@yielded/auth 0.1.0-beta.1

package/dist/drizzle/passkey-enrollment.mjs

@@ -0,0 +1,132 @@
+import { both } from "./transaction-owner.mjs";
+import { PasskeyCeremony } from "../passkey/models.mjs";
+import { CurrentPasskeyTransaction, credentialKey, equal, handleKey, invariant, sameRevision } from "./passkey-state.mjs";
+import { guardChargeSet, lockAdmission, readCharges } from "./passkey-admission.mjs";
+import { readModule, readPolicyGuards } from "./passkey-credentials.mjs";
+import { compatiblePolicy, exactClaim, issueAssertion, liveCondition, readFlow, terminalFlow } from "./passkey-flow.mjs";
+import { authorizeAction, credentialRows, currentSubject, digest, enrollmentDigest, insertCredential, invalidate, invalidationMatches, managementPolicy, validRegistration } from "./passkey-write-state.mjs";
+import { Effect } from "effect";
+import { sql } from "drizzle-orm";
+//#region src/drizzle/passkey-enrollment.ts
+const enrollmentHandle = Effect.fn("passkey.enrollmentHandle")(function* (mapping, subject, ceremony, create) {
+	const owner = yield* CurrentPasskeyTransaction;
+	invariant(ceremony.context._tag === "Enrollment");
+	const table = mapping.read.handleOwnership;
+	const where = equal(table.table, {
+		[table.rpId]: ceremony.profile.rpId,
+		[table.subjectId]: subject.nativeId
+	});
+	const found = yield* owner.read(table.table, where, { limit: 1 });
+	const row = found.rows[0];
+	const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
+	if (row !== void 0) return table.isOwnedState(row[table.state]) && row[table.handleKey] === hashed && row[table.userHandle] === ceremony.context.userHandle && mapping.read.subjectIds.equals(table.decodeSubjectId(row), subject.nativeId);
+	if (!create) return false;
+	const absent = yield* owner.read(table.table, equal(table.table, { [table.handleKey]: hashed }), { limit: 1 });
+	if (absent.rows.length !== 0) return false;
+	const inserted = yield* owner.insert(table.table, {
+		...mapping.write.handleOwnership.encodeInsert({
+			subjectId: subject.nativeId,
+			rpId: ceremony.profile.rpId,
+			userHandle: ceremony.context.userHandle,
+			marker: owner.marker
+		}),
+		[table.handleKey]: hashed,
+		[table.rpId]: ceremony.profile.rpId,
+		[table.userHandle]: ceremony.context.userHandle,
+		[table.subjectId]: subject.nativeId,
+		[table.state]: mapping.write.handleOwnership.ownedState,
+		[table.version]: owner.marker,
+		[table.reservationId]: null
+	}, { [table.handleKey]: hashed });
+	found.rows = inserted.rows;
+	absent.rows = inserted.rows;
+	return true;
+});
+const capCondition = (mapping, subject, maximum, addition) => {
+	const table = mapping.read.credential;
+	return sql`(select count(*) from ${table.table} where ${both(equal(table.table, { [table.subjectId]: subject.nativeId }), table.activeCondition)}) + ${addition} <= ${maximum}`;
+};
+const issueEnrollment = Effect.fn("passkey.issueEnrollment")(function* (mapping, input) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const ceremony = input.ceremony;
+	if (ceremony.context._tag !== "Enrollment" || ceremony.purpose !== "enrollment" || ceremony.moduleId !== mapping.moduleId) return { _tag: "Rejected" };
+	const current = yield* readModule(mapping);
+	if (current === void 0 || !compatiblePolicy(ceremony, input.policy, current)) return { _tag: "Rejected" };
+	yield* lockAdmission(mapping);
+	const subject = yield* currentSubject(mapping, ceremony.context.revision.subjectId);
+	if (subject === void 0 || !sameRevision(subject.revision, ceremony.context.revision)) return { _tag: "Rejected" };
+	yield* readPolicyGuards(mapping);
+	const policy = managementPolicy(mapping, subject);
+	const maximum = Math.min(policy.maximumCredentials, input.management.maximumCredentials);
+	const ids = (yield* credentialRows(mapping, subject, ceremony.profile.rpId)).map((row) => row[mapping.read.credential.protocolCredentialId]);
+	if (ids.length !== ceremony.allowedCredentials.length || !ids.every((id) => ceremony.allowedCredentials.some((item) => item.id === id)) || !(yield* owner.check(capCondition(mapping, subject, maximum, 1)))) return { _tag: "Rejected" };
+	if (!(yield* authorizeAction(mapping, subject, input.authorization, {
+		action: "enroll-begin",
+		commandId: ceremony.commandId,
+		flowId: ceremony.flowId,
+		bindingDigest: enrollmentDigest(ceremony),
+		revision: ceremony.context.revision
+	}, {
+		...policy,
+		maximumEvidenceAgeMillis: Math.min(policy.maximumEvidenceAgeMillis, input.management.maximumEvidenceAgeMillis)
+	}))) return { _tag: "Rejected" };
+	invariant(digest(PasskeyCeremony.fields.context, ceremony.context) === digest(PasskeyCeremony.fields.context, {
+		...ceremony.context,
+		authorization: input.authorization
+	}));
+	const issued = yield* issueAssertion(mapping, ceremony, input.policy);
+	if (issued._tag !== "Issued") return issued;
+	invariant(yield* enrollmentHandle(mapping, subject, ceremony, true));
+	owner.postconditions.push(capCondition(mapping, subject, maximum, 1));
+	return issued;
+});
+const completeEnrollment = Effect.fn("passkey.completeEnrollment")(function* (mapping, input) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const ceremony = input.claim.ceremony;
+	if (ceremony.context._tag !== "Enrollment" || ceremony.purpose !== "enrollment" || ceremony.moduleId !== mapping.moduleId) return { _tag: "Rejected" };
+	const current = yield* readModule(mapping);
+	if (current === void 0) return { _tag: "Rejected" };
+	yield* lockAdmission(mapping);
+	const subject = yield* currentSubject(mapping, ceremony.context.revision.subjectId);
+	yield* readPolicyGuards(mapping);
+	const read = yield* readFlow(mapping, ceremony.flowId);
+	if (read === void 0 || !exactClaim(read, input.claim)) return { _tag: "Rejected" };
+	const reject = Effect.gen(function* () {
+		yield* terminalFlow(mapping, read, "Rejected");
+		return { _tag: "Rejected" };
+	});
+	if (subject === void 0 || !sameRevision(subject.revision, ceremony.context.revision) || !compatiblePolicy(ceremony, read.policy, current) || !validRegistration(ceremony, input.verified) || !(yield* owner.check(liveCondition(mapping, ceremony, input.claim)))) return yield* reject;
+	const policy = managementPolicy(mapping, subject);
+	const maximum = Math.min(policy.maximumCredentials, input.management.maximumCredentials);
+	if (!invalidationMatches(mapping, input.invalidation, policy) || !invalidationMatches(mapping, input.invalidation, input.management) || !(yield* owner.check(capCondition(mapping, subject, maximum, 1))) || !(yield* enrollmentHandle(mapping, subject, ceremony, false))) return yield* reject;
+	if (!(yield* authorizeAction(mapping, subject, input.authorization, {
+		action: "enroll-complete",
+		commandId: ceremony.commandId,
+		flowId: ceremony.flowId,
+		bindingDigest: digest(PasskeyCeremony, ceremony),
+		revision: ceremony.context.revision
+	}, {
+		...policy,
+		maximumEvidenceAgeMillis: Math.min(policy.maximumEvidenceAgeMillis, input.management.maximumEvidenceAgeMillis)
+	}, ceremony.context.authorization.requirement))) return yield* reject;
+	const tuple = mapping.read.credentialOwnership;
+	const key = credentialKey(ceremony.profile.rpId, input.verified.protocolCredentialId);
+	if ((yield* owner.read(tuple.table, equal(tuple.table, { [tuple.credentialKey]: key }), {
+		limit: 1,
+		observe: false
+	})).rows.length !== 0) return yield* reject;
+	yield* readCharges(mapping, ceremony, read.policy, subject.subjectId);
+	yield* guardChargeSet(mapping, ceremony, subject.subjectId);
+	const safe = yield* insertCredential(mapping, subject, ceremony, input.verified, yield* owner.now(mapping.clock));
+	yield* terminalFlow(mapping, read, "Verified");
+	yield* invalidate(mapping, subject, input.invalidation);
+	owner.postconditions.push(liveCondition(mapping, ceremony, input.claim), capCondition(mapping, subject, maximum, 0));
+	return {
+		_tag: "Enrolled",
+		credential: safe
+	};
+});
+//#endregion
+export { completeEnrollment, enrollmentHandle, issueEnrollment };
+
+//# sourceMappingURL=passkey-enrollment.mjs.map

package/dist/drizzle/passkey-enrollment.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-enrollment.mjs","names":["Ceremony","credentialKeyFor"],"sources":["../../src/drizzle/passkey-enrollment.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- private mapped-row kernel; public mappings retain concrete tables. */\nimport { sql } from \"drizzle-orm\";\nimport { Effect } from \"effect\";\n\nimport { type PasskeyCeremony, PasskeyCeremony as Ceremony } from \"../passkey/models\";\nimport type { PasskeyManagementPersistence } from \"../passkey/PasskeyManagementPersistence\";\nimport { lockAdmission, readCharges, guardChargeSet } from \"./passkey-admission\";\nimport { readModule, readPolicyGuards } from \"./passkey-credentials\";\nimport {\n  compatiblePolicy,\n  exactClaim,\n  issueAssertion,\n  liveCondition,\n  readFlow,\n  terminalFlow,\n} from \"./passkey-flow\";\nimport {\n  equal,\n  handleKey,\n  invariant,\n  sameRevision,\n  CurrentPasskeyTransaction,\n  credentialKey as credentialKeyFor,\n} from \"./passkey-state\";\nimport {\n  authorizeAction,\n  credentialRows,\n  currentSubject,\n  enrollmentDigest,\n  digest,\n  insertCredential,\n  invalidate,\n  invalidationMatches,\n  managementPolicy,\n  validRegistration,\n  type WriteSubject,\n} from \"./passkey-write-state\";\nimport { both } from \"./transaction-owner\";\n\ntype Issue = Parameters<PasskeyManagementPersistence[\"Service\"][\"issueEnrollment\"]>[0];\ntype Complete = Parameters<PasskeyManagementPersistence[\"Service\"][\"completeEnrollment\"]>[0];\n\nexport const enrollmentHandle = Effect.fn(\"passkey.enrollmentHandle\")(function* (\n  mapping: any,\n  subject: WriteSubject,\n  ceremony: PasskeyCeremony,\n  create: boolean,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n\n  invariant(ceremony.context._tag === \"Enrollment\");\n  const table = mapping.read.handleOwnership;\n\n  const where = equal(table.table, {\n    [table.rpId]: ceremony.profile.rpId,\n    [table.subjectId]: subject.nativeId,\n  });\n\n  const found = yield* owner.read(table.table, where, { limit: 1 });\n  const row = found.rows[0];\n  const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);\n\n  if (row !== undefined)\n    return (\n      table.isOwnedState(row[table.state]) &&\n      row[table.handleKey] === hashed &&\n      row[table.userHandle] === ceremony.context.userHandle &&\n      mapping.read.subjectIds.equals(table.decodeSubjectId(row), subject.nativeId)\n    );\n  if (!create) return false;\n\n  const absent = yield* owner.read(table.table, equal(table.table, { [table.handleKey]: hashed }), {\n    limit: 1,\n  });\n\n  if (absent.rows.length !== 0) return false;\n\n  const inserted = yield* owner.insert(\n    table.table,\n    {\n      ...mapping.write.handleOwnership.encodeInsert({\n        subjectId: subject.nativeId,\n        rpId: ceremony.profile.rpId,\n        userHandle: ceremony.context.userHandle,\n        marker: owner.marker,\n      }),\n      [table.handleKey]: hashed,\n      [table.rpId]: ceremony.profile.rpId,\n      [table.userHandle]: ceremony.context.userHandle,\n      [table.subjectId]: subject.nativeId,\n      [table.state]: mapping.write.handleOwnership.ownedState,\n      [table.version]: owner.marker,\n      [table.reservationId]: null,\n    },\n    { [table.handleKey]: hashed },\n  );\n\n  found.rows = inserted.rows;\n  absent.rows = inserted.rows;\n\n  return true;\n});\n\nconst capCondition = (mapping: any, subject: WriteSubject, maximum: number, addition: number) => {\n  const table = mapping.read.credential;\n\n  return sql`(select count(*) from ${table.table} where ${both(equal(table.table, { [table.subjectId]: subject.nativeId }), table.activeCondition)}) + ${addition} <= ${maximum}`;\n};\n\nexport const issueEnrollment = Effect.fn(\"passkey.issueEnrollment\")(function* (\n  mapping: any,\n  input: Issue,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const ceremony = input.ceremony;\n\n  if (\n    ceremony.context._tag !== \"Enrollment\" ||\n    ceremony.purpose !== \"enrollment\" ||\n    ceremony.moduleId !== mapping.moduleId\n  )\n    return { _tag: \"Rejected\" } as const;\n  const current = yield* readModule(mapping);\n\n  if (current === undefined || !compatiblePolicy(ceremony, input.policy, current))\n    return { _tag: \"Rejected\" } as const;\n  yield* lockAdmission(mapping);\n  const subject = yield* currentSubject(mapping, ceremony.context.revision.subjectId);\n\n  if (subject === undefined || !sameRevision(subject.revision, ceremony.context.revision))\n    return { _tag: \"Rejected\" } as const;\n  yield* readPolicyGuards(mapping);\n  const policy = managementPolicy(mapping, subject);\n  const maximum = Math.min(policy.maximumCredentials, input.management.maximumCredentials);\n  const rows = yield* credentialRows(mapping, subject, ceremony.profile.rpId);\n  const ids = rows.map((row) => row[mapping.read.credential.protocolCredentialId]);\n\n  if (\n    ids.length !== ceremony.allowedCredentials.length ||\n    !ids.every((id) => ceremony.allowedCredentials.some((item) => item.id === id)) ||\n    !(yield* owner.check(capCondition(mapping, subject, maximum, 1)))\n  )\n    return { _tag: \"Rejected\" } as const;\n  if (\n    !(yield* authorizeAction(\n      mapping,\n      subject,\n      input.authorization,\n      {\n        action: \"enroll-begin\",\n        commandId: ceremony.commandId,\n        flowId: ceremony.flowId,\n        bindingDigest: enrollmentDigest(ceremony),\n        revision: ceremony.context.revision,\n      },\n      {\n        ...policy,\n        maximumEvidenceAgeMillis: Math.min(\n          policy.maximumEvidenceAgeMillis,\n          input.management.maximumEvidenceAgeMillis,\n        ),\n      },\n    ))\n  )\n    return { _tag: \"Rejected\" } as const;\n  invariant(\n    digest(Ceremony.fields.context, ceremony.context) ===\n      digest(Ceremony.fields.context, { ...ceremony.context, authorization: input.authorization }),\n  );\n  const issued = yield* issueAssertion(mapping, ceremony, input.policy);\n\n  if (issued._tag !== \"Issued\") return issued;\n  invariant(yield* enrollmentHandle(mapping, subject, ceremony, true));\n  owner.postconditions.push(capCondition(mapping, subject, maximum, 1));\n\n  return issued;\n});\n\nexport const completeEnrollment = Effect.fn(\"passkey.completeEnrollment\")(function* (\n  mapping: any,\n  input: Complete,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const ceremony = input.claim.ceremony;\n\n  if (\n    ceremony.context._tag !== \"Enrollment\" ||\n    ceremony.purpose !== \"enrollment\" ||\n    ceremony.moduleId !== mapping.moduleId\n  )\n    return { _tag: \"Rejected\" } as const;\n  const current = yield* readModule(mapping);\n\n  if (current === undefined) return { _tag: \"Rejected\" } as const;\n  yield* lockAdmission(mapping);\n  const subject = yield* currentSubject(mapping, ceremony.context.revision.subjectId);\n\n  yield* readPolicyGuards(mapping);\n  const read = yield* readFlow(mapping, ceremony.flowId);\n\n  if (read === undefined || !exactClaim(read, input.claim)) return { _tag: \"Rejected\" } as const;\n\n  const reject = Effect.gen(function* () {\n    yield* terminalFlow(mapping, read, \"Rejected\");\n\n    return { _tag: \"Rejected\" } as const;\n  });\n\n  if (\n    subject === undefined ||\n    !sameRevision(subject.revision, ceremony.context.revision) ||\n    !compatiblePolicy(ceremony, read.policy, current) ||\n    !validRegistration(ceremony, input.verified) ||\n    !(yield* owner.check(liveCondition(mapping, ceremony, input.claim)))\n  )\n    return yield* reject;\n  const policy = managementPolicy(mapping, subject);\n  const maximum = Math.min(policy.maximumCredentials, input.management.maximumCredentials);\n\n  if (\n    !invalidationMatches(mapping, input.invalidation, policy) ||\n    !invalidationMatches(mapping, input.invalidation, input.management) ||\n    !(yield* owner.check(capCondition(mapping, subject, maximum, 1))) ||\n    !(yield* enrollmentHandle(mapping, subject, ceremony, false))\n  )\n    return yield* reject;\n  if (\n    !(yield* authorizeAction(\n      mapping,\n      subject,\n      input.authorization,\n      {\n        action: \"enroll-complete\",\n        commandId: ceremony.commandId,\n        flowId: ceremony.flowId,\n        bindingDigest: digest(Ceremony, ceremony),\n        revision: ceremony.context.revision,\n      },\n      {\n        ...policy,\n        maximumEvidenceAgeMillis: Math.min(\n          policy.maximumEvidenceAgeMillis,\n          input.management.maximumEvidenceAgeMillis,\n        ),\n      },\n      ceremony.context.authorization.requirement,\n    ))\n  )\n    return yield* reject;\n  const tuple = mapping.read.credentialOwnership;\n  // Credential ownership is RP-global, including retained registration custody.\n  const key = credentialKeyFor(ceremony.profile.rpId, input.verified.protocolCredentialId);\n\n  if (\n    (yield* owner.read(tuple.table, equal(tuple.table, { [tuple.credentialKey]: key }), {\n      limit: 1,\n      observe: false,\n    })).rows.length !== 0\n  )\n    return yield* reject;\n  yield* readCharges(mapping, ceremony, read.policy, subject.subjectId);\n  yield* guardChargeSet(mapping, ceremony, subject.subjectId);\n\n  const safe = yield* insertCredential(\n    mapping,\n    subject,\n    ceremony,\n    input.verified,\n    yield* owner.now(mapping.clock),\n  );\n\n  yield* terminalFlow(mapping, read, \"Verified\");\n  yield* invalidate(mapping, subject, input.invalidation);\n  owner.postconditions.push(\n    liveCondition(mapping, ceremony, input.claim),\n    capCondition(mapping, subject, maximum, 0),\n  );\n\n  return { _tag: \"Enrolled\", credential: safe } as const;\n});\n"],"mappings":";;;;;;;;;;AA0CA,MAAa,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACpE,SACA,SACA,UACA,QACA;CACA,MAAM,QAAQ,OAAO;CAErB,UAAU,SAAS,QAAQ,SAAS,YAAY;CAChD,MAAM,QAAQ,QAAQ,KAAK;CAE3B,MAAM,QAAQ,MAAM,MAAM,OAAO;GAC9B,MAAM,OAAO,SAAS,QAAQ;GAC9B,MAAM,YAAY,QAAQ;CAC7B,CAAC;CAED,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM,OAAO,OAAO,EAAE,OAAO,EAAE,CAAC;CAChE,MAAM,MAAM,MAAM,KAAK;CACvB,MAAM,SAAS,UAAU,SAAS,QAAQ,MAAM,SAAS,QAAQ,UAAU;CAE3E,IAAI,QAAQ,KAAA,GACV,OACE,MAAM,aAAa,IAAI,MAAM,MAAM,KACnC,IAAI,MAAM,eAAe,UACzB,IAAI,MAAM,gBAAgB,SAAS,QAAQ,cAC3C,QAAQ,KAAK,WAAW,OAAO,MAAM,gBAAgB,GAAG,GAAG,QAAQ,QAAQ;CAE/E,IAAI,CAAC,QAAQ,OAAO;CAEpB,MAAM,SAAS,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,OAAO,GAAG,MAAM,YAAY,OAAO,CAAC,GAAG,EAC/F,OAAO,EACT,CAAC;CAED,IAAI,OAAO,KAAK,WAAW,GAAG,OAAO;CAErC,MAAM,WAAW,OAAO,MAAM,OAC5B,MAAM,OACN;EACE,GAAG,QAAQ,MAAM,gBAAgB,aAAa;GAC5C,WAAW,QAAQ;GACnB,MAAM,SAAS,QAAQ;GACvB,YAAY,SAAS,QAAQ;GAC7B,QAAQ,MAAM;EAChB,CAAC;GACA,MAAM,YAAY;GAClB,MAAM,OAAO,SAAS,QAAQ;GAC9B,MAAM,aAAa,SAAS,QAAQ;GACpC,MAAM,YAAY,QAAQ;GAC1B,MAAM,QAAQ,QAAQ,MAAM,gBAAgB;GAC5C,MAAM,UAAU,MAAM;GACtB,MAAM,gBAAgB;CACzB,GACA,GAAG,MAAM,YAAY,OAAO,CAC9B;CAEA,MAAM,OAAO,SAAS;CACtB,OAAO,OAAO,SAAS;CAEvB,OAAO;AACT,CAAC;AAED,MAAM,gBAAgB,SAAc,SAAuB,SAAiB,aAAqB;CAC/F,MAAM,QAAQ,QAAQ,KAAK;CAE3B,OAAO,GAAG,yBAAyB,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,GAAG,MAAM,YAAY,QAAQ,SAAS,CAAC,GAAG,MAAM,eAAe,EAAE,MAAM,SAAS,MAAM;AACxK;AAEA,MAAa,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAClE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,WAAW,MAAM;CAEvB,IACE,SAAS,QAAQ,SAAS,gBAC1B,SAAS,YAAY,gBACrB,SAAS,aAAa,QAAQ,UAE9B,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,UAAU,OAAO,WAAW,OAAO;CAEzC,IAAI,YAAY,KAAA,KAAa,CAAC,iBAAiB,UAAU,MAAM,QAAQ,OAAO,GAC5E,OAAO,EAAE,MAAM,WAAW;CAC5B,OAAO,cAAc,OAAO;CAC5B,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS,QAAQ,SAAS,SAAS;CAElF,IAAI,YAAY,KAAA,KAAa,CAAC,aAAa,QAAQ,UAAU,SAAS,QAAQ,QAAQ,GACpF,OAAO,EAAE,MAAM,WAAW;CAC5B,OAAO,iBAAiB,OAAO;CAC/B,MAAM,SAAS,iBAAiB,SAAS,OAAO;CAChD,MAAM,UAAU,KAAK,IAAI,OAAO,oBAAoB,MAAM,WAAW,kBAAkB;CAEvF,MAAM,OAAM,OADQ,eAAe,SAAS,SAAS,SAAS,QAAQ,IAAI,EAAA,CACzD,KAAK,QAAQ,IAAI,QAAQ,KAAK,WAAW,qBAAqB;CAE/E,IACE,IAAI,WAAW,SAAS,mBAAmB,UAC3C,CAAC,IAAI,OAAO,OAAO,SAAS,mBAAmB,MAAM,SAAS,KAAK,OAAO,EAAE,CAAC,KAC7E,EAAE,OAAO,MAAM,MAAM,aAAa,SAAS,SAAS,SAAS,CAAC,CAAC,IAE/D,OAAO,EAAE,MAAM,WAAW;CAC5B,IACE,EAAE,OAAO,gBACP,SACA,SACA,MAAM,eACN;EACE,QAAQ;EACR,WAAW,SAAS;EACpB,QAAQ,SAAS;EACjB,eAAe,iBAAiB,QAAQ;EACxC,UAAU,SAAS,QAAQ;CAC7B,GACA;EACE,GAAG;EACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;CACF,CACF,IAEA,OAAO,EAAE,MAAM,WAAW;CAC5B,UACE,OAAOA,gBAAS,OAAO,SAAS,SAAS,OAAO,MAC9C,OAAOA,gBAAS,OAAO,SAAS;EAAE,GAAG,SAAS;EAAS,eAAe,MAAM;CAAc,CAAC,CAC/F;CACA,MAAM,SAAS,OAAO,eAAe,SAAS,UAAU,MAAM,MAAM;CAEpE,IAAI,OAAO,SAAS,UAAU,OAAO;CACrC,UAAU,OAAO,iBAAiB,SAAS,SAAS,UAAU,IAAI,CAAC;CACnE,MAAM,eAAe,KAAK,aAAa,SAAS,SAAS,SAAS,CAAC,CAAC;CAEpE,OAAO;AACT,CAAC;AAED,MAAa,qBAAqB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACxE,SACA,OACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,WAAW,MAAM,MAAM;CAE7B,IACE,SAAS,QAAQ,SAAS,gBAC1B,SAAS,YAAY,gBACrB,SAAS,aAAa,QAAQ,UAE9B,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,UAAU,OAAO,WAAW,OAAO;CAEzC,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACrD,OAAO,cAAc,OAAO;CAC5B,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS,QAAQ,SAAS,SAAS;CAElF,OAAO,iBAAiB,OAAO;CAC/B,MAAM,OAAO,OAAO,SAAS,SAAS,SAAS,MAAM;CAErD,IAAI,SAAS,KAAA,KAAa,CAAC,WAAW,MAAM,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,WAAW;CAEpF,MAAM,SAAS,OAAO,IAAI,aAAa;EACrC,OAAO,aAAa,SAAS,MAAM,UAAU;EAE7C,OAAO,EAAE,MAAM,WAAW;CAC5B,CAAC;CAED,IACE,YAAY,KAAA,KACZ,CAAC,aAAa,QAAQ,UAAU,SAAS,QAAQ,QAAQ,KACzD,CAAC,iBAAiB,UAAU,KAAK,QAAQ,OAAO,KAChD,CAAC,kBAAkB,UAAU,MAAM,QAAQ,KAC3C,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,UAAU,MAAM,KAAK,CAAC,IAElE,OAAO,OAAO;CAChB,MAAM,SAAS,iBAAiB,SAAS,OAAO;CAChD,MAAM,UAAU,KAAK,IAAI,OAAO,oBAAoB,MAAM,WAAW,kBAAkB;CAEvF,IACE,CAAC,oBAAoB,SAAS,MAAM,cAAc,MAAM,KACxD,CAAC,oBAAoB,SAAS,MAAM,cAAc,MAAM,UAAU,KAClE,EAAE,OAAO,MAAM,MAAM,aAAa,SAAS,SAAS,SAAS,CAAC,CAAC,MAC/D,EAAE,OAAO,iBAAiB,SAAS,SAAS,UAAU,KAAK,IAE3D,OAAO,OAAO;CAChB,IACE,EAAE,OAAO,gBACP,SACA,SACA,MAAM,eACN;EACE,QAAQ;EACR,WAAW,SAAS;EACpB,QAAQ,SAAS;EACjB,eAAe,OAAOA,iBAAU,QAAQ;EACxC,UAAU,SAAS,QAAQ;CAC7B,GACA;EACE,GAAG;EACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;CACF,GACA,SAAS,QAAQ,cAAc,WACjC,IAEA,OAAO,OAAO;CAChB,MAAM,QAAQ,QAAQ,KAAK;CAE3B,MAAM,MAAMC,cAAiB,SAAS,QAAQ,MAAM,MAAM,SAAS,oBAAoB;CAEvF,KACG,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,OAAO,GAAG,MAAM,gBAAgB,IAAI,CAAC,GAAG;EAClF,OAAO;EACP,SAAS;CACX,CAAC,EAAA,CAAG,KAAK,WAAW,GAEpB,OAAO,OAAO;CAChB,OAAO,YAAY,SAAS,UAAU,KAAK,QAAQ,QAAQ,SAAS;CACpE,OAAO,eAAe,SAAS,UAAU,QAAQ,SAAS;CAE1D,MAAM,OAAO,OAAO,iBAClB,SACA,SACA,UACA,MAAM,UACN,OAAO,MAAM,IAAI,QAAQ,KAAK,CAChC;CAEA,OAAO,aAAa,SAAS,MAAM,UAAU;CAC7C,OAAO,WAAW,SAAS,SAAS,MAAM,YAAY;CACtD,MAAM,eAAe,KACnB,cAAc,SAAS,UAAU,MAAM,KAAK,GAC5C,aAAa,SAAS,SAAS,SAAS,CAAC,CAC3C;CAEA,OAAO;EAAE,MAAM;EAAY,YAAY;CAAK;AAC9C,CAAC"}

package/dist/drizzle/passkey-flow.mjs

@@ -0,0 +1,436 @@
+import { both } from "./transaction-owner.mjs";
+import { PasskeyClaim } from "../passkey/models.mjs";
+import { snapshotPasskeySync } from "../passkey/snapshot.mjs";
+import { CurrentPasskeyTransaction, ceremonyStorage, col, credentialStorage, equal, existsExact, invariant, mappedColumns, policyStorage, profileStorage, sameCredential, sameRevision, semanticCredentialColumns, subjectScope, targetScope } from "./passkey-state.mjs";
+import { admissionCondition, chargeScopes, guardAdmission, guardChargeSet, insertCharges, lockAdmission, readCharges } from "./passkey-admission.mjs";
+import { readCredential, readModule, readPolicyGuards, readRevision, readSubject } from "./passkey-credentials.mjs";
+import { releaseRegistrationCustody, scrubRegistrationIntent } from "./passkey-registration-custody.mjs";
+import { DateTime, Effect } from "effect";
+import { sql } from "drizzle-orm";
+//#region src/drizzle/passkey-flow.ts
+const assertionPurposes = [
+	"sign-in",
+	"pending",
+	"step-up",
+	"action"
+];
+const contextPurpose = {
+	SignIn: "sign-in",
+	Pending: "pending",
+	StepUp: "step-up",
+	Action: "action",
+	Enrollment: "enrollment",
+	Registration: "registration"
+};
+const knownSubject = (ceremony) => "target" in ceremony.context ? ceremony.context.target.revision.subjectId : ceremony.context._tag === "Enrollment" ? ceremony.context.revision.subjectId : void 0;
+const compatiblePolicy = (ceremony, original, current) => {
+	const selected = current.profiles.find((profile) => profile.profileId === ceremony.profile.profileId);
+	const issued = original.profiles.find((profile) => profile.profileId === ceremony.profile.profileId);
+	return ceremony.generation === current.generation && ceremony.generation === original.generation && selected !== void 0 && issued !== void 0 && profileStorage.encode(selected) === profileStorage.encode(ceremony.profile) && profileStorage.encode(issued) === profileStorage.encode(ceremony.profile) && ceremony.claimLifetimeMillis === original.claimLifetimeMillis && ceremony.expiresAtMillis > ceremony.issuedAtMillis && ceremony.expiresAtMillis <= ceremony.requestBindingExpiresAtMillis && ceremony.expiresAtMillis - ceremony.issuedAtMillis <= original.lifetimeMillis && ceremony.expiresAtMillis - ceremony.issuedAtMillis <= current.lifetimeMillis && ceremony.retentionUntilMillis === ceremony.issuedAtMillis + original.retentionMillis && contextPurpose[ceremony.context._tag] === ceremony.purpose && new Set(ceremony.allowedCredentials.map((item) => item.id)).size === ceremony.allowedCredentials.length;
+};
+const liveCondition = (mapping, ceremony, claim) => {
+	const now = mapping.clock.engineNowMillis;
+	return both(sql`${now} >= ${ceremony.issuedAtMillis}`, sql`${now} < ${ceremony.expiresAtMillis}`, sql`${now} < ${ceremony.requestBindingExpiresAtMillis}`, "target" in ceremony.context ? sql`${now} < ${ceremony.context.target.expiresAtMillis}` : void 0, claim === void 0 ? void 0 : both(sql`${now} >= ${claim.claimedAtMillis}`, sql`${now} < ${claim.claimExpiresAtMillis}`));
+};
+const matchesAccess = (ceremony, access) => ceremony.moduleId === access.moduleId && ceremony.generation === access.generation && ceremony.purpose === access.purpose && ceremony.flowId === access.flowId && ceremony.requestBindingVerifier === access.requestBindingVerifier && ceremony.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis;
+const readFlow = Effect.fn("passkey.readFlow")(function* (mapping, flowId) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const table = mapping.flow;
+	const row = (yield* owner.read(table.table, equal(table.table, {
+		[table.moduleId]: mapping.moduleId,
+		[table.flowId]: flowId
+	}), {
+		limit: 1,
+		columns: mappedColumns(table)
+	})).rows[0];
+	if (row === void 0) return void 0;
+	const ceremony = ceremonyStorage.decode(row[table.snapshot]);
+	const policy = policyStorage.decode(row[table.policySnapshot]);
+	const state = Object.keys(table.states).find((name) => table.states[name] === row[table.state]);
+	invariant(state !== void 0 && ceremony.moduleId === mapping.moduleId && ceremony.flowId === flowId);
+	invariant(row[table.moduleId] === ceremony.moduleId && row[table.flowId] === ceremony.flowId && row[table.commandId] === ceremony.commandId);
+	invariant(row[table.purpose] === ceremony.purpose && row[table.generation] === ceremony.generation);
+	invariant(row[table.requestBindingVerifier] === ceremony.requestBindingVerifier && mapping.clock.decodeInstant(row[table.requestBindingExpiresAt]) === ceremony.requestBindingExpiresAtMillis);
+	invariant(mapping.clock.decodeInstant(row[table.issuedAt]) === ceremony.issuedAtMillis && mapping.clock.decodeInstant(row[table.expiresAt]) === ceremony.expiresAtMillis && mapping.clock.decodeInstant(row[table.retentionUntil]) === ceremony.retentionUntilMillis);
+	invariant(compatiblePolicy(ceremony, policy, policy));
+	const credential = row[table.credentialSnapshot] === null ? void 0 : credentialStorage.decode(row[table.credentialSnapshot]);
+	const subject = credential?.revision.subjectId ?? knownSubject(ceremony);
+	invariant(row[table.subjectScope] === (subject === void 0 ? null : subjectScope(subject)) && row[table.targetScope] === targetScope(ceremony));
+	if (state === "Pending") {
+		invariant(row[table.claimId] === null && row[table.claimedAt] === null && row[table.claimExpiresAt] === null && credential === void 0);
+		return {
+			row,
+			ceremony,
+			policy,
+			state
+		};
+	}
+	const claim = row[table.claimId] === null ? void 0 : snapshotPasskeySync(PasskeyClaim, {
+		ceremony,
+		claimId: row[table.claimId],
+		claimedAtMillis: mapping.clock.decodeInstant(row[table.claimedAt]),
+		claimExpiresAtMillis: mapping.clock.decodeInstant(row[table.claimExpiresAt])
+	});
+	invariant(state !== "Claimed" || claim !== void 0);
+	if (claim !== void 0) invariant(claim.claimExpiresAtMillis === Math.min(claim.claimedAtMillis + ceremony.claimLifetimeMillis, ceremony.expiresAtMillis));
+	return {
+		row,
+		ceremony,
+		policy,
+		state,
+		...claim === void 0 ? {} : { claim },
+		...credential === void 0 ? {} : { credential }
+	};
+});
+const terminalFlow = Effect.fn("passkey.terminalFlow")(function* (mapping, read, state) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const table = mapping.flow;
+	yield* owner.update(table.table, {
+		[table.moduleId]: mapping.moduleId,
+		[table.flowId]: read.ceremony.flowId
+	}, {
+		[table.state]: table.states[state],
+		[table.version]: owner.marker
+	});
+	owner.postconditions.push(yield* existsExact(table.table, {
+		[table.moduleId]: mapping.moduleId,
+		[table.flowId]: read.ceremony.flowId,
+		[table.state]: table.states[state],
+		[table.version]: owner.marker
+	}));
+	return state;
+});
+const targetRevision = (ceremony) => "target" in ceremony.context ? ceremony.context.target.revision : ceremony.context._tag === "Enrollment" ? ceremony.context.revision : void 0;
+const currentTarget = Effect.fn("passkey.currentTarget")(function* (mapping, subject, ceremony) {
+	const target = targetRevision(ceremony);
+	if (target === void 0) return true;
+	if (subject === void 0 || subject.subjectId !== target.subjectId || subject.securityRevision !== target.securityRevision) return false;
+	const current = yield* readRevision(mapping.read, subject, target.credentials.map((item) => item.credentialId));
+	return current !== void 0 && sameRevision(current, target);
+});
+const issueAssertion = Effect.fn("passkey.issueAssertion")(function* (mapping, ceremony, suppliedPolicy) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const current = yield* readModule(mapping);
+	if (current === void 0 || ceremony.moduleId !== mapping.moduleId || !compatiblePolicy(ceremony, suppliedPolicy, current) || policyStorage.encode(suppliedPolicy) !== policyStorage.encode(current)) return { _tag: "Rejected" };
+	yield* lockAdmission(mapping);
+	const subjectId = knownSubject(ceremony);
+	const subject = subjectId === void 0 ? void 0 : yield* readSubject(mapping.read, subjectId);
+	yield* readPolicyGuards(mapping);
+	if (!(yield* currentTarget(mapping, subject, ceremony))) return { _tag: "Rejected" };
+	if (ceremony.context._tag === "SignIn" && (!ceremony.profile.primarySignIn || ceremony.profile.userVerification !== "required" || ceremony.profile.residentKey !== "required")) return { _tag: "Rejected" };
+	const table = mapping.flow;
+	const sameCommand = yield* owner.read(table.table, equal(table.table, {
+		[table.moduleId]: mapping.moduleId,
+		[table.commandId]: ceremony.commandId
+	}), { limit: 1 });
+	const sameFlow = yield* readFlow(mapping, ceremony.flowId);
+	if (sameCommand.rows.length !== 0 || sameFlow !== void 0) return { _tag: "Rejected" };
+	const kinds = chargeScopes(ceremony, subjectId).map((item) => item.kind);
+	if (!(yield* owner.check(liveCondition(mapping, ceremony))) || !(yield* owner.check(admissionCondition(mapping, [current], ceremony, subjectId, kinds, true, false)))) return { _tag: "Rejected" };
+	const values = {
+		...table.encodeInsert({
+			ceremony,
+			policy: suppliedPolicy,
+			marker: owner.marker
+		}),
+		[table.moduleId]: ceremony.moduleId,
+		[table.flowId]: ceremony.flowId,
+		[table.commandId]: ceremony.commandId,
+		[table.purpose]: ceremony.purpose,
+		[table.state]: table.states.Pending,
+		[table.version]: owner.marker,
+		[table.generation]: ceremony.generation,
+		[table.snapshot]: ceremonyStorage.encode(ceremony),
+		[table.policySnapshot]: policyStorage.encode(suppliedPolicy),
+		[table.requestBindingVerifier]: ceremony.requestBindingVerifier,
+		[table.requestBindingExpiresAt]: mapping.clock.encodeInstant(ceremony.requestBindingExpiresAtMillis),
+		[table.issuedAt]: mapping.clock.encodeInstant(ceremony.issuedAtMillis),
+		[table.expiresAt]: mapping.clock.encodeInstant(ceremony.expiresAtMillis),
+		[table.retentionUntil]: mapping.clock.encodeInstant(ceremony.retentionUntilMillis),
+		[table.claimId]: null,
+		[table.claimedAt]: null,
+		[table.claimExpiresAt]: null,
+		[table.credentialSnapshot]: null,
+		[table.subjectScope]: subjectId === void 0 ? null : subjectScope(subjectId),
+		[table.targetScope]: targetScope(ceremony)
+	};
+	const inserted = yield* owner.insert(table.table, values, {
+		[table.moduleId]: mapping.moduleId,
+		[table.flowId]: ceremony.flowId
+	});
+	sameCommand.rows = inserted.rows;
+	for (const observation of owner.observations) if (observation.table === table.table && observation.rows.length === 0) observation.rows = inserted.rows;
+	yield* insertCharges(mapping, ceremony, suppliedPolicy, kinds, subjectId);
+	yield* guardChargeSet(mapping, ceremony, subjectId);
+	yield* guardAdmission(mapping, [current], ceremony, subjectId);
+	owner.postconditions.push(liveCondition(mapping, ceremony));
+	return {
+		_tag: "Issued",
+		ceremony
+	};
+});
+const contextAssertion = Effect.fn("passkey.contextAssertion")(function* (mapping, access) {
+	const owner = yield* CurrentPasskeyTransaction;
+	if (access.moduleId !== mapping.moduleId) return void 0;
+	const current = yield* readModule(mapping);
+	if (current === void 0) return void 0;
+	yield* readPolicyGuards(mapping);
+	const read = yield* readFlow(mapping, access.flowId);
+	if (read === void 0 || read.state !== "Pending" || !matchesAccess(read.ceremony, access) || !compatiblePolicy(read.ceremony, read.policy, current)) return void 0;
+	if (!(yield* owner.check(liveCondition(mapping, read.ceremony)))) return void 0;
+	owner.postconditions.push(liveCondition(mapping, read.ceremony));
+	return read.ceremony;
+});
+const claimAssertion = Effect.fn("passkey.claimAssertion")(function* (mapping, input) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const current = yield* readModule(mapping);
+	if (current === void 0 || input.access.moduleId !== mapping.moduleId) return { _tag: "Rejected" };
+	yield* lockAdmission(mapping);
+	const expectedSubject = knownSubject(input.ceremony);
+	const subjectId = expectedSubject ?? input.credential?.revision.subjectId;
+	const subject = subjectId === void 0 ? void 0 : yield* readSubject(mapping.read, subjectId);
+	yield* readPolicyGuards(mapping);
+	const requested = targetRevision(input.ceremony)?.credentials.map((item) => item.credentialId) ?? input.credential?.revision.credentials.map((item) => item.credentialId);
+	const credential = input.credential === void 0 || subject === void 0 ? void 0 : yield* readCredential(mapping.read, subject, input.ceremony.profile.rpId, input.credential.protocolCredentialId, requested);
+	const read = yield* readFlow(mapping, input.access.flowId);
+	if (read === void 0 || read.state !== "Pending" || !matchesAccess(read.ceremony, input.access)) return { _tag: "Rejected" };
+	invariant(ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(input.ceremony));
+	const reject = Effect.gen(function* () {
+		yield* terminalFlow(mapping, read, "Rejected");
+		return { _tag: "Rejected" };
+	});
+	if (!compatiblePolicy(read.ceremony, read.policy, current) || policyStorage.encode(input.policy) !== policyStorage.encode(current) || !(yield* currentTarget(mapping, subject, read.ceremony))) return yield* reject;
+	if (input.credential !== void 0 && (credential === void 0 || !sameCredential(input.credential, credential.credential))) return yield* reject;
+	if (input.credential !== void 0 && credential !== void 0) {
+		const original = input.credential.revision;
+		const actual = credential.credential.revision;
+		const ids = [.../* @__PURE__ */ new Set([...requested ?? [], input.credential.credentialId])];
+		if (original.subjectId !== actual.subjectId || original.securityRevision !== actual.securityRevision || ids.some((id) => {
+			const before = original.credentials.find((item) => item.credentialId === id);
+			const after = actual.credentials.find((item) => item.credentialId === id);
+			return after === void 0 || (before === void 0 ? id === input.credential?.credentialId || targetRevision(read.ceremony) === void 0 : before.revision !== after.revision);
+		})) return yield* reject;
+	}
+	if (!(yield* owner.check(liveCondition(mapping, read.ceremony)))) return yield* reject;
+	yield* readCharges(mapping, read.ceremony, read.policy, expectedSubject);
+	const resolved = expectedSubject === void 0 && subjectId !== void 0;
+	if (!(yield* owner.check(admissionCondition(mapping, [read.policy, current], read.ceremony, subjectId, resolved ? ["subject"] : [], false, resolved)))) return yield* reject;
+	const claimedAtMillis = yield* owner.now(mapping.clock);
+	const claim = snapshotPasskeySync(PasskeyClaim, {
+		ceremony: read.ceremony,
+		claimId: input.claimId,
+		claimedAtMillis,
+		claimExpiresAtMillis: Math.min(claimedAtMillis + read.ceremony.claimLifetimeMillis, read.ceremony.expiresAtMillis)
+	});
+	const table = mapping.flow;
+	yield* owner.update(table.table, {
+		[table.moduleId]: mapping.moduleId,
+		[table.flowId]: read.ceremony.flowId
+	}, {
+		[table.state]: table.states.Claimed,
+		[table.version]: owner.marker,
+		[table.claimId]: claim.claimId,
+		[table.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),
+		[table.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),
+		[table.credentialSnapshot]: input.credential === void 0 ? null : credentialStorage.encode(input.credential),
+		[table.subjectScope]: subjectId === void 0 ? null : subjectScope(subjectId)
+	});
+	if (resolved) yield* insertCharges(mapping, read.ceremony, read.policy, ["subject"], subjectId);
+	yield* guardChargeSet(mapping, read.ceremony, subjectId);
+	yield* guardAdmission(mapping, [read.policy, current], read.ceremony, subjectId);
+	owner.postconditions.push(liveCondition(mapping, read.ceremony, claim));
+	return {
+		_tag: "Claimed",
+		claim
+	};
+});
+const exactClaim = (read, claim) => read.state === "Claimed" && read.claim !== void 0 && read.claim.claimId === claim.claimId && read.claim.claimedAtMillis === claim.claimedAtMillis && read.claim.claimExpiresAtMillis === claim.claimExpiresAtMillis && ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(claim.ceremony);
+const evidenceMatches = (ceremony, captured, credential, assertion, evidence) => {
+	const proof = evidence.proofs[0];
+	const original = targetRevision(ceremony) ?? captured.revision;
+	const ids = [.../* @__PURE__ */ new Set([...original.credentials.map((item) => item.credentialId), credential.credentialId])];
+	const expected = {
+		...credential.revision,
+		credentials: credential.revision.credentials.filter((item) => ids.includes(item.credentialId))
+	};
+	const selected = captured.revision.credentials.find((item) => item.credentialId === credential.credentialId);
+	return evidence.proofs.length === 1 && proof !== void 0 && proof.method === "passkey" && proof.credentialId === credential.credentialId && proof.factors.length === 1 && proof.factors[0] === "possession" && proof.userVerified === assertion.userVerified && proof.phishingResistant && DateTime.toEpochMillis(proof.verifiedAt) === ceremony.issuedAtMillis && evidence.flowId === ("target" in ceremony.context ? ceremony.context.target.flowId : ceremony.flowId) && evidence.bindingDigest === ("target" in ceremony.context ? ceremony.context.target.bindingDigest : ceremony.requestBindingVerifier) && expected.credentials.length === ids.length && sameRevision(evidence.revision, expected) && original.subjectId === expected.subjectId && original.securityRevision === expected.securityRevision && original.credentials.every((item) => expected.credentials.some((current) => current.credentialId === item.credentialId && current.revision === item.revision)) && selected !== void 0 && expected.credentials.some((item) => item.credentialId === selected.credentialId && item.revision === selected.revision);
+};
+const updateTelemetry = Effect.fn("passkey.updateTelemetry")(function* (mapping, found, assertion, dialect) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const table = mapping.read.credential;
+	const counter = sql`${col(table.table, table.counter)}`;
+	const maximum = sql`${col(table.table, table.maximumCounter)}`;
+	const max = (...values) => dialect === "sqlite" ? sql`max(${sql.join([...values], sql`, `)})` : sql`greatest(${sql.join([...values], sql`, `)})`;
+	const semantic = Object.fromEntries(semanticCredentialColumns(table).map((column) => [column, found.row[column]]));
+	const bs = mapping.telemetry.encodeBackupState(assertion.backupState);
+	const synced = found.credential.backupEligible;
+	const merged = max(counter, maximum, sql`${assertion.counter}`);
+	const currentCounter = synced ? sql`1 = 1` : sql`((${counter} = 0 and ${assertion.counter} = 0) or ${counter} < ${assertion.counter})`;
+	yield* owner.updateGuarded(table.table, both(owner.exact(table.table, semantic), table.activeCondition, currentCounter), {
+		[table.counter]: synced ? merged : assertion.counter,
+		[table.maximumCounter]: merged,
+		[table.backupState]: bs
+	}, {
+		rows: 1,
+		postcondition: yield* existsExact(table.table, {
+			...semantic,
+			[table.backupState]: bs
+		}, both(synced ? sql`${counter} = ${maximum}` : sql`${counter} = ${assertion.counter}`, sql`${maximum} >= ${assertion.counter}`))
+	});
+	const earliest = yield* owner.now(mapping.clock);
+	const lastUsed = sql`${col(table.table, mapping.telemetry.lastUsedAt)}`;
+	const millis = mapping.clock.toMillis(lastUsed);
+	yield* owner.finalUpdate(table.table, owner.exact(table.table, semantic), { [mapping.telemetry.lastUsedAt]: mapping.clock.fromMillis(max(sql`coalesce(${millis}, 0)`, mapping.clock.engineNowMillis)) }, {
+		rows: 1,
+		postcondition: yield* existsExact(table.table, semantic, both(sql`${millis} >= ${earliest}`, sql`${millis} <= ${mapping.clock.engineNowMillis}`))
+	});
+});
+const settleAssertion = Effect.fn("passkey.settleAssertion")(function* (mapping, claim, outcome, dialect) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const assertedCredential = outcome._tag === "Assertion" ? outcome.credential : void 0;
+	const current = yield* readModule(mapping);
+	if (current === void 0 || claim.ceremony.moduleId !== mapping.moduleId) return "Rejected";
+	yield* lockAdmission(mapping);
+	const originalIds = targetRevision(claim.ceremony)?.credentials.map((item) => item.credentialId) ?? (outcome._tag === "Assertion" ? outcome.credential.revision.credentials.map((item) => item.credentialId) : void 0);
+	const subjectId = outcome._tag === "Assertion" ? outcome.credential.revision.subjectId : knownSubject(claim.ceremony);
+	const subject = subjectId === void 0 ? void 0 : yield* readSubject(mapping.read, subjectId);
+	yield* readPolicyGuards(mapping);
+	const found = outcome._tag !== "Assertion" || subject === void 0 ? void 0 : yield* readCredential(mapping.read, subject, claim.ceremony.profile.rpId, outcome.credential.protocolCredentialId, originalIds);
+	const read = yield* readFlow(mapping, claim.ceremony.flowId);
+	if (read === void 0 || !exactClaim(read, claim)) return "Rejected";
+	if (outcome._tag !== "Assertion") return yield* terminalFlow(mapping, read, outcome._tag);
+	invariant(assertedCredential !== void 0);
+	const captured = "credential" in read ? read.credential : void 0;
+	const assertion = outcome.assertion;
+	if (captured === void 0 || found === void 0 || !compatiblePolicy(read.ceremony, read.policy, current) || !sameCredential(captured, assertedCredential) || !sameCredential(captured, found.credential)) return yield* terminalFlow(mapping, read, "Rejected");
+	const credential = found.credential;
+	const profile = read.ceremony.profile;
+	if (assertion.protocolCredentialId !== credential.protocolCredentialId || assertion.userHandle !== void 0 && assertion.userHandle !== credential.userHandle || assertion.backupEligible !== credential.backupEligible || assertion.backupState && !assertion.backupEligible || profile.userVerification === "required" && !assertion.userVerified || !profile.algorithms.includes(credential.algorithm) || read.ceremony.allowedCredentials.length !== 0 && !read.ceremony.allowedCredentials.some((item) => item.id === credential.protocolCredentialId) || read.ceremony.purpose === "sign-in" && (assertion.userHandle !== credential.userHandle || !credential.primarySignIn || !credential.enrollmentUserVerified || !credential.profile.primarySignIn || credential.profile.userVerification !== "required" || !assertion.userVerified) || !evidenceMatches(read.ceremony, captured, credential, assertion, outcome.evidence) || !(yield* owner.check(liveCondition(mapping, read.ceremony, claim)))) return yield* terminalFlow(mapping, read, "Rejected");
+	yield* readCharges(mapping, read.ceremony, read.policy, credential.revision.subjectId);
+	yield* guardChargeSet(mapping, read.ceremony, credential.revision.subjectId);
+	yield* updateTelemetry(mapping, found, assertion, dialect);
+	yield* terminalFlow(mapping, read, "Verified");
+	owner.postconditions.push(liveCondition(mapping, read.ceremony, claim));
+	return "Verified";
+});
+const purposeCondition = (table, purposes) => sql`${col(table.table, table.purpose)} in (${sql.join(purposes.map((purpose) => sql`${purpose}`), sql`, `)})`;
+const custodyFree = (mapping, flowExpression) => {
+	if (mapping.intent === void 0) return sql`1 = 1`;
+	const intent = mapping.intent;
+	return sql`not exists (select 1 from ${intent.table} where ${both(equal(intent.table, { [intent.moduleId]: mapping.moduleId }), sql`${col(intent.table, intent.flowId)} = ${flowExpression}`, intent.custodyCondition)})`;
+};
+const flowDue = (mapping, purposes) => {
+	const flow = mapping.flow, charge = mapping.charge, now = mapping.clock.engineNowMillis;
+	const state = sql`${col(flow.table, flow.state)}`;
+	const retained = sql`${mapping.clock.toMillis(sql`${col(flow.table, flow.retentionUntil)}`)} <= ${now}`;
+	const chargeLive = sql`exists (select 1 from ${charge.table} where ${both(equal(charge.table, { [charge.moduleId]: mapping.moduleId }), sql`${col(charge.table, charge.flowId)} = ${col(flow.table, flow.flowId)}`, sql`(${col(charge.table, charge.retainUntil)} is null or ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${now})`)})`;
+	return both(equal(flow.table, { [flow.moduleId]: mapping.moduleId }), purposeCondition(flow, purposes), sql`((${state} = ${flow.states.Pending} and ${mapping.clock.toMillis(sql`${col(flow.table, flow.expiresAt)}`)} <= ${now}) or
+      (${state} = ${flow.states.Claimed} and ${mapping.clock.toMillis(sql`${col(flow.table, flow.claimExpiresAt)}`)} <= ${now}) or
+      (${state} in (${flow.states.Verified}, ${flow.states.Rejected}, ${flow.states.Ambiguous}, ${flow.states.RegistrationAccepted}) and ${retained} and not (${chargeLive}) and ${custodyFree(mapping, sql`${col(flow.table, flow.flowId)}`)}))`);
+};
+const chargeDue = (mapping, purposes) => {
+	const charge = mapping.charge;
+	return both(equal(charge.table, { [charge.moduleId]: mapping.moduleId }), purposeCondition(charge, purposes), sql`${col(charge.table, charge.admittedAt)} is not null and ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} <= ${mapping.clock.engineNowMillis}`, custodyFree(mapping, sql`${col(charge.table, charge.flowId)}`));
+};
+/** Flow transitions and row removals share one bound. Prepared hasMore is
+* predicted from this owner's staged changes, then asserted after final writes. */
+const cleanupCeremonies = Effect.fn("passkey.cleanupCeremonies")(function* (mapping, input, purposes) {
+	const owner = yield* CurrentPasskeyTransaction;
+	invariant(input.moduleId === mapping.moduleId && Number.isSafeInteger(input.nowMillis) && input.nowMillis >= 0 && Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 1e3);
+	yield* readModule(mapping);
+	yield* lockAdmission(mapping);
+	yield* readPolicyGuards(mapping);
+	const flow = mapping.flow, charge = mapping.charge;
+	const rows = (yield* owner.read(flow.table, flowDue(mapping, purposes), {
+		limit: input.limit,
+		takeOnly: true,
+		observe: false,
+		orderBy: sql`${col(flow.table, flow.flowId)}`
+	})).rows;
+	const touched = [];
+	const transitioned = [];
+	let terminalized = 0, removed = 0;
+	for (const candidate of rows) {
+		const read = yield* readFlow(mapping, candidate[flow.flowId]);
+		if (read === void 0) continue;
+		invariant(yield* owner.check(sql`exists (select 1 from ${flow.table} where ${both(equal(flow.table, {
+			[flow.moduleId]: mapping.moduleId,
+			[flow.flowId]: read.ceremony.flowId
+		}), flowDue(mapping, purposes))})`));
+		touched.push(read.ceremony.flowId);
+		if (read.state === "Pending" || read.state === "Claimed") {
+			const deadline = read.state === "Pending" ? read.ceremony.expiresAtMillis : read.claim.claimExpiresAtMillis;
+			if (read.state === "Pending") yield* releaseRegistrationCustody(mapping, read.ceremony);
+			yield* terminalFlow(mapping, read, read.state === "Pending" ? "Rejected" : "Ambiguous");
+			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${deadline}`);
+			transitioned.push(read);
+			terminalized++;
+		} else {
+			yield* scrubRegistrationIntent(mapping, read.ceremony);
+			yield* owner.remove(flow.table, {
+				[flow.moduleId]: mapping.moduleId,
+				[flow.flowId]: read.ceremony.flowId
+			});
+			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${read.ceremony.retentionUntilMillis}`, custodyFree(mapping, sql`${read.ceremony.flowId}`), sql`not exists (select 1 from ${charge.table} where ${both(equal(charge.table, {
+				[charge.moduleId]: mapping.moduleId,
+				[charge.flowId]: read.ceremony.flowId
+			}), sql`(${col(charge.table, charge.retainUntil)} is null or ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${mapping.clock.engineNowMillis})`)})`);
+			removed++;
+		}
+	}
+	const removedCharges = [];
+	const remaining = input.limit - terminalized - removed;
+	if (remaining > 0) {
+		const charges = (yield* owner.read(charge.table, chargeDue(mapping, purposes), {
+			limit: remaining,
+			takeOnly: true,
+			observe: false,
+			orderBy: sql`${col(charge.table, charge.flowId)}, ${col(charge.table, charge.kind)}`
+		})).rows;
+		for (const candidate of charges) {
+			const identity = {
+				[charge.moduleId]: mapping.moduleId,
+				[charge.flowId]: candidate[charge.flowId],
+				[charge.kind]: candidate[charge.kind]
+			};
+			const selected = (yield* owner.read(charge.table, equal(charge.table, identity), { limit: 1 })).rows[0];
+			invariant(selected !== void 0);
+			const horizon = mapping.clock.decodeInstant(selected[charge.retainUntil]);
+			invariant(Number.isSafeInteger(horizon));
+			yield* owner.remove(charge.table, identity);
+			owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${horizon}`, custodyFree(mapping, sql`${candidate[charge.flowId]}`));
+			removedCharges.push({
+				flowId: candidate[charge.flowId],
+				kind: candidate[charge.kind]
+			});
+			removed++;
+		}
+	}
+	const excludeFlows = touched.length === 0 ? void 0 : sql`${col(flow.table, flow.flowId)} not in (${sql.join(touched.map((id) => sql`${id}`), sql`, `)})`;
+	const excludeCharges = removedCharges.map((item) => sql`not (${equal(charge.table, {
+		[charge.flowId]: item.flowId,
+		[charge.kind]: item.kind
+	})})`);
+	const predicted = sql`exists (select 1 from ${flow.table} where ${both(flowDue(mapping, purposes), excludeFlows)}) or exists (select 1 from ${charge.table} where ${both(chargeDue(mapping, purposes), ...excludeCharges)})`;
+	let hasMore = yield* owner.check(predicted);
+	for (const read of transitioned) {
+		if (read.ceremony.retentionUntilMillis > (yield* owner.now(mapping.clock))) continue;
+		const liveCharges = sql`exists (select 1 from ${charge.table} where ${both(equal(charge.table, {
+			[charge.moduleId]: mapping.moduleId,
+			[charge.flowId]: read.ceremony.flowId
+		}), sql`${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${mapping.clock.engineNowMillis}`, ...excludeCharges)})`;
+		if (!(yield* owner.check(liveCharges)) && (yield* owner.check(custodyFree(mapping, sql`${read.ceremony.flowId}`)))) hasMore = true;
+	}
+	const actual = sql`exists (select 1 from ${flow.table} where ${flowDue(mapping, purposes)}) or exists (select 1 from ${charge.table} where ${chargeDue(mapping, purposes)})`;
+	owner.postconditions.push(hasMore ? actual : sql`not (${actual})`);
+	return {
+		terminalized,
+		removed,
+		hasMore
+	};
+});
+//#endregion
+export { assertionPurposes, claimAssertion, cleanupCeremonies, compatiblePolicy, contextAssertion, contextPurpose, exactClaim, issueAssertion, knownSubject, liveCondition, matchesAccess, readFlow, settleAssertion, terminalFlow };
+
+//# sourceMappingURL=passkey-flow.mjs.map