@yielded/auth 0.1.0-beta.1

package/dist/drizzle/passkey-registration-custody.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-registration-custody.mjs","names":[],"sources":["../../src/drizzle/passkey-registration-custody.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- private mapped custody writes preserve the public concrete table descriptors. */\nimport { Effect } from \"effect\";\n\nimport type { PasskeyCeremony } from \"../passkey/models\";\nimport {\n  ceremonyStorage,\n  equal,\n  handleKey,\n  invariant,\n  CurrentPasskeyTransaction,\n} from \"./passkey-state\";\n\n/** SQL-local writers have no external provisioning work. A definite terminal\n * rejection can release only its exact still-reserved handle; ambiguous owners\n * retain custody, and an accepted transaction no longer matches this reservation. */\nexport const releaseRegistrationCustody = Effect.fn(\"passkey.releaseRegistrationCustody\")(\n  function* (mapping: any, ceremony: PasskeyCeremony) {\n    if (mapping.registration === undefined || ceremony.context._tag !== \"Registration\") return;\n    const owner = yield* CurrentPasskeyTransaction;\n    const handle = mapping.handle;\n    const intent = mapping.intent;\n    const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);\n\n    const held = (yield* owner.read(\n      handle.table,\n      equal(handle.table, { [handle.handleKey]: hashed }),\n      { limit: 1 },\n    )).rows[0];\n\n    const row = (yield* owner.read(\n      intent.table,\n      equal(intent.table, {\n        [intent.moduleId]: mapping.moduleId,\n        [intent.flowId]: ceremony.flowId,\n      }),\n      { limit: 1 },\n    )).rows[0];\n\n    if (row === undefined || !intent.isPendingState(row[intent.state])) return;\n    invariant(\n      held !== undefined &&\n        handle.isReservedState(held[handle.state]) &&\n        held[handle.reservationId] === row[intent.reservationId] &&\n        row[intent.handleKey] === hashed &&\n        row[intent.commandId] === ceremony.commandId &&\n        row[intent.ceremonySnapshot] === ceremonyStorage.encode(ceremony),\n    );\n    yield* owner.update(\n      intent.table,\n      { [intent.moduleId]: mapping.moduleId, [intent.flowId]: ceremony.flowId },\n      { [intent.state]: intent.rejectedState, [intent.version]: owner.marker },\n    );\n    yield* owner.remove(handle.table, { [handle.handleKey]: hashed });\n  },\n);\n\n/** Keep the command/flow tombstone after retention, without retaining the\n * application registration payload or ceremony. Ambiguous custody is never scrubbed. */\nexport const scrubRegistrationIntent = Effect.fn(\"passkey.scrubRegistrationIntent\")(function* (\n  mapping: any,\n  ceremony: PasskeyCeremony,\n) {\n  if (mapping.registration === undefined || ceremony.context._tag !== \"Registration\") return;\n  const owner = yield* CurrentPasskeyTransaction;\n  const intent = mapping.intent;\n  const identity = { [intent.moduleId]: mapping.moduleId, [intent.flowId]: ceremony.flowId };\n\n  const row = (yield* owner.read(intent.table, equal(intent.table, identity), { limit: 1 }))\n    .rows[0];\n\n  if (row === undefined) return;\n  invariant(\n    (row[intent.state] === intent.acceptedState || row[intent.state] === intent.rejectedState) &&\n      row[intent.commandId] === ceremony.commandId &&\n      row[intent.ceremonySnapshot] === ceremonyStorage.encode(ceremony),\n  );\n  yield* owner.update(intent.table, identity, {\n    [intent.applicationSnapshot]: \"\",\n    [intent.ceremonySnapshot]: \"\",\n    [intent.version]: owner.marker,\n  });\n});\n"],"mappings":";;;;;;AAeA,MAAa,6BAA6B,OAAO,GAAG,oCAAoC,CAAC,CACvF,WAAW,SAAc,UAA2B;CAClD,IAAI,QAAQ,iBAAiB,KAAA,KAAa,SAAS,QAAQ,SAAS,gBAAgB;CACpF,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,QAAQ;CACvB,MAAM,SAAS,QAAQ;CACvB,MAAM,SAAS,UAAU,SAAS,QAAQ,MAAM,SAAS,QAAQ,UAAU;CAE3E,MAAM,QAAQ,OAAO,MAAM,KACzB,OAAO,OACP,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,OAAO,CAAC,GAClD,EAAE,OAAO,EAAE,CACb,EAAA,CAAG,KAAK;CAER,MAAM,OAAO,OAAO,MAAM,KACxB,OAAO,OACP,MAAM,OAAO,OAAO;GACjB,OAAO,WAAW,QAAQ;GAC1B,OAAO,SAAS,SAAS;CAC5B,CAAC,GACD,EAAE,OAAO,EAAE,CACb,EAAA,CAAG,KAAK;CAER,IAAI,QAAQ,KAAA,KAAa,CAAC,OAAO,eAAe,IAAI,OAAO,MAAM,GAAG;CACpE,UACE,SAAS,KAAA,KACP,OAAO,gBAAgB,KAAK,OAAO,MAAM,KACzC,KAAK,OAAO,mBAAmB,IAAI,OAAO,kBAC1C,IAAI,OAAO,eAAe,UAC1B,IAAI,OAAO,eAAe,SAAS,aACnC,IAAI,OAAO,sBAAsB,gBAAgB,OAAO,QAAQ,CACpE;CACA,OAAO,MAAM,OACX,OAAO,OACP;GAAG,OAAO,WAAW,QAAQ;GAAW,OAAO,SAAS,SAAS;CAAO,GACxE;GAAG,OAAO,QAAQ,OAAO;GAAgB,OAAO,UAAU,MAAM;CAAO,CACzE;CACA,OAAO,MAAM,OAAO,OAAO,OAAO,GAAG,OAAO,YAAY,OAAO,CAAC;AAClE,CACF;;;AAIA,MAAa,0BAA0B,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAClF,SACA,UACA;CACA,IAAI,QAAQ,iBAAiB,KAAA,KAAa,SAAS,QAAQ,SAAS,gBAAgB;CACpF,MAAM,QAAQ,OAAO;CACrB,MAAM,SAAS,QAAQ;CACvB,MAAM,WAAW;GAAG,OAAO,WAAW,QAAQ;GAAW,OAAO,SAAS,SAAS;CAAO;CAEzF,MAAM,OAAO,OAAO,MAAM,KAAK,OAAO,OAAO,MAAM,OAAO,OAAO,QAAQ,GAAG,EAAE,OAAO,EAAE,CAAC,EAAA,CACrF,KAAK;CAER,IAAI,QAAQ,KAAA,GAAW;CACvB,WACG,IAAI,OAAO,WAAW,OAAO,iBAAiB,IAAI,OAAO,WAAW,OAAO,kBAC1E,IAAI,OAAO,eAAe,SAAS,aACnC,IAAI,OAAO,sBAAsB,gBAAgB,OAAO,QAAQ,CACpE;CACA,OAAO,MAAM,OAAO,OAAO,OAAO,UAAU;GACzC,OAAO,sBAAsB;GAC7B,OAAO,mBAAmB;GAC1B,OAAO,UAAU,MAAM;CAC1B,CAAC;AACH,CAAC"}

package/dist/drizzle/passkey-registration-write.mjs

@@ -0,0 +1,205 @@
+import { SubjectId } from "../Schema.mjs";
+import { both } from "./transaction-owner.mjs";
+import { PasskeyLabel, PasskeyRevision } from "../passkey/models.mjs";
+import { CurrentPasskeyTransaction, ceremonyStorage, credentialKey, equal, handleKey, invariant } from "./passkey-state.mjs";
+import { guardChargeSet, lockAdmission, readCharges } from "./passkey-admission.mjs";
+import { readModule, readPolicyGuards } from "./passkey-credentials.mjs";
+import { releaseRegistrationCustody } from "./passkey-registration-custody.mjs";
+import { compatiblePolicy, exactClaim, issueAssertion, liveCondition, readFlow, terminalFlow } from "./passkey-flow.mjs";
+import { digest, insertCredential, jsonStorage, validRegistration } from "./passkey-write-state.mjs";
+import { Effect, Schema } from "effect";
+import { sql } from "drizzle-orm";
+//#region src/drizzle/passkey-registration-write.ts
+const registrationData = (mapping, registration) => {
+	const codec = jsonStorage(mapping.registration.schema);
+	const encoded = codec.encode(registration);
+	invariant(new TextEncoder().encode(encoded).length <= 1048576);
+	return {
+		encoded,
+		registration: codec.decode(encoded),
+		fingerprint: digest(mapping.registration.schema, registration)
+	};
+};
+const describe = (mapping, registration) => {
+	const data = registrationData(mapping, registration);
+	const labels = Schema.decodeSync(Schema.Struct({
+		name: PasskeyLabel,
+		displayName: PasskeyLabel
+	}))(mapping.registration.describe(data.registration));
+	return {
+		...data,
+		...labels
+	};
+};
+const inspectRegistration = Effect.fn("passkey.inspectRegistration")(function* (mapping, registration) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const value = describe(mapping, registration);
+	const current = yield* readModule(mapping);
+	yield* readPolicyGuards(mapping);
+	const eligible = current !== void 0 && (yield* owner.check(mapping.registration.eligible(value.registration)));
+	return {
+		fingerprint: value.fingerprint,
+		name: value.name,
+		displayName: value.displayName,
+		eligible
+	};
+});
+const issueRegistration = Effect.fn("passkey.issueRegistration")(function* (mapping, input) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const ceremony = input.ceremony;
+	if (ceremony.moduleId !== mapping.moduleId || ceremony.purpose !== "registration" || ceremony.context._tag !== "Registration" || !ceremony.profile.primarySignIn || ceremony.profile.userVerification !== "required" || ceremony.profile.residentKey !== "required" || ceremony.allowedCredentials.length !== 0) return { _tag: "Rejected" };
+	const value = describe(mapping, input.registration);
+	if (value.fingerprint !== ceremony.context.fingerprint || value.name !== ceremony.context.name || value.displayName !== ceremony.context.displayName) return { _tag: "Rejected" };
+	if ((yield* readModule(mapping)) === void 0) return { _tag: "Rejected" };
+	yield* lockAdmission(mapping);
+	yield* readPolicyGuards(mapping);
+	const eligible = mapping.registration.eligible(value.registration);
+	if (!(yield* owner.check(eligible))) return { _tag: "Rejected" };
+	const handle = mapping.handle;
+	const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
+	const absentHandle = yield* owner.read(handle.table, equal(handle.table, { [handle.handleKey]: hashed }), { limit: 1 });
+	const intent = mapping.intent;
+	const absentCommand = yield* owner.read(intent.table, equal(intent.table, {
+		[intent.moduleId]: mapping.moduleId,
+		[intent.commandId]: ceremony.commandId
+	}), { limit: 1 });
+	const absentFlow = yield* owner.read(intent.table, equal(intent.table, {
+		[intent.moduleId]: mapping.moduleId,
+		[intent.flowId]: ceremony.flowId
+	}), { limit: 1 });
+	if (absentHandle.rows.length !== 0 || absentCommand.rows.length !== 0 || absentFlow.rows.length !== 0) return { _tag: "Rejected" };
+	const issued = yield* issueAssertion(mapping, ceremony, input.policy);
+	if (issued._tag !== "Issued") return issued;
+	absentHandle.rows = (yield* owner.insert(handle.table, {
+		...handle.encodeInsert({
+			ceremony,
+			reservationId: owner.marker
+		}),
+		[handle.handleKey]: hashed,
+		[handle.rpId]: ceremony.profile.rpId,
+		[handle.userHandle]: ceremony.context.userHandle,
+		[handle.state]: handle.reservedState,
+		[handle.version]: owner.marker,
+		[handle.reservationId]: owner.marker,
+		[mapping.read.handleOwnership.subjectId]: null
+	}, { [handle.handleKey]: hashed })).rows;
+	const inserted = yield* owner.insert(intent.table, {
+		...intent.encodeInsert({
+			ceremony,
+			registration: value.registration,
+			reservationId: owner.marker
+		}),
+		[intent.moduleId]: mapping.moduleId,
+		[intent.flowId]: ceremony.flowId,
+		[intent.commandId]: ceremony.commandId,
+		[intent.state]: intent.pendingState,
+		[intent.version]: owner.marker,
+		[intent.fingerprint]: value.fingerprint,
+		[intent.handleKey]: hashed,
+		[intent.reservationId]: owner.marker,
+		[intent.ceremonySnapshot]: ceremonyStorage.encode(ceremony),
+		[intent.applicationSnapshot]: value.encoded
+	}, {
+		[intent.moduleId]: mapping.moduleId,
+		[intent.flowId]: ceremony.flowId
+	});
+	absentCommand.rows = inserted.rows;
+	absentFlow.rows = inserted.rows;
+	owner.postconditions.push(eligible);
+	return issued;
+});
+const completeRegistration = Effect.fn("passkey.completeRegistration")(function* (mapping, input) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const ceremony = input.claim.ceremony;
+	if (ceremony.moduleId !== mapping.moduleId || ceremony.purpose !== "registration" || ceremony.context._tag !== "Registration") return { _tag: "Rejected" };
+	const current = yield* readModule(mapping);
+	if (current === void 0) return { _tag: "Rejected" };
+	yield* lockAdmission(mapping);
+	yield* readPolicyGuards(mapping);
+	const tuple = mapping.read.credentialOwnership;
+	const absentCredential = yield* owner.read(tuple.table, equal(tuple.table, { [tuple.credentialKey]: credentialKey(ceremony.profile.rpId, input.verified.protocolCredentialId) }), {
+		limit: 1,
+		observe: false
+	});
+	const handle = mapping.handle;
+	const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);
+	const held = (yield* owner.read(handle.table, equal(handle.table, { [handle.handleKey]: hashed }), { limit: 1 })).rows[0];
+	const intent = mapping.intent;
+	const row = (yield* owner.read(intent.table, equal(intent.table, {
+		[intent.moduleId]: mapping.moduleId,
+		[intent.flowId]: ceremony.flowId
+	}), { limit: 1 })).rows[0];
+	const read = yield* readFlow(mapping, ceremony.flowId);
+	if (read === void 0 || !exactClaim(read, input.claim)) return { _tag: "Rejected" };
+	const reject = Effect.gen(function* () {
+		yield* releaseRegistrationCustody(mapping, ceremony);
+		yield* terminalFlow(mapping, read, "Rejected");
+		return { _tag: "Rejected" };
+	});
+	if (absentCredential.rows.length !== 0 || held === void 0 || row === void 0 || !handle.isReservedState(held[handle.state]) || !intent.isPendingState(row[intent.state]) || row[intent.commandId] !== ceremony.commandId || row[intent.ceremonySnapshot] !== ceremonyStorage.encode(ceremony) || row[intent.fingerprint] !== ceremony.context.fingerprint || row[intent.handleKey] !== hashed || held[handle.reservationId] !== row[intent.reservationId] || held[handle.rpId] !== ceremony.profile.rpId || held[handle.userHandle] !== ceremony.context.userHandle || !compatiblePolicy(ceremony, read.policy, current) || !validRegistration(ceremony, input.verified) || !input.verified.userVerified || !ceremony.profile.primarySignIn || !(yield* owner.check(liveCondition(mapping, ceremony, input.claim)))) return yield* reject;
+	const data = describe(mapping, jsonStorage(mapping.registration.schema).decode(row[intent.applicationSnapshot]));
+	if (data.encoded !== row[intent.applicationSnapshot] || data.fingerprint !== ceremony.context.fingerprint || data.name !== ceremony.context.name || data.displayName !== ceremony.context.displayName) return yield* reject;
+	const eligible = mapping.registration.eligible(data.registration);
+	if (!(yield* owner.check(eligible))) return yield* reject;
+	const provision = mapping.registration.subject({
+		registration: data.registration,
+		ceremony,
+		marker: owner.marker
+	});
+	const nativeId = provision.subjectId;
+	const subjectId = SubjectId.make(mapping.read.subjectIds.toSubject(nativeId));
+	invariant(mapping.read.subjectIds.equals(mapping.read.subjectIds.toNative(subjectId), nativeId));
+	const table = mapping.read.subject;
+	const absentSubject = yield* owner.read(table.table, equal(table.table, { [table.id]: nativeId }), { limit: 1 });
+	if (absentSubject.rows.length !== 0) return yield* reject;
+	const values = {
+		...provision.values,
+		[table.id]: nativeId,
+		[table.status]: mapping.registration.activeStatus,
+		[table.securityRevision]: owner.marker
+	};
+	absentSubject.rows = (yield* owner.insert(table.table, values, { [table.id]: nativeId })).rows;
+	const subject = {
+		subjectId,
+		nativeId,
+		row: values,
+		revision: PasskeyRevision.make({
+			subjectId,
+			securityRevision: PasskeyRevision.fields.securityRevision.make(owner.marker),
+			credentials: []
+		})
+	};
+	yield* owner.update(handle.table, { [handle.handleKey]: hashed }, {
+		[mapping.read.handleOwnership.subjectId]: nativeId,
+		[handle.state]: mapping.write.handleOwnership.ownedState,
+		[handle.version]: owner.marker,
+		[handle.reservationId]: null
+	});
+	yield* readCharges(mapping, ceremony, read.policy);
+	yield* guardChargeSet(mapping, ceremony);
+	yield* insertCredential(mapping, subject, ceremony, input.verified, yield* owner.now(mapping.clock));
+	yield* owner.update(intent.table, {
+		[intent.moduleId]: mapping.moduleId,
+		[intent.flowId]: ceremony.flowId
+	}, {
+		[intent.state]: intent.acceptedState,
+		[intent.version]: owner.marker
+	});
+	const flow = mapping.flow;
+	yield* owner.update(flow.table, {
+		[flow.moduleId]: mapping.moduleId,
+		[flow.flowId]: ceremony.flowId
+	}, {
+		[flow.state]: flow.states.RegistrationAccepted,
+		[flow.version]: owner.marker
+	});
+	owner.postconditions.push(liveCondition(mapping, ceremony, input.claim), mapping.registration.finalEligibility({
+		registration: data.registration,
+		subjectId: nativeId
+	}), sql`exists(select 1 from ${table.table} where ${both(owner.exact(table.table, values), table.activeCondition)})`);
+	return { _tag: "RegistrationAccepted" };
+});
+//#endregion
+export { completeRegistration, inspectRegistration, issueRegistration };
+
+//# sourceMappingURL=passkey-registration-write.mjs.map

package/dist/drizzle/passkey-registration-write.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-registration-write.mjs","names":[],"sources":["../../src/drizzle/passkey-registration-write.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- private row bridge; public mappings retain consumer payload, table, and ID types. */\nimport { sql } from \"drizzle-orm\";\nimport { Effect, Schema } from \"effect\";\n\nimport {\n  PasskeyLabel,\n  PasskeyRevision,\n  type PasskeyCeremony,\n  type PasskeyClaim,\n  type PasskeyRegistrationVerified,\n} from \"../passkey/models\";\nimport type { PasskeyMethodPolicy } from \"../passkey/policy\";\nimport { SubjectId } from \"../Schema\";\nimport { lockAdmission, readCharges, guardChargeSet } from \"./passkey-admission\";\nimport { readModule, readPolicyGuards } from \"./passkey-credentials\";\nimport {\n  compatiblePolicy,\n  exactClaim,\n  issueAssertion,\n  liveCondition,\n  readFlow,\n  terminalFlow,\n} from \"./passkey-flow\";\nimport { releaseRegistrationCustody } from \"./passkey-registration-custody\";\nimport {\n  ceremonyStorage,\n  credentialKey,\n  equal,\n  handleKey,\n  invariant,\n  CurrentPasskeyTransaction,\n} from \"./passkey-state\";\nimport { digest, insertCredential, jsonStorage, validRegistration } from \"./passkey-write-state\";\nimport { both } from \"./transaction-owner\";\n\nconst registrationData = (mapping: any, registration: any) => {\n  const codec = jsonStorage(mapping.registration.schema);\n  const encoded = codec.encode(registration);\n\n  invariant(new TextEncoder().encode(encoded).length <= 1048576);\n\n  return {\n    encoded,\n    registration: codec.decode(encoded),\n    fingerprint: digest(mapping.registration.schema, registration),\n  };\n};\n\nconst describe = (mapping: any, registration: any) => {\n  const data = registrationData(mapping, registration);\n\n  const labels = Schema.decodeSync(\n    Schema.Struct({ name: PasskeyLabel, displayName: PasskeyLabel }),\n  )(mapping.registration.describe(data.registration));\n\n  return { ...data, ...labels };\n};\n\nexport const inspectRegistration = Effect.fn(\"passkey.inspectRegistration\")(function* (\n  mapping: any,\n  registration: any,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const value = describe(mapping, registration);\n  const current = yield* readModule(mapping);\n\n  yield* readPolicyGuards(mapping);\n\n  const eligible =\n    current !== undefined &&\n    (yield* owner.check(mapping.registration.eligible(value.registration)));\n\n  return {\n    fingerprint: value.fingerprint,\n    name: value.name,\n    displayName: value.displayName,\n    eligible,\n  };\n});\n\nexport const issueRegistration = Effect.fn(\"passkey.issueRegistration\")(function* (\n  mapping: any,\n  input: {\n    readonly ceremony: PasskeyCeremony;\n    readonly policy: PasskeyMethodPolicy;\n    readonly registration: any;\n  },\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const ceremony = input.ceremony;\n\n  if (\n    ceremony.moduleId !== mapping.moduleId ||\n    ceremony.purpose !== \"registration\" ||\n    ceremony.context._tag !== \"Registration\" ||\n    !ceremony.profile.primarySignIn ||\n    ceremony.profile.userVerification !== \"required\" ||\n    ceremony.profile.residentKey !== \"required\" ||\n    ceremony.allowedCredentials.length !== 0\n  )\n    return { _tag: \"Rejected\" } as const;\n  const value = describe(mapping, input.registration);\n\n  if (\n    value.fingerprint !== ceremony.context.fingerprint ||\n    value.name !== ceremony.context.name ||\n    value.displayName !== ceremony.context.displayName\n  )\n    return { _tag: \"Rejected\" } as const;\n  if ((yield* readModule(mapping)) === undefined) return { _tag: \"Rejected\" } as const;\n  yield* lockAdmission(mapping);\n  yield* readPolicyGuards(mapping);\n  const eligible = mapping.registration.eligible(value.registration);\n\n  if (!(yield* owner.check(eligible))) return { _tag: \"Rejected\" } as const;\n  const handle = mapping.handle;\n  const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);\n\n  const absentHandle = yield* owner.read(\n    handle.table,\n    equal(handle.table, { [handle.handleKey]: hashed }),\n    { limit: 1 },\n  );\n\n  const intent = mapping.intent;\n\n  const absentCommand = yield* owner.read(\n    intent.table,\n    equal(intent.table, {\n      [intent.moduleId]: mapping.moduleId,\n      [intent.commandId]: ceremony.commandId,\n    }),\n    { limit: 1 },\n  );\n\n  const absentFlow = yield* owner.read(\n    intent.table,\n    equal(intent.table, { [intent.moduleId]: mapping.moduleId, [intent.flowId]: ceremony.flowId }),\n    { limit: 1 },\n  );\n\n  if (\n    absentHandle.rows.length !== 0 ||\n    absentCommand.rows.length !== 0 ||\n    absentFlow.rows.length !== 0\n  )\n    return { _tag: \"Rejected\" } as const;\n  const issued = yield* issueAssertion(mapping, ceremony, input.policy);\n\n  if (issued._tag !== \"Issued\") return issued;\n\n  const reserved = yield* owner.insert(\n    handle.table,\n    {\n      ...handle.encodeInsert({ ceremony, reservationId: owner.marker }),\n      [handle.handleKey]: hashed,\n      [handle.rpId]: ceremony.profile.rpId,\n      [handle.userHandle]: ceremony.context.userHandle,\n      [handle.state]: handle.reservedState,\n      [handle.version]: owner.marker,\n      [handle.reservationId]: owner.marker,\n      [mapping.read.handleOwnership.subjectId]: null,\n    },\n    { [handle.handleKey]: hashed },\n  );\n\n  absentHandle.rows = reserved.rows;\n\n  const inserted = yield* owner.insert(\n    intent.table,\n    {\n      ...intent.encodeInsert({\n        ceremony,\n        registration: value.registration,\n        reservationId: owner.marker,\n      }),\n      [intent.moduleId]: mapping.moduleId,\n      [intent.flowId]: ceremony.flowId,\n      [intent.commandId]: ceremony.commandId,\n      [intent.state]: intent.pendingState,\n      [intent.version]: owner.marker,\n      [intent.fingerprint]: value.fingerprint,\n      [intent.handleKey]: hashed,\n      [intent.reservationId]: owner.marker,\n      [intent.ceremonySnapshot]: ceremonyStorage.encode(ceremony),\n      [intent.applicationSnapshot]: value.encoded,\n    },\n    { [intent.moduleId]: mapping.moduleId, [intent.flowId]: ceremony.flowId },\n  );\n\n  absentCommand.rows = inserted.rows;\n  absentFlow.rows = inserted.rows;\n  owner.postconditions.push(eligible);\n\n  return issued;\n});\n\nexport const completeRegistration = Effect.fn(\"passkey.completeRegistration\")(function* (\n  mapping: any,\n  input: {\n    readonly claim: PasskeyClaim;\n    readonly verified: PasskeyRegistrationVerified;\n    readonly nowMillis: number;\n  },\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const ceremony = input.claim.ceremony;\n\n  if (\n    ceremony.moduleId !== mapping.moduleId ||\n    ceremony.purpose !== \"registration\" ||\n    ceremony.context._tag !== \"Registration\"\n  )\n    return { _tag: \"Rejected\" } as const;\n  const current = yield* readModule(mapping);\n\n  if (current === undefined) return { _tag: \"Rejected\" } as const;\n  yield* lockAdmission(mapping);\n  yield* readPolicyGuards(mapping);\n  const tuple = mapping.read.credentialOwnership;\n\n  const absentCredential = yield* owner.read(\n    tuple.table,\n    equal(tuple.table, {\n      [tuple.credentialKey]: credentialKey(\n        ceremony.profile.rpId,\n        input.verified.protocolCredentialId,\n      ),\n    }),\n    { limit: 1, observe: false },\n  );\n\n  const handle = mapping.handle;\n  const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);\n\n  const held = (yield* owner.read(\n    handle.table,\n    equal(handle.table, { [handle.handleKey]: hashed }),\n    { limit: 1 },\n  )).rows[0];\n\n  const intent = mapping.intent;\n\n  const row = (yield* owner.read(\n    intent.table,\n    equal(intent.table, { [intent.moduleId]: mapping.moduleId, [intent.flowId]: ceremony.flowId }),\n    { limit: 1 },\n  )).rows[0];\n\n  const read = yield* readFlow(mapping, ceremony.flowId);\n\n  if (read === undefined || !exactClaim(read, input.claim)) return { _tag: \"Rejected\" } as const;\n\n  const reject = Effect.gen(function* () {\n    yield* releaseRegistrationCustody(mapping, ceremony);\n    yield* terminalFlow(mapping, read, \"Rejected\");\n\n    return { _tag: \"Rejected\" } as const;\n  });\n\n  if (\n    absentCredential.rows.length !== 0 ||\n    held === undefined ||\n    row === undefined ||\n    !handle.isReservedState(held[handle.state]) ||\n    !intent.isPendingState(row[intent.state]) ||\n    row[intent.commandId] !== ceremony.commandId ||\n    row[intent.ceremonySnapshot] !== ceremonyStorage.encode(ceremony) ||\n    row[intent.fingerprint] !== ceremony.context.fingerprint ||\n    row[intent.handleKey] !== hashed ||\n    held[handle.reservationId] !== row[intent.reservationId] ||\n    held[handle.rpId] !== ceremony.profile.rpId ||\n    held[handle.userHandle] !== ceremony.context.userHandle ||\n    !compatiblePolicy(ceremony, read.policy, current) ||\n    !validRegistration(ceremony, input.verified) ||\n    !input.verified.userVerified ||\n    !ceremony.profile.primarySignIn ||\n    !(yield* owner.check(liveCondition(mapping, ceremony, input.claim)))\n  )\n    return yield* reject;\n\n  const data = describe(\n    mapping,\n    jsonStorage(mapping.registration.schema).decode(row[intent.applicationSnapshot]),\n  );\n\n  if (\n    data.encoded !== row[intent.applicationSnapshot] ||\n    data.fingerprint !== ceremony.context.fingerprint ||\n    data.name !== ceremony.context.name ||\n    data.displayName !== ceremony.context.displayName\n  )\n    return yield* reject;\n  const eligible = mapping.registration.eligible(data.registration);\n\n  if (!(yield* owner.check(eligible))) return yield* reject;\n\n  const provision = mapping.registration.subject({\n    registration: data.registration,\n    ceremony,\n    marker: owner.marker,\n  });\n\n  const nativeId = provision.subjectId;\n  const subjectId = SubjectId.make(mapping.read.subjectIds.toSubject(nativeId));\n\n  invariant(mapping.read.subjectIds.equals(mapping.read.subjectIds.toNative(subjectId), nativeId));\n  const table = mapping.read.subject;\n\n  const absentSubject = yield* owner.read(\n    table.table,\n    equal(table.table, { [table.id]: nativeId }),\n    { limit: 1 },\n  );\n\n  if (absentSubject.rows.length !== 0) return yield* reject;\n\n  const values = {\n    ...provision.values,\n    [table.id]: nativeId,\n    [table.status]: mapping.registration.activeStatus,\n    [table.securityRevision]: owner.marker,\n  };\n\n  const inserted = yield* owner.insert(table.table, values, { [table.id]: nativeId });\n\n  absentSubject.rows = inserted.rows;\n\n  const subject = {\n    subjectId,\n    nativeId,\n    row: values,\n    revision: PasskeyRevision.make({\n      subjectId,\n      securityRevision: PasskeyRevision.fields.securityRevision.make(owner.marker),\n      credentials: [],\n    }),\n  };\n\n  yield* owner.update(\n    handle.table,\n    { [handle.handleKey]: hashed },\n    {\n      [mapping.read.handleOwnership.subjectId]: nativeId,\n      [handle.state]: mapping.write.handleOwnership.ownedState,\n      [handle.version]: owner.marker,\n      [handle.reservationId]: null,\n    },\n  );\n  yield* readCharges(mapping, ceremony, read.policy);\n  yield* guardChargeSet(mapping, ceremony);\n  yield* insertCredential(\n    mapping,\n    subject,\n    ceremony,\n    input.verified,\n    yield* owner.now(mapping.clock),\n  );\n  yield* owner.update(\n    intent.table,\n    { [intent.moduleId]: mapping.moduleId, [intent.flowId]: ceremony.flowId },\n    { [intent.state]: intent.acceptedState, [intent.version]: owner.marker },\n  );\n  const flow = mapping.flow;\n\n  yield* owner.update(\n    flow.table,\n    { [flow.moduleId]: mapping.moduleId, [flow.flowId]: ceremony.flowId },\n    { [flow.state]: flow.states.RegistrationAccepted, [flow.version]: owner.marker },\n  );\n  owner.postconditions.push(\n    liveCondition(mapping, ceremony, input.claim),\n    mapping.registration.finalEligibility({ registration: data.registration, subjectId: nativeId }),\n    sql`exists(select 1 from ${table.table} where ${both(owner.exact(table.table, values), table.activeCondition)})`,\n  );\n\n  return { _tag: \"RegistrationAccepted\" } as const;\n});\n"],"mappings":";;;;;;;;;;;;AAmCA,MAAM,oBAAoB,SAAc,iBAAsB;CAC5D,MAAM,QAAQ,YAAY,QAAQ,aAAa,MAAM;CACrD,MAAM,UAAU,MAAM,OAAO,YAAY;CAEzC,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,OAAO;CAE7D,OAAO;EACL;EACA,cAAc,MAAM,OAAO,OAAO;EAClC,aAAa,OAAO,QAAQ,aAAa,QAAQ,YAAY;CAC/D;AACF;AAEA,MAAM,YAAY,SAAc,iBAAsB;CACpD,MAAM,OAAO,iBAAiB,SAAS,YAAY;CAEnD,MAAM,SAAS,OAAO,WACpB,OAAO,OAAO;EAAE,MAAM;EAAc,aAAa;CAAa,CAAC,CACjE,CAAC,CAAC,QAAQ,aAAa,SAAS,KAAK,YAAY,CAAC;CAElD,OAAO;EAAE,GAAG;EAAM,GAAG;CAAO;AAC9B;AAEA,MAAa,sBAAsB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC1E,SACA,cACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,SAAS,SAAS,YAAY;CAC5C,MAAM,UAAU,OAAO,WAAW,OAAO;CAEzC,OAAO,iBAAiB,OAAO;CAE/B,MAAM,WACJ,YAAY,KAAA,MACX,OAAO,MAAM,MAAM,QAAQ,aAAa,SAAS,MAAM,YAAY,CAAC;CAEvE,OAAO;EACL,aAAa,MAAM;EACnB,MAAM,MAAM;EACZ,aAAa,MAAM;EACnB;CACF;AACF,CAAC;AAED,MAAa,oBAAoB,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACtE,SACA,OAKA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,WAAW,MAAM;CAEvB,IACE,SAAS,aAAa,QAAQ,YAC9B,SAAS,YAAY,kBACrB,SAAS,QAAQ,SAAS,kBAC1B,CAAC,SAAS,QAAQ,iBAClB,SAAS,QAAQ,qBAAqB,cACtC,SAAS,QAAQ,gBAAgB,cACjC,SAAS,mBAAmB,WAAW,GAEvC,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,QAAQ,SAAS,SAAS,MAAM,YAAY;CAElD,IACE,MAAM,gBAAgB,SAAS,QAAQ,eACvC,MAAM,SAAS,SAAS,QAAQ,QAChC,MAAM,gBAAgB,SAAS,QAAQ,aAEvC,OAAO,EAAE,MAAM,WAAW;CAC5B,KAAK,OAAO,WAAW,OAAO,OAAO,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CAC1E,OAAO,cAAc,OAAO;CAC5B,OAAO,iBAAiB,OAAO;CAC/B,MAAM,WAAW,QAAQ,aAAa,SAAS,MAAM,YAAY;CAEjE,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;CAC/D,MAAM,SAAS,QAAQ;CACvB,MAAM,SAAS,UAAU,SAAS,QAAQ,MAAM,SAAS,QAAQ,UAAU;CAE3E,MAAM,eAAe,OAAO,MAAM,KAChC,OAAO,OACP,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,OAAO,CAAC,GAClD,EAAE,OAAO,EAAE,CACb;CAEA,MAAM,SAAS,QAAQ;CAEvB,MAAM,gBAAgB,OAAO,MAAM,KACjC,OAAO,OACP,MAAM,OAAO,OAAO;GACjB,OAAO,WAAW,QAAQ;GAC1B,OAAO,YAAY,SAAS;CAC/B,CAAC,GACD,EAAE,OAAO,EAAE,CACb;CAEA,MAAM,aAAa,OAAO,MAAM,KAC9B,OAAO,OACP,MAAM,OAAO,OAAO;GAAG,OAAO,WAAW,QAAQ;GAAW,OAAO,SAAS,SAAS;CAAO,CAAC,GAC7F,EAAE,OAAO,EAAE,CACb;CAEA,IACE,aAAa,KAAK,WAAW,KAC7B,cAAc,KAAK,WAAW,KAC9B,WAAW,KAAK,WAAW,GAE3B,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,SAAS,OAAO,eAAe,SAAS,UAAU,MAAM,MAAM;CAEpE,IAAI,OAAO,SAAS,UAAU,OAAO;CAiBrC,aAAa,QAAO,OAfI,MAAM,OAC5B,OAAO,OACP;EACE,GAAG,OAAO,aAAa;GAAE;GAAU,eAAe,MAAM;EAAO,CAAC;GAC/D,OAAO,YAAY;GACnB,OAAO,OAAO,SAAS,QAAQ;GAC/B,OAAO,aAAa,SAAS,QAAQ;GACrC,OAAO,QAAQ,OAAO;GACtB,OAAO,UAAU,MAAM;GACvB,OAAO,gBAAgB,MAAM;GAC7B,QAAQ,KAAK,gBAAgB,YAAY;CAC5C,GACA,GAAG,OAAO,YAAY,OAAO,CAC/B,EAAA,CAE6B;CAE7B,MAAM,WAAW,OAAO,MAAM,OAC5B,OAAO,OACP;EACE,GAAG,OAAO,aAAa;GACrB;GACA,cAAc,MAAM;GACpB,eAAe,MAAM;EACvB,CAAC;GACA,OAAO,WAAW,QAAQ;GAC1B,OAAO,SAAS,SAAS;GACzB,OAAO,YAAY,SAAS;GAC5B,OAAO,QAAQ,OAAO;GACtB,OAAO,UAAU,MAAM;GACvB,OAAO,cAAc,MAAM;GAC3B,OAAO,YAAY;GACnB,OAAO,gBAAgB,MAAM;GAC7B,OAAO,mBAAmB,gBAAgB,OAAO,QAAQ;GACzD,OAAO,sBAAsB,MAAM;CACtC,GACA;GAAG,OAAO,WAAW,QAAQ;GAAW,OAAO,SAAS,SAAS;CAAO,CAC1E;CAEA,cAAc,OAAO,SAAS;CAC9B,WAAW,OAAO,SAAS;CAC3B,MAAM,eAAe,KAAK,QAAQ;CAElC,OAAO;AACT,CAAC;AAED,MAAa,uBAAuB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAC5E,SACA,OAKA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,WAAW,MAAM,MAAM;CAE7B,IACE,SAAS,aAAa,QAAQ,YAC9B,SAAS,YAAY,kBACrB,SAAS,QAAQ,SAAS,gBAE1B,OAAO,EAAE,MAAM,WAAW;CAC5B,MAAM,UAAU,OAAO,WAAW,OAAO;CAEzC,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;CACrD,OAAO,cAAc,OAAO;CAC5B,OAAO,iBAAiB,OAAO;CAC/B,MAAM,QAAQ,QAAQ,KAAK;CAE3B,MAAM,mBAAmB,OAAO,MAAM,KACpC,MAAM,OACN,MAAM,MAAM,OAAO,GAChB,MAAM,gBAAgB,cACrB,SAAS,QAAQ,MACjB,MAAM,SAAS,oBACjB,EACF,CAAC,GACD;EAAE,OAAO;EAAG,SAAS;CAAM,CAC7B;CAEA,MAAM,SAAS,QAAQ;CACvB,MAAM,SAAS,UAAU,SAAS,QAAQ,MAAM,SAAS,QAAQ,UAAU;CAE3E,MAAM,QAAQ,OAAO,MAAM,KACzB,OAAO,OACP,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,OAAO,CAAC,GAClD,EAAE,OAAO,EAAE,CACb,EAAA,CAAG,KAAK;CAER,MAAM,SAAS,QAAQ;CAEvB,MAAM,OAAO,OAAO,MAAM,KACxB,OAAO,OACP,MAAM,OAAO,OAAO;GAAG,OAAO,WAAW,QAAQ;GAAW,OAAO,SAAS,SAAS;CAAO,CAAC,GAC7F,EAAE,OAAO,EAAE,CACb,EAAA,CAAG,KAAK;CAER,MAAM,OAAO,OAAO,SAAS,SAAS,SAAS,MAAM;CAErD,IAAI,SAAS,KAAA,KAAa,CAAC,WAAW,MAAM,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,WAAW;CAEpF,MAAM,SAAS,OAAO,IAAI,aAAa;EACrC,OAAO,2BAA2B,SAAS,QAAQ;EACnD,OAAO,aAAa,SAAS,MAAM,UAAU;EAE7C,OAAO,EAAE,MAAM,WAAW;CAC5B,CAAC;CAED,IACE,iBAAiB,KAAK,WAAW,KACjC,SAAS,KAAA,KACT,QAAQ,KAAA,KACR,CAAC,OAAO,gBAAgB,KAAK,OAAO,MAAM,KAC1C,CAAC,OAAO,eAAe,IAAI,OAAO,MAAM,KACxC,IAAI,OAAO,eAAe,SAAS,aACnC,IAAI,OAAO,sBAAsB,gBAAgB,OAAO,QAAQ,KAChE,IAAI,OAAO,iBAAiB,SAAS,QAAQ,eAC7C,IAAI,OAAO,eAAe,UAC1B,KAAK,OAAO,mBAAmB,IAAI,OAAO,kBAC1C,KAAK,OAAO,UAAU,SAAS,QAAQ,QACvC,KAAK,OAAO,gBAAgB,SAAS,QAAQ,cAC7C,CAAC,iBAAiB,UAAU,KAAK,QAAQ,OAAO,KAChD,CAAC,kBAAkB,UAAU,MAAM,QAAQ,KAC3C,CAAC,MAAM,SAAS,gBAChB,CAAC,SAAS,QAAQ,iBAClB,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,UAAU,MAAM,KAAK,CAAC,IAElE,OAAO,OAAO;CAEhB,MAAM,OAAO,SACX,SACA,YAAY,QAAQ,aAAa,MAAM,CAAC,CAAC,OAAO,IAAI,OAAO,oBAAoB,CACjF;CAEA,IACE,KAAK,YAAY,IAAI,OAAO,wBAC5B,KAAK,gBAAgB,SAAS,QAAQ,eACtC,KAAK,SAAS,SAAS,QAAQ,QAC/B,KAAK,gBAAgB,SAAS,QAAQ,aAEtC,OAAO,OAAO;CAChB,MAAM,WAAW,QAAQ,aAAa,SAAS,KAAK,YAAY;CAEhE,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,OAAO;CAEnD,MAAM,YAAY,QAAQ,aAAa,QAAQ;EAC7C,cAAc,KAAK;EACnB;EACA,QAAQ,MAAM;CAChB,CAAC;CAED,MAAM,WAAW,UAAU;CAC3B,MAAM,YAAY,UAAU,KAAK,QAAQ,KAAK,WAAW,UAAU,QAAQ,CAAC;CAE5E,UAAU,QAAQ,KAAK,WAAW,OAAO,QAAQ,KAAK,WAAW,SAAS,SAAS,GAAG,QAAQ,CAAC;CAC/F,MAAM,QAAQ,QAAQ,KAAK;CAE3B,MAAM,gBAAgB,OAAO,MAAM,KACjC,MAAM,OACN,MAAM,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,GAC3C,EAAE,OAAO,EAAE,CACb;CAEA,IAAI,cAAc,KAAK,WAAW,GAAG,OAAO,OAAO;CAEnD,MAAM,SAAS;EACb,GAAG,UAAU;GACZ,MAAM,KAAK;GACX,MAAM,SAAS,QAAQ,aAAa;GACpC,MAAM,mBAAmB,MAAM;CAClC;CAIA,cAAc,QAAO,OAFG,MAAM,OAAO,MAAM,OAAO,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,EAAA,CAEpD;CAE9B,MAAM,UAAU;EACd;EACA;EACA,KAAK;EACL,UAAU,gBAAgB,KAAK;GAC7B;GACA,kBAAkB,gBAAgB,OAAO,iBAAiB,KAAK,MAAM,MAAM;GAC3E,aAAa,CAAC;EAChB,CAAC;CACH;CAEA,OAAO,MAAM,OACX,OAAO,OACP,GAAG,OAAO,YAAY,OAAO,GAC7B;GACG,QAAQ,KAAK,gBAAgB,YAAY;GACzC,OAAO,QAAQ,QAAQ,MAAM,gBAAgB;GAC7C,OAAO,UAAU,MAAM;GACvB,OAAO,gBAAgB;CAC1B,CACF;CACA,OAAO,YAAY,SAAS,UAAU,KAAK,MAAM;CACjD,OAAO,eAAe,SAAS,QAAQ;CACvC,OAAO,iBACL,SACA,SACA,UACA,MAAM,UACN,OAAO,MAAM,IAAI,QAAQ,KAAK,CAChC;CACA,OAAO,MAAM,OACX,OAAO,OACP;GAAG,OAAO,WAAW,QAAQ;GAAW,OAAO,SAAS,SAAS;CAAO,GACxE;GAAG,OAAO,QAAQ,OAAO;GAAgB,OAAO,UAAU,MAAM;CAAO,CACzE;CACA,MAAM,OAAO,QAAQ;CAErB,OAAO,MAAM,OACX,KAAK,OACL;GAAG,KAAK,WAAW,QAAQ;GAAW,KAAK,SAAS,SAAS;CAAO,GACpE;GAAG,KAAK,QAAQ,KAAK,OAAO;GAAuB,KAAK,UAAU,MAAM;CAAO,CACjF;CACA,MAAM,eAAe,KACnB,cAAc,SAAS,UAAU,MAAM,KAAK,GAC5C,QAAQ,aAAa,iBAAiB;EAAE,cAAc,KAAK;EAAc,WAAW;CAAS,CAAC,GAC9F,GAAG,wBAAwB,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,MAAM,OAAO,MAAM,GAAG,MAAM,eAAe,EAAE,EAChH;CAEA,OAAO,EAAE,MAAM,uBAAuB;AACxC,CAAC"}

package/dist/drizzle/passkey-state.d.mts

@@ -0,0 +1,5 @@
+import "../passkey/models.mjs";
+import "../passkey/errors.mjs";
+import "./transaction-owner.mjs";
+import { Context, Effect } from "effect";
+import { SQL } from "drizzle-orm";

package/dist/drizzle/passkey-state.mjs

@@ -0,0 +1,207 @@
+import { requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "./passkey-model.mjs";
+import { requiredPasskeyRegistrationCeremonyConstraints } from "./passkey-registration-ceremony-model.mjs";
+import { both, makeTransactionRows } from "./transaction-owner.mjs";
+import { PasskeyConfigurationError, PasskeyUnavailable } from "../passkey/errors.mjs";
+import { PasskeyCeremony, PasskeyCredential, PasskeyModuleId, PasskeyProfile, PasskeyRevision } from "../passkey/models.mjs";
+import { snapshotPasskeySync } from "../passkey/snapshot.mjs";
+import { PasskeyMethodPolicy } from "../passkey/policy.mjs";
+import { Context, Effect, Encoding, Schema } from "effect";
+import { getTableColumns, sql } from "drizzle-orm";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { randomBytes } from "@noble/hashes/utils.js";
+//#region src/drizzle/passkey-state.ts
+const unavailable = () => PasskeyUnavailable.make({});
+const invariant = (value) => {
+	if (!value) throw unavailable();
+};
+const { col, equal, copiedRow, matchesNativeRow } = makeTransactionRows(unavailable);
+var CurrentPasskeyTransaction = class extends Context.Service()("effect-auth/drizzle/CurrentPasskeyTransaction") {};
+const nonce = () => Encoding.encodeBase64Url(randomBytes(32));
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+/** RP tuples and admission scopes have no collation-dependent string identity. */
+const key = (kind, fields) => {
+	const values = ["effect-auth/passkey/" + kind + "/v1", ...fields].map((field) => {
+		const bytes = encoder.encode(field);
+		invariant(decoder.decode(bytes) === field);
+		return bytes;
+	});
+	const packed = new Uint8Array(values.reduce((size, bytes) => size + 4 + bytes.length, 0));
+	const view = new DataView(packed.buffer);
+	let offset = 0;
+	for (const bytes of values) {
+		view.setUint32(offset, bytes.length, false);
+		packed.set(bytes, offset + 4);
+		offset += 4 + bytes.length;
+	}
+	return "v1:" + Array.from(sha256(packed), (value) => value.toString(16).padStart(2, "0")).join("");
+};
+const credentialKey = (rpId, id) => key("credential", [rpId, id]);
+const handleKey = (rpId, handle) => key("handle", [rpId, handle]);
+const subjectScope = (subjectId) => key("subject", [subjectId]);
+const targetScope = (ceremony) => {
+	const context = ceremony.context;
+	if (!("target" in context)) return null;
+	const target = context.target;
+	return key("target", [
+		target.moduleId,
+		target.kind,
+		target.flowId,
+		target.commandId,
+		target.bindingDigest,
+		target.revision.subjectId
+	]);
+};
+/** Private storage is decoded Type data, never a consumer wire transform. */
+const storage = (schema, maximumBytes) => {
+	const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));
+	const encode = (value) => {
+		const text = "v1:" + Schema.encodeSync(codec)(snapshotPasskeySync(schema, value));
+		invariant(encoder.encode(text).length <= maximumBytes);
+		return text;
+	};
+	return {
+		encode,
+		decode: (text) => {
+			invariant(typeof text === "string" && text.startsWith("v1:"));
+			invariant(encoder.encode(text).length <= maximumBytes);
+			const value = snapshotPasskeySync(schema, Schema.decodeSync(codec)(text.slice(3)));
+			invariant(encode(value) === text);
+			return value;
+		}
+	};
+};
+const policyStorage = storage(PasskeyMethodPolicy, 8388608);
+const ceremonyStorage = storage(PasskeyCeremony, 524288);
+const credentialStorage = storage(PasskeyCredential, 524288);
+const profileStorage = storage(PasskeyProfile, 262144);
+storage(PasskeyRevision, 262144);
+const sameCredential = (left, right) => {
+	const semantic = (value) => ({
+		...value,
+		counter: 0,
+		maximumCounter: 0,
+		backupState: false,
+		revision: {
+			...value.revision,
+			credentials: []
+		}
+	});
+	return credentialStorage.encode(semantic(left)) === credentialStorage.encode(semantic(right));
+};
+const sameRevision = (left, right) => {
+	const pairs = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));
+	return left.subjectId === right.subjectId && left.securityRevision === right.securityRevision && pairs.size === left.credentials.length && new Set(right.credentials.map((item) => item.credentialId)).size === right.credentials.length && pairs.size === right.credentials.length && right.credentials.every((item) => pairs.get(item.credentialId) === item.revision);
+};
+const semanticCredentialColumns = (mapping) => [
+	"credentialId",
+	"subjectId",
+	"rpId",
+	"protocolCredentialId",
+	"credentialKey",
+	"handleKey",
+	"userHandle",
+	"publicKey",
+	"algorithm",
+	"profile",
+	"credentialRevision",
+	"status",
+	"primarySignIn",
+	"enrollmentUserVerified",
+	"backupEligible"
+].map((name) => mapping[name]);
+const mappedColumns = (mapping) => Object.entries(mapping).filter(([name, value]) => ![
+	"table",
+	"reservedState",
+	"pendingState",
+	"acceptedState",
+	"rejectedState"
+].includes(name) && typeof value === "string").map(([, value]) => value);
+const observeSemantic = (mapping, where, row) => Effect.map(CurrentPasskeyTransaction, (owner) => {
+	owner.observations.push({
+		table: mapping.table,
+		where,
+		rows: [Object.fromEntries(semanticCredentialColumns(mapping).map((column) => [column, row[column]]))]
+	});
+});
+/** Capture descriptor graphs, preserving actual Drizzle SQL/table objects. */
+const captureMapping = (input) => {
+	const seen = /* @__PURE__ */ new Map();
+	const copy = (value) => {
+		if (value === null || typeof value !== "object" || Effect.isEffect(value)) return value;
+		if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return value;
+		const prior = seen.get(value);
+		if (prior !== void 0) return prior;
+		const result = Array.isArray(value) ? [] : {};
+		seen.set(value, result);
+		for (const [name, child] of Object.entries(value)) result[name] = copy(child);
+		return Object.freeze(result);
+	};
+	return copy(input);
+};
+const constraints = (actual, expected) => {
+	for (const [name, columns] of Object.entries(expected)) invariant(JSON.stringify(actual?.[name]) === JSON.stringify(columns));
+};
+const descriptor = (value) => {
+	const columns = getTableColumns(value.table);
+	for (const name of mappedColumns(value)) invariant(columns[name] !== void 0);
+};
+const validateMapping = (mapping, kind) => {
+	try {
+		const read = kind === "read" ? mapping : kind !== "registration" ? mapping.read : void 0;
+		if (read !== void 0) {
+			for (const name of [
+				"subject",
+				"credential",
+				"authority",
+				"credentialOwnership",
+				"handleOwnership"
+			]) descriptor(read[name]);
+			constraints(read.constraints, requiredPasskeyCredentialConstraints);
+		}
+		if (kind === "read") return;
+		Schema.decodeUnknownSync(PasskeyModuleId)(mapping.moduleId);
+		descriptor(mapping.module);
+		invariant(mapping.module.policyColumns.length > 0);
+		for (const name of mapping.module.policyColumns) col(mapping.module.table, name);
+		const scopes = /* @__PURE__ */ new Set();
+		for (const guard of mapping.module.guards ?? []) {
+			invariant(typeof guard.scope === "string" && guard.scope.length > 0 && guard.scope.length <= 256);
+			invariant(!scopes.has(guard.scope) && guard.columns.length > 0);
+			scopes.add(guard.scope);
+			for (const name of guard.columns) col(guard.table, name);
+		}
+		invariant(scopes.size <= 32);
+		if (kind === "context") return;
+		invariant(typeof mapping.authorityScope === "string" && mapping.authorityScope.length > 0 && mapping.authorityScope.length <= 256);
+		for (const name of [
+			"flow",
+			"admission",
+			"charge"
+		]) descriptor(mapping[name]);
+		if (kind === "registration") {
+			descriptor(mapping.intent);
+			descriptor(mapping.handle);
+		} else col(mapping.read.credential.table, mapping.telemetry.lastUsedAt);
+		constraints(mapping.constraints, kind === "registration" ? requiredPasskeyRegistrationCeremonyConstraints : requiredPasskeyPersistenceConstraints);
+		const states = Object.values(mapping.flow.states);
+		invariant(states.length === 7 && new Set(states.map((value) => JSON.stringify(value))).size === 7);
+		for (const value of [
+			0,
+			1,
+			123456789,
+			864e10
+		]) invariant(mapping.clock.decodeInstant(mapping.clock.encodeInstant(value)) === value);
+	} catch {
+		throw PasskeyConfigurationError.make({});
+	}
+};
+const assertNow = (condition) => Effect.flatMap(CurrentPasskeyTransaction, (owner) => Effect.gen(function* () {
+	invariant(yield* owner.check(condition));
+	owner.postconditions.push(condition);
+}));
+const existsExact = (table, values, condition) => Effect.map(CurrentPasskeyTransaction, (owner) => sql`exists(select 1 from ${table} where ${both(owner.exact(table, values), condition)})`);
+//#endregion
+export { CurrentPasskeyTransaction, assertNow, captureMapping, ceremonyStorage, col, copiedRow, credentialKey, credentialStorage, equal, existsExact, handleKey, invariant, key, mappedColumns, matchesNativeRow, nonce, observeSemantic, policyStorage, profileStorage, sameCredential, sameRevision, semanticCredentialColumns, subjectScope, targetScope, unavailable, validateMapping };
+
+//# sourceMappingURL=passkey-state.mjs.map

package/dist/drizzle/passkey-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-state.mjs","names":[],"sources":["../../src/drizzle/passkey-state.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- private concrete-table bridge; public descriptors retain native types. */\n// oxlint-disable-next-line import/extensions -- Noble exposes its explicit .js subpaths.\nimport { sha256 } from \"@noble/hashes/sha2.js\";\n// oxlint-disable-next-line import/extensions -- Noble exposes its explicit .js subpaths.\nimport { randomBytes } from \"@noble/hashes/utils.js\";\nimport { getTableColumns, sql, type SQL } from \"drizzle-orm\";\nimport { Context, Effect, Encoding, Schema } from \"effect\";\n\nimport { PasskeyConfigurationError, PasskeyUnavailable } from \"../passkey/errors\";\nimport {\n  PasskeyCeremony,\n  PasskeyCredential,\n  PasskeyModuleId,\n  PasskeyProfile,\n  PasskeyRevision,\n} from \"../passkey/models\";\nimport { PasskeyMethodPolicy } from \"../passkey/policy\";\nimport { snapshotPasskeySync } from \"../passkey/snapshot\";\nimport {\n  requiredPasskeyCredentialConstraints,\n  requiredPasskeyPersistenceConstraints,\n} from \"./passkey-model\";\nimport { requiredPasskeyRegistrationCeremonyConstraints } from \"./passkey-registration-ceremony-model\";\nimport { both, makeTransactionRows, type TransactionOwner } from \"./transaction-owner\";\n\nexport const unavailable = () => PasskeyUnavailable.make({});\n\nexport const invariant: (value: unknown) => asserts value = (value) => {\n  if (!value) throw unavailable();\n};\n\nexport const { col, equal, copiedRow, matchesNativeRow } = makeTransactionRows(unavailable);\nexport type PasskeyOwner = TransactionOwner<PasskeyUnavailable>;\n\nexport class CurrentPasskeyTransaction extends Context.Service<\n  CurrentPasskeyTransaction,\n  PasskeyOwner\n>()(\"effect-auth/drizzle/CurrentPasskeyTransaction\") {}\n\nexport const nonce = () => Encoding.encodeBase64Url(randomBytes(32));\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\n/** RP tuples and admission scopes have no collation-dependent string identity. */\nexport const key = (kind: string, fields: ReadonlyArray<string>) => {\n  const values = [\"effect-auth/passkey/\" + kind + \"/v1\", ...fields].map((field) => {\n    const bytes = encoder.encode(field);\n\n    invariant(decoder.decode(bytes) === field);\n\n    return bytes;\n  });\n\n  const packed = new Uint8Array(values.reduce((size, bytes) => size + 4 + bytes.length, 0));\n  const view = new DataView(packed.buffer);\n  let offset = 0;\n\n  for (const bytes of values) {\n    view.setUint32(offset, bytes.length, false);\n    packed.set(bytes, offset + 4);\n    offset += 4 + bytes.length;\n  }\n\n  return (\n    \"v1:\" + Array.from(sha256(packed), (value) => value.toString(16).padStart(2, \"0\")).join(\"\")\n  );\n};\n\nexport const credentialKey = (rpId: string, id: string) => key(\"credential\", [rpId, id]);\nexport const handleKey = (rpId: string, handle: string) => key(\"handle\", [rpId, handle]);\nexport const subjectScope = (subjectId: string) => key(\"subject\", [subjectId]);\n\nexport const targetScope = (ceremony: PasskeyCeremony) => {\n  const context = ceremony.context;\n\n  if (!(\"target\" in context)) return null;\n  const target = context.target;\n\n  return key(\"target\", [\n    target.moduleId,\n    target.kind,\n    target.flowId,\n    target.commandId,\n    target.bindingDigest,\n    target.revision.subjectId,\n  ]);\n};\n\n/** Private storage is decoded Type data, never a consumer wire transform. */\nconst storage = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  maximumBytes: number,\n) => {\n  const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n\n  const encode = (value: S[\"Type\"]) => {\n    const text = \"v1:\" + Schema.encodeSync(codec)(snapshotPasskeySync(schema, value));\n\n    invariant(encoder.encode(text).length <= maximumBytes);\n\n    return text;\n  };\n\n  return {\n    encode,\n    decode: (text: unknown): S[\"Type\"] => {\n      invariant(typeof text === \"string\" && text.startsWith(\"v1:\"));\n      invariant(encoder.encode(text).length <= maximumBytes);\n      const value = snapshotPasskeySync(schema, Schema.decodeSync(codec)(text.slice(3)));\n\n      invariant(encode(value) === text);\n\n      return value;\n    },\n  };\n};\n\n// Legal 32 x 16 x 2048 origins require more than one MiB before JSON escaping.\nexport const policyStorage = storage(PasskeyMethodPolicy, 8 * 1024 * 1024);\nexport const ceremonyStorage = storage(PasskeyCeremony, 512 * 1024);\nexport const credentialStorage = storage(PasskeyCredential, 512 * 1024);\nexport const profileStorage = storage(PasskeyProfile, 256 * 1024);\nexport const revisionStorage = storage(PasskeyRevision, 256 * 1024);\n\nexport const sameCredential = (left: PasskeyCredential, right: PasskeyCredential) => {\n  const semantic = (value: PasskeyCredential) => ({\n    ...value,\n    counter: 0,\n    maximumCounter: 0,\n    backupState: false,\n    revision: { ...value.revision, credentials: [] },\n  });\n\n  return credentialStorage.encode(semantic(left)) === credentialStorage.encode(semantic(right));\n};\n\nexport const sameRevision = (\n  left: typeof PasskeyRevision.Type,\n  right: typeof PasskeyRevision.Type,\n) => {\n  const pairs = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));\n\n  return (\n    left.subjectId === right.subjectId &&\n    left.securityRevision === right.securityRevision &&\n    pairs.size === left.credentials.length &&\n    new Set(right.credentials.map((item) => item.credentialId)).size === right.credentials.length &&\n    pairs.size === right.credentials.length &&\n    right.credentials.every((item) => pairs.get(item.credentialId) === item.revision)\n  );\n};\n\nexport const semanticCredentialColumns = (mapping: any): string[] =>\n  [\n    \"credentialId\",\n    \"subjectId\",\n    \"rpId\",\n    \"protocolCredentialId\",\n    \"credentialKey\",\n    \"handleKey\",\n    \"userHandle\",\n    \"publicKey\",\n    \"algorithm\",\n    \"profile\",\n    \"credentialRevision\",\n    \"status\",\n    \"primarySignIn\",\n    \"enrollmentUserVerified\",\n    \"backupEligible\",\n  ].map((name) => mapping[name]);\n\nexport const mappedColumns = (mapping: any): string[] =>\n  Object.entries(mapping)\n    .filter(\n      ([name, value]) =>\n        ![\"table\", \"reservedState\", \"pendingState\", \"acceptedState\", \"rejectedState\"].includes(\n          name,\n        ) && typeof value === \"string\",\n    )\n    .map(([, value]) => value as string);\n\nexport const observeSemantic = (mapping: any, where: SQL, row: any) =>\n  Effect.map(CurrentPasskeyTransaction, (owner) => {\n    owner.observations.push({\n      table: mapping.table,\n      where,\n      rows: [\n        Object.fromEntries(\n          semanticCredentialColumns(mapping).map((column) => [column, row[column]]),\n        ),\n      ],\n    });\n  });\n\n/** Capture descriptor graphs, preserving actual Drizzle SQL/table objects. */\nexport const captureMapping = <A>(input: A): A => {\n  const seen = new Map<object, unknown>();\n\n  const copy = (value: unknown): unknown => {\n    if (value === null || typeof value !== \"object\" || Effect.isEffect(value)) return value;\n    if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return value;\n    const prior = seen.get(value);\n\n    if (prior !== undefined) return prior;\n    const result: any = Array.isArray(value) ? [] : {};\n\n    seen.set(value, result);\n    for (const [name, child] of Object.entries(value)) result[name] = copy(child);\n\n    return Object.freeze(result);\n  };\n\n  return copy(input) as A;\n};\n\nconst constraints = (actual: any, expected: any) => {\n  for (const [name, columns] of Object.entries(expected))\n    // oxlint-disable-next-line no-restricted-properties -- exact configured constraint descriptor fingerprint.\n    invariant(JSON.stringify(actual?.[name]) === JSON.stringify(columns));\n};\n\nconst descriptor = (value: any) => {\n  const columns = getTableColumns(value.table);\n\n  for (const name of mappedColumns(value)) invariant(columns[name] !== undefined);\n};\n\nexport const validateMapping = (\n  mapping: any,\n  kind: \"read\" | \"context\" | \"assertion\" | \"registration\",\n) => {\n  try {\n    const read = kind === \"read\" ? mapping : kind !== \"registration\" ? mapping.read : undefined;\n\n    if (read !== undefined) {\n      for (const name of [\n        \"subject\",\n        \"credential\",\n        \"authority\",\n        \"credentialOwnership\",\n        \"handleOwnership\",\n      ])\n        descriptor(read[name]);\n      constraints(read.constraints, requiredPasskeyCredentialConstraints);\n    }\n    if (kind === \"read\") return;\n    // oxlint-disable-next-line no-restricted-properties -- validate the untyped captured configuration boundary.\n    Schema.decodeUnknownSync(PasskeyModuleId)(mapping.moduleId);\n    descriptor(mapping.module);\n    invariant(mapping.module.policyColumns.length > 0);\n    for (const name of mapping.module.policyColumns) col(mapping.module.table, name);\n    const scopes = new Set<string>();\n\n    for (const guard of mapping.module.guards ?? []) {\n      invariant(\n        typeof guard.scope === \"string\" && guard.scope.length > 0 && guard.scope.length <= 256,\n      );\n      invariant(!scopes.has(guard.scope) && guard.columns.length > 0);\n      scopes.add(guard.scope);\n      for (const name of guard.columns) col(guard.table, name);\n    }\n    invariant(scopes.size <= 32);\n    if (kind === \"context\") return;\n    invariant(\n      typeof mapping.authorityScope === \"string\" &&\n        mapping.authorityScope.length > 0 &&\n        mapping.authorityScope.length <= 256,\n    );\n    for (const name of [\"flow\", \"admission\", \"charge\"]) descriptor(mapping[name]);\n    if (kind === \"registration\") {\n      descriptor(mapping.intent);\n      descriptor(mapping.handle);\n    } else col(mapping.read.credential.table, mapping.telemetry.lastUsedAt);\n    constraints(\n      mapping.constraints,\n      kind === \"registration\"\n        ? requiredPasskeyRegistrationCeremonyConstraints\n        : requiredPasskeyPersistenceConstraints,\n    );\n    const states = Object.values(mapping.flow.states);\n\n    // oxlint-disable-next-line no-restricted-properties -- configured native state identity fingerprints.\n    invariant(\n      // oxlint-disable-next-line no-restricted-properties -- configured native state identity fingerprints.\n      states.length === 7 && new Set(states.map((value) => JSON.stringify(value))).size === 7,\n    );\n    for (const value of [0, 1, 123456789, 8640000000000])\n      invariant(mapping.clock.decodeInstant(mapping.clock.encodeInstant(value)) === value);\n  } catch {\n    throw PasskeyConfigurationError.make({});\n  }\n};\n\nexport const assertNow = (condition: SQL) =>\n  Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n    Effect.gen(function* () {\n      invariant(yield* owner.check(condition));\n      owner.postconditions.push(condition);\n    }),\n  );\n\nexport const existsExact = (table: any, values: any, condition?: SQL) =>\n  Effect.map(\n    CurrentPasskeyTransaction,\n    (owner) =>\n      sql`exists(select 1 from ${table} where ${both(owner.exact(table, values), condition)})`,\n  );\n"],"mappings":";;;;;;;;;;;;AAyBA,MAAa,oBAAoB,mBAAmB,KAAK,CAAC,CAAC;AAE3D,MAAa,aAAgD,UAAU;CACrE,IAAI,CAAC,OAAO,MAAM,YAAY;AAChC;AAEA,MAAa,EAAE,KAAK,OAAO,WAAW,qBAAqB,oBAAoB,WAAW;AAG1F,IAAa,4BAAb,cAA+C,QAAQ,QAGrD,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC;AAEtD,MAAa,cAAc,SAAS,gBAAgB,YAAY,EAAE,CAAC;AACnE,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;;AAGxD,MAAa,OAAO,MAAc,WAAkC;CAClE,MAAM,SAAS,CAAC,yBAAyB,OAAO,OAAO,GAAG,MAAM,CAAC,CAAC,KAAK,UAAU;EAC/E,MAAM,QAAQ,QAAQ,OAAO,KAAK;EAElC,UAAU,QAAQ,OAAO,KAAK,MAAM,KAAK;EAEzC,OAAO;CACT,CAAC;CAED,MAAM,SAAS,IAAI,WAAW,OAAO,QAAQ,MAAM,UAAU,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC;CACxF,MAAM,OAAO,IAAI,SAAS,OAAO,MAAM;CACvC,IAAI,SAAS;CAEb,KAAK,MAAM,SAAS,QAAQ;EAC1B,KAAK,UAAU,QAAQ,MAAM,QAAQ,KAAK;EAC1C,OAAO,IAAI,OAAO,SAAS,CAAC;EAC5B,UAAU,IAAI,MAAM;CACtB;CAEA,OACE,QAAQ,MAAM,KAAK,OAAO,MAAM,IAAI,UAAU,MAAM,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAE9F;AAEA,MAAa,iBAAiB,MAAc,OAAe,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;AACvF,MAAa,aAAa,MAAc,WAAmB,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC;AACvF,MAAa,gBAAgB,cAAsB,IAAI,WAAW,CAAC,SAAS,CAAC;AAE7E,MAAa,eAAe,aAA8B;CACxD,MAAM,UAAU,SAAS;CAEzB,IAAI,EAAE,YAAY,UAAU,OAAO;CACnC,MAAM,SAAS,QAAQ;CAEvB,OAAO,IAAI,UAAU;EACnB,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO;EACP,OAAO,SAAS;CAClB,CAAC;AACH;;AAGA,MAAM,WACJ,QACA,iBACG;CACH,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;CAE7E,MAAM,UAAU,UAAqB;EACnC,MAAM,OAAO,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,oBAAoB,QAAQ,KAAK,CAAC;EAEhF,UAAU,QAAQ,OAAO,IAAI,CAAC,CAAC,UAAU,YAAY;EAErD,OAAO;CACT;CAEA,OAAO;EACL;EACA,SAAS,SAA6B;GACpC,UAAU,OAAO,SAAS,YAAY,KAAK,WAAW,KAAK,CAAC;GAC5D,UAAU,QAAQ,OAAO,IAAI,CAAC,CAAC,UAAU,YAAY;GACrD,MAAM,QAAQ,oBAAoB,QAAQ,OAAO,WAAW,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;GAEjF,UAAU,OAAO,KAAK,MAAM,IAAI;GAEhC,OAAO;EACT;CACF;AACF;AAGA,MAAa,gBAAgB,QAAQ,qBAAqB,OAAe;AACzE,MAAa,kBAAkB,QAAQ,iBAAiB,MAAU;AAClE,MAAa,oBAAoB,QAAQ,mBAAmB,MAAU;AACtE,MAAa,iBAAiB,QAAQ,gBAAgB,MAAU;AACjC,QAAQ,iBAAiB,MAAU;AAElE,MAAa,kBAAkB,MAAyB,UAA6B;CACnF,MAAM,YAAY,WAA8B;EAC9C,GAAG;EACH,SAAS;EACT,gBAAgB;EAChB,aAAa;EACb,UAAU;GAAE,GAAG,MAAM;GAAU,aAAa,CAAC;EAAE;CACjD;CAEA,OAAO,kBAAkB,OAAO,SAAS,IAAI,CAAC,MAAM,kBAAkB,OAAO,SAAS,KAAK,CAAC;AAC9F;AAEA,MAAa,gBACX,MACA,UACG;CACH,MAAM,QAAQ,IAAI,IAAI,KAAK,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAAC;CAExF,OACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,MAAM,SAAS,KAAK,YAAY,UAChC,IAAI,IAAI,MAAM,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,MAAM,YAAY,UACvF,MAAM,SAAS,MAAM,YAAY,UACjC,MAAM,YAAY,OAAO,SAAS,MAAM,IAAI,KAAK,YAAY,MAAM,KAAK,QAAQ;AAEpF;AAEA,MAAa,6BAA6B,YACxC;CACE;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,SAAS,QAAQ,KAAK;AAE/B,MAAa,iBAAiB,YAC5B,OAAO,QAAQ,OAAO,CAAC,CACpB,QACE,CAAC,MAAM,WACN,CAAC;CAAC;CAAS;CAAiB;CAAgB;CAAiB;AAAe,CAAC,CAAC,SAC5E,IACF,KAAK,OAAO,UAAU,QAC1B,CAAC,CACA,KAAK,GAAG,WAAW,KAAe;AAEvC,MAAa,mBAAmB,SAAc,OAAY,QACxD,OAAO,IAAI,4BAA4B,UAAU;CAC/C,MAAM,aAAa,KAAK;EACtB,OAAO,QAAQ;EACf;EACA,MAAM,CACJ,OAAO,YACL,0BAA0B,OAAO,CAAC,CAAC,KAAK,WAAW,CAAC,QAAQ,IAAI,OAAO,CAAC,CAC1E,CACF;CACF,CAAC;AACH,CAAC;;AAGH,MAAa,kBAAqB,UAAgB;CAChD,MAAM,uBAAO,IAAI,IAAqB;CAEtC,MAAM,QAAQ,UAA4B;EACxC,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG,OAAO;EAClF,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,eAAe,KAAK,MAAM,OAAO,WAAW,OAAO;EACvF,MAAM,QAAQ,KAAK,IAAI,KAAK;EAE5B,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,MAAM,SAAc,MAAM,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC;EAEjD,KAAK,IAAI,OAAO,MAAM;EACtB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,GAAG,OAAO,QAAQ,KAAK,KAAK;EAE5E,OAAO,OAAO,OAAO,MAAM;CAC7B;CAEA,OAAO,KAAK,KAAK;AACnB;AAEA,MAAM,eAAe,QAAa,aAAkB;CAClD,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,QAAQ,GAEnD,UAAU,KAAK,UAAU,SAAS,KAAK,MAAM,KAAK,UAAU,OAAO,CAAC;AACxE;AAEA,MAAM,cAAc,UAAe;CACjC,MAAM,UAAU,gBAAgB,MAAM,KAAK;CAE3C,KAAK,MAAM,QAAQ,cAAc,KAAK,GAAG,UAAU,QAAQ,UAAU,KAAA,CAAS;AAChF;AAEA,MAAa,mBACX,SACA,SACG;CACH,IAAI;EACF,MAAM,OAAO,SAAS,SAAS,UAAU,SAAS,iBAAiB,QAAQ,OAAO,KAAA;EAElF,IAAI,SAAS,KAAA,GAAW;GACtB,KAAK,MAAM,QAAQ;IACjB;IACA;IACA;IACA;IACA;GACF,GACE,WAAW,KAAK,KAAK;GACvB,YAAY,KAAK,aAAa,oCAAoC;EACpE;EACA,IAAI,SAAS,QAAQ;EAErB,OAAO,kBAAkB,eAAe,CAAC,CAAC,QAAQ,QAAQ;EAC1D,WAAW,QAAQ,MAAM;EACzB,UAAU,QAAQ,OAAO,cAAc,SAAS,CAAC;EACjD,KAAK,MAAM,QAAQ,QAAQ,OAAO,eAAe,IAAI,QAAQ,OAAO,OAAO,IAAI;EAC/E,MAAM,yBAAS,IAAI,IAAY;EAE/B,KAAK,MAAM,SAAS,QAAQ,OAAO,UAAU,CAAC,GAAG;GAC/C,UACE,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,UAAU,GACrF;GACA,UAAU,CAAC,OAAO,IAAI,MAAM,KAAK,KAAK,MAAM,QAAQ,SAAS,CAAC;GAC9D,OAAO,IAAI,MAAM,KAAK;GACtB,KAAK,MAAM,QAAQ,MAAM,SAAS,IAAI,MAAM,OAAO,IAAI;EACzD;EACA,UAAU,OAAO,QAAQ,EAAE;EAC3B,IAAI,SAAS,WAAW;EACxB,UACE,OAAO,QAAQ,mBAAmB,YAChC,QAAQ,eAAe,SAAS,KAChC,QAAQ,eAAe,UAAU,GACrC;EACA,KAAK,MAAM,QAAQ;GAAC;GAAQ;GAAa;EAAQ,GAAG,WAAW,QAAQ,KAAK;EAC5E,IAAI,SAAS,gBAAgB;GAC3B,WAAW,QAAQ,MAAM;GACzB,WAAW,QAAQ,MAAM;EAC3B,OAAO,IAAI,QAAQ,KAAK,WAAW,OAAO,QAAQ,UAAU,UAAU;EACtE,YACE,QAAQ,aACR,SAAS,iBACL,iDACA,qCACN;EACA,MAAM,SAAS,OAAO,OAAO,QAAQ,KAAK,MAAM;EAGhD,UAEE,OAAO,WAAW,KAAK,IAAI,IAAI,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CACxF;EACA,KAAK,MAAM,SAAS;GAAC;GAAG;GAAG;GAAW;EAAa,GACjD,UAAU,QAAQ,MAAM,cAAc,QAAQ,MAAM,cAAc,KAAK,CAAC,MAAM,KAAK;CACvF,QAAQ;EACN,MAAM,0BAA0B,KAAK,CAAC,CAAC;CACzC;AACF;AAEA,MAAa,aAAa,cACxB,OAAO,QAAQ,4BAA4B,UACzC,OAAO,IAAI,aAAa;CACtB,UAAU,OAAO,MAAM,MAAM,SAAS,CAAC;CACvC,MAAM,eAAe,KAAK,SAAS;AACrC,CAAC,CACH;AAEF,MAAa,eAAe,OAAY,QAAa,cACnD,OAAO,IACL,4BACC,UACC,GAAG,wBAAwB,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,MAAM,GAAG,SAAS,EAAE,EAC1F"}

package/dist/drizzle/passkey-target.d.mts

@@ -0,0 +1,16 @@
+import "../hooks/LifecycleHooks.mjs";
+import "../hooks/commit.mjs";
+import { DrizzleMappingError } from "./model.mjs";
+import { PasskeyConfigurationError, PasskeyUnavailable } from "../passkey/errors.mjs";
+import "../passkey/PasskeyPersistence.mjs";
+import "./passkey-model.mjs";
+import "./passkey-registration-ceremony-model.mjs";
+import { TransactionCoordinatorError } from "./transaction-execution.mjs";
+import "./passkey-state.mjs";
+import { Effect, Schema } from "effect";
+import { Statement } from "effect/unstable/sql/Statement";
+//#region src/drizzle/passkey-target.d.ts
+type PasskeyCoordinatorError<E> = TransactionCoordinatorError<E, PasskeyUnavailable> | PasskeyConfigurationError | DrizzleMappingError;
+//#endregion
+export { PasskeyCoordinatorError };
+//# sourceMappingURL=passkey-target.d.mts.map