB,CAAC;GACD,MAAM,CAAC,GAAG;EACZ,CAAC;CACH;AACF,CAAC;AAED,MAAa,kBAAkB,SAAc,UAA2B,cACtE,OAAO,QAAQ,4BAA4B,UACzC,OAAO,IAAI,aAAa;CACtB,MAAM,QAAQ,QAAQ;CACtB,MAAM,SAAS,aAAa,UAAU,SAAS;CAE/C,MAAM,QAAQ,MAAM,MAAM,OAAO;GAC9B,MAAM,WAAW,SAAS;GAC1B,MAAM,SAAS,SAAS;CAC3B,CAAC;CAED,MAAM,eAAe,KACnB,GAAG,yBAAyB,MAAM,MAAM,SAAS,MAAM,MAAM,OAAO,QACtE;CACA,KAAK,MAAM,EAAE,MAAM,WAAW,QAC5B,MAAM,eAAe,KACnB,OAAO,YAAY,MAAM,OAAO;GAC7B,MAAM,WAAW,SAAS;GAC1B,MAAM,SAAS,SAAS;GACxB,MAAM,UAAU,SAAS;GACzB,MAAM,OAAO;GACb,MAAM,QAAQ;CACjB,CAAC,CACH;AACJ,CAAC,CACH;AAEF,MAAa,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WAC9D,SACA,UACA,QACA,OACA,WACA;CACA,MAAM,QAAQ,OAAO;CAErB,IAAI,MAAM,WAAW,GAAG;CACxB,MAAM,QAAQ,QAAQ;CACtB,MAAM,SAAS,QAAQ;CACvB,MAAM,QAAQ,QAAQ;CACtB,MAAM,WAAW,OAAO,MAAM,IAAI,KAAK;CACvC,MAAM,aAAwC,CAAC;CAE/C,KAAK,MAAM,EAAE,MAAM,WAAW,aAAa,UAAU,SAAS,CAAC,CAAC,QAAQ,SACtE,MAAM,SAAS,KAAK,IAAI,CAC1B,GAAG;EACD,MAAM,WAAW;IACd,MAAM,WAAW,SAAS;IAC1B,MAAM,SAAS,SAAS;IACxB,MAAM,OAAO;EAChB;EAEA,MAAM,SAAS;GACb,GAAG,MAAM,aAAa;IACpB,UAAU,SAAS;IACnB,QAAQ,SAAS;IACjB,SAAS,SAAS;IAClB;IACA;IACA,sBAAsB,OAAO,UAAU,KAAK,CAAC;IAC7C,QAAQ,MAAM;GAChB,CAAC;GACD,GAAG;IACF,MAAM,UAAU,SAAS;IACzB,MAAM,QAAQ;IACd,MAAM,uBAAuB,OAAO,UAAU,KAAK,CAAC;IACpD,MAAM,aAAa;IACnB,MAAM,cAAc;IACpB,MAAM,UAAU,MAAM;IACtB,MAAM,cAAc,MAAM;EAC7B;EAEA,MAAM,cAAc,OAAO,MAAM,OAAO,MAAM,OAAO,QAAQ,QAAQ;EAErE,YAAY,OAAO,YAAY,KAAK,KAAK,QACvC,OAAO,YACL,OAAO,QAAQ,GAAG,CAAC,CAAC,QACjB,CAAC,UAAU,SAAS,MAAM,cAAc,SAAS,MAAM,WAC1D,CACF,CACF;EACA,WAAW,KAAK,QAAQ;CAC1B;CACA,UAAU,WAAW,WAAW,MAAM,MAAM;CAE5C,MAAM,iBAAiB;GACpB,OAAO,iBAAiB,QAAQ;GAChC,OAAO,WAAW,QAAQ;GAC1B,OAAO,UAAU,MAAM;GACvB,OAAO,cAAc,MAAM;CAC9B;CAEA,MAAM,QAAQ,GAAG,WAAW,IAAI,OAAO,OAAO,OAAO,UAAU,EAAE,QAAQ,OAAO,MAAM,SAAS,MAAM,MAAM,OAAO,OAAO,cAAc,EAAE;CACzI,MAAM,cAAc,MAAM,SAAS,KAAK;CAExC,MAAM,aAAkB,KACtB,OAAO,YAAY,OAAO,OAAO,cAAc,GAC/C,GAAG,GAAG,MAAM,eACZ,GAAG,GAAG,YAAY,MAAM,YACxB,GAAG,GAAG,YAAY,MAAM,MAAM,mBAC9B,GAAG,GAAG,YAAY,MAAM,eAC1B;CAEA,OAAO,MAAM,YACX,OAAO,OACP,MAAM,MAAM,OAAO,OAAO;EAAE,GAAG;GAAiB,OAAO,aAAa;CAAK,CAAC,GAC1E,GACG,OAAO,aAAa,MAAM,WAAW,MAAM,eAAe,EAC7D,GACA;EAAE,MAAM;EAAG,eAAe;CAAW,CACvC;CACA,KAAK,MAAM,YAAY,YAAY;EACjC,MAAM,WAAW;GACf,GAAG;IACF,MAAM,UAAU,MAAM;IACtB,MAAM,cAAc,MAAM;EAC7B;EAEA,MAAM,gBAAgB,OAAO,YAC3B,MAAM,OACN,UACA,KACE,GAAG,GAAG,MAAM,SAAS,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,UAAU,GAAG,EAAE,KAAK,eACtE,GAAG,GAAG,MAAM,SAAS,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,WAAW,GAAG,EAAE,KAAK,YAAY,KAAK,uBAC1F,CACF;EAEA,OAAO,MAAM,YACX,MAAM,OACN,MAAM,MAAM,MAAM,OAAO;GACvB,GAAG;IACF,MAAM,aAAa;IACnB,MAAM,cAAc;EACvB,CAAC,GACD;IACG,MAAM,aAAa;IACnB,MAAM,cAAc,MAAM,WAAW,GAAG,GAAG,YAAY,KAAK,uBAAuB;EACtF,GACA;GAAE,MAAM;GAAG;EAAc,CAC3B;CACF;CACA,MAAM,eAAe,KACnB,GAAG,yBAAyB,MAAM,MAAM,SAAS,MAAM,MAAM,MAAM,OAAO;GACvE,MAAM,WAAW,SAAS;GAC1B,MAAM,SAAS,SAAS;GACxB,MAAM,cAAc,MAAM;CAC7B,CAAC,EAAE,MAAM,WAAW,QACtB;AACF,CAAC"}

package/dist/drizzle/passkey-credentials.mjs

@@ -0,0 +1,239 @@
+import { both } from "./transaction-owner.mjs";
+import { PasskeyCredential, PasskeyDescriptor, PasskeyRevision, PasskeyUserHandle } from "../passkey/models.mjs";
+import { snapshotPasskeySync } from "../passkey/snapshot.mjs";
+import { validatePasskeyPolicy } from "../passkey/policy.mjs";
+import { CurrentPasskeyTransaction, assertNow, col, copiedRow, credentialKey, equal, handleKey, invariant, mappedColumns, matchesNativeRow, observeSemantic, semanticCredentialColumns, unavailable } from "./passkey-state.mjs";
+import { Effect, Schema } from "effect";
+import { asc, inArray, sql } from "drizzle-orm";
+//#region src/drizzle/passkey-credentials.ts
+const readSubject = Effect.fn("passkey.readSubject")(function* (mapping, subjectId) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const descriptor = mapping.subject;
+	const nativeId = mapping.subjectIds.toNative(subjectId);
+	invariant(mapping.subjectIds.toSubject(nativeId) === subjectId);
+	const row = (yield* owner.read(descriptor.table, equal(descriptor.table, { [descriptor.id]: nativeId }), {
+		limit: 1,
+		columns: [
+			descriptor.id,
+			descriptor.status,
+			descriptor.securityRevision
+		]
+	})).rows[0];
+	if (row === void 0 || !descriptor.isActiveStatus(row[descriptor.status])) return void 0;
+	invariant(mapping.subjectIds.equals(descriptor.decodeId(copiedRow(row)), nativeId));
+	const active = sql`exists(select 1 from ${descriptor.table} where ${both(owner.exact(descriptor.table, row), descriptor.activeCondition)})`;
+	if (!(yield* owner.check(active))) return void 0;
+	owner.postconditions.push(active);
+	return {
+		nativeId,
+		subjectId,
+		securityRevision: Schema.decodeUnknownSync(PasskeyRevision.fields.securityRevision)(row[descriptor.securityRevision])
+	};
+});
+const readModule = Effect.fn("passkey.readModule")(function* (mapping) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const descriptor = mapping.module;
+	const columns = [.../* @__PURE__ */ new Set([
+		descriptor.moduleId,
+		descriptor.status,
+		descriptor.policyRevision,
+		...descriptor.policyColumns
+	])];
+	const row = (yield* owner.read(descriptor.table, equal(descriptor.table, { [descriptor.moduleId]: mapping.moduleId }), {
+		limit: 1,
+		columns
+	})).rows[0];
+	if (row === void 0 || !descriptor.isActiveStatus(row[descriptor.status])) return void 0;
+	invariant(row[descriptor.moduleId] === mapping.moduleId);
+	yield* assertNow(sql`exists(select 1 from ${descriptor.table} where ${both(owner.exact(descriptor.table, row), descriptor.activeCondition)})`);
+	return yield* validatePasskeyPolicy(descriptor.decodeMethodPolicy(copiedRow(row))).pipe(Effect.mapError(unavailable));
+});
+const readPolicyGuards = Effect.fn("passkey.readPolicyGuards")(function* (mapping) {
+	const owner = yield* CurrentPasskeyTransaction;
+	for (const guard of [...mapping.module.guards ?? []].sort((a, b) => a.scope < b.scope ? -1 : a.scope > b.scope ? 1 : 0)) {
+		const locked = yield* owner.read(guard.table, guard.where(mapping.moduleId), {
+			limit: 1,
+			columns: guard.columns
+		});
+		invariant(locked.rows.length === 1);
+		yield* assertNow(guard.condition(mapping.moduleId));
+	}
+});
+/** Advisory discovery never locks a tuple before its subject. All fields are
+* reread under the common subject/tuple lock order by readCredential. */
+const discoverSubject = Effect.fn("passkey.discoverSubject")(function* (mapping, rpId, protocolCredentialId) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const descriptor = mapping.credentialOwnership;
+	const row = (yield* owner.read(descriptor.table, equal(descriptor.table, { [descriptor.credentialKey]: credentialKey(rpId, protocolCredentialId) }), {
+		lock: false,
+		observe: false,
+		limit: 1,
+		columns: mappedColumns(descriptor)
+	})).rows[0];
+	if (row === void 0) return void 0;
+	invariant(row[descriptor.rpId] === rpId && row[descriptor.protocolCredentialId] === protocolCredentialId);
+	if (!descriptor.isOwnedState(row[descriptor.state])) return void 0;
+	const native = descriptor.decodeSubjectId(copiedRow(row));
+	const subjectId = mapping.subjectIds.toSubject(native);
+	invariant(mapping.subjectIds.equals(mapping.subjectIds.toNative(subjectId), native));
+	return subjectId;
+});
+const readRevision = Effect.fn("passkey.readRevision")(function* (mapping, subject, ids) {
+	const owner = yield* CurrentPasskeyTransaction;
+	if (ids !== void 0) invariant(ids.length <= 64 && new Set(ids).size === ids.length);
+	const descriptor = mapping.authority;
+	const where = both(equal(descriptor.table, { [descriptor.subjectId]: subject.nativeId }), descriptor.activeCondition, ids === void 0 ? void 0 : ids.length === 0 ? sql`1 = 0` : inArray(col(descriptor.table, descriptor.credentialId), [...ids]));
+	const credentials = (yield* owner.read(descriptor.table, where, {
+		limit: 64,
+		columns: mappedColumns(descriptor),
+		orderBy: asc(col(descriptor.table, descriptor.credentialId))
+	})).rows.map((row) => {
+		invariant(descriptor.isActiveStatus(row[descriptor.status]));
+		return {
+			credentialId: row[descriptor.credentialId],
+			revision: row[descriptor.revision]
+		};
+	});
+	const revision = snapshotPasskeySync(PasskeyRevision, {
+		subjectId: subject.subjectId,
+		securityRevision: subject.securityRevision,
+		credentials
+	});
+	invariant(new Set(revision.credentials.map((item) => item.credentialId)).size === revision.credentials.length);
+	if (ids !== void 0 && (revision.credentials.length !== ids.length || !ids.every((id) => revision.credentials.some((item) => item.credentialId === id)))) return void 0;
+	return revision;
+});
+const readCredential = Effect.fn("passkey.readCredential")(function* (mapping, subject, rpId, protocolCredentialId, ids) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const ownership = mapping.credentialOwnership;
+	const tupleKey = credentialKey(rpId, protocolCredentialId);
+	const tuple = (yield* owner.read(ownership.table, equal(ownership.table, { [ownership.credentialKey]: tupleKey }), {
+		limit: 1,
+		columns: mappedColumns(ownership)
+	})).rows[0];
+	if (tuple === void 0) return void 0;
+	invariant(tuple[ownership.rpId] === rpId && tuple[ownership.protocolCredentialId] === protocolCredentialId);
+	if (!ownership.isOwnedState(tuple[ownership.state])) return void 0;
+	if (!mapping.subjectIds.equals(ownership.decodeSubjectId(copiedRow(tuple)), subject.nativeId)) return void 0;
+	yield* assertNow(sql`exists(select 1 from ${ownership.table} where ${both(owner.exact(ownership.table, tuple), ownership.ownedCondition)})`);
+	const descriptor = mapping.credential;
+	const where = equal(descriptor.table, { [descriptor.credentialId]: tuple[ownership.credentialId] });
+	let row = (yield* owner.read(descriptor.table, where, {
+		limit: 1,
+		lock: false,
+		observe: false,
+		columns: mappedColumns(descriptor)
+	})).rows[0];
+	if (row === void 0) return void 0;
+	if (!descriptor.isActiveStatus(row[descriptor.status])) return void 0;
+	if (!mapping.subjectIds.equals(descriptor.decodeSubjectId(copiedRow(row)), subject.nativeId)) return void 0;
+	let decoded = descriptor.decode(copiedRow(row));
+	const handle = mapping.handleOwnership;
+	const expectedHandleKey = handleKey(rpId, decoded.userHandle);
+	const handleRow = (yield* owner.read(handle.table, equal(handle.table, { [handle.handleKey]: expectedHandleKey }), {
+		limit: 1,
+		columns: mappedColumns(handle)
+	})).rows[0];
+	invariant(row[descriptor.credentialKey] === tupleKey && row[descriptor.handleKey] === expectedHandleKey);
+	if (handleRow === void 0 || !handle.isOwnedState(handleRow[handle.state])) return void 0;
+	invariant(handleRow[handle.rpId] === rpId && handleRow[handle.userHandle] === decoded.userHandle);
+	if (!mapping.subjectIds.equals(handle.decodeSubjectId(copiedRow(handleRow)), subject.nativeId)) return void 0;
+	yield* assertNow(sql`exists(select 1 from ${handle.table} where ${both(owner.exact(handle.table, handleRow), handle.ownedCondition)})`);
+	const locked = (yield* owner.read(descriptor.table, where, {
+		limit: 1,
+		observe: false,
+		columns: mappedColumns(descriptor)
+	})).rows[0];
+	if (locked === void 0) return void 0;
+	invariant(matchesNativeRow(descriptor.table, locked, Object.fromEntries(semanticCredentialColumns(descriptor).map((column) => [column, row[column]]))));
+	row = locked;
+	decoded = descriptor.decode(copiedRow(row));
+	yield* observeSemantic(descriptor, where, row);
+	yield* assertNow(sql`exists(select 1 from ${descriptor.table} where ${both(owner.exact(descriptor.table, {
+		[descriptor.credentialId]: row[descriptor.credentialId],
+		[descriptor.credentialRevision]: row[descriptor.credentialRevision]
+	}), descriptor.activeCondition)})`);
+	const requested = ids === void 0 ? void 0 : [.../* @__PURE__ */ new Set([...ids, decoded.credentialId])].sort();
+	const revision = yield* readRevision(mapping, subject, requested);
+	if (revision === void 0) return void 0;
+	const credential = snapshotPasskeySync(PasskeyCredential, {
+		...decoded,
+		revision,
+		active: true
+	});
+	invariant(credential.rpId === rpId && credential.protocolCredentialId === protocolCredentialId);
+	invariant(credential.credentialId === row[descriptor.credentialId] && credential.credentialId === tuple[ownership.credentialId]);
+	invariant(credential.profile.rpId === rpId && credential.profile.algorithms.includes(credential.algorithm));
+	invariant(credential.counter === Number(row[descriptor.counter]) && credential.maximumCounter === Number(row[descriptor.maximumCounter]));
+	invariant(credential.maximumCounter >= credential.counter && (!credential.backupState || credential.backupEligible));
+	if (!revision.credentials.some((item) => item.credentialId === credential.credentialId && item.revision === row[descriptor.credentialRevision])) return void 0;
+	return {
+		credential,
+		row
+	};
+});
+const lookupCredential = Effect.fn("passkey.lookupCredential")(function* (mapping, rpId, protocolCredentialId) {
+	const subjectId = yield* discoverSubject(mapping, rpId, protocolCredentialId);
+	if (subjectId === void 0) return void 0;
+	const subject = yield* readSubject(mapping, subjectId);
+	if (subject === void 0) return void 0;
+	return (yield* readCredential(mapping, subject, rpId, protocolCredentialId))?.credential;
+});
+const captureEnrollmentContext = Effect.fn("passkey.captureEnrollmentContext")(function* (mapping, input) {
+	const owner = yield* CurrentPasskeyTransaction;
+	if (input.moduleId !== mapping.moduleId) return void 0;
+	const policy = yield* readModule(mapping);
+	if (policy === void 0 || !policy.profiles.some((profile) => profile.rpId === input.rpId)) return void 0;
+	const subject = yield* readSubject(mapping.read, input.subjectId);
+	if (subject === void 0) return void 0;
+	yield* readPolicyGuards(mapping);
+	const handle = mapping.read.handleOwnership;
+	const handleRow = (yield* owner.read(handle.table, both(equal(handle.table, {
+		[handle.rpId]: input.rpId,
+		[handle.subjectId]: subject.nativeId
+	}), handle.ownedCondition), {
+		limit: 1,
+		columns: mappedColumns(handle)
+	})).rows[0];
+	let userHandle;
+	if (handleRow !== void 0) {
+		invariant(handle.isOwnedState(handleRow[handle.state]) && handleRow[handle.rpId] === input.rpId);
+		invariant(mapping.read.subjectIds.equals(handle.decodeSubjectId(copiedRow(handleRow)), subject.nativeId));
+		userHandle = Schema.decodeUnknownSync(PasskeyUserHandle)(handleRow[handle.userHandle]);
+		invariant(handleRow[handle.handleKey] === handleKey(input.rpId, userHandle));
+	}
+	const credential = mapping.read.credential;
+	const credentials = (yield* owner.read(credential.table, both(equal(credential.table, {
+		[credential.rpId]: input.rpId,
+		[credential.subjectId]: subject.nativeId
+	}), credential.activeCondition), {
+		limit: 64,
+		columns: [
+			credential.credentialId,
+			credential.rpId,
+			credential.protocolCredentialId,
+			credential.subjectId,
+			credential.credentialRevision,
+			credential.status
+		],
+		orderBy: asc(col(credential.table, credential.protocolCredentialId))
+	})).rows.map((row) => {
+		invariant(credential.isActiveStatus(row[credential.status]) && row[credential.rpId] === input.rpId);
+		return snapshotPasskeySync(PasskeyDescriptor, {
+			type: "public-key",
+			id: row[credential.protocolCredentialId]
+		});
+	});
+	invariant(new Set(credentials.map((item) => item.id)).size === credentials.length);
+	const revision = yield* readRevision(mapping.read, subject);
+	invariant(revision !== void 0);
+	return {
+		revision,
+		...userHandle === void 0 ? {} : { userHandle },
+		credentials
+	};
+});
+//#endregion
+export { captureEnrollmentContext, discoverSubject, lookupCredential, readCredential, readModule, readPolicyGuards, readRevision, readSubject };
+
+//# sourceMappingURL=passkey-credentials.mjs.map

package/dist/drizzle/passkey-credentials.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-credentials.mjs","names":[],"sources":["../../src/drizzle/passkey-credentials.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- private row bridge; concrete makers retain every table/native-ID type. */\nimport { asc, inArray, sql } from \"drizzle-orm\";\nimport { Effect, Schema } from \"effect\";\n\nimport {\n  PasskeyCredential,\n  PasskeyDescriptor,\n  PasskeyRevision,\n  PasskeyUserHandle,\n} from \"../passkey/models\";\nimport { validatePasskeyPolicy } from \"../passkey/policy\";\nimport { snapshotPasskeySync } from \"../passkey/snapshot\";\nimport type { SubjectId } from \"../Schema\";\nimport {\n  assertNow,\n  col,\n  copiedRow,\n  credentialKey,\n  equal,\n  handleKey,\n  invariant,\n  mappedColumns,\n  observeSemantic,\n  matchesNativeRow,\n  semanticCredentialColumns,\n  CurrentPasskeyTransaction,\n  unavailable,\n} from \"./passkey-state\";\nimport { both } from \"./transaction-owner\";\n\nexport interface SubjectRead {\n  readonly nativeId: unknown;\n  readonly subjectId: SubjectId;\n  readonly securityRevision: typeof PasskeyRevision.Type.securityRevision;\n}\n\nexport const readSubject = Effect.fn(\"passkey.readSubject\")(function* (\n  mapping: any,\n  subjectId: SubjectId,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const descriptor = mapping.subject;\n  const nativeId = mapping.subjectIds.toNative(subjectId);\n\n  invariant(mapping.subjectIds.toSubject(nativeId) === subjectId);\n\n  const found = yield* owner.read(\n    descriptor.table,\n    equal(descriptor.table, { [descriptor.id]: nativeId }),\n    {\n      limit: 1,\n      columns: [descriptor.id, descriptor.status, descriptor.securityRevision],\n    },\n  );\n\n  const row = found.rows[0];\n\n  if (row === undefined || !descriptor.isActiveStatus(row[descriptor.status])) return undefined;\n  invariant(mapping.subjectIds.equals(descriptor.decodeId(copiedRow(row)), nativeId));\n\n  const active = sql`exists(select 1 from ${descriptor.table} where ${both(\n    owner.exact(descriptor.table, row),\n    descriptor.activeCondition,\n  )})`;\n\n  if (!(yield* owner.check(active))) return undefined;\n  owner.postconditions.push(active);\n\n  // oxlint-disable-next-line no-restricted-properties -- native SQL column values enter through this untyped driver boundary.\n  const securityRevision = Schema.decodeUnknownSync(PasskeyRevision.fields.securityRevision)(\n    row[descriptor.securityRevision],\n  );\n\n  return { nativeId, subjectId, securityRevision };\n});\n\nexport const readModule = Effect.fn(\"passkey.readModule\")(function* (mapping: any) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const descriptor = mapping.module;\n\n  const columns = [\n    ...new Set<string>([\n      descriptor.moduleId,\n      descriptor.status,\n      descriptor.policyRevision,\n      ...descriptor.policyColumns,\n    ]),\n  ];\n\n  const found = yield* owner.read(\n    descriptor.table,\n    equal(descriptor.table, { [descriptor.moduleId]: mapping.moduleId }),\n    {\n      limit: 1,\n      columns,\n    },\n  );\n\n  const row = found.rows[0];\n\n  if (row === undefined || !descriptor.isActiveStatus(row[descriptor.status])) return undefined;\n  invariant(row[descriptor.moduleId] === mapping.moduleId);\n  yield* assertNow(\n    sql`exists(select 1 from ${descriptor.table} where ${both(\n      owner.exact(descriptor.table, row),\n      descriptor.activeCondition,\n    )})`,\n  );\n\n  return yield* validatePasskeyPolicy(descriptor.decodeMethodPolicy(copiedRow(row))).pipe(\n    Effect.mapError(unavailable),\n  );\n});\n\nexport const readPolicyGuards = Effect.fn(\"passkey.readPolicyGuards\")(function* (mapping: any) {\n  const owner = yield* CurrentPasskeyTransaction;\n\n  for (const guard of [...(mapping.module.guards ?? [])].sort((a, b) =>\n    a.scope < b.scope ? -1 : a.scope > b.scope ? 1 : 0,\n  )) {\n    const locked = yield* owner.read(guard.table, guard.where(mapping.moduleId), {\n      limit: 1,\n      columns: guard.columns,\n    });\n\n    invariant(locked.rows.length === 1);\n    yield* assertNow(guard.condition(mapping.moduleId));\n  }\n});\n\n/** Advisory discovery never locks a tuple before its subject. All fields are\n * reread under the common subject/tuple lock order by readCredential. */\nexport const discoverSubject = Effect.fn(\"passkey.discoverSubject\")(function* (\n  mapping: any,\n  rpId: string,\n  protocolCredentialId: string,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const descriptor = mapping.credentialOwnership;\n\n  const found = yield* owner.read(\n    descriptor.table,\n    equal(descriptor.table, {\n      [descriptor.credentialKey]: credentialKey(rpId, protocolCredentialId),\n    }),\n    { lock: false, observe: false, limit: 1, columns: mappedColumns(descriptor) },\n  );\n\n  const row = found.rows[0];\n\n  if (row === undefined) return undefined;\n  invariant(\n    row[descriptor.rpId] === rpId && row[descriptor.protocolCredentialId] === protocolCredentialId,\n  );\n  if (!descriptor.isOwnedState(row[descriptor.state])) return undefined;\n  const native = descriptor.decodeSubjectId(copiedRow(row));\n  const subjectId = mapping.subjectIds.toSubject(native);\n\n  invariant(mapping.subjectIds.equals(mapping.subjectIds.toNative(subjectId), native));\n\n  return subjectId as SubjectId;\n});\n\nexport const readRevision = Effect.fn(\"passkey.readRevision\")(function* (\n  mapping: any,\n  subject: SubjectRead,\n  ids?: ReadonlyArray<string>,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n\n  if (ids !== undefined) invariant(ids.length <= 64 && new Set(ids).size === ids.length);\n  const descriptor = mapping.authority;\n\n  const where = both(\n    equal(descriptor.table, { [descriptor.subjectId]: subject.nativeId }),\n    descriptor.activeCondition,\n    ids === undefined\n      ? undefined\n      : ids.length === 0\n        ? sql`1 = 0`\n        : inArray(col(descriptor.table, descriptor.credentialId), [...ids]),\n  );\n\n  const found = yield* owner.read(descriptor.table, where, {\n    limit: 64,\n    columns: mappedColumns(descriptor),\n    orderBy: asc(col(descriptor.table, descriptor.credentialId)),\n  });\n\n  const credentials = found.rows.map((row) => {\n    invariant(descriptor.isActiveStatus(row[descriptor.status]));\n\n    return {\n      credentialId: row[descriptor.credentialId],\n      revision: row[descriptor.revision],\n    };\n  });\n\n  const revision = snapshotPasskeySync(PasskeyRevision, {\n    subjectId: subject.subjectId,\n    securityRevision: subject.securityRevision,\n    credentials,\n  });\n\n  invariant(\n    new Set(revision.credentials.map((item) => item.credentialId)).size ===\n      revision.credentials.length,\n  );\n  if (\n    ids !== undefined &&\n    (revision.credentials.length !== ids.length ||\n      !ids.every((id) => revision.credentials.some((item) => item.credentialId === id)))\n  )\n    return undefined;\n\n  return revision;\n});\n\nexport interface CredentialRead {\n  readonly credential: PasskeyCredential;\n  readonly row: Record<string, unknown>;\n}\n\nexport const readCredential = Effect.fn(\"passkey.readCredential\")(function* (\n  mapping: any,\n  subject: SubjectRead,\n  rpId: string,\n  protocolCredentialId: string,\n  ids?: ReadonlyArray<string>,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const ownership = mapping.credentialOwnership;\n  const tupleKey = credentialKey(rpId, protocolCredentialId);\n\n  const tuple = (yield* owner.read(\n    ownership.table,\n    equal(ownership.table, { [ownership.credentialKey]: tupleKey }),\n    {\n      limit: 1,\n      columns: mappedColumns(ownership),\n    },\n  )).rows[0];\n\n  if (tuple === undefined) return undefined;\n  invariant(\n    tuple[ownership.rpId] === rpId &&\n      tuple[ownership.protocolCredentialId] === protocolCredentialId,\n  );\n  if (!ownership.isOwnedState(tuple[ownership.state])) return undefined;\n  if (!mapping.subjectIds.equals(ownership.decodeSubjectId(copiedRow(tuple)), subject.nativeId))\n    return undefined;\n  yield* assertNow(\n    sql`exists(select 1 from ${ownership.table} where ${both(owner.exact(ownership.table, tuple), ownership.ownedCondition)})`,\n  );\n  const descriptor = mapping.credential;\n\n  const where = equal(descriptor.table, {\n    [descriptor.credentialId]: tuple[ownership.credentialId],\n  });\n\n  let row = (yield* owner.read(descriptor.table, where, {\n    limit: 1,\n    lock: false,\n    observe: false,\n    columns: mappedColumns(descriptor),\n  })).rows[0];\n\n  if (row === undefined) return undefined;\n  if (!descriptor.isActiveStatus(row[descriptor.status])) return undefined;\n  if (!mapping.subjectIds.equals(descriptor.decodeSubjectId(copiedRow(row)), subject.nativeId))\n    return undefined;\n  let decoded = descriptor.decode(copiedRow(row));\n  const handle = mapping.handleOwnership;\n  const expectedHandleKey = handleKey(rpId, decoded.userHandle);\n\n  const handleRow = (yield* owner.read(\n    handle.table,\n    equal(handle.table, { [handle.handleKey]: expectedHandleKey }),\n    {\n      limit: 1,\n      columns: mappedColumns(handle),\n    },\n  )).rows[0];\n\n  invariant(\n    row[descriptor.credentialKey] === tupleKey && row[descriptor.handleKey] === expectedHandleKey,\n  );\n  if (handleRow === undefined || !handle.isOwnedState(handleRow[handle.state])) return undefined;\n  invariant(handleRow[handle.rpId] === rpId && handleRow[handle.userHandle] === decoded.userHandle);\n  if (!mapping.subjectIds.equals(handle.decodeSubjectId(copiedRow(handleRow)), subject.nativeId))\n    return undefined;\n  yield* assertNow(\n    sql`exists(select 1 from ${handle.table} where ${both(owner.exact(handle.table, handleRow), handle.ownedCondition)})`,\n  );\n\n  const locked = (yield* owner.read(descriptor.table, where, {\n    limit: 1,\n    observe: false,\n    columns: mappedColumns(descriptor),\n  })).rows[0];\n\n  if (locked === undefined) return undefined;\n  invariant(\n    matchesNativeRow(\n      descriptor.table,\n      locked,\n      Object.fromEntries(\n        semanticCredentialColumns(descriptor).map((column) => [column, row![column]]),\n      ),\n    ),\n  );\n  row = locked;\n  decoded = descriptor.decode(copiedRow(row));\n  yield* observeSemantic(descriptor, where, row);\n  yield* assertNow(\n    sql`exists(select 1 from ${descriptor.table} where ${both(\n      owner.exact(descriptor.table, {\n        [descriptor.credentialId]: row[descriptor.credentialId],\n        [descriptor.credentialRevision]: row[descriptor.credentialRevision],\n      }),\n      descriptor.activeCondition,\n    )})`,\n  );\n\n  const requested =\n    ids === undefined ? undefined : [...new Set([...ids, decoded.credentialId])].sort();\n\n  const revision = yield* readRevision(mapping, subject, requested);\n\n  if (revision === undefined) return undefined;\n  const credential = snapshotPasskeySync(PasskeyCredential, { ...decoded, revision, active: true });\n\n  invariant(credential.rpId === rpId && credential.protocolCredentialId === protocolCredentialId);\n  invariant(\n    credential.credentialId === row[descriptor.credentialId] &&\n      credential.credentialId === tuple[ownership.credentialId],\n  );\n  invariant(\n    credential.profile.rpId === rpId &&\n      credential.profile.algorithms.includes(credential.algorithm),\n  );\n  invariant(\n    credential.counter === Number(row[descriptor.counter]) &&\n      credential.maximumCounter === Number(row[descriptor.maximumCounter]),\n  );\n  invariant(\n    credential.maximumCounter >= credential.counter &&\n      (!credential.backupState || credential.backupEligible),\n  );\n  if (\n    !revision.credentials.some(\n      (item) =>\n        item.credentialId === credential.credentialId &&\n        item.revision === row[descriptor.credentialRevision],\n    )\n  )\n    return undefined;\n\n  return { credential, row };\n});\n\nexport const lookupCredential = Effect.fn(\"passkey.lookupCredential\")(function* (\n  mapping: any,\n  rpId: string,\n  protocolCredentialId: string,\n) {\n  const subjectId = yield* discoverSubject(mapping, rpId, protocolCredentialId);\n\n  if (subjectId === undefined) return undefined;\n  const subject = yield* readSubject(mapping, subjectId);\n\n  if (subject === undefined) return undefined;\n\n  return (yield* readCredential(mapping, subject, rpId, protocolCredentialId))?.credential;\n});\n\nexport const captureEnrollmentContext = Effect.fn(\"passkey.captureEnrollmentContext\")(function* (\n  mapping: any,\n  input: { readonly moduleId: string; readonly rpId: string; readonly subjectId: SubjectId },\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n\n  if (input.moduleId !== mapping.moduleId) return undefined;\n  const policy = yield* readModule(mapping);\n\n  if (policy === undefined || !policy.profiles.some((profile) => profile.rpId === input.rpId))\n    return undefined;\n  const subject = yield* readSubject(mapping.read, input.subjectId);\n\n  if (subject === undefined) return undefined;\n  yield* readPolicyGuards(mapping);\n  const handle = mapping.read.handleOwnership;\n\n  const handles = yield* owner.read(\n    handle.table,\n    both(\n      equal(handle.table, {\n        [handle.rpId]: input.rpId,\n        [handle.subjectId]: subject.nativeId,\n      }),\n      handle.ownedCondition,\n    ),\n    { limit: 1, columns: mappedColumns(handle) },\n  );\n\n  const handleRow = handles.rows[0];\n  let userHandle: PasskeyUserHandle | undefined;\n\n  if (handleRow !== undefined) {\n    invariant(\n      handle.isOwnedState(handleRow[handle.state]) && handleRow[handle.rpId] === input.rpId,\n    );\n    invariant(\n      mapping.read.subjectIds.equals(\n        handle.decodeSubjectId(copiedRow(handleRow)),\n        subject.nativeId,\n      ),\n    );\n    // oxlint-disable-next-line no-restricted-properties -- native SQL column values enter through this untyped driver boundary.\n    userHandle = Schema.decodeUnknownSync(PasskeyUserHandle)(handleRow[handle.userHandle]);\n    invariant(handleRow[handle.handleKey] === handleKey(input.rpId, userHandle));\n  }\n  const credential = mapping.read.credential;\n\n  const found = yield* owner.read(\n    credential.table,\n    both(\n      equal(credential.table, {\n        [credential.rpId]: input.rpId,\n        [credential.subjectId]: subject.nativeId,\n      }),\n      credential.activeCondition,\n    ),\n    {\n      limit: 64,\n      columns: [\n        credential.credentialId,\n        credential.rpId,\n        credential.protocolCredentialId,\n        credential.subjectId,\n        credential.credentialRevision,\n        credential.status,\n      ],\n      orderBy: asc(col(credential.table, credential.protocolCredentialId)),\n    },\n  );\n\n  const credentials = found.rows.map((row) => {\n    invariant(\n      credential.isActiveStatus(row[credential.status]) && row[credential.rpId] === input.rpId,\n    );\n\n    return snapshotPasskeySync(PasskeyDescriptor, {\n      type: \"public-key\",\n      id: row[credential.protocolCredentialId],\n    });\n  });\n\n  invariant(new Set(credentials.map((item) => item.id)).size === credentials.length);\n  const revision = yield* readRevision(mapping.read, subject);\n\n  invariant(revision !== undefined);\n\n  return { revision, ...(userHandle === undefined ? {} : { userHandle }), credentials };\n});\n"],"mappings":";;;;;;;;AAoCA,MAAa,cAAc,OAAO,GAAG,qBAAqB,CAAC,CAAC,WAC1D,SACA,WACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,aAAa,QAAQ;CAC3B,MAAM,WAAW,QAAQ,WAAW,SAAS,SAAS;CAEtD,UAAU,QAAQ,WAAW,UAAU,QAAQ,MAAM,SAAS;CAW9D,MAAM,OAAM,OATS,MAAM,KACzB,WAAW,OACX,MAAM,WAAW,OAAO,GAAG,WAAW,KAAK,SAAS,CAAC,GACrD;EACE,OAAO;EACP,SAAS;GAAC,WAAW;GAAI,WAAW;GAAQ,WAAW;EAAgB;CACzE,CACF,EAAA,CAEkB,KAAK;CAEvB,IAAI,QAAQ,KAAA,KAAa,CAAC,WAAW,eAAe,IAAI,WAAW,OAAO,GAAG,OAAO,KAAA;CACpF,UAAU,QAAQ,WAAW,OAAO,WAAW,SAAS,UAAU,GAAG,CAAC,GAAG,QAAQ,CAAC;CAElF,MAAM,SAAS,GAAG,wBAAwB,WAAW,MAAM,SAAS,KAClE,MAAM,MAAM,WAAW,OAAO,GAAG,GACjC,WAAW,eACb,EAAE;CAEF,IAAI,EAAE,OAAO,MAAM,MAAM,MAAM,IAAI,OAAO,KAAA;CAC1C,MAAM,eAAe,KAAK,MAAM;CAOhC,OAAO;EAAE;EAAU;EAAW,kBAJL,OAAO,kBAAkB,gBAAgB,OAAO,gBAAgB,CAAC,CACxF,IAAI,WAAW,iBAG4B;CAAE;AACjD,CAAC;AAED,MAAa,aAAa,OAAO,GAAG,oBAAoB,CAAC,CAAC,WAAW,SAAc;CACjF,MAAM,QAAQ,OAAO;CACrB,MAAM,aAAa,QAAQ;CAE3B,MAAM,UAAU,CACd,mBAAG,IAAI,IAAY;EACjB,WAAW;EACX,WAAW;EACX,WAAW;EACX,GAAG,WAAW;CAChB,CAAC,CACH;CAWA,MAAM,OAAM,OATS,MAAM,KACzB,WAAW,OACX,MAAM,WAAW,OAAO,GAAG,WAAW,WAAW,QAAQ,SAAS,CAAC,GACnE;EACE,OAAO;EACP;CACF,CACF,EAAA,CAEkB,KAAK;CAEvB,IAAI,QAAQ,KAAA,KAAa,CAAC,WAAW,eAAe,IAAI,WAAW,OAAO,GAAG,OAAO,KAAA;CACpF,UAAU,IAAI,WAAW,cAAc,QAAQ,QAAQ;CACvD,OAAO,UACL,GAAG,wBAAwB,WAAW,MAAM,SAAS,KACnD,MAAM,MAAM,WAAW,OAAO,GAAG,GACjC,WAAW,eACb,EAAE,EACJ;CAEA,OAAO,OAAO,sBAAsB,WAAW,mBAAmB,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,KACjF,OAAO,SAAS,WAAW,CAC7B;AACF,CAAC;AAED,MAAa,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAAW,SAAc;CAC7F,MAAM,QAAQ,OAAO;CAErB,KAAK,MAAM,SAAS,CAAC,GAAI,QAAQ,OAAO,UAAU,CAAC,CAAE,CAAC,CAAC,MAAM,GAAG,MAC9D,EAAE,QAAQ,EAAE,QAAQ,KAAK,EAAE,QAAQ,EAAE,QAAQ,IAAI,CACnD,GAAG;EACD,MAAM,SAAS,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,QAAQ,QAAQ,GAAG;GAC3E,OAAO;GACP,SAAS,MAAM;EACjB,CAAC;EAED,UAAU,OAAO,KAAK,WAAW,CAAC;EAClC,OAAO,UAAU,MAAM,UAAU,QAAQ,QAAQ,CAAC;CACpD;AACF,CAAC;;;AAID,MAAa,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAClE,SACA,MACA,sBACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,aAAa,QAAQ;CAU3B,MAAM,OAAM,OARS,MAAM,KACzB,WAAW,OACX,MAAM,WAAW,OAAO,GACrB,WAAW,gBAAgB,cAAc,MAAM,oBAAoB,EACtE,CAAC,GACD;EAAE,MAAM;EAAO,SAAS;EAAO,OAAO;EAAG,SAAS,cAAc,UAAU;CAAE,CAC9E,EAAA,CAEkB,KAAK;CAEvB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,UACE,IAAI,WAAW,UAAU,QAAQ,IAAI,WAAW,0BAA0B,oBAC5E;CACA,IAAI,CAAC,WAAW,aAAa,IAAI,WAAW,MAAM,GAAG,OAAO,KAAA;CAC5D,MAAM,SAAS,WAAW,gBAAgB,UAAU,GAAG,CAAC;CACxD,MAAM,YAAY,QAAQ,WAAW,UAAU,MAAM;CAErD,UAAU,QAAQ,WAAW,OAAO,QAAQ,WAAW,SAAS,SAAS,GAAG,MAAM,CAAC;CAEnF,OAAO;AACT,CAAC;AAED,MAAa,eAAe,OAAO,GAAG,sBAAsB,CAAC,CAAC,WAC5D,SACA,SACA,KACA;CACA,MAAM,QAAQ,OAAO;CAErB,IAAI,QAAQ,KAAA,GAAW,UAAU,IAAI,UAAU,MAAM,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,IAAI,MAAM;CACrF,MAAM,aAAa,QAAQ;CAE3B,MAAM,QAAQ,KACZ,MAAM,WAAW,OAAO,GAAG,WAAW,YAAY,QAAQ,SAAS,CAAC,GACpE,WAAW,iBACX,QAAQ,KAAA,IACJ,KAAA,IACA,IAAI,WAAW,IACb,GAAG,UACH,QAAQ,IAAI,WAAW,OAAO,WAAW,YAAY,GAAG,CAAC,GAAG,GAAG,CAAC,CACxE;CAQA,MAAM,eAAc,OANC,MAAM,KAAK,WAAW,OAAO,OAAO;EACvD,OAAO;EACP,SAAS,cAAc,UAAU;EACjC,SAAS,IAAI,IAAI,WAAW,OAAO,WAAW,YAAY,CAAC;CAC7D,CAAC,EAAA,CAEyB,KAAK,KAAK,QAAQ;EAC1C,UAAU,WAAW,eAAe,IAAI,WAAW,OAAO,CAAC;EAE3D,OAAO;GACL,cAAc,IAAI,WAAW;GAC7B,UAAU,IAAI,WAAW;EAC3B;CACF,CAAC;CAED,MAAM,WAAW,oBAAoB,iBAAiB;EACpD,WAAW,QAAQ;EACnB,kBAAkB,QAAQ;EAC1B;CACF,CAAC;CAED,UACE,IAAI,IAAI,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAC7D,SAAS,YAAY,MACzB;CACA,IACE,QAAQ,KAAA,MACP,SAAS,YAAY,WAAW,IAAI,UACnC,CAAC,IAAI,OAAO,OAAO,SAAS,YAAY,MAAM,SAAS,KAAK,iBAAiB,EAAE,CAAC,IAElF,OAAO,KAAA;CAET,OAAO;AACT,CAAC;AAOD,MAAa,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAChE,SACA,SACA,MACA,sBACA,KACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,YAAY,QAAQ;CAC1B,MAAM,WAAW,cAAc,MAAM,oBAAoB;CAEzD,MAAM,SAAS,OAAO,MAAM,KAC1B,UAAU,OACV,MAAM,UAAU,OAAO,GAAG,UAAU,gBAAgB,SAAS,CAAC,GAC9D;EACE,OAAO;EACP,SAAS,cAAc,SAAS;CAClC,CACF,EAAA,CAAG,KAAK;CAER,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,UACE,MAAM,UAAU,UAAU,QACxB,MAAM,UAAU,0BAA0B,oBAC9C;CACA,IAAI,CAAC,UAAU,aAAa,MAAM,UAAU,MAAM,GAAG,OAAO,KAAA;CAC5D,IAAI,CAAC,QAAQ,WAAW,OAAO,UAAU,gBAAgB,UAAU,KAAK,CAAC,GAAG,QAAQ,QAAQ,GAC1F,OAAO,KAAA;CACT,OAAO,UACL,GAAG,wBAAwB,UAAU,MAAM,SAAS,KAAK,MAAM,MAAM,UAAU,OAAO,KAAK,GAAG,UAAU,cAAc,EAAE,EAC1H;CACA,MAAM,aAAa,QAAQ;CAE3B,MAAM,QAAQ,MAAM,WAAW,OAAO,GACnC,WAAW,eAAe,MAAM,UAAU,cAC7C,CAAC;CAED,IAAI,OAAO,OAAO,MAAM,KAAK,WAAW,OAAO,OAAO;EACpD,OAAO;EACP,MAAM;EACN,SAAS;EACT,SAAS,cAAc,UAAU;CACnC,CAAC,EAAA,CAAG,KAAK;CAET,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,IAAI,CAAC,WAAW,eAAe,IAAI,WAAW,OAAO,GAAG,OAAO,KAAA;CAC/D,IAAI,CAAC,QAAQ,WAAW,OAAO,WAAW,gBAAgB,UAAU,GAAG,CAAC,GAAG,QAAQ,QAAQ,GACzF,OAAO,KAAA;CACT,IAAI,UAAU,WAAW,OAAO,UAAU,GAAG,CAAC;CAC9C,MAAM,SAAS,QAAQ;CACvB,MAAM,oBAAoB,UAAU,MAAM,QAAQ,UAAU;CAE5D,MAAM,aAAa,OAAO,MAAM,KAC9B,OAAO,OACP,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,kBAAkB,CAAC,GAC7D;EACE,OAAO;EACP,SAAS,cAAc,MAAM;CAC/B,CACF,EAAA,CAAG,KAAK;CAER,UACE,IAAI,WAAW,mBAAmB,YAAY,IAAI,WAAW,eAAe,iBAC9E;CACA,IAAI,cAAc,KAAA,KAAa,CAAC,OAAO,aAAa,UAAU,OAAO,MAAM,GAAG,OAAO,KAAA;CACrF,UAAU,UAAU,OAAO,UAAU,QAAQ,UAAU,OAAO,gBAAgB,QAAQ,UAAU;CAChG,IAAI,CAAC,QAAQ,WAAW,OAAO,OAAO,gBAAgB,UAAU,SAAS,CAAC,GAAG,QAAQ,QAAQ,GAC3F,OAAO,KAAA;CACT,OAAO,UACL,GAAG,wBAAwB,OAAO,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,OAAO,SAAS,GAAG,OAAO,cAAc,EAAE,EACrH;CAEA,MAAM,UAAU,OAAO,MAAM,KAAK,WAAW,OAAO,OAAO;EACzD,OAAO;EACP,SAAS;EACT,SAAS,cAAc,UAAU;CACnC,CAAC,EAAA,CAAG,KAAK;CAET,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;CACjC,UACE,iBACE,WAAW,OACX,QACA,OAAO,YACL,0BAA0B,UAAU,CAAC,CAAC,KAAK,WAAW,CAAC,QAAQ,IAAK,OAAO,CAAC,CAC9E,CACF,CACF;CACA,MAAM;CACN,UAAU,WAAW,OAAO,UAAU,GAAG,CAAC;CAC1C,OAAO,gBAAgB,YAAY,OAAO,GAAG;CAC7C,OAAO,UACL,GAAG,wBAAwB,WAAW,MAAM,SAAS,KACnD,MAAM,MAAM,WAAW,OAAO;GAC3B,WAAW,eAAe,IAAI,WAAW;GACzC,WAAW,qBAAqB,IAAI,WAAW;CAClD,CAAC,GACD,WAAW,eACb,EAAE,EACJ;CAEA,MAAM,YACJ,QAAQ,KAAA,IAAY,KAAA,IAAY,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK;CAEpF,MAAM,WAAW,OAAO,aAAa,SAAS,SAAS,SAAS;CAEhE,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;CACnC,MAAM,aAAa,oBAAoB,mBAAmB;EAAE,GAAG;EAAS;EAAU,QAAQ;CAAK,CAAC;CAEhG,UAAU,WAAW,SAAS,QAAQ,WAAW,yBAAyB,oBAAoB;CAC9F,UACE,WAAW,iBAAiB,IAAI,WAAW,iBACzC,WAAW,iBAAiB,MAAM,UAAU,aAChD;CACA,UACE,WAAW,QAAQ,SAAS,QAC1B,WAAW,QAAQ,WAAW,SAAS,WAAW,SAAS,CAC/D;CACA,UACE,WAAW,YAAY,OAAO,IAAI,WAAW,QAAQ,KACnD,WAAW,mBAAmB,OAAO,IAAI,WAAW,eAAe,CACvE;CACA,UACE,WAAW,kBAAkB,WAAW,YACrC,CAAC,WAAW,eAAe,WAAW,eAC3C;CACA,IACE,CAAC,SAAS,YAAY,MACnB,SACC,KAAK,iBAAiB,WAAW,gBACjC,KAAK,aAAa,IAAI,WAAW,mBACrC,GAEA,OAAO,KAAA;CAET,OAAO;EAAE;EAAY;CAAI;AAC3B,CAAC;AAED,MAAa,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACpE,SACA,MACA,sBACA;CACA,MAAM,YAAY,OAAO,gBAAgB,SAAS,MAAM,oBAAoB;CAE5E,IAAI,cAAc,KAAA,GAAW,OAAO,KAAA;CACpC,MAAM,UAAU,OAAO,YAAY,SAAS,SAAS;CAErD,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;CAElC,QAAQ,OAAO,eAAe,SAAS,SAAS,MAAM,oBAAoB,EAAA,EAAI;AAChF,CAAC;AAED,MAAa,2BAA2B,OAAO,GAAG,kCAAkC,CAAC,CAAC,WACpF,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CAErB,IAAI,MAAM,aAAa,QAAQ,UAAU,OAAO,KAAA;CAChD,MAAM,SAAS,OAAO,WAAW,OAAO;CAExC,IAAI,WAAW,KAAA,KAAa,CAAC,OAAO,SAAS,MAAM,YAAY,QAAQ,SAAS,MAAM,IAAI,GACxF,OAAO,KAAA;CACT,MAAM,UAAU,OAAO,YAAY,QAAQ,MAAM,MAAM,SAAS;CAEhE,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;CAClC,OAAO,iBAAiB,OAAO;CAC/B,MAAM,SAAS,QAAQ,KAAK;CAc5B,MAAM,aAAY,OAZK,MAAM,KAC3B,OAAO,OACP,KACE,MAAM,OAAO,OAAO;GACjB,OAAO,OAAO,MAAM;GACpB,OAAO,YAAY,QAAQ;CAC9B,CAAC,GACD,OAAO,cACT,GACA;EAAE,OAAO;EAAG,SAAS,cAAc,MAAM;CAAE,CAC7C,EAAA,CAE0B,KAAK;CAC/B,IAAI;CAEJ,IAAI,cAAc,KAAA,GAAW;EAC3B,UACE,OAAO,aAAa,UAAU,OAAO,MAAM,KAAK,UAAU,OAAO,UAAU,MAAM,IACnF;EACA,UACE,QAAQ,KAAK,WAAW,OACtB,OAAO,gBAAgB,UAAU,SAAS,CAAC,GAC3C,QAAQ,QACV,CACF;EAEA,aAAa,OAAO,kBAAkB,iBAAiB,CAAC,CAAC,UAAU,OAAO,WAAW;EACrF,UAAU,UAAU,OAAO,eAAe,UAAU,MAAM,MAAM,UAAU,CAAC;CAC7E;CACA,MAAM,aAAa,QAAQ,KAAK;CAyBhC,MAAM,eAAc,OAvBC,MAAM,KACzB,WAAW,OACX,KACE,MAAM,WAAW,OAAO;GACrB,WAAW,OAAO,MAAM;GACxB,WAAW,YAAY,QAAQ;CAClC,CAAC,GACD,WAAW,eACb,GACA;EACE,OAAO;EACP,SAAS;GACP,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;GACX,WAAW;EACb;EACA,SAAS,IAAI,IAAI,WAAW,OAAO,WAAW,oBAAoB,CAAC;CACrE,CACF,EAAA,CAE0B,KAAK,KAAK,QAAQ;EAC1C,UACE,WAAW,eAAe,IAAI,WAAW,OAAO,KAAK,IAAI,WAAW,UAAU,MAAM,IACtF;EAEA,OAAO,oBAAoB,mBAAmB;GAC5C,MAAM;GACN,IAAI,IAAI,WAAW;EACrB,CAAC;CACH,CAAC;CAED,UAAU,IAAI,IAAI,YAAY,KAAK,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,YAAY,MAAM;CACjF,MAAM,WAAW,OAAO,aAAa,QAAQ,MAAM,OAAO;CAE1D,UAAU,aAAa,KAAA,CAAS;CAEhC,OAAO;EAAE;EAAU,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;EAAI;CAAY;AACtF,CAAC"}

package/dist/drizzle/passkey-drivers.mjs

@@ -0,0 +1,34 @@
+import { PasskeyPersistence } from "../passkey/PasskeyPersistence.mjs";
+import { coordinateTargetPasskey, coordinateTargetPasskeyRegistration, makeTargetPasskeyCredentials, makeTargetPasskeyEnrollmentContext, makeTargetPasskeyPersistence, makeTargetPasskeyRegistration } from "./passkey-target.mjs";
+import { makePasskeyWriteTarget } from "./passkey-write-drivers.mjs";
+import { Context, Effect } from "effect";
+//#region src/drizzle/passkey-drivers.ts
+const makePasskeyTarget = (configuration) => {
+	function coordinatePasskeyPersistence(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetPasskey(database, options.mapping, configuration, (transaction, services) => {
+			const provided = Context.make(PasskeyPersistence, services.passkeyPersistence);
+			const work = Effect.provideContext(body, provided);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	function coordinatePasskeyRegistrationCeremony(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetPasskeyRegistration(database, options.mapping, configuration, (transaction, services) => {
+			const provided = Context.make(PasskeyPersistence, services.passkeyPersistence);
+			const work = Effect.provideContext(body, provided);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	return {
+		...makePasskeyWriteTarget(configuration),
+		makePasskeyCredentialServices: (database, mapping) => makeTargetPasskeyCredentials(database, mapping, configuration),
+		makePasskeyEnrollmentContextServices: (database, mapping) => makeTargetPasskeyEnrollmentContext(database, mapping, configuration),
+		makePasskeyPersistenceServices: (database, mapping) => makeTargetPasskeyPersistence(database, mapping, configuration),
+		makePasskeyRegistrationCeremonyServices: (database, mapping) => makeTargetPasskeyRegistration(database, mapping, configuration),
+		coordinatePasskeyPersistence,
+		coordinatePasskeyRegistrationCeremony
+	};
+};
+//#endregion
+export { makePasskeyTarget };
+
+//# sourceMappingURL=passkey-drivers.mjs.map

package/dist/drizzle/passkey-drivers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-drivers.mjs","names":[],"sources":["../../src/drizzle/passkey-drivers.ts"],"sourcesContent":["import type { Table } from \"drizzle-orm\";\nimport { Effect, Context } from \"effect\";\n\nimport type { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { PasskeyPersistence } from \"../passkey/PasskeyPersistence\";\nimport type {\n  PasskeyCredentialMapping,\n  PasskeyEnrollmentContextMapping,\n  PasskeyMappingSource,\n  PasskeyPersistenceMapping,\n  PasskeyPersistenceServices,\n} from \"./passkey-model\";\nimport type {\n  PasskeyRegistrationCeremonyMapping,\n  PasskeyRegistrationCeremonyServices,\n} from \"./passkey-registration-ceremony-model\";\nimport {\n  type PasskeyCoordinatorError,\n  coordinateTargetPasskey,\n  coordinateTargetPasskeyRegistration,\n  makeTargetPasskeyCredentials,\n  makeTargetPasskeyEnrollmentContext,\n  makeTargetPasskeyPersistence,\n  makeTargetPasskeyRegistration,\n  type PasskeyTargetConfiguration,\n} from \"./passkey-target\";\nimport { makePasskeyWriteTarget } from \"./passkey-write-drivers\";\nimport type { SuppliedService } from \"./SuppliedService\";\n\n// oxlint-disable-next-line no-explicit-any -- inspect only the concrete database's installed generic transaction callback.\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\n\nexport const makePasskeyTarget = <\n  D,\n  T extends Table,\n  Extra = unknown,\n  Synchronous extends boolean = false,\n>(\n  configuration: PasskeyTargetConfiguration,\n) => {\n  function coordinatePasskeyPersistence<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    N,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyPersistenceMapping<\n          PasskeyCredentialMapping<S, C, F, O, H, N>,\n          M,\n          Flow,\n          Admission,\n          Charge,\n          N\n        > &\n          Extra,\n        RSetup\n      >;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n    | RSetup\n  >;\n  function coordinatePasskeyPersistence<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyPersistenceMapping<\n          PasskeyCredentialMapping<S, C, F, O, H, N>,\n          M,\n          Flow,\n          Admission,\n          Charge,\n          N\n        > &\n          Extra,\n        RSetup\n      >;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence | TxId> : R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n    | RSetup\n  >;\n  function coordinatePasskeyPersistence<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyPersistenceMapping<\n          PasskeyCredentialMapping<S, C, F, O, H, N>,\n          M,\n          Flow,\n          Admission,\n          Charge,\n          N\n        > &\n          Extra,\n        RSetup\n      >;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    Exclude<R, PasskeyPersistence> | LifecycleHooks | DatabaseRequirements | RSetup\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetPasskey(\n        database,\n        options.mapping,\n        configuration,\n        (transaction: TransactionOf<Database>, services: PasskeyPersistenceServices) => {\n          const provided = Context.make(PasskeyPersistence, services.passkeyPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n  function coordinatePasskeyRegistrationCeremony<\n    Database extends D,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    H extends T,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,\n        RSetup\n      >;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence> : R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence>)\n    | LifecycleHooks\n    | DatabaseRequirements\n    | RSetup\n  >;\n  function coordinatePasskeyRegistrationCeremony<\n    Database extends D,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    H extends T,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,\n        RSetup\n      >;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, Synchronous extends true ? NoInfer<PasskeyPersistence | TxId> : R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | TxId>)\n    | LifecycleHooks\n    | DatabaseRequirements\n    | RSetup\n  >;\n  function coordinatePasskeyRegistrationCeremony<\n    Database extends D,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    H extends T,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,\n        RSetup\n      >;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    Exclude<R, PasskeyPersistence> | LifecycleHooks | DatabaseRequirements | RSetup\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetPasskeyRegistration(\n        database,\n        options.mapping,\n        configuration,\n        (transaction: TransactionOf<Database>, services: PasskeyRegistrationCeremonyServices) => {\n          const provided = Context.make(PasskeyPersistence, services.passkeyPersistence);\n          const work = Effect.provideContext(body, provided);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  return {\n    ...makePasskeyWriteTarget<D, T, Extra, Synchronous>(configuration),\n    makePasskeyCredentialServices: <\n      Database extends D,\n      S extends T,\n      C extends T,\n      F extends T,\n      O extends T,\n      H extends T,\n      N,\n      RSetup = never,\n    >(\n      database: Database,\n      mapping: PasskeyMappingSource<PasskeyCredentialMapping<S, C, F, O, H, N> & Extra, RSetup>,\n    ) => makeTargetPasskeyCredentials(database, mapping, configuration),\n    makePasskeyEnrollmentContextServices: <\n      Database extends D,\n      S extends T,\n      C extends T,\n      F extends T,\n      O extends T,\n      H extends T,\n      M extends T,\n      N,\n      RSetup = never,\n    >(\n      database: Database,\n      mapping: PasskeyMappingSource<\n        PasskeyEnrollmentContextMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, N> & Extra,\n        RSetup\n      >,\n    ) => makeTargetPasskeyEnrollmentContext(database, mapping, configuration),\n    makePasskeyPersistenceServices: <\n      Database extends D,\n      S extends T,\n      C extends T,\n      F extends T,\n      O extends T,\n      H extends T,\n      M extends T,\n      Flow extends T,\n      Admission extends T,\n      Charge extends T,\n      N,\n      RSetup = never,\n    >(\n      database: Database,\n      mapping: PasskeyMappingSource<\n        PasskeyPersistenceMapping<\n          PasskeyCredentialMapping<S, C, F, O, H, N>,\n          M,\n          Flow,\n          Admission,\n          Charge,\n          N\n        > &\n          Extra,\n        RSetup\n      >,\n    ) => makeTargetPasskeyPersistence(database, mapping, configuration),\n    makePasskeyRegistrationCeremonyServices: <\n      Database extends D,\n      M extends T,\n      Flow extends T,\n      Admission extends T,\n      Charge extends T,\n      Intent extends T,\n      H extends T,\n      RSetup = never,\n    >(\n      database: Database,\n      mapping: PasskeyMappingSource<\n        PasskeyRegistrationCeremonyMapping<M, Flow, Admission, Charge, Intent, H> & Extra,\n        RSetup\n      >,\n    ) => makeTargetPasskeyRegistration(database, mapping, configuration),\n    coordinatePasskeyPersistence,\n    coordinatePasskeyRegistrationCeremony,\n  };\n};\n"],"mappings":";;;;;AAkCA,MAAa,qBAMX,kBACG;CA2FH,SAAS,6BAqBP,SACA,SAeA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,wBACE,UACA,QAAQ,SACR,gBACC,aAAsC,aAAyC;GAC9E,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS,kBAAkB;GAC7E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAmEA,SAAS,sCAiBP,SACA,SAOA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,oCACE,UACA,QAAQ,SACR,gBACC,aAAsC,aAAkD;GACvF,MAAM,WAAW,QAAQ,KAAK,oBAAoB,SAAS,kBAAkB;GAC7E,MAAM,OAAO,OAAO,eAAe,MAAM,QAAQ;GAEjD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,OAAO;EACL,GAAG,uBAAiD,aAAa;EACjE,gCAUE,UACA,YACG,6BAA6B,UAAU,SAAS,aAAa;EAClE,uCAWE,UACA,YAIG,mCAAmC,UAAU,SAAS,aAAa;EACxE,iCAcE,UACA,YAYG,6BAA6B,UAAU,SAAS,aAAa;EAClE,0CAUE,UACA,YAIG,8BAA8B,UAAU,SAAS,aAAa;EACnE;EACA;CACF;AACF"}