@yielded/auth 0.1.0-beta.1

package/dist/drizzle/passkey-target.mjs

@@ -0,0 +1,174 @@
+import { SubjectId } from "../Schema.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { coordinateTransactionOwner, makeTransactionExecution, sqlClientTransactionStandaloneGuard } from "./transaction-execution.mjs";
+import { PasskeyConfigurationError } from "../passkey/errors.mjs";
+import { PasskeyAccess, PasskeyAssertionVerified, PasskeyCeremony, PasskeyClaim, PasskeyClaimDecision, PasskeyCleanupResult, PasskeyCredential, PasskeyEnrollmentSnapshot, PasskeyEvidence, PasskeyInstant, PasskeyIssueDecision, PasskeyModuleId, PasskeyProfile, PasskeyProtocolCredentialId, PasskeySettlement } from "../passkey/models.mjs";
+import { snapshotPasskeySync } from "../passkey/snapshot.mjs";
+import { PasskeyMethodPolicy } from "../passkey/policy.mjs";
+import { CurrentPasskeyTransaction, captureMapping, invariant, nonce, unavailable, validateMapping } from "./passkey-state.mjs";
+import { captureEnrollmentContext, lookupCredential } from "./passkey-credentials.mjs";
+import { assertionPurposes, claimAssertion, cleanupCeremonies, contextAssertion, issueAssertion, settleAssertion } from "./passkey-flow.mjs";
+import { claimRegistration, contextRegistration, settleRegistration } from "./passkey-registration-ceremony.mjs";
+import { Effect, Schema } from "effect";
+//#region src/drizzle/passkey-target.ts
+const sqlClientPasskeyStandaloneGuard = (database) => sqlClientTransactionStandaloneGuard(unavailable, database);
+const emptyHooks = {
+	before: () => Effect.void,
+	after: () => Effect.succeed([])
+};
+const makePasskeyExecution = (database, hooks, configuration) => {
+	const execution = makeTransactionExecution(CurrentPasskeyTransaction, database, configuration, unavailable, nonce);
+	return {
+		...execution,
+		run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
+	};
+};
+const issueInput = Schema.Struct({
+	ceremony: PasskeyCeremony,
+	policy: PasskeyMethodPolicy
+});
+const claimInput = Schema.Struct({
+	access: PasskeyAccess,
+	policy: PasskeyMethodPolicy,
+	ceremony: PasskeyCeremony,
+	claimId: PasskeyClaim.fields.claimId,
+	credential: Schema.optionalKey(PasskeyCredential)
+});
+const settleInput = Schema.Struct({
+	claim: PasskeyClaim,
+	nowMillis: PasskeyInstant,
+	outcome: Schema.Union([
+		Schema.TaggedStruct("Rejected", {}),
+		Schema.TaggedStruct("Ambiguous", {}),
+		Schema.TaggedStruct("Assertion", {
+			credential: PasskeyCredential,
+			assertion: PasskeyAssertionVerified,
+			evidence: PasskeyEvidence
+		})
+	])
+});
+const cleanupInput = Schema.Struct({
+	moduleId: PasskeyModuleId,
+	nowMillis: PasskeyInstant,
+	limit: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 1e3
+	}))
+});
+const lookupInput = Schema.Struct({
+	rpId: PasskeyProfile.fields.rpId,
+	protocolCredentialId: PasskeyProtocolCredentialId
+});
+const contextInput = Schema.Struct({
+	moduleId: PasskeyModuleId,
+	rpId: PasskeyProfile.fields.rpId,
+	subjectId: SubjectId
+});
+const inputs = {
+	issue: issueInput,
+	context: PasskeyAccess,
+	claim: claimInput,
+	settle: settleInput,
+	cleanup: cleanupInput
+};
+const capturedService = (service, schemas, execute) => Object.freeze(Object.fromEntries(Object.entries(service).map(([name, method]) => [name, (original, prepare) => Effect.suspend(() => {
+	invariant(execute.active());
+	return method(snapshotPasskeySync(schemas[name], original), prepare);
+}).pipe(Effect.onExit((exit) => Effect.sync(() => {
+	if (exit._tag === "Failure") execute.poison();
+})), Effect.catchDefect(() => Effect.fail(unavailable())))])));
+const prepareValue = (value, prepare) => Effect.flatMap(CurrentPasskeyTransaction, (owner) => Effect.sync(() => {
+	owner.guards.push(owner.journal.prepare(void 0));
+	const receipt = prepare(value, owner.journal);
+	invariant(receipt !== null && typeof receipt === "object" && receipt._tag === "PreparedCommit" && typeof receipt.read === "object" && Effect.isEffect(receipt.read));
+	owner.guards.push(receipt);
+	return receipt;
+}));
+const requirePurpose = (purpose, registration, enrollment = false) => invariant(enrollment ? purpose === "enrollment" : registration ? purpose === "registration" : assertionPurposes.some((supported) => supported === purpose));
+/** Context is advisory. Retain observations and final predicates without taking
+* later-ranked locks before a subsequent mutation acquires its full lock set. */
+const observationalContext = (operation) => Effect.flatMap(CurrentPasskeyTransaction, (owner) => operation.pipe(Effect.provideService(CurrentPasskeyTransaction, {
+	...owner,
+	read: (table, where, options) => owner.read(table, where, {
+		...options,
+		lock: false
+	})
+})));
+const makePasskeyPersistence = (mapping, execute, configuration, registration = false, enrollment = false) => capturedService({
+	issue: (input, prepare) => Effect.suspend(() => {
+		invariant(!registration && !enrollment);
+		requirePurpose(input.ceremony.purpose, false);
+		return execute.run(Effect.gen(function* () {
+			const value = yield* issueAssertion(mapping, input.ceremony, input.policy);
+			return yield* prepareValue(snapshotPasskeySync(PasskeyIssueDecision, value), prepare);
+		}));
+	}),
+	context: (access) => Effect.suspend(() => {
+		requirePurpose(access.purpose, registration, enrollment);
+		return execute.run(observationalContext(registration ? contextRegistration(mapping, access) : contextAssertion(mapping, access)), false);
+	}),
+	claim: (input, prepare) => Effect.suspend(() => {
+		requirePurpose(input.access.purpose, registration, enrollment);
+		requirePurpose(input.ceremony.purpose, registration, enrollment);
+		invariant(!registration && !enrollment || input.credential === void 0);
+		return execute.run(Effect.gen(function* () {
+			const value = yield* registration ? claimRegistration(mapping, input) : claimAssertion(mapping, input);
+			return yield* prepareValue(snapshotPasskeySync(PasskeyClaimDecision, value), prepare);
+		}));
+	}),
+	settle: (input, prepare) => Effect.suspend(() => {
+		requirePurpose(input.claim.ceremony.purpose, registration, enrollment);
+		invariant(!registration && !enrollment || input.outcome._tag !== "Assertion");
+		return execute.run(Effect.gen(function* () {
+			const value = yield* registration ? settleRegistration(mapping, input.claim, input.outcome._tag) : settleAssertion(mapping, input.claim, input.outcome, configuration.dialect);
+			return yield* prepareValue(snapshotPasskeySync(PasskeySettlement, value), prepare);
+		}));
+	}),
+	cleanup: (input, prepare) => execute.run(Effect.gen(function* () {
+		const value = yield* cleanupCeremonies(mapping, input, registration ? ["registration"] : enrollment ? ["enrollment"] : assertionPurposes);
+		return yield* prepareValue(snapshotPasskeySync(PasskeyCleanupResult, value), prepare);
+	}))
+}, inputs, execute);
+const credentialService = (mapping, execute) => capturedService({ lookup: (input) => execute.run(lookupCredential(mapping, input.rpId, input.protocolCredentialId), false) }, { lookup: lookupInput }, execute);
+const enrollmentService = (mapping, execute) => capturedService({ capture: (input) => execute.run(Effect.map(captureEnrollmentContext(mapping, input), (value) => value === void 0 ? void 0 : snapshotPasskeySync(PasskeyEnrollmentSnapshot, value)), false) }, { capture: contextInput }, execute);
+const registrationServices = (mapping, execute, configuration) => ({
+	capabilities: Object.freeze({
+		purposes: Object.freeze(["registration"]),
+		issue: "registration-authority",
+		assertionSettlement: false
+	}),
+	passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true)
+});
+const capturedMapping = (source, kind, configuration) => Effect.flatMap(Effect.isEffect(source) ? source : Effect.succeed(source), (mapping) => Effect.try({
+	try: () => {
+		const captured = captureMapping(mapping);
+		validateMapping(captured, kind);
+		if (configuration.mode === "batch") invariant(captured.d1?.primary === true);
+		return captured;
+	},
+	catch: () => PasskeyConfigurationError.make({})
+}));
+const makeTargetPasskeyCredentials = (database, source, configuration) => Effect.map(capturedMapping(source, "read", configuration), (mapping) => ({ passkeyCredentials: credentialService(mapping, makePasskeyExecution(database, emptyHooks, configuration)) }));
+const makeTargetPasskeyEnrollmentContext = (database, source, configuration) => Effect.map(capturedMapping(source, "context", configuration), (mapping) => ({ passkeyEnrollmentContext: enrollmentService(mapping, makePasskeyExecution(database, emptyHooks, configuration)) }));
+const makeTargetPasskeyPersistence = (database, source, configuration) => Effect.gen(function* () {
+	const mapping = yield* capturedMapping(source, "assertion", configuration);
+	const hooks = yield* LifecycleHooks;
+	return { passkeyPersistence: makePasskeyPersistence(mapping, makePasskeyExecution(database, hooks, configuration), configuration) };
+});
+const makeTargetPasskeyRegistration = (database, source, configuration) => Effect.gen(function* () {
+	const mapping = yield* capturedMapping(source, "registration", configuration);
+	const hooks = yield* LifecycleHooks;
+	return registrationServices(mapping, makePasskeyExecution(database, hooks, configuration), configuration);
+});
+const coordinateTargetPasskey = (database, source, configuration, owner) => Effect.flatMap(capturedMapping(source, "assertion", configuration), (mapping) => Effect.flatMap(LifecycleHooks, (hooks) => coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, Effect.void, unavailable, nonce, (execution) => ({ passkeyPersistence: makePasskeyPersistence(mapping, {
+	...execution,
+	run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
+}, configuration) }), owner).pipe(Effect.provideService(LifecycleHooks, hooks))));
+const coordinateTargetPasskeyRegistration = (database, source, configuration, owner) => Effect.flatMap(capturedMapping(source, "registration", configuration), (mapping) => Effect.flatMap(LifecycleHooks, (hooks) => coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, Effect.void, unavailable, nonce, (execution) => registrationServices(mapping, {
+	...execution,
+	run: (operation, mutation) => execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
+}, configuration), owner).pipe(Effect.provideService(LifecycleHooks, hooks))));
+//#endregion
+export { capturedMapping, capturedService, coordinateTargetPasskey, coordinateTargetPasskeyRegistration, makePasskeyExecution, makePasskeyPersistence, makeTargetPasskeyCredentials, makeTargetPasskeyEnrollmentContext, makeTargetPasskeyPersistence, makeTargetPasskeyRegistration, observationalContext, prepareValue, sqlClientPasskeyStandaloneGuard };
+
+//# sourceMappingURL=passkey-target.mjs.map

package/dist/drizzle/passkey-target.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-target.mjs","names":[],"sources":["../../src/drizzle/passkey-target.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- private bridge; concrete public makers preserve table, ID and environment types. */\nimport { Effect, Schema } from \"effect\";\nimport type { Statement } from \"effect/unstable/sql/Statement\";\n\nimport type { PreparedCommit } from \"../hooks/commit\";\nimport { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { PasskeyConfigurationError, type PasskeyUnavailable } from \"../passkey/errors\";\nimport {\n  PasskeyAccess,\n  PasskeyAssertionVerified,\n  PasskeyCeremony,\n  PasskeyClaim,\n  PasskeyClaimDecision,\n  PasskeyCleanupResult,\n  PasskeyCredential,\n  PasskeyEnrollmentSnapshot,\n  PasskeyEvidence,\n  PasskeyInstant,\n  PasskeyIssueDecision,\n  PasskeyModuleId,\n  PasskeyProfile,\n  PasskeyProtocolCredentialId,\n  PasskeySettlement,\n} from \"../passkey/models\";\nimport type { PasskeyCredentials } from \"../passkey/PasskeyCredentials\";\nimport type { PasskeyEnrollmentContext } from \"../passkey/PasskeyEnrollmentContext\";\nimport type { PasskeyPersistence, PreparePasskeyCommit } from \"../passkey/PasskeyPersistence\";\nimport { PasskeyMethodPolicy } from \"../passkey/policy\";\nimport { snapshotPasskeySync } from \"../passkey/snapshot\";\nimport { SubjectId } from \"../Schema\";\nimport type { DrizzleMappingError } from \"./model\";\nimport { captureEnrollmentContext, lookupCredential } from \"./passkey-credentials\";\nimport {\n  assertionPurposes,\n  claimAssertion,\n  cleanupCeremonies,\n  contextAssertion,\n  issueAssertion,\n  settleAssertion,\n} from \"./passkey-flow\";\nimport type {\n  PasskeyCredentialServices,\n  PasskeyEnrollmentContextServices,\n  PasskeyMappingSource,\n  PasskeyPersistenceServices,\n} from \"./passkey-model\";\nimport {\n  claimRegistration,\n  contextRegistration,\n  settleRegistration,\n} from \"./passkey-registration-ceremony\";\nimport type { PasskeyRegistrationCeremonyServices } from \"./passkey-registration-ceremony-model\";\nimport {\n  captureMapping,\n  invariant,\n  nonce,\n  unavailable,\n  validateMapping,\n  CurrentPasskeyTransaction,\n} from \"./passkey-state\";\nimport {\n  coordinateTransactionOwner,\n  makeTransactionExecution,\n  sqlClientTransactionStandaloneGuard,\n  type TransactionCoordinatorError,\n  type TransactionExecution,\n  type TransactionTargetConfiguration,\n} from \"./transaction-execution\";\n\nexport type PasskeyTargetConfiguration = TransactionTargetConfiguration<PasskeyUnavailable>;\n\nexport type PasskeyCoordinatorError<E> =\n  | TransactionCoordinatorError<E, PasskeyUnavailable>\n  | PasskeyConfigurationError\n  | DrizzleMappingError;\n\nexport const sqlClientPasskeyStandaloneGuard = (\n  database: Parameters<typeof sqlClientTransactionStandaloneGuard>[1],\n) => sqlClientTransactionStandaloneGuard(unavailable, database);\n\nconst emptyHooks: LifecycleHooks[\"Service\"] = {\n  before: () => Effect.void,\n  after: () => Effect.succeed([]),\n};\n\nexport type PasskeyExecution = TransactionExecution<\n  PasskeyUnavailable,\n  CurrentPasskeyTransaction,\n  never\n>;\n\nexport const makePasskeyExecution = (\n  database: Parameters<typeof makeTransactionExecution>[1],\n  hooks: LifecycleHooks[\"Service\"],\n  configuration: PasskeyTargetConfiguration,\n): PasskeyExecution => {\n  const execution = makeTransactionExecution(\n    CurrentPasskeyTransaction,\n    database,\n    configuration,\n    unavailable,\n    nonce,\n  );\n\n  return {\n    ...execution,\n    run: (operation, mutation) =>\n      execution.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks)),\n  };\n};\n\nconst issueInput = Schema.Struct({ ceremony: PasskeyCeremony, policy: PasskeyMethodPolicy });\n\nconst claimInput = Schema.Struct({\n  access: PasskeyAccess,\n  policy: PasskeyMethodPolicy,\n  ceremony: PasskeyCeremony,\n  claimId: PasskeyClaim.fields.claimId,\n  credential: Schema.optionalKey(PasskeyCredential),\n});\n\nconst settleInput = Schema.Struct({\n  claim: PasskeyClaim,\n  nowMillis: PasskeyInstant,\n  outcome: Schema.Union([\n    Schema.TaggedStruct(\"Rejected\", {}),\n    Schema.TaggedStruct(\"Ambiguous\", {}),\n    Schema.TaggedStruct(\"Assertion\", {\n      credential: PasskeyCredential,\n      assertion: PasskeyAssertionVerified,\n      evidence: PasskeyEvidence,\n    }),\n  ]),\n});\n\nconst cleanupInput = Schema.Struct({\n  moduleId: PasskeyModuleId,\n  nowMillis: PasskeyInstant,\n  limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 1000 })),\n});\n\nconst lookupInput = Schema.Struct({\n  rpId: PasskeyProfile.fields.rpId,\n  protocolCredentialId: PasskeyProtocolCredentialId,\n});\n\nconst contextInput = Schema.Struct({\n  moduleId: PasskeyModuleId,\n  rpId: PasskeyProfile.fields.rpId,\n  subjectId: SubjectId,\n});\n\nconst inputs = {\n  issue: issueInput,\n  context: PasskeyAccess,\n  claim: claimInput,\n  settle: settleInput,\n  cleanup: cleanupInput,\n};\n\nexport const capturedService = <S>(\n  service: S,\n  schemas: Record<string, Schema.Codec<any, any, never, never>>,\n  execute: PasskeyExecution,\n): S =>\n  Object.freeze(\n    Object.fromEntries(\n      Object.entries(\n        service as Record<string, (...args: any[]) => Effect.Effect<any, PasskeyUnavailable>>,\n      ).map(([name, method]) => [\n        name,\n        (original: any, prepare?: any) =>\n          Effect.suspend(() => {\n            invariant(execute.active());\n            const input = snapshotPasskeySync(schemas[name]!, original);\n\n            return method(input, prepare);\n          }).pipe(\n            Effect.onExit((exit) =>\n              Effect.sync(() => {\n                if (exit._tag === \"Failure\") execute.poison();\n              }),\n            ),\n            Effect.catchDefect(() => Effect.fail(unavailable())),\n          ),\n      ]),\n    ),\n  ) as S;\n\nexport const prepareValue = <Value, A>(\n  value: Value,\n  prepare: PreparePasskeyCommit<Value, A>,\n): Effect.Effect<PreparedCommit<A>, never, CurrentPasskeyTransaction> =>\n  Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n    Effect.sync(() => {\n      owner.guards.push(owner.journal.prepare(undefined));\n      const receipt = prepare(value, owner.journal);\n\n      invariant(\n        receipt !== null &&\n          typeof receipt === \"object\" &&\n          receipt._tag === \"PreparedCommit\" &&\n          typeof receipt.read === \"object\" &&\n          Effect.isEffect(receipt.read),\n      );\n      owner.guards.push(receipt);\n\n      return receipt;\n    }),\n  );\n\nconst requirePurpose = (purpose: string, registration: boolean, enrollment = false) =>\n  invariant(\n    enrollment\n      ? purpose === \"enrollment\"\n      : registration\n        ? purpose === \"registration\"\n        : assertionPurposes.some((supported) => supported === purpose),\n  );\n\n/** Context is advisory. Retain observations and final predicates without taking\n * later-ranked locks before a subsequent mutation acquires its full lock set. */\nexport const observationalContext = <A, E, R>(operation: Effect.Effect<A, E, R>) =>\n  Effect.flatMap(CurrentPasskeyTransaction, (owner) =>\n    operation.pipe(\n      Effect.provideService(CurrentPasskeyTransaction, {\n        ...owner,\n        read: (table, where, options) => owner.read(table, where, { ...options, lock: false }),\n      }),\n    ),\n  );\n\nexport const makePasskeyPersistence = (\n  mapping: any,\n  execute: PasskeyExecution,\n  configuration: PasskeyTargetConfiguration,\n  registration = false,\n  enrollment = false,\n): PasskeyPersistence[\"Service\"] =>\n  capturedService<PasskeyPersistence[\"Service\"]>(\n    {\n      issue: (input, prepare) =>\n        Effect.suspend(() => {\n          invariant(!registration && !enrollment);\n          requirePurpose(input.ceremony.purpose, false);\n\n          return execute.run(\n            Effect.gen(function* () {\n              const value = yield* issueAssertion(mapping, input.ceremony, input.policy);\n\n              return yield* prepareValue(snapshotPasskeySync(PasskeyIssueDecision, value), prepare);\n            }),\n          );\n        }),\n      context: (access) =>\n        Effect.suspend(() => {\n          requirePurpose(access.purpose, registration, enrollment);\n\n          return execute.run(\n            observationalContext(\n              registration\n                ? contextRegistration(mapping, access)\n                : contextAssertion(mapping, access),\n            ),\n            false,\n          );\n        }),\n      claim: (input, prepare) =>\n        Effect.suspend(() => {\n          requirePurpose(input.access.purpose, registration, enrollment);\n          requirePurpose(input.ceremony.purpose, registration, enrollment);\n          invariant((!registration && !enrollment) || input.credential === undefined);\n\n          return execute.run(\n            Effect.gen(function* () {\n              const value = yield* registration\n                ? claimRegistration(mapping, input)\n                : claimAssertion(mapping, input);\n\n              return yield* prepareValue(snapshotPasskeySync(PasskeyClaimDecision, value), prepare);\n            }),\n          );\n        }),\n      settle: (input, prepare) =>\n        Effect.suspend(() => {\n          requirePurpose(input.claim.ceremony.purpose, registration, enrollment);\n          invariant((!registration && !enrollment) || input.outcome._tag !== \"Assertion\");\n\n          return execute.run(\n            Effect.gen(function* () {\n              const value = yield* registration\n                ? settleRegistration(\n                    mapping,\n                    input.claim,\n                    input.outcome._tag as \"Rejected\" | \"Ambiguous\",\n                  )\n                : settleAssertion(mapping, input.claim, input.outcome, configuration.dialect);\n\n              return yield* prepareValue(snapshotPasskeySync(PasskeySettlement, value), prepare);\n            }),\n          );\n        }),\n      cleanup: (input, prepare) =>\n        execute.run(\n          Effect.gen(function* () {\n            const value = yield* cleanupCeremonies(\n              mapping,\n              input,\n              registration ? [\"registration\"] : enrollment ? [\"enrollment\"] : assertionPurposes,\n            );\n\n            return yield* prepareValue(snapshotPasskeySync(PasskeyCleanupResult, value), prepare);\n          }),\n        ),\n    },\n    inputs,\n    execute,\n  );\n\nconst credentialService = (\n  mapping: any,\n  execute: PasskeyExecution,\n): PasskeyCredentials[\"Service\"] =>\n  capturedService<PasskeyCredentials[\"Service\"]>(\n    {\n      lookup: (input) =>\n        execute.run(lookupCredential(mapping, input.rpId, input.protocolCredentialId), false),\n    },\n    { lookup: lookupInput },\n    execute,\n  );\n\nconst enrollmentService = (\n  mapping: any,\n  execute: PasskeyExecution,\n): PasskeyEnrollmentContext[\"Service\"] =>\n  capturedService<PasskeyEnrollmentContext[\"Service\"]>(\n    {\n      capture: (input) =>\n        execute.run(\n          Effect.map(captureEnrollmentContext(mapping, input), (value) =>\n            value === undefined ? undefined : snapshotPasskeySync(PasskeyEnrollmentSnapshot, value),\n          ),\n          false,\n        ),\n    },\n    { capture: contextInput },\n    execute,\n  );\n\nconst registrationServices = (\n  mapping: any,\n  execute: PasskeyExecution,\n  configuration: PasskeyTargetConfiguration,\n): PasskeyRegistrationCeremonyServices => ({\n  capabilities: Object.freeze({\n    purposes: Object.freeze([\"registration\"] as const),\n    issue: \"registration-authority\",\n    assertionSettlement: false,\n  }),\n  passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true),\n});\n\nexport const capturedMapping = <M, RSetup>(\n  source: PasskeyMappingSource<M, RSetup>,\n  kind: \"read\" | \"context\" | \"assertion\" | \"registration\",\n  configuration: PasskeyTargetConfiguration,\n): Effect.Effect<M, PasskeyConfigurationError | DrizzleMappingError, RSetup> =>\n  Effect.flatMap(Effect.isEffect(source) ? source : Effect.succeed(source), (mapping) =>\n    Effect.try({\n      try: () => {\n        const captured = captureMapping(mapping);\n\n        validateMapping(captured, kind);\n        if (configuration.mode === \"batch\") invariant((captured as any).d1?.primary === true);\n\n        return captured;\n      },\n      catch: () => PasskeyConfigurationError.make({}),\n    }),\n  );\n\nexport const makeTargetPasskeyCredentials = <M, RSetup>(\n  database: any,\n  source: PasskeyMappingSource<M, RSetup>,\n  configuration: PasskeyTargetConfiguration,\n): Effect.Effect<\n  PasskeyCredentialServices,\n  PasskeyConfigurationError | DrizzleMappingError,\n  RSetup\n> =>\n  Effect.map(capturedMapping(source, \"read\", configuration), (mapping) => ({\n    passkeyCredentials: credentialService(\n      mapping,\n      makePasskeyExecution(database, emptyHooks, configuration),\n    ),\n  }));\n\nexport const makeTargetPasskeyEnrollmentContext = <M, RSetup>(\n  database: any,\n  source: PasskeyMappingSource<M, RSetup>,\n  configuration: PasskeyTargetConfiguration,\n): Effect.Effect<\n  PasskeyEnrollmentContextServices,\n  PasskeyConfigurationError | DrizzleMappingError,\n  RSetup\n> =>\n  Effect.map(capturedMapping(source, \"context\", configuration), (mapping) => ({\n    passkeyEnrollmentContext: enrollmentService(\n      mapping,\n      makePasskeyExecution(database, emptyHooks, configuration),\n    ),\n  }));\n\nexport const makeTargetPasskeyPersistence = <M, RSetup>(\n  database: any,\n  source: PasskeyMappingSource<M, RSetup>,\n  configuration: PasskeyTargetConfiguration,\n): Effect.Effect<\n  PasskeyPersistenceServices,\n  PasskeyConfigurationError | DrizzleMappingError,\n  RSetup | LifecycleHooks\n> =>\n  Effect.gen(function* () {\n    const mapping = yield* capturedMapping(source, \"assertion\", configuration);\n    const hooks = yield* LifecycleHooks;\n\n    return {\n      passkeyPersistence: makePasskeyPersistence(\n        mapping,\n        makePasskeyExecution(database, hooks, configuration),\n        configuration,\n      ),\n    };\n  });\n\nexport const makeTargetPasskeyRegistration = <M, RSetup>(\n  database: any,\n  source: PasskeyMappingSource<M, RSetup>,\n  configuration: PasskeyTargetConfiguration,\n): Effect.Effect<\n  PasskeyRegistrationCeremonyServices,\n  PasskeyConfigurationError | DrizzleMappingError,\n  RSetup | LifecycleHooks\n> =>\n  Effect.gen(function* () {\n    const mapping = yield* capturedMapping(source, \"registration\", configuration);\n    const hooks = yield* LifecycleHooks;\n\n    return registrationServices(\n      mapping,\n      makePasskeyExecution(database, hooks, configuration),\n      configuration,\n    );\n  });\n\nexport const coordinateTargetPasskey = <M, RSetup, Transaction, A, E, R>(\n  database: any,\n  source: PasskeyMappingSource<M, RSetup>,\n  configuration: PasskeyTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: PasskeyPersistenceServices,\n    append: (statement: Statement<unknown>) => void,\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n  Effect.flatMap(capturedMapping(source, \"assertion\", configuration), (mapping) =>\n    Effect.flatMap(LifecycleHooks, (hooks) =>\n      coordinateTransactionOwner(\n        database,\n        CurrentPasskeyTransaction,\n        configuration,\n        Effect.void,\n        unavailable,\n        nonce,\n        (execution) => ({\n          passkeyPersistence: makePasskeyPersistence(\n            mapping,\n            {\n              ...execution,\n              run: (operation, mutation) =>\n                execution\n                  .run(operation, mutation)\n                  .pipe(Effect.provideService(LifecycleHooks, hooks)),\n            },\n            configuration,\n          ),\n        }),\n        owner,\n      ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    ),\n  );\n\nexport const coordinateTargetPasskeyRegistration = <M, RSetup, Transaction, A, E, R>(\n  database: any,\n  source: PasskeyMappingSource<M, RSetup>,\n  configuration: PasskeyTargetConfiguration,\n  owner: (\n    transaction: Transaction,\n    services: PasskeyRegistrationCeremonyServices,\n    append: (statement: Statement<unknown>) => void,\n  ) => Effect.Effect<A, E, R>,\n): Effect.Effect<A, PasskeyCoordinatorError<E>, R | RSetup | LifecycleHooks> =>\n  Effect.flatMap(capturedMapping(source, \"registration\", configuration), (mapping) =>\n    Effect.flatMap(LifecycleHooks, (hooks) =>\n      coordinateTransactionOwner(\n        database,\n        CurrentPasskeyTransaction,\n        configuration,\n        Effect.void,\n        unavailable,\n        nonce,\n        (execution) =>\n          registrationServices(\n            mapping,\n            {\n              ...execution,\n              run: (operation, mutation) =>\n                execution\n                  .run(operation, mutation)\n                  .pipe(Effect.provideService(LifecycleHooks, hooks)),\n            },\n            configuration,\n          ),\n        owner,\n      ).pipe(Effect.provideService(LifecycleHooks, hooks)),\n    ),\n  );\n"],"mappings":";;;;;;;;;;;;;AA4EA,MAAa,mCACX,aACG,oCAAoC,aAAa,QAAQ;AAE9D,MAAM,aAAwC;CAC5C,cAAc,OAAO;CACrB,aAAa,OAAO,QAAQ,CAAC,CAAC;AAChC;AAQA,MAAa,wBACX,UACA,OACA,kBACqB;CACrB,MAAM,YAAY,yBAChB,2BACA,UACA,eACA,aACA,KACF;CAEA,OAAO;EACL,GAAG;EACH,MAAM,WAAW,aACf,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CACxF;AACF;AAEA,MAAM,aAAa,OAAO,OAAO;CAAE,UAAU;CAAiB,QAAQ;AAAoB,CAAC;AAE3F,MAAM,aAAa,OAAO,OAAO;CAC/B,QAAQ;CACR,QAAQ;CACR,UAAU;CACV,SAAS,aAAa,OAAO;CAC7B,YAAY,OAAO,YAAY,iBAAiB;AAClD,CAAC;AAED,MAAM,cAAc,OAAO,OAAO;CAChC,OAAO;CACP,WAAW;CACX,SAAS,OAAO,MAAM;EACpB,OAAO,aAAa,YAAY,CAAC,CAAC;EAClC,OAAO,aAAa,aAAa,CAAC,CAAC;EACnC,OAAO,aAAa,aAAa;GAC/B,YAAY;GACZ,WAAW;GACX,UAAU;EACZ,CAAC;CACH,CAAC;AACH,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,UAAU;CACV,WAAW;CACX,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;EAAE,SAAS;EAAG,SAAS;CAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,cAAc,OAAO,OAAO;CAChC,MAAM,eAAe,OAAO;CAC5B,sBAAsB;AACxB,CAAC;AAED,MAAM,eAAe,OAAO,OAAO;CACjC,UAAU;CACV,MAAM,eAAe,OAAO;CAC5B,WAAW;AACb,CAAC;AAED,MAAM,SAAS;CACb,OAAO;CACP,SAAS;CACT,OAAO;CACP,QAAQ;CACR,SAAS;AACX;AAEA,MAAa,mBACX,SACA,SACA,YAEA,OAAO,OACL,OAAO,YACL,OAAO,QACL,OACF,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CACxB,OACC,UAAe,YACd,OAAO,cAAc;CACnB,UAAU,QAAQ,OAAO,CAAC;CAG1B,OAAO,OAFO,oBAAoB,QAAQ,OAAQ,QAEhC,GAAG,OAAO;AAC9B,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,OAAO,WAAW;CAChB,IAAI,KAAK,SAAS,WAAW,QAAQ,OAAO;AAC9C,CAAC,CACH,GACA,OAAO,kBAAkB,OAAO,KAAK,YAAY,CAAC,CAAC,CACrD,CACJ,CAAC,CACH,CACF;AAEF,MAAa,gBACX,OACA,YAEA,OAAO,QAAQ,4BAA4B,UACzC,OAAO,WAAW;CAChB,MAAM,OAAO,KAAK,MAAM,QAAQ,QAAQ,KAAA,CAAS,CAAC;CAClD,MAAM,UAAU,QAAQ,OAAO,MAAM,OAAO;CAE5C,UACE,YAAY,QACV,OAAO,YAAY,YACnB,QAAQ,SAAS,oBACjB,OAAO,QAAQ,SAAS,YACxB,OAAO,SAAS,QAAQ,IAAI,CAChC;CACA,MAAM,OAAO,KAAK,OAAO;CAEzB,OAAO;AACT,CAAC,CACH;AAEF,MAAM,kBAAkB,SAAiB,cAAuB,aAAa,UAC3E,UACE,aACI,YAAY,eACZ,eACE,YAAY,iBACZ,kBAAkB,MAAM,cAAc,cAAc,OAAO,CACnE;;;AAIF,MAAa,wBAAiC,cAC5C,OAAO,QAAQ,4BAA4B,UACzC,UAAU,KACR,OAAO,eAAe,2BAA2B;CAC/C,GAAG;CACH,OAAO,OAAO,OAAO,YAAY,MAAM,KAAK,OAAO,OAAO;EAAE,GAAG;EAAS,MAAM;CAAM,CAAC;AACvF,CAAC,CACH,CACF;AAEF,MAAa,0BACX,SACA,SACA,eACA,eAAe,OACf,aAAa,UAEb,gBACE;CACE,QAAQ,OAAO,YACb,OAAO,cAAc;EACnB,UAAU,CAAC,gBAAgB,CAAC,UAAU;EACtC,eAAe,MAAM,SAAS,SAAS,KAAK;EAE5C,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,eAAe,SAAS,MAAM,UAAU,MAAM,MAAM;GAEzE,OAAO,OAAO,aAAa,oBAAoB,sBAAsB,KAAK,GAAG,OAAO;EACtF,CAAC,CACH;CACF,CAAC;CACH,UAAU,WACR,OAAO,cAAc;EACnB,eAAe,OAAO,SAAS,cAAc,UAAU;EAEvD,OAAO,QAAQ,IACb,qBACE,eACI,oBAAoB,SAAS,MAAM,IACnC,iBAAiB,SAAS,MAAM,CACtC,GACA,KACF;CACF,CAAC;CACH,QAAQ,OAAO,YACb,OAAO,cAAc;EACnB,eAAe,MAAM,OAAO,SAAS,cAAc,UAAU;EAC7D,eAAe,MAAM,SAAS,SAAS,cAAc,UAAU;EAC/D,UAAW,CAAC,gBAAgB,CAAC,cAAe,MAAM,eAAe,KAAA,CAAS;EAE1E,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,eACjB,kBAAkB,SAAS,KAAK,IAChC,eAAe,SAAS,KAAK;GAEjC,OAAO,OAAO,aAAa,oBAAoB,sBAAsB,KAAK,GAAG,OAAO;EACtF,CAAC,CACH;CACF,CAAC;CACH,SAAS,OAAO,YACd,OAAO,cAAc;EACnB,eAAe,MAAM,MAAM,SAAS,SAAS,cAAc,UAAU;EACrE,UAAW,CAAC,gBAAgB,CAAC,cAAe,MAAM,QAAQ,SAAS,WAAW;EAE9E,OAAO,QAAQ,IACb,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,eACjB,mBACE,SACA,MAAM,OACN,MAAM,QAAQ,IAChB,IACA,gBAAgB,SAAS,MAAM,OAAO,MAAM,SAAS,cAAc,OAAO;GAE9E,OAAO,OAAO,aAAa,oBAAoB,mBAAmB,KAAK,GAAG,OAAO;EACnF,CAAC,CACH;CACF,CAAC;CACH,UAAU,OAAO,YACf,QAAQ,IACN,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,kBACnB,SACA,OACA,eAAe,CAAC,cAAc,IAAI,aAAa,CAAC,YAAY,IAAI,iBAClE;EAEA,OAAO,OAAO,aAAa,oBAAoB,sBAAsB,KAAK,GAAG,OAAO;CACtF,CAAC,CACH;AACJ,GACA,QACA,OACF;AAEF,MAAM,qBACJ,SACA,YAEA,gBACE,EACE,SAAS,UACP,QAAQ,IAAI,iBAAiB,SAAS,MAAM,MAAM,MAAM,oBAAoB,GAAG,KAAK,EACxF,GACA,EAAE,QAAQ,YAAY,GACtB,OACF;AAEF,MAAM,qBACJ,SACA,YAEA,gBACE,EACE,UAAU,UACR,QAAQ,IACN,OAAO,IAAI,yBAAyB,SAAS,KAAK,IAAI,UACpD,UAAU,KAAA,IAAY,KAAA,IAAY,oBAAoB,2BAA2B,KAAK,CACxF,GACA,KACF,EACJ,GACA,EAAE,SAAS,aAAa,GACxB,OACF;AAEF,MAAM,wBACJ,SACA,SACA,mBACyC;CACzC,cAAc,OAAO,OAAO;EAC1B,UAAU,OAAO,OAAO,CAAC,cAAc,CAAU;EACjD,OAAO;EACP,qBAAqB;CACvB,CAAC;CACD,oBAAoB,uBAAuB,SAAS,SAAS,eAAe,IAAI;AAClF;AAEA,MAAa,mBACX,QACA,MACA,kBAEA,OAAO,QAAQ,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO,QAAQ,MAAM,IAAI,YACzE,OAAO,IAAI;CACT,WAAW;EACT,MAAM,WAAW,eAAe,OAAO;EAEvC,gBAAgB,UAAU,IAAI;EAC9B,IAAI,cAAc,SAAS,SAAS,UAAW,SAAiB,IAAI,YAAY,IAAI;EAEpF,OAAO;CACT;CACA,aAAa,0BAA0B,KAAK,CAAC,CAAC;AAChD,CAAC,CACH;AAEF,MAAa,gCACX,UACA,QACA,kBAMA,OAAO,IAAI,gBAAgB,QAAQ,QAAQ,aAAa,IAAI,aAAa,EACvE,oBAAoB,kBAClB,SACA,qBAAqB,UAAU,YAAY,aAAa,CAC1D,EACF,EAAE;AAEJ,MAAa,sCACX,UACA,QACA,kBAMA,OAAO,IAAI,gBAAgB,QAAQ,WAAW,aAAa,IAAI,aAAa,EAC1E,0BAA0B,kBACxB,SACA,qBAAqB,UAAU,YAAY,aAAa,CAC1D,EACF,EAAE;AAEJ,MAAa,gCACX,UACA,QACA,kBAMA,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,aAAa,aAAa;CACzE,MAAM,QAAQ,OAAO;CAErB,OAAO,EACL,oBAAoB,uBAClB,SACA,qBAAqB,UAAU,OAAO,aAAa,GACnD,aACF,EACF;AACF,CAAC;AAEH,MAAa,iCACX,UACA,QACA,kBAMA,OAAO,IAAI,aAAa;CACtB,MAAM,UAAU,OAAO,gBAAgB,QAAQ,gBAAgB,aAAa;CAC5E,MAAM,QAAQ,OAAO;CAErB,OAAO,qBACL,SACA,qBAAqB,UAAU,OAAO,aAAa,GACnD,aACF;AACF,CAAC;AAEH,MAAa,2BACX,UACA,QACA,eACA,UAMA,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,aAAa,IAAI,YACnE,OAAO,QAAQ,iBAAiB,UAC9B,2BACE,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,eAAe,EACd,oBAAoB,uBAClB,SACA;CACE,GAAG;CACH,MAAM,WAAW,aACf,UACG,IAAI,WAAW,QAAQ,CAAC,CACxB,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;AACxD,GACA,aACF,EACF,IACA,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD,CACF;AAEF,MAAa,uCACX,UACA,QACA,eACA,UAMA,OAAO,QAAQ,gBAAgB,QAAQ,gBAAgB,aAAa,IAAI,YACtE,OAAO,QAAQ,iBAAiB,UAC9B,2BACE,UACA,2BACA,eACA,OAAO,MACP,aACA,QACC,cACC,qBACE,SACA;CACE,GAAG;CACH,MAAM,WAAW,aACf,UACG,IAAI,WAAW,QAAQ,CAAC,CACxB,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;AACxD,GACA,aACF,GACF,KACF,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC,CACrD,CACF"}

package/dist/drizzle/passkey-write-drivers.mjs

@@ -0,0 +1,33 @@
+import { PasskeyPersistence } from "../passkey/PasskeyPersistence.mjs";
+import { PasskeyManagementPersistence } from "../passkey/PasskeyManagementPersistence.mjs";
+import { coordinateTargetPasskeyManagement, coordinateTargetPasskeyRegistrationWriter, makeTargetPasskeyManagement, makeTargetPasskeyRegistrationWriter } from "./passkey-write-target.mjs";
+import { Context, Effect } from "effect";
+//#region src/drizzle/passkey-write-drivers.ts
+const makePasskeyWriteTarget = (configuration) => {
+	function coordinatePasskeyManagement(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetPasskeyManagement(database, options.mapping, configuration, (transaction, services) => {
+			const context = Context.make(PasskeyPersistence, services.passkeyPersistence).pipe(Context.add(PasskeyManagementPersistence, services.passkeyManagementPersistence));
+			const work = Effect.provideContext(body, context);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	const makePasskeyManagementServices = (database, mapping) => makeTargetPasskeyManagement(database, mapping, configuration);
+	function coordinatePasskeyRegistration(acquire, options, body) {
+		return Effect.flatMap(acquire, (database) => coordinateTargetPasskeyRegistrationWriter(database, options.mapping, configuration, (transaction, services) => {
+			const context = Context.make(PasskeyPersistence, services.passkeyPersistence).pipe(Context.add(options.authority, services.passkeyRegistrationAuthority));
+			const work = Effect.provideContext(body, context);
+			return options.transaction === void 0 ? work : Effect.provideService(work, options.transaction, options.transaction.of(transaction));
+		}));
+	}
+	const makePasskeyRegistrationServices = (database, mapping) => makeTargetPasskeyRegistrationWriter(database, mapping, configuration);
+	return {
+		makePasskeyManagementServices,
+		makePasskeyRegistrationServices,
+		coordinatePasskeyManagement,
+		coordinatePasskeyRegistration
+	};
+};
+//#endregion
+export { makePasskeyWriteTarget };
+
+//# sourceMappingURL=passkey-write-drivers.mjs.map

package/dist/drizzle/passkey-write-drivers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-write-drivers.mjs","names":[],"sources":["../../src/drizzle/passkey-write-drivers.ts"],"sourcesContent":["import type { Table } from \"drizzle-orm\";\nimport { Context, Effect } from \"effect\";\n\nimport type { LifecycleHooks } from \"../hooks/LifecycleHooks\";\nimport { PasskeyManagementPersistence } from \"../passkey/PasskeyManagementPersistence\";\nimport { PasskeyPersistence } from \"../passkey/PasskeyPersistence\";\nimport type { PasskeyMappingSource } from \"./passkey-model\";\nimport type { PasskeyCoordinatorError, PasskeyTargetConfiguration } from \"./passkey-target\";\nimport type {\n  PasskeyManagementMapping,\n  PasskeyRegistrationMapping,\n  PasskeyRegistrationWriter,\n} from \"./passkey-write-model\";\nimport {\n  coordinateTargetPasskeyManagement,\n  coordinateTargetPasskeyRegistrationWriter,\n  makeTargetPasskeyManagement,\n  makeTargetPasskeyRegistrationWriter,\n} from \"./passkey-write-target\";\nimport type { SuppliedService } from \"./SuppliedService\";\n// oxlint-disable-next-line no-explicit-any -- inspect the installed concrete transaction callback.\ntype TransactionOf<D> = D extends { readonly transaction: (...args: any[]) => any }\n  ? Parameters<Parameters<D[\"transaction\"]>[0]>[0]\n  : never;\n\nexport const makePasskeyWriteTarget = <\n  D,\n  T extends Table,\n  Extra = unknown,\n  Synchronous extends boolean = false,\n>(\n  configuration: PasskeyTargetConfiguration,\n) => {\n  function coordinatePasskeyManagement<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Command extends T,\n    N,\n    A,\n    E,\n    R,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N> & Extra,\n        RSetup\n      >;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<PasskeyPersistence | PasskeyManagementPersistence> : R\n    >,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true\n        ? never\n        : Exclude<R, PasskeyPersistence | PasskeyManagementPersistence>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinatePasskeyManagement<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Command extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N> & Extra,\n        RSetup\n      >;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true\n        ? NoInfer<PasskeyPersistence | PasskeyManagementPersistence | TxId>\n        : R\n    >,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true\n        ? never\n        : Exclude<R, PasskeyPersistence | PasskeyManagementPersistence | TxId>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinatePasskeyManagement<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Command extends T,\n    N,\n    A,\n    E,\n    R,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N> & Extra,\n        RSetup\n      >;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | Exclude<R, PasskeyPersistence | PasskeyManagementPersistence>\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetPasskeyManagement(\n        database,\n        options.mapping,\n        configuration,\n        (transaction: TransactionOf<Database>, services) => {\n          const context = Context.make(PasskeyPersistence, services.passkeyPersistence).pipe(\n            Context.add(PasskeyManagementPersistence, services.passkeyManagementPersistence),\n          );\n\n          const work = Effect.provideContext(body, context);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  const makePasskeyManagementServices = <\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Command extends T,\n    N,\n    RSetup = never,\n  >(\n    database: Database,\n    mapping: PasskeyMappingSource<\n      PasskeyManagementMapping<S, C, F, O, H, M, Flow, Admission, Charge, Command, N> & Extra,\n      RSetup\n    >,\n  ) => makeTargetPasskeyManagement(database, mapping, configuration);\n\n  function coordinatePasskeyRegistration<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    N,\n    Value,\n    A,\n    E,\n    R,\n    AuthorityId,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &\n          Extra,\n        RSetup\n      >;\n      readonly authority: Context.Key<AuthorityId, PasskeyRegistrationWriter<Value>>;\n      readonly transaction?: never;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<PasskeyPersistence | AuthorityId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | AuthorityId>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinatePasskeyRegistration<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    N,\n    Value,\n    A,\n    E,\n    R,\n    AuthorityId,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &\n          Extra,\n        RSetup\n      >;\n      readonly authority: Context.Key<AuthorityId, PasskeyRegistrationWriter<Value>>;\n      readonly transaction: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<\n      A,\n      E,\n      Synchronous extends true ? NoInfer<PasskeyPersistence | AuthorityId | TxId> : R\n    >,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    | (Synchronous extends true ? never : Exclude<R, PasskeyPersistence | AuthorityId | TxId>)\n    | LifecycleHooks\n    | RSetup\n    | DatabaseRequirements\n  >;\n  function coordinatePasskeyRegistration<\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    N,\n    Value,\n    A,\n    E,\n    R,\n    AuthorityId,\n    TxId,\n    TxShape,\n    RSetup = never,\n    DatabaseError = never,\n    DatabaseRequirements = never,\n  >(\n    acquire: Effect.Effect<Database, DatabaseError, DatabaseRequirements>,\n    options: {\n      readonly mapping: PasskeyMappingSource<\n        PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &\n          Extra,\n        RSetup\n      >;\n      readonly authority: Context.Key<AuthorityId, PasskeyRegistrationWriter<Value>>;\n      readonly transaction?: SuppliedService<TxId, NoInfer<TransactionOf<Database>>, TxShape>;\n    },\n    body: Effect.Effect<A, E, R>,\n  ): Effect.Effect<\n    A,\n    PasskeyCoordinatorError<E> | DatabaseError,\n    Exclude<R, PasskeyPersistence | AuthorityId> | LifecycleHooks | RSetup | DatabaseRequirements\n  > {\n    return Effect.flatMap(acquire, (database) =>\n      coordinateTargetPasskeyRegistrationWriter(\n        database,\n        options.mapping,\n        configuration,\n        (\n          transaction: TransactionOf<Database>,\n          services: import(\"./passkey-write-model\").PasskeyRegistrationServices<Value>,\n        ) => {\n          const context = Context.make(PasskeyPersistence, services.passkeyPersistence).pipe(\n            Context.add(options.authority, services.passkeyRegistrationAuthority),\n          );\n\n          const work = Effect.provideContext(body, context);\n\n          return options.transaction === undefined\n            ? work\n            : Effect.provideService(work, options.transaction, options.transaction.of(transaction));\n        },\n      ),\n    );\n  }\n\n  const makePasskeyRegistrationServices = <\n    Database extends D,\n    S extends T,\n    C extends T,\n    F extends T,\n    O extends T,\n    H extends T,\n    M extends T,\n    Flow extends T,\n    Admission extends T,\n    Charge extends T,\n    Intent extends T,\n    N,\n    Value,\n    RSetup = never,\n  >(\n    database: Database,\n    mapping: PasskeyMappingSource<\n      PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &\n        Extra,\n      RSetup\n    >,\n  ) =>\n    makeTargetPasskeyRegistrationWriter<\n      PasskeyRegistrationMapping<S, C, F, O, H, M, Flow, Admission, Charge, Intent, N, Value> &\n        Extra,\n      Value,\n      RSetup\n    >(database, mapping, configuration);\n\n  return {\n    makePasskeyManagementServices,\n    makePasskeyRegistrationServices,\n    coordinatePasskeyManagement,\n    coordinatePasskeyRegistration,\n  };\n};\n"],"mappings":";;;;;AAyBA,MAAa,0BAMX,kBACG;CA2FH,SAAS,4BAsBP,SACA,SAOA,MAQA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,kCACE,UACA,QAAQ,SACR,gBACC,aAAsC,aAAa;GAClD,MAAM,UAAU,QAAQ,KAAK,oBAAoB,SAAS,kBAAkB,CAAC,CAAC,KAC5E,QAAQ,IAAI,8BAA8B,SAAS,4BAA4B,CACjF;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,OAAO;GAEhD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,MAAM,iCAeJ,UACA,YAIG,4BAA4B,UAAU,SAAS,aAAa;CA8FjE,SAAS,8BAwBP,SACA,SASA,MAKA;EACA,OAAO,OAAO,QAAQ,UAAU,aAC9B,0CACE,UACA,QAAQ,SACR,gBAEE,aACA,aACG;GACH,MAAM,UAAU,QAAQ,KAAK,oBAAoB,SAAS,kBAAkB,CAAC,CAAC,KAC5E,QAAQ,IAAI,QAAQ,WAAW,SAAS,4BAA4B,CACtE;GAEA,MAAM,OAAO,OAAO,eAAe,MAAM,OAAO;GAEhD,OAAO,QAAQ,gBAAgB,KAAA,IAC3B,OACA,OAAO,eAAe,MAAM,QAAQ,aAAa,QAAQ,YAAY,GAAG,WAAW,CAAC;EAC1F,CACF,CACF;CACF;CAEA,MAAM,mCAgBJ,UACA,YAMA,oCAKE,UAAU,SAAS,aAAa;CAEpC,OAAO;EACL;EACA;EACA;EACA;CACF;AACF"}

package/dist/drizzle/passkey-write-model.d.mts

@@ -0,0 +1,192 @@
+import { TokenDigest } from "../Schema.mjs";
+import { PreparedCommit } from "../hooks/commit.mjs";
+import { SessionInvalidationWindow } from "../sessions/invalidation.mjs";
+import { PasskeyActionAuthorization, PasskeyCeremony, PasskeyClaim, PasskeyCredential, PasskeyCredentialSummary, PasskeyIssueDecision, PasskeyRegistrationResult, PasskeyRegistrationVerified, PasskeyRequirement, PasskeyRevision } from "../passkey/models.mjs";
+import { PasskeyUnavailable } from "../passkey/errors.mjs";
+import { PasskeyManagementPolicy, PasskeyMethodPolicy } from "../passkey/policy.mjs";
+import { PreparePasskeyCommit } from "../passkey/PasskeyPersistence.mjs";
+import { PasskeyColumn, PasskeyCredentialMapping, PasskeyFlowTable, PasskeyHandleReservationTable, PasskeyPersistenceMapping, PasskeyPersistenceServices } from "./passkey-model.mjs";
+import { PasskeyRegistrationIntentReadTable } from "./passkey-registration-ceremony-model.mjs";
+import { PasskeyManagementPersistence } from "../passkey/PasskeyManagementPersistence.mjs";
+import { Effect, Schema } from "effect";
+import { InferInsertModel, InferSelectModel, SQL, Table } from "drizzle-orm";
+//#region src/drizzle/passkey-write-model.d.ts
+interface PasskeyCredentialInsert<N> {
+  readonly subjectId: N;
+  readonly credential: PasskeyCredential;
+  readonly summary: PasskeyCredentialSummary;
+  readonly marker: string;
+}
+interface PasskeyWriteTables<S extends Table, C extends Table, F extends Table, O extends Table, H extends Table, N> {
+  readonly credential: {
+    readonly name: PasskeyColumn<C>;
+    readonly createdAt: PasskeyColumn<C>;
+    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => InferInsertModel<C>;
+    readonly encodePrimarySignIn: (value: boolean) => unknown;
+    readonly encodeEnrollmentUserVerified: (value: boolean) => unknown;
+    readonly encodeBackupEligible: (value: boolean) => unknown;
+    readonly activeStatus: unknown;
+    readonly removedStatus: unknown;
+  };
+  readonly authority: {
+    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => InferInsertModel<F>;
+    readonly activeStatus: unknown;
+    readonly removedStatus: unknown;
+  };
+  readonly credentialOwnership: {
+    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => InferInsertModel<O>;
+    readonly ownedState: unknown;
+    readonly removedState: unknown;
+  };
+  readonly handleOwnership: {
+    readonly encodeInsert: (input: {
+      readonly subjectId: N;
+      readonly rpId: string;
+      readonly userHandle: string;
+      readonly marker: string;
+    }) => InferInsertModel<H>;
+    readonly ownedState: unknown;
+  };
+  /** All mutable policy dependencies must be subject columns or declared module guards. */
+  readonly policy: {
+    readonly subjectColumns: ReadonlyArray<PasskeyColumn<S>>;
+    readonly management: (row: Readonly<Partial<InferSelectModel<S>>>) => PasskeyManagementPolicy;
+    readonly requirement: (row: Readonly<Partial<InferSelectModel<S>>>, action: PasskeyActionAuthorization["challenge"]["action"]) => typeof PasskeyRequirement.Type;
+    readonly metadata: (subjectId: N) => SQL;
+    readonly action: (subjectId: N, authorization: PasskeyActionAuthorization) => SQL;
+    /** Usable primary/recovery path AND required remaining factors. Evaluated with the target excluded, before and after removal. Connected grants/factor-only credentials are not primary paths. */
+    readonly remainingSignIn: (subjectId: N, removedCredentialId: string) => SQL;
+  };
+}
+interface PasskeyInvalidationInput<N> {
+  readonly subjectId: N;
+  readonly previousRevision: typeof PasskeyRevision.Type.securityRevision;
+  readonly securityRevision: typeof PasskeyRevision.Type.securityRevision;
+  readonly invalidation: SessionInvalidationWindow;
+}
+interface PasskeyInvalidationMutation<N> {
+  readonly table: Table;
+  readonly where: (input: PasskeyInvalidationInput<N>) => SQL;
+  readonly values: (input: PasskeyInvalidationInput<N>) => Readonly<Record<string, unknown>>;
+  readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;
+}
+/** Same-owner updates for consumer session/pending tables. No external effects or callbacks after commit. */
+declare const passkeyInvalidationMutation: <T extends Table, N>(input: {
+  readonly table: T;
+  readonly where: (input: PasskeyInvalidationInput<N>) => SQL;
+  readonly values: (input: PasskeyInvalidationInput<N>) => Partial<InferInsertModel<T>>;
+  readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;
+}) => PasskeyInvalidationMutation<N>;
+interface PasskeyCommandTable<T extends Table, N> {
+  readonly table: T;
+  readonly moduleId: PasskeyColumn<T>;
+  readonly commandId: PasskeyColumn<T>;
+  readonly subjectId: PasskeyColumn<T>;
+  readonly credentialId: PasskeyColumn<T>;
+  readonly intent: PasskeyColumn<T>;
+  readonly decision: PasskeyColumn<T>;
+  readonly retentionUntil: PasskeyColumn<T>;
+  readonly version: PasskeyColumn<T>;
+  readonly encodeInsert: (input: {
+    readonly moduleId: string;
+    readonly commandId: string;
+    readonly subjectId: N;
+    readonly credentialId: string;
+  }) => InferInsertModel<T>;
+}
+interface PasskeyManagementMapping<S extends Table, C extends Table, F extends Table, O extends Table, H extends Table, M extends Table, Flow extends Table, A extends Table, Charge extends Table, Command extends Table, N> extends PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, Flow, A, Charge, N> {
+  readonly write: PasskeyWriteTables<S, C, F, O, H, N>;
+  readonly command: PasskeyCommandTable<Command, N>;
+  readonly managementConstraints: typeof requiredPasskeyManagementConstraints;
+  /** Must match the installed session strategy. Subject revision is always changed; immediate sessions must consult that authority or be updated here. */
+  readonly invalidation: {
+    readonly window: SessionInvalidationWindow;
+    readonly mutations: ReadonlyArray<PasskeyInvalidationMutation<N>>;
+    readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;
+  };
+}
+declare const requiredPasskeyManagementConstraints: {
+  readonly command: readonly ["moduleId", "commandId"];
+};
+interface PasskeyManagementServices extends PasskeyPersistenceServices {
+  readonly passkeyManagementPersistence: PasskeyManagementPersistence["Service"];
+}
+interface PasskeyRegistrationWriter<R> {
+  readonly inspect: (registration: R) => Effect.Effect<{
+    readonly fingerprint: TokenDigest;
+    readonly eligible: boolean;
+    readonly name: string;
+    readonly displayName: string;
+  }, PasskeyUnavailable>;
+  readonly issueRegistration: <A>(input: {
+    readonly ceremony: PasskeyCeremony;
+    readonly policy: PasskeyMethodPolicy;
+    readonly registration: R;
+  }, prepare: PreparePasskeyCommit<PasskeyIssueDecision, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
+  readonly completeRegistration: <A>(input: {
+    readonly claim: PasskeyClaim;
+    readonly verified: PasskeyRegistrationVerified;
+    readonly nowMillis: number;
+  }, prepare: PreparePasskeyCommit<PasskeyRegistrationResult | {
+    readonly _tag: "Rejected";
+  }, A>) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;
+}
+interface PasskeyRegistrationServices<R> extends PasskeyPersistenceServices {
+  readonly passkeyRegistrationAuthority: PasskeyRegistrationWriter<R>;
+}
+interface PasskeyRegistrationMapping<S extends Table, C extends Table, F extends Table, O extends Table, H extends Table, M extends Table, Flow extends Table, A extends Table, Charge extends Table, Intent extends Table, N, R> extends PasskeyPersistenceMapping<PasskeyCredentialMapping<S, C, F, O, H, N>, M, Flow, A, Charge, N> {
+  readonly write: PasskeyWriteTables<S, C, F, O, H, N>;
+  readonly flow: PasskeyFlowTable<Flow>;
+  readonly handle: PasskeyHandleReservationTable<H> & {
+    readonly reservedState: unknown;
+    readonly encodeInsert: (input: {
+      readonly ceremony: PasskeyCeremony;
+      readonly reservationId: string;
+    }) => InferInsertModel<H>;
+  };
+  readonly intent: PasskeyRegistrationIntentReadTable<Intent> & {
+    readonly pendingState: unknown;
+    readonly acceptedState: unknown;
+    readonly rejectedState: unknown;
+    readonly encodeInsert: (input: {
+      readonly ceremony: PasskeyCeremony;
+      readonly registration: R;
+      readonly reservationId: string;
+    }) => InferInsertModel<Intent>;
+  };
+  /** Consumer-owned data and identity, synchronously encoded inside the owner. A SQL-local registration creates no session and needs no email address. */
+  readonly registration: {
+    readonly schema: Schema.Codec<R, unknown, never, never>;
+    readonly describe: (registration: R) => {
+      readonly name: string;
+      readonly displayName: string;
+    };
+    readonly eligible: (registration: R) => SQL;
+    /** Commit-time application policy after provisioning. Unlike `eligible`, this
+     * must permit the newly created subject and retain every mutable prerequisite.
+     * Declare mutable external policy rows in module.guards so native locking
+     * owners serialize revocation through commit; this predicate alone is not a lock. */
+    readonly finalEligibility: (input: {
+      readonly registration: R;
+      readonly subjectId: N;
+    }) => SQL;
+    readonly subject: (input: {
+      readonly registration: R;
+      readonly ceremony: PasskeyCeremony;
+      readonly marker: string;
+    }) => {
+      readonly subjectId: N;
+      readonly values: InferInsertModel<S>;
+    };
+    readonly activeStatus: unknown;
+  };
+  readonly registrationConstraints: typeof requiredPasskeyRegistrationWriteConstraints;
+}
+declare const requiredPasskeyRegistrationWriteConstraints: {
+  readonly intentFlow: readonly ["moduleId", "flowId"];
+  readonly intentCommand: readonly ["moduleId", "commandId"];
+  readonly handle: readonly ["handleKey"];
+};
+//#endregion
+export { PasskeyCommandTable, PasskeyCredentialInsert, PasskeyInvalidationInput, PasskeyInvalidationMutation, PasskeyManagementMapping, PasskeyManagementServices, PasskeyRegistrationMapping, PasskeyRegistrationServices, PasskeyRegistrationWriter, PasskeyWriteTables, passkeyInvalidationMutation, requiredPasskeyManagementConstraints, requiredPasskeyRegistrationWriteConstraints };
+//# sourceMappingURL=passkey-write-model.d.mts.map

package/dist/drizzle/passkey-write-model.mjs

@@ -0,0 +1,13 @@
+//#region src/drizzle/passkey-write-model.ts
+/** Same-owner updates for consumer session/pending tables. No external effects or callbacks after commit. */
+const passkeyInvalidationMutation = (input) => input;
+const requiredPasskeyManagementConstraints = { command: ["moduleId", "commandId"] };
+const requiredPasskeyRegistrationWriteConstraints = {
+	intentFlow: ["moduleId", "flowId"],
+	intentCommand: ["moduleId", "commandId"],
+	handle: ["handleKey"]
+};
+//#endregion
+export { passkeyInvalidationMutation, requiredPasskeyManagementConstraints, requiredPasskeyRegistrationWriteConstraints };
+
+//# sourceMappingURL=passkey-write-model.mjs.map

package/dist/drizzle/passkey-write-model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-write-model.mjs","names":[],"sources":["../../src/drizzle/passkey-write-model.ts"],"sourcesContent":["import type { InferInsertModel, InferSelectModel, SQL, Table } from \"drizzle-orm\";\nimport type { Effect, Schema } from \"effect\";\n\nimport type { PreparedCommit } from \"../hooks/commit\";\nimport type { PasskeyUnavailable } from \"../passkey/errors\";\nimport type {\n  PasskeyActionAuthorization,\n  PasskeyCeremony,\n  PasskeyClaim,\n  PasskeyCredential,\n  PasskeyCredentialSummary,\n  PasskeyIssueDecision,\n  PasskeyRegistrationResult,\n  PasskeyRegistrationVerified,\n  PasskeyRequirement,\n  PasskeyRevision,\n} from \"../passkey/models\";\nimport type { PasskeyManagementPersistence } from \"../passkey/PasskeyManagementPersistence\";\nimport type { PreparePasskeyCommit } from \"../passkey/PasskeyPersistence\";\nimport type { PasskeyManagementPolicy, PasskeyMethodPolicy } from \"../passkey/policy\";\nimport type { TokenDigest } from \"../Schema\";\nimport type { SessionInvalidationWindow } from \"../sessions/invalidation\";\nimport type {\n  PasskeyColumn,\n  PasskeyCredentialMapping,\n  PasskeyFlowTable,\n  PasskeyHandleReservationTable,\n  PasskeyPersistenceMapping,\n  PasskeyPersistenceServices,\n} from \"./passkey-model\";\nimport type { PasskeyRegistrationIntentReadTable } from \"./passkey-registration-ceremony-model\";\n\nexport interface PasskeyCredentialInsert<N> {\n  readonly subjectId: N;\n  readonly credential: PasskeyCredential;\n  readonly summary: PasskeyCredentialSummary;\n  readonly marker: string;\n}\n\nexport interface PasskeyWriteTables<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  N,\n> {\n  readonly credential: {\n    readonly name: PasskeyColumn<C>;\n    readonly createdAt: PasskeyColumn<C>;\n    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => InferInsertModel<C>;\n    readonly encodePrimarySignIn: (value: boolean) => unknown;\n    readonly encodeEnrollmentUserVerified: (value: boolean) => unknown;\n    readonly encodeBackupEligible: (value: boolean) => unknown;\n    readonly activeStatus: unknown;\n    readonly removedStatus: unknown;\n  };\n  readonly authority: {\n    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => InferInsertModel<F>;\n    readonly activeStatus: unknown;\n    readonly removedStatus: unknown;\n  };\n  readonly credentialOwnership: {\n    readonly encodeInsert: (input: PasskeyCredentialInsert<N>) => InferInsertModel<O>;\n    readonly ownedState: unknown;\n    readonly removedState: unknown;\n  };\n  readonly handleOwnership: {\n    readonly encodeInsert: (input: {\n      readonly subjectId: N;\n      readonly rpId: string;\n      readonly userHandle: string;\n      readonly marker: string;\n    }) => InferInsertModel<H>;\n    readonly ownedState: unknown;\n  };\n  /** All mutable policy dependencies must be subject columns or declared module guards. */\n  readonly policy: {\n    readonly subjectColumns: ReadonlyArray<PasskeyColumn<S>>;\n    readonly management: (row: Readonly<Partial<InferSelectModel<S>>>) => PasskeyManagementPolicy;\n    readonly requirement: (\n      row: Readonly<Partial<InferSelectModel<S>>>,\n      action: PasskeyActionAuthorization[\"challenge\"][\"action\"],\n    ) => typeof PasskeyRequirement.Type;\n    readonly metadata: (subjectId: N) => SQL;\n    readonly action: (subjectId: N, authorization: PasskeyActionAuthorization) => SQL;\n    /** Usable primary/recovery path AND required remaining factors. Evaluated with the target excluded, before and after removal. Connected grants/factor-only credentials are not primary paths. */\n    readonly remainingSignIn: (subjectId: N, removedCredentialId: string) => SQL;\n  };\n}\n\nexport interface PasskeyInvalidationInput<N> {\n  readonly subjectId: N;\n  readonly previousRevision: typeof PasskeyRevision.Type.securityRevision;\n  readonly securityRevision: typeof PasskeyRevision.Type.securityRevision;\n  readonly invalidation: SessionInvalidationWindow;\n}\n\nexport interface PasskeyInvalidationMutation<N> {\n  readonly table: Table;\n  readonly where: (input: PasskeyInvalidationInput<N>) => SQL;\n  readonly values: (input: PasskeyInvalidationInput<N>) => Readonly<Record<string, unknown>>;\n  readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;\n}\n\n/** Same-owner updates for consumer session/pending tables. No external effects or callbacks after commit. */\nexport const passkeyInvalidationMutation = <T extends Table, N>(input: {\n  readonly table: T;\n  readonly where: (input: PasskeyInvalidationInput<N>) => SQL;\n  readonly values: (input: PasskeyInvalidationInput<N>) => Partial<InferInsertModel<T>>;\n  readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;\n}): PasskeyInvalidationMutation<N> => input;\n\nexport interface PasskeyCommandTable<T extends Table, N> {\n  readonly table: T;\n  readonly moduleId: PasskeyColumn<T>;\n  readonly commandId: PasskeyColumn<T>;\n  readonly subjectId: PasskeyColumn<T>;\n  readonly credentialId: PasskeyColumn<T>;\n  readonly intent: PasskeyColumn<T>;\n  readonly decision: PasskeyColumn<T>;\n  readonly retentionUntil: PasskeyColumn<T>;\n  readonly version: PasskeyColumn<T>;\n  readonly encodeInsert: (input: {\n    readonly moduleId: string;\n    readonly commandId: string;\n    readonly subjectId: N;\n    readonly credentialId: string;\n  }) => InferInsertModel<T>;\n}\n\nexport interface PasskeyManagementMapping<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  M extends Table,\n  Flow extends Table,\n  A extends Table,\n  Charge extends Table,\n  Command extends Table,\n  N,\n> extends PasskeyPersistenceMapping<\n  PasskeyCredentialMapping<S, C, F, O, H, N>,\n  M,\n  Flow,\n  A,\n  Charge,\n  N\n> {\n  readonly write: PasskeyWriteTables<S, C, F, O, H, N>;\n  readonly command: PasskeyCommandTable<Command, N>;\n  readonly managementConstraints: typeof requiredPasskeyManagementConstraints;\n  /** Must match the installed session strategy. Subject revision is always changed; immediate sessions must consult that authority or be updated here. */\n  readonly invalidation: {\n    readonly window: SessionInvalidationWindow;\n    readonly mutations: ReadonlyArray<PasskeyInvalidationMutation<N>>;\n    readonly postcondition: (input: PasskeyInvalidationInput<N>) => SQL;\n  };\n}\n\nexport const requiredPasskeyManagementConstraints = { command: [\"moduleId\", \"commandId\"] } as const;\n\nexport interface PasskeyManagementServices extends PasskeyPersistenceServices {\n  readonly passkeyManagementPersistence: PasskeyManagementPersistence[\"Service\"];\n}\n\nexport interface PasskeyRegistrationWriter<R> {\n  readonly inspect: (registration: R) => Effect.Effect<\n    {\n      readonly fingerprint: TokenDigest;\n      readonly eligible: boolean;\n      readonly name: string;\n      readonly displayName: string;\n    },\n    PasskeyUnavailable\n  >;\n  readonly issueRegistration: <A>(\n    input: {\n      readonly ceremony: PasskeyCeremony;\n      readonly policy: PasskeyMethodPolicy;\n      readonly registration: R;\n    },\n    prepare: PreparePasskeyCommit<PasskeyIssueDecision, A>,\n  ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n  readonly completeRegistration: <A>(\n    input: {\n      readonly claim: PasskeyClaim;\n      readonly verified: PasskeyRegistrationVerified;\n      readonly nowMillis: number;\n    },\n    prepare: PreparePasskeyCommit<PasskeyRegistrationResult | { readonly _tag: \"Rejected\" }, A>,\n  ) => Effect.Effect<PreparedCommit<A>, PasskeyUnavailable>;\n}\n\nexport interface PasskeyRegistrationServices<R> extends PasskeyPersistenceServices {\n  readonly passkeyRegistrationAuthority: PasskeyRegistrationWriter<R>;\n}\n\nexport interface PasskeyRegistrationMapping<\n  S extends Table,\n  C extends Table,\n  F extends Table,\n  O extends Table,\n  H extends Table,\n  M extends Table,\n  Flow extends Table,\n  A extends Table,\n  Charge extends Table,\n  Intent extends Table,\n  N,\n  R,\n> extends PasskeyPersistenceMapping<\n  PasskeyCredentialMapping<S, C, F, O, H, N>,\n  M,\n  Flow,\n  A,\n  Charge,\n  N\n> {\n  readonly write: PasskeyWriteTables<S, C, F, O, H, N>;\n  readonly flow: PasskeyFlowTable<Flow>;\n  readonly handle: PasskeyHandleReservationTable<H> & {\n    readonly reservedState: unknown;\n    readonly encodeInsert: (input: {\n      readonly ceremony: PasskeyCeremony;\n      readonly reservationId: string;\n    }) => InferInsertModel<H>;\n  };\n  readonly intent: PasskeyRegistrationIntentReadTable<Intent> & {\n    readonly pendingState: unknown;\n    readonly acceptedState: unknown;\n    readonly rejectedState: unknown;\n    readonly encodeInsert: (input: {\n      readonly ceremony: PasskeyCeremony;\n      readonly registration: R;\n      readonly reservationId: string;\n    }) => InferInsertModel<Intent>;\n  };\n  /** Consumer-owned data and identity, synchronously encoded inside the owner. A SQL-local registration creates no session and needs no email address. */\n  readonly registration: {\n    readonly schema: Schema.Codec<R, unknown, never, never>;\n    readonly describe: (registration: R) => { readonly name: string; readonly displayName: string };\n    readonly eligible: (registration: R) => SQL;\n    /** Commit-time application policy after provisioning. Unlike `eligible`, this\n     * must permit the newly created subject and retain every mutable prerequisite.\n     * Declare mutable external policy rows in module.guards so native locking\n     * owners serialize revocation through commit; this predicate alone is not a lock. */\n    readonly finalEligibility: (input: { readonly registration: R; readonly subjectId: N }) => SQL;\n    readonly subject: (input: {\n      readonly registration: R;\n      readonly ceremony: PasskeyCeremony;\n      readonly marker: string;\n    }) => { readonly subjectId: N; readonly values: InferInsertModel<S> };\n    readonly activeStatus: unknown;\n  };\n  readonly registrationConstraints: typeof requiredPasskeyRegistrationWriteConstraints;\n}\n\nexport const requiredPasskeyRegistrationWriteConstraints = {\n  intentFlow: [\"moduleId\", \"flowId\"],\n  intentCommand: [\"moduleId\", \"commandId\"],\n  handle: [\"handleKey\"],\n} as const;\n"],"mappings":";;AA0GA,MAAa,+BAAmD,UAK1B;AAmDtC,MAAa,uCAAuC,EAAE,SAAS,CAAC,YAAY,WAAW,EAAE;AAkGzF,MAAa,8CAA8C;CACzD,YAAY,CAAC,YAAY,QAAQ;CACjC,eAAe,CAAC,YAAY,WAAW;CACvC,QAAQ,CAAC,WAAW;AACtB"}