@yielded/auth 0.1.0-beta.1

package/dist/drizzle/passkey-write-state.mjs

@@ -0,0 +1,326 @@
+import { TokenDigest } from "../Schema.mjs";
+import { SessionInvalidationWindow } from "../sessions/invalidation.mjs";
+import { both } from "./transaction-owner.mjs";
+import { PasskeyBegin, PasskeyCredential, PasskeyCredentialSummary, PasskeyDescriptor, PasskeyLabel, PasskeyModuleId, PasskeyProfile, PasskeyRequirement, PasskeyRevision, PasskeyUserHandle } from "../passkey/models.mjs";
+import { snapshotPasskeySync } from "../passkey/snapshot.mjs";
+import { PasskeyManagementPolicy } from "../passkey/policy.mjs";
+import { CurrentPasskeyTransaction, col, copiedRow, credentialKey, equal, handleKey, invariant, mappedColumns, sameCredential, sameRevision, subjectScope } from "./passkey-state.mjs";
+import { DateTime, Effect, Encoding, Schema } from "effect";
+import { sql } from "drizzle-orm";
+import { sha256 } from "@noble/hashes/sha2.js";
+//#region src/drizzle/passkey-write-state.ts
+const jsonStorage = (schema) => {
+	const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));
+	return {
+		encode: (value) => Schema.encodeSync(codec)(snapshotPasskeySync(schema, value)),
+		decode: (text) => {
+			return Schema.decodeUnknownSync(codec)(text);
+		}
+	};
+};
+const digest = (schema, value) => TokenDigest.make(Encoding.encodeBase64Url(sha256(new TextEncoder().encode(jsonStorage(schema).encode(value)))));
+const currentSubject = Effect.fn("passkey.currentWriteSubject")(function* (mapping, subjectId) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const read = mapping.read;
+	const table = read.subject;
+	const nativeId = read.subjectIds.toNative(subjectId);
+	invariant(read.subjectIds.toSubject(nativeId) === subjectId);
+	const row = (yield* owner.read(table.table, equal(table.table, { [table.id]: nativeId }), {
+		limit: 1,
+		columns: [.../* @__PURE__ */ new Set([
+			table.id,
+			table.status,
+			table.securityRevision,
+			...mapping.write.policy.subjectColumns
+		])]
+	})).rows[0];
+	if (row === void 0 || !table.isActiveStatus(row[table.status])) return void 0;
+	invariant(read.subjectIds.equals(table.decodeId(copiedRow(row)), nativeId));
+	const active = sql`exists(select 1 from ${table.table} where ${both(equal(table.table, { [table.id]: nativeId }), table.activeCondition)})`;
+	if (!(yield* owner.check(active))) return void 0;
+	owner.postconditions.push(active);
+	const factor = read.authority;
+	const factors = (yield* owner.read(factor.table, both(equal(factor.table, { [factor.subjectId]: nativeId }), factor.activeCondition), {
+		limit: 64,
+		columns: mappedColumns(factor),
+		orderBy: col(factor.table, factor.credentialId)
+	})).rows;
+	const revision = snapshotPasskeySync(PasskeyRevision, {
+		subjectId,
+		securityRevision: row[table.securityRevision],
+		credentials: factors.map((value) => ({
+			credentialId: value[factor.credentialId],
+			revision: value[factor.revision]
+		}))
+	});
+	invariant(new Set(revision.credentials.map((item) => item.credentialId)).size === revision.credentials.length);
+	return {
+		subjectId,
+		nativeId,
+		row,
+		revision
+	};
+});
+const credentialRows = Effect.fn("passkey.writeCredentialRows")(function* (mapping, subject, rpId) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const table = mapping.read.credential;
+	return (yield* owner.read(table.table, both(equal(table.table, { [table.subjectId]: subject.nativeId }), table.activeCondition, rpId === void 0 ? void 0 : equal(table.table, { [table.rpId]: rpId })), {
+		limit: 64,
+		orderBy: col(table.table, table.credentialId)
+	})).rows;
+});
+const summary = (mapping, row) => {
+	const table = mapping.read.credential;
+	const write = mapping.write.credential;
+	const decoded = table.decode(copiedRow(row));
+	return snapshotPasskeySync(PasskeyCredentialSummary, {
+		credentialId: decoded.credentialId,
+		name: row[write.name],
+		primarySignIn: decoded.primarySignIn,
+		createdAtMillis: mapping.clock.decodeInstant(row[write.createdAt]),
+		...row[mapping.telemetry.lastUsedAt] === null || row[mapping.telemetry.lastUsedAt] === void 0 ? {} : { lastUsedAtMillis: mapping.clock.decodeInstant(row[mapping.telemetry.lastUsedAt]) }
+	});
+};
+const ownedCredential = Effect.fn("passkey.ownedWriteCredential")(function* (mapping, subject, row) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const read = mapping.read;
+	const table = read.credential;
+	const decoded = snapshotPasskeySync(PasskeyCredential, {
+		...table.decode(copiedRow(row)),
+		revision: subject.revision,
+		active: true
+	});
+	invariant(decoded.credentialId === row[table.credentialId] && decoded.profile.rpId === decoded.rpId && read.subjectIds.equals(table.decodeSubjectId(copiedRow(row)), subject.nativeId));
+	const ownership = read.credentialOwnership;
+	const key = credentialKey(decoded.rpId, decoded.protocolCredentialId);
+	const tuple = (yield* owner.read(ownership.table, equal(ownership.table, { [ownership.credentialKey]: key }), {
+		limit: 1,
+		columns: mappedColumns(ownership)
+	})).rows[0];
+	if (tuple === void 0 || !ownership.isOwnedState(tuple[ownership.state]) || !read.subjectIds.equals(ownership.decodeSubjectId(copiedRow(tuple)), subject.nativeId)) return void 0;
+	invariant(tuple[ownership.rpId] === decoded.rpId && tuple[ownership.protocolCredentialId] === decoded.protocolCredentialId && tuple[ownership.credentialId] === decoded.credentialId && row[table.credentialKey] === key);
+	const handle = read.handleOwnership;
+	const hashedHandle = handleKey(decoded.rpId, decoded.userHandle);
+	const held = (yield* owner.read(handle.table, equal(handle.table, { [handle.handleKey]: hashedHandle }), {
+		limit: 1,
+		columns: mappedColumns(handle)
+	})).rows[0];
+	if (held === void 0 || !handle.isOwnedState(held[handle.state]) || !read.subjectIds.equals(handle.decodeSubjectId(copiedRow(held)), subject.nativeId)) return void 0;
+	invariant(held[handle.rpId] === decoded.rpId && held[handle.userHandle] === decoded.userHandle && row[table.handleKey] === hashedHandle);
+	invariant(subject.revision.credentials.some((item) => item.credentialId === decoded.credentialId && item.revision === row[table.credentialRevision]));
+	return decoded;
+});
+const managementPolicy = (mapping, subject) => snapshotPasskeySync(PasskeyManagementPolicy, mapping.write.policy.management(copiedRow(subject.row)));
+const metadataAllowed = Effect.fn("passkey.metadataAllowed")(function* (mapping, subject) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const condition = mapping.write.policy.metadata(subject.nativeId);
+	const allowed = yield* owner.check(condition);
+	if (allowed) owner.postconditions.push(condition);
+	return allowed;
+});
+const enrollmentDigest = (ceremony) => {
+	invariant(ceremony.context._tag === "Enrollment");
+	const context = ceremony.context;
+	return digest(Schema.Tuple([
+		PasskeyModuleId,
+		Schema.Literal("enrollment"),
+		Schema.Struct({
+			...PasskeyBegin.fields,
+			name: PasskeyLabel
+		}),
+		PasskeyProfile,
+		PasskeyRevision,
+		PasskeyUserHandle,
+		Schema.Array(PasskeyDescriptor)
+	]), [
+		ceremony.moduleId,
+		"enrollment",
+		{
+			flowId: ceremony.flowId,
+			commandId: ceremony.commandId,
+			profileId: ceremony.profile.profileId,
+			name: context.name
+		},
+		ceremony.profile,
+		context.revision,
+		context.userHandle,
+		ceremony.allowedCredentials
+	]);
+};
+const removeDigest = (moduleId, commandId, credential) => digest(Schema.Tuple([
+	PasskeyModuleId,
+	Schema.Literal("remove"),
+	PasskeyBegin.fields.commandId,
+	PasskeyCredential
+]), [
+	PasskeyModuleId.make(moduleId),
+	"remove",
+	PasskeyBegin.fields.commandId.make(commandId),
+	credential
+]);
+const authorizeAction = Effect.fn("passkey.authorizeWriteAction")(function* (mapping, subject, authorization, expected, policy, original) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const { challenge, evidence } = authorization;
+	if (challenge.moduleId !== mapping.moduleId || challenge.action !== expected.action || challenge.commandId !== expected.commandId || challenge.flowId !== expected.flowId || challenge.bindingDigest !== expected.bindingDigest || evidence.flowId !== expected.flowId || evidence.bindingDigest !== expected.bindingDigest || !sameRevision(challenge.revision, expected.revision) || subject.revision.subjectId !== expected.revision.subjectId || subject.revision.securityRevision !== expected.revision.securityRevision || evidence.revision.subjectId !== subject.subjectId || evidence.revision.securityRevision !== subject.revision.securityRevision) return false;
+	for (const revision of [expected.revision, evidence.revision]) if (revision.credentials.some((item) => !subject.revision.credentials.some((current) => current.credentialId === item.credentialId && current.revision === item.revision))) return false;
+	const now = yield* owner.now(mapping.clock);
+	if (evidence.proofs.some((proof) => DateTime.toEpochMillis(proof.verifiedAt) > now || !evidence.revision.credentials.some((item) => item.credentialId === proof.credentialId))) return false;
+	const current = snapshotPasskeySync(PasskeyRequirement, mapping.write.policy.requirement(copiedRow(subject.row), expected.action));
+	for (const requirement of [
+		authorization.requirement,
+		current,
+		...original === void 0 ? [] : [original]
+	]) {
+		const age = Math.min(policy.maximumEvidenceAgeMillis, requirement.maximumAgeMillis);
+		const fresh = evidence.proofs.filter((proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age);
+		const factors = new Set(fresh.flatMap((proof) => proof.factors));
+		if (!requirement.alternatives.some((alternative) => alternative.factors.every((factor) => factors.has(factor)) && new Set(fresh.map((proof) => proof.credentialId)).size >= alternative.minimumCredentials && fresh.some((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)))) return false;
+		owner.postconditions.push(both(sql`${mapping.clock.engineNowMillis} >= ${now}`, ...fresh.map((proof) => sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`)));
+	}
+	const condition = mapping.write.policy.action(subject.nativeId, authorization);
+	if (!(yield* owner.check(condition))) return false;
+	owner.postconditions.push(condition);
+	return true;
+});
+const invalidationMatches = (mapping, supplied, policy) => jsonStorage(SessionInvalidationWindow).encode(supplied) === jsonStorage(SessionInvalidationWindow).encode(mapping.invalidation.window) && (!policy.requireImmediateInvalidation || supplied.existingSessions === "immediate");
+const invalidate = Effect.fn("passkey.invalidateCredentialChange")(function* (mapping, subject, invalidation) {
+	const owner = yield* CurrentPasskeyTransaction;
+	const table = mapping.read.subject;
+	const revision = PasskeyRevision.fields.securityRevision.make(owner.marker);
+	yield* owner.update(table.table, { [table.id]: subject.nativeId }, { [table.securityRevision]: revision });
+	const input = {
+		subjectId: subject.nativeId,
+		previousRevision: subject.revision.securityRevision,
+		securityRevision: revision,
+		invalidation
+	};
+	for (const mutation of mapping.invalidation.mutations) {
+		yield* owner.write(owner.database.update(mutation.table).set(mutation.values(input)).where(mutation.where(input)));
+		owner.postconditions.push(mutation.postcondition(input));
+	}
+	owner.postconditions.push(mapping.invalidation.postcondition(input));
+	const flow = mapping.flow;
+	const where = both(equal(flow.table, { [flow.subjectScope]: subjectScope(subject.subjectId) }), sql`${col(flow.table, flow.state)} in (${flow.states.Pending}, ${flow.states.Claimed})`);
+	yield* owner.write(owner.database.update(flow.table).set({
+		[flow.state]: flow.states.Rejected,
+		[flow.version]: owner.marker
+	}).where(where));
+	for (const observation of owner.observations) if (observation.table === flow.table) observation.rows = observation.rows.map((row) => row[flow.subjectScope] === subjectScope(subject.subjectId) && [flow.states.Pending, flow.states.Claimed].includes(row[flow.state]) ? {
+		...row,
+		[flow.state]: flow.states.Rejected,
+		[flow.version]: owner.marker
+	} : row);
+	owner.postconditions.push(sql`not exists(select 1 from ${flow.table} where ${where})`);
+	return revision;
+});
+const validRegistration = (ceremony, verified) => ceremony.profile.algorithms.some((algorithm) => algorithm === verified.algorithm) && (ceremony.profile.userVerification !== "required" || verified.userVerified) && (!verified.backupState || verified.backupEligible) && !ceremony.allowedCredentials.some((item) => item.id === verified.protocolCredentialId);
+const insertCredential = Effect.fn("passkey.insertCredential")(function* (mapping, subject, ceremony, verified, now) {
+	const owner = yield* CurrentPasskeyTransaction;
+	invariant(ceremony.context._tag === "Enrollment" || ceremony.context._tag === "Registration");
+	const read = mapping.read;
+	const write = mapping.write;
+	const id = PasskeyCredential.fields.credentialId.make(owner.marker);
+	const credential = snapshotPasskeySync(PasskeyCredential, {
+		credentialId: id,
+		rpId: ceremony.profile.rpId,
+		protocolCredentialId: verified.protocolCredentialId,
+		userHandle: ceremony.context.userHandle,
+		publicKey: verified.publicKey,
+		algorithm: verified.algorithm,
+		profile: ceremony.profile,
+		revision: {
+			...subject.revision,
+			credentials: [...subject.revision.credentials, {
+				credentialId: id,
+				revision: PasskeyRevision.fields.securityRevision.make(owner.marker)
+			}]
+		},
+		active: true,
+		primarySignIn: ceremony.profile.primarySignIn && verified.userVerified,
+		enrollmentUserVerified: verified.userVerified,
+		backupEligible: verified.backupEligible,
+		backupState: verified.backupState,
+		counter: verified.counter,
+		maximumCounter: verified.counter
+	});
+	const safe = snapshotPasskeySync(PasskeyCredentialSummary, {
+		credentialId: id,
+		name: ceremony.context.name,
+		primarySignIn: credential.primarySignIn,
+		createdAtMillis: now
+	});
+	const input = {
+		subjectId: subject.nativeId,
+		credential,
+		summary: safe,
+		marker: owner.marker
+	};
+	const tupleKey = credentialKey(credential.rpId, credential.protocolCredentialId);
+	const hashedHandle = handleKey(credential.rpId, credential.userHandle);
+	const tuple = read.credentialOwnership;
+	const absent = yield* owner.read(tuple.table, equal(tuple.table, { [tuple.credentialKey]: tupleKey }), { limit: 1 });
+	invariant(absent.rows.length === 0);
+	const inserted = yield* owner.insert(tuple.table, {
+		...write.credentialOwnership.encodeInsert(input),
+		[tuple.credentialKey]: tupleKey,
+		[tuple.rpId]: credential.rpId,
+		[tuple.protocolCredentialId]: credential.protocolCredentialId,
+		[tuple.subjectId]: subject.nativeId,
+		[tuple.credentialId]: id,
+		[tuple.state]: write.credentialOwnership.ownedState,
+		[tuple.version]: owner.marker,
+		[tuple.reservationId]: null
+	}, { [tuple.credentialKey]: tupleKey });
+	absent.rows = inserted.rows;
+	const table = read.credential;
+	const values = {
+		...write.credential.encodeInsert(input),
+		[table.credentialId]: id,
+		[table.subjectId]: subject.nativeId,
+		[table.rpId]: credential.rpId,
+		[table.protocolCredentialId]: credential.protocolCredentialId,
+		[table.credentialKey]: tupleKey,
+		[table.handleKey]: hashedHandle,
+		[table.userHandle]: credential.userHandle,
+		[table.algorithm]: credential.algorithm,
+		[table.credentialRevision]: owner.marker,
+		[table.status]: write.credential.activeStatus,
+		[table.primarySignIn]: write.credential.encodePrimarySignIn(credential.primarySignIn),
+		[table.enrollmentUserVerified]: write.credential.encodeEnrollmentUserVerified(credential.enrollmentUserVerified),
+		[table.backupEligible]: write.credential.encodeBackupEligible(credential.backupEligible),
+		[table.backupState]: mapping.telemetry.encodeBackupState(credential.backupState),
+		[table.counter]: credential.counter,
+		[table.maximumCounter]: credential.maximumCounter,
+		[write.credential.name]: safe.name,
+		[write.credential.createdAt]: mapping.clock.encodeInstant(now),
+		[mapping.telemetry.lastUsedAt]: null
+	};
+	yield* owner.insert(table.table, values, { [table.credentialId]: id });
+	for (const observation of owner.observations) if (observation.table === table.table && observation.rows !== inserted.rows && !observation.rows.some((row) => row[table.credentialId] === id)) observation.rows = [...observation.rows, values];
+	const factor = read.authority;
+	const factorValues = {
+		...write.authority.encodeInsert(input),
+		[factor.subjectId]: subject.nativeId,
+		[factor.credentialId]: id,
+		[factor.revision]: owner.marker,
+		[factor.status]: write.authority.activeStatus
+	};
+	yield* owner.insert(factor.table, factorValues, {
+		[factor.subjectId]: subject.nativeId,
+		[factor.credentialId]: id
+	});
+	for (const observation of owner.observations) if (observation.table === factor.table && !observation.rows.some((row) => row[factor.credentialId] === id)) observation.rows = [...observation.rows, factorValues];
+	const decoded = snapshotPasskeySync(PasskeyCredential, {
+		...table.decode(copiedRow(values)),
+		revision: credential.revision,
+		active: true
+	});
+	invariant(sameCredential(decoded, credential) && decoded.counter === credential.counter && decoded.maximumCounter === credential.maximumCounter && decoded.backupState === credential.backupState);
+	invariant(summary(mapping, values).credentialId === id);
+	owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now}`);
+	return safe;
+});
+//#endregion
+export { authorizeAction, credentialRows, currentSubject, digest, enrollmentDigest, insertCredential, invalidate, invalidationMatches, jsonStorage, managementPolicy, metadataAllowed, ownedCredential, removeDigest, summary, validRegistration };
+
+//# sourceMappingURL=passkey-write-state.mjs.map

package/dist/drizzle/passkey-write-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-write-state.mjs","names":[],"sources":["../../src/drizzle/passkey-write-state.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- private mapped-row kernel; public descriptors preserve concrete tables and native identities. */\n// oxlint-disable-next-line import/extensions -- Noble exposes explicit .js subpaths.\nimport { sha256 } from \"@noble/hashes/sha2.js\";\nimport { sql } from \"drizzle-orm\";\nimport { DateTime, Effect, Encoding, Schema } from \"effect\";\n\nimport type { PasskeyActionAuthorization, PasskeyCeremony } from \"../passkey/models\";\nimport {\n  PasskeyBegin,\n  PasskeyCredential,\n  PasskeyCredentialSummary,\n  PasskeyDescriptor,\n  PasskeyLabel,\n  PasskeyModuleId,\n  PasskeyProfile,\n  PasskeyRequirement,\n  PasskeyRevision,\n  PasskeyUserHandle,\n} from \"../passkey/models\";\nimport { PasskeyManagementPolicy } from \"../passkey/policy\";\nimport { snapshotPasskeySync } from \"../passkey/snapshot\";\nimport { TokenDigest, type SubjectId } from \"../Schema\";\nimport { SessionInvalidationWindow } from \"../sessions/invalidation\";\nimport {\n  col,\n  copiedRow,\n  credentialKey,\n  equal,\n  handleKey,\n  invariant,\n  mappedColumns,\n  sameCredential,\n  sameRevision,\n  subjectScope,\n  CurrentPasskeyTransaction,\n} from \"./passkey-state\";\nimport { both } from \"./transaction-owner\";\n\nexport const jsonStorage = <S extends Schema.Codec<unknown, unknown, never, never>>(schema: S) => {\n  const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n\n  return {\n    encode: (value: S[\"Type\"]) => Schema.encodeSync(codec)(snapshotPasskeySync(schema, value)),\n    decode: (text: unknown): S[\"Type\"] => {\n      // oxlint-disable-next-line no-restricted-properties -- persisted private JSON enters through its schema.\n      return Schema.decodeUnknownSync(codec)(text);\n    },\n  };\n};\n\nexport const digest = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  value: S[\"Type\"],\n) =>\n  TokenDigest.make(\n    Encoding.encodeBase64Url(sha256(new TextEncoder().encode(jsonStorage(schema).encode(value)))),\n  );\n\nexport interface WriteSubject {\n  readonly subjectId: SubjectId;\n  readonly nativeId: any;\n  readonly row: Record<string, any>;\n  readonly revision: typeof PasskeyRevision.Type;\n}\n\nexport const currentSubject = Effect.fn(\"passkey.currentWriteSubject\")(function* (\n  mapping: any,\n  subjectId: SubjectId,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const read = mapping.read;\n  const table = read.subject;\n  const nativeId = read.subjectIds.toNative(subjectId);\n\n  invariant(read.subjectIds.toSubject(nativeId) === subjectId);\n\n  const row = (yield* owner.read(table.table, equal(table.table, { [table.id]: nativeId }), {\n    limit: 1,\n    columns: [\n      ...new Set<string>([\n        table.id,\n        table.status,\n        table.securityRevision,\n        ...mapping.write.policy.subjectColumns,\n      ]),\n    ],\n  })).rows[0];\n\n  if (row === undefined || !table.isActiveStatus(row[table.status])) return undefined;\n  invariant(read.subjectIds.equals(table.decodeId(copiedRow(row)), nativeId));\n  const active = sql`exists(select 1 from ${table.table} where ${both(equal(table.table, { [table.id]: nativeId }), table.activeCondition)})`;\n\n  if (!(yield* owner.check(active))) return undefined;\n  owner.postconditions.push(active);\n  const factor = read.authority;\n\n  const factors = (yield* owner.read(\n    factor.table,\n    both(equal(factor.table, { [factor.subjectId]: nativeId }), factor.activeCondition),\n    { limit: 64, columns: mappedColumns(factor), orderBy: col(factor.table, factor.credentialId) },\n  )).rows;\n\n  const revision = snapshotPasskeySync(PasskeyRevision, {\n    subjectId,\n    securityRevision: row[table.securityRevision],\n    credentials: factors.map((value) => ({\n      credentialId: value[factor.credentialId],\n      revision: value[factor.revision],\n    })),\n  });\n\n  invariant(\n    new Set(revision.credentials.map((item) => item.credentialId)).size ===\n      revision.credentials.length,\n  );\n\n  return { subjectId, nativeId, row, revision };\n});\n\nexport const credentialRows = Effect.fn(\"passkey.writeCredentialRows\")(function* (\n  mapping: any,\n  subject: WriteSubject,\n  rpId?: string,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const table = mapping.read.credential;\n\n  return (yield* owner.read(\n    table.table,\n    both(\n      equal(table.table, { [table.subjectId]: subject.nativeId }),\n      table.activeCondition,\n      rpId === undefined ? undefined : equal(table.table, { [table.rpId]: rpId }),\n    ),\n    { limit: 64, orderBy: col(table.table, table.credentialId) },\n  )).rows;\n});\n\nexport const summary = (mapping: any, row: any) => {\n  const table = mapping.read.credential;\n  const write = mapping.write.credential;\n  const decoded = table.decode(copiedRow(row));\n\n  return snapshotPasskeySync(PasskeyCredentialSummary, {\n    credentialId: decoded.credentialId,\n    name: row[write.name],\n    primarySignIn: decoded.primarySignIn,\n    createdAtMillis: mapping.clock.decodeInstant(row[write.createdAt]),\n    ...(row[mapping.telemetry.lastUsedAt] === null ||\n    row[mapping.telemetry.lastUsedAt] === undefined\n      ? {}\n      : { lastUsedAtMillis: mapping.clock.decodeInstant(row[mapping.telemetry.lastUsedAt]) }),\n  });\n};\n\nexport const ownedCredential = Effect.fn(\"passkey.ownedWriteCredential\")(function* (\n  mapping: any,\n  subject: WriteSubject,\n  row: any,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const read = mapping.read;\n  const table = read.credential;\n\n  const decoded = snapshotPasskeySync(PasskeyCredential, {\n    ...table.decode(copiedRow(row)),\n    revision: subject.revision,\n    active: true,\n  });\n\n  invariant(\n    decoded.credentialId === row[table.credentialId] &&\n      decoded.profile.rpId === decoded.rpId &&\n      read.subjectIds.equals(table.decodeSubjectId(copiedRow(row)), subject.nativeId),\n  );\n  const ownership = read.credentialOwnership;\n  const key = credentialKey(decoded.rpId, decoded.protocolCredentialId);\n\n  const tuple = (yield* owner.read(\n    ownership.table,\n    equal(ownership.table, { [ownership.credentialKey]: key }),\n    { limit: 1, columns: mappedColumns(ownership) },\n  )).rows[0];\n\n  if (\n    tuple === undefined ||\n    !ownership.isOwnedState(tuple[ownership.state]) ||\n    !read.subjectIds.equals(ownership.decodeSubjectId(copiedRow(tuple)), subject.nativeId)\n  )\n    return undefined;\n  invariant(\n    tuple[ownership.rpId] === decoded.rpId &&\n      tuple[ownership.protocolCredentialId] === decoded.protocolCredentialId &&\n      tuple[ownership.credentialId] === decoded.credentialId &&\n      row[table.credentialKey] === key,\n  );\n  const handle = read.handleOwnership;\n  const hashedHandle = handleKey(decoded.rpId, decoded.userHandle);\n\n  const held = (yield* owner.read(\n    handle.table,\n    equal(handle.table, { [handle.handleKey]: hashedHandle }),\n    { limit: 1, columns: mappedColumns(handle) },\n  )).rows[0];\n\n  if (\n    held === undefined ||\n    !handle.isOwnedState(held[handle.state]) ||\n    !read.subjectIds.equals(handle.decodeSubjectId(copiedRow(held)), subject.nativeId)\n  )\n    return undefined;\n  invariant(\n    held[handle.rpId] === decoded.rpId &&\n      held[handle.userHandle] === decoded.userHandle &&\n      row[table.handleKey] === hashedHandle,\n  );\n  invariant(\n    subject.revision.credentials.some(\n      (item) =>\n        item.credentialId === decoded.credentialId &&\n        item.revision === row[table.credentialRevision],\n    ),\n  );\n\n  return decoded;\n});\n\nexport const managementPolicy = (mapping: any, subject: WriteSubject) =>\n  snapshotPasskeySync(\n    PasskeyManagementPolicy,\n    mapping.write.policy.management(copiedRow(subject.row)),\n  );\n\nexport const metadataAllowed = Effect.fn(\"passkey.metadataAllowed\")(function* (\n  mapping: any,\n  subject: WriteSubject,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const condition = mapping.write.policy.metadata(subject.nativeId);\n  const allowed = yield* owner.check(condition);\n\n  if (allowed) owner.postconditions.push(condition);\n\n  return allowed;\n});\n\nexport const enrollmentDigest = (ceremony: PasskeyCeremony) => {\n  invariant(ceremony.context._tag === \"Enrollment\");\n  const context = ceremony.context;\n\n  return digest(\n    Schema.Tuple([\n      PasskeyModuleId,\n      Schema.Literal(\"enrollment\"),\n      Schema.Struct({ ...PasskeyBegin.fields, name: PasskeyLabel }),\n      PasskeyProfile,\n      PasskeyRevision,\n      PasskeyUserHandle,\n      Schema.Array(PasskeyDescriptor),\n    ]),\n    [\n      ceremony.moduleId,\n      \"enrollment\",\n      {\n        flowId: ceremony.flowId,\n        commandId: ceremony.commandId,\n        profileId: ceremony.profile.profileId,\n        name: context.name,\n      },\n      ceremony.profile,\n      context.revision,\n      context.userHandle,\n      ceremony.allowedCredentials,\n    ],\n  );\n};\n\nexport const removeDigest = (moduleId: string, commandId: string, credential: PasskeyCredential) =>\n  digest(\n    Schema.Tuple([\n      PasskeyModuleId,\n      Schema.Literal(\"remove\"),\n      PasskeyBegin.fields.commandId,\n      PasskeyCredential,\n    ]),\n    [\n      PasskeyModuleId.make(moduleId),\n      \"remove\",\n      PasskeyBegin.fields.commandId.make(commandId),\n      credential,\n    ],\n  );\n\nexport const authorizeAction = Effect.fn(\"passkey.authorizeWriteAction\")(function* (\n  mapping: any,\n  subject: WriteSubject,\n  authorization: PasskeyActionAuthorization,\n  expected: {\n    readonly action: PasskeyActionAuthorization[\"challenge\"][\"action\"];\n    readonly commandId: string;\n    readonly flowId: string;\n    readonly bindingDigest: string;\n    readonly revision: typeof PasskeyRevision.Type;\n  },\n  policy: PasskeyManagementPolicy,\n  original?: typeof PasskeyRequirement.Type,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const { challenge, evidence } = authorization;\n\n  if (\n    challenge.moduleId !== mapping.moduleId ||\n    challenge.action !== expected.action ||\n    challenge.commandId !== expected.commandId ||\n    challenge.flowId !== expected.flowId ||\n    challenge.bindingDigest !== expected.bindingDigest ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== expected.bindingDigest ||\n    !sameRevision(challenge.revision, expected.revision) ||\n    subject.revision.subjectId !== expected.revision.subjectId ||\n    subject.revision.securityRevision !== expected.revision.securityRevision ||\n    evidence.revision.subjectId !== subject.subjectId ||\n    evidence.revision.securityRevision !== subject.revision.securityRevision\n  )\n    return false;\n  for (const revision of [expected.revision, evidence.revision])\n    if (\n      revision.credentials.some(\n        (item) =>\n          !subject.revision.credentials.some(\n            (current) =>\n              current.credentialId === item.credentialId && current.revision === item.revision,\n          ),\n      )\n    )\n      return false;\n  const now = yield* owner.now(mapping.clock);\n\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        DateTime.toEpochMillis(proof.verifiedAt) > now ||\n        !evidence.revision.credentials.some((item) => item.credentialId === proof.credentialId),\n    )\n  )\n    return false;\n\n  const current = snapshotPasskeySync(\n    PasskeyRequirement,\n    mapping.write.policy.requirement(copiedRow(subject.row), expected.action),\n  );\n\n  for (const requirement of [\n    authorization.requirement,\n    current,\n    ...(original === undefined ? [] : [original]),\n  ]) {\n    const age = Math.min(policy.maximumEvidenceAgeMillis, requirement.maximumAgeMillis);\n\n    const fresh = evidence.proofs.filter(\n      (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n    );\n\n    const factors = new Set(fresh.flatMap((proof) => proof.factors));\n\n    if (\n      !requirement.alternatives.some(\n        (alternative) =>\n          alternative.factors.every((factor) => factors.has(factor)) &&\n          new Set(fresh.map((proof) => proof.credentialId)).size >=\n            alternative.minimumCredentials &&\n          fresh.some(\n            (proof) =>\n              (!alternative.userVerified || proof.userVerified) &&\n              (!alternative.phishingResistant || proof.phishingResistant),\n          ),\n      )\n    )\n      return false;\n    owner.postconditions.push(\n      both(\n        sql`${mapping.clock.engineNowMillis} >= ${now}`,\n        ...fresh.map(\n          (proof) =>\n            sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`,\n        ),\n      ),\n    );\n  }\n  const condition = mapping.write.policy.action(subject.nativeId, authorization);\n\n  if (!(yield* owner.check(condition))) return false;\n  owner.postconditions.push(condition);\n\n  return true;\n});\n\nexport const invalidationMatches = (\n  mapping: any,\n  supplied: SessionInvalidationWindow,\n  policy: PasskeyManagementPolicy,\n) =>\n  jsonStorage(SessionInvalidationWindow).encode(supplied) ===\n    jsonStorage(SessionInvalidationWindow).encode(mapping.invalidation.window) &&\n  (!policy.requireImmediateInvalidation || supplied.existingSessions === \"immediate\");\n\nexport const invalidate = Effect.fn(\"passkey.invalidateCredentialChange\")(function* (\n  mapping: any,\n  subject: WriteSubject,\n  invalidation: SessionInvalidationWindow,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n  const table = mapping.read.subject;\n  const revision = PasskeyRevision.fields.securityRevision.make(owner.marker);\n\n  yield* owner.update(\n    table.table,\n    { [table.id]: subject.nativeId },\n    { [table.securityRevision]: revision },\n  );\n\n  const input = {\n    subjectId: subject.nativeId,\n    previousRevision: subject.revision.securityRevision,\n    securityRevision: revision,\n    invalidation,\n  };\n\n  for (const mutation of mapping.invalidation.mutations) {\n    yield* owner.write(\n      owner.database\n        .update(mutation.table)\n        .set(mutation.values(input))\n        .where(mutation.where(input)),\n    );\n    owner.postconditions.push(mutation.postcondition(input));\n  }\n  owner.postconditions.push(mapping.invalidation.postcondition(input));\n  const flow = mapping.flow;\n\n  const where = both(\n    equal(flow.table, { [flow.subjectScope]: subjectScope(subject.subjectId) }),\n    sql`${col(flow.table, flow.state)} in (${flow.states.Pending}, ${flow.states.Claimed})`,\n  );\n\n  yield* owner.write(\n    owner.database\n      .update(flow.table)\n      .set({ [flow.state]: flow.states.Rejected, [flow.version]: owner.marker })\n      .where(where),\n  );\n  for (const observation of owner.observations)\n    if (observation.table === flow.table)\n      observation.rows = observation.rows.map((row) =>\n        row[flow.subjectScope] === subjectScope(subject.subjectId) &&\n        [flow.states.Pending, flow.states.Claimed].includes(row[flow.state])\n          ? { ...row, [flow.state]: flow.states.Rejected, [flow.version]: owner.marker }\n          : row,\n      );\n  owner.postconditions.push(sql`not exists(select 1 from ${flow.table} where ${where})`);\n\n  return revision;\n});\n\nexport const validRegistration = (\n  ceremony: PasskeyCeremony,\n  verified: {\n    readonly algorithm: number;\n    readonly userVerified: boolean;\n    readonly backupEligible: boolean;\n    readonly backupState: boolean;\n    readonly protocolCredentialId: string;\n  },\n) =>\n  ceremony.profile.algorithms.some((algorithm) => algorithm === verified.algorithm) &&\n  (ceremony.profile.userVerification !== \"required\" || verified.userVerified) &&\n  (!verified.backupState || verified.backupEligible) &&\n  !ceremony.allowedCredentials.some((item) => item.id === verified.protocolCredentialId);\n\nexport const insertCredential = Effect.fn(\"passkey.insertCredential\")(function* (\n  mapping: any,\n  subject: WriteSubject,\n  ceremony: PasskeyCeremony,\n  verified: any,\n  now: number,\n) {\n  const owner = yield* CurrentPasskeyTransaction;\n\n  invariant(ceremony.context._tag === \"Enrollment\" || ceremony.context._tag === \"Registration\");\n  const read = mapping.read;\n  const write = mapping.write;\n  const id = PasskeyCredential.fields.credentialId.make(owner.marker);\n\n  const credential = snapshotPasskeySync(PasskeyCredential, {\n    credentialId: id,\n    rpId: ceremony.profile.rpId,\n    protocolCredentialId: verified.protocolCredentialId,\n    userHandle: ceremony.context.userHandle,\n    publicKey: verified.publicKey,\n    algorithm: verified.algorithm,\n    profile: ceremony.profile,\n    revision: {\n      ...subject.revision,\n      credentials: [\n        ...subject.revision.credentials,\n        { credentialId: id, revision: PasskeyRevision.fields.securityRevision.make(owner.marker) },\n      ],\n    },\n    active: true,\n    primarySignIn: ceremony.profile.primarySignIn && verified.userVerified,\n    enrollmentUserVerified: verified.userVerified,\n    backupEligible: verified.backupEligible,\n    backupState: verified.backupState,\n    counter: verified.counter,\n    maximumCounter: verified.counter,\n  });\n\n  const safe = snapshotPasskeySync(PasskeyCredentialSummary, {\n    credentialId: id,\n    name: ceremony.context.name,\n    primarySignIn: credential.primarySignIn,\n    createdAtMillis: now,\n  });\n\n  const input = { subjectId: subject.nativeId, credential, summary: safe, marker: owner.marker };\n  const tupleKey = credentialKey(credential.rpId, credential.protocolCredentialId);\n  const hashedHandle = handleKey(credential.rpId, credential.userHandle);\n  const tuple = read.credentialOwnership;\n\n  const absent = yield* owner.read(\n    tuple.table,\n    equal(tuple.table, { [tuple.credentialKey]: tupleKey }),\n    { limit: 1 },\n  );\n\n  invariant(absent.rows.length === 0);\n\n  const inserted = yield* owner.insert(\n    tuple.table,\n    {\n      ...write.credentialOwnership.encodeInsert(input),\n      [tuple.credentialKey]: tupleKey,\n      [tuple.rpId]: credential.rpId,\n      [tuple.protocolCredentialId]: credential.protocolCredentialId,\n      [tuple.subjectId]: subject.nativeId,\n      [tuple.credentialId]: id,\n      [tuple.state]: write.credentialOwnership.ownedState,\n      [tuple.version]: owner.marker,\n      [tuple.reservationId]: null,\n    },\n    { [tuple.credentialKey]: tupleKey },\n  );\n\n  absent.rows = inserted.rows;\n  const table = read.credential;\n\n  const values = {\n    ...write.credential.encodeInsert(input),\n    [table.credentialId]: id,\n    [table.subjectId]: subject.nativeId,\n    [table.rpId]: credential.rpId,\n    [table.protocolCredentialId]: credential.protocolCredentialId,\n    [table.credentialKey]: tupleKey,\n    [table.handleKey]: hashedHandle,\n    [table.userHandle]: credential.userHandle,\n    [table.algorithm]: credential.algorithm,\n    [table.credentialRevision]: owner.marker,\n    [table.status]: write.credential.activeStatus,\n    [table.primarySignIn]: write.credential.encodePrimarySignIn(credential.primarySignIn),\n    [table.enrollmentUserVerified]: write.credential.encodeEnrollmentUserVerified(\n      credential.enrollmentUserVerified,\n    ),\n    [table.backupEligible]: write.credential.encodeBackupEligible(credential.backupEligible),\n    [table.backupState]: mapping.telemetry.encodeBackupState(credential.backupState),\n    [table.counter]: credential.counter,\n    [table.maximumCounter]: credential.maximumCounter,\n    [write.credential.name]: safe.name,\n    [write.credential.createdAt]: mapping.clock.encodeInstant(now),\n    [mapping.telemetry.lastUsedAt]: null,\n  };\n\n  yield* owner.insert(table.table, values, { [table.credentialId]: id });\n  for (const observation of owner.observations)\n    if (\n      observation.table === table.table &&\n      observation.rows !== inserted.rows &&\n      !observation.rows.some((row) => row[table.credentialId] === id)\n    )\n      observation.rows = [...observation.rows, values];\n  const factor = read.authority;\n\n  const factorValues = {\n    ...write.authority.encodeInsert(input),\n    [factor.subjectId]: subject.nativeId,\n    [factor.credentialId]: id,\n    [factor.revision]: owner.marker,\n    [factor.status]: write.authority.activeStatus,\n  };\n\n  yield* owner.insert(factor.table, factorValues, {\n    [factor.subjectId]: subject.nativeId,\n    [factor.credentialId]: id,\n  });\n  for (const observation of owner.observations)\n    if (\n      observation.table === factor.table &&\n      !observation.rows.some((row) => row[factor.credentialId] === id)\n    )\n      observation.rows = [...observation.rows, factorValues];\n\n  const decoded = snapshotPasskeySync(PasskeyCredential, {\n    ...table.decode(copiedRow(values)),\n    revision: credential.revision,\n    active: true,\n  });\n\n  invariant(\n    sameCredential(decoded, credential) &&\n      decoded.counter === credential.counter &&\n      decoded.maximumCounter === credential.maximumCounter &&\n      decoded.backupState === credential.backupState,\n  );\n  invariant(summary(mapping, values).credentialId === id);\n  owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now}`);\n\n  return safe;\n});\n"],"mappings":";;;;;;;;;;;AAsCA,MAAa,eAAuE,WAAc;CAChG,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;CAE7E,OAAO;EACL,SAAS,UAAqB,OAAO,WAAW,KAAK,CAAC,CAAC,oBAAoB,QAAQ,KAAK,CAAC;EACzF,SAAS,SAA6B;GAEpC,OAAO,OAAO,kBAAkB,KAAK,CAAC,CAAC,IAAI;EAC7C;CACF;AACF;AAEA,MAAa,UACX,QACA,UAEA,YAAY,KACV,SAAS,gBAAgB,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,YAAY,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAC9F;AASF,MAAa,iBAAiB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACrE,SACA,WACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,QAAQ;CACrB,MAAM,QAAQ,KAAK;CACnB,MAAM,WAAW,KAAK,WAAW,SAAS,SAAS;CAEnD,UAAU,KAAK,WAAW,UAAU,QAAQ,MAAM,SAAS;CAE3D,MAAM,OAAO,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,GAAG;EACxF,OAAO;EACP,SAAS,CACP,mBAAG,IAAI,IAAY;GACjB,MAAM;GACN,MAAM;GACN,MAAM;GACN,GAAG,QAAQ,MAAM,OAAO;EAC1B,CAAC,CACH;CACF,CAAC,EAAA,CAAG,KAAK;CAET,IAAI,QAAQ,KAAA,KAAa,CAAC,MAAM,eAAe,IAAI,MAAM,OAAO,GAAG,OAAO,KAAA;CAC1E,UAAU,KAAK,WAAW,OAAO,MAAM,SAAS,UAAU,GAAG,CAAC,GAAG,QAAQ,CAAC;CAC1E,MAAM,SAAS,GAAG,wBAAwB,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,GAAG,MAAM,eAAe,EAAE;CAEzI,IAAI,EAAE,OAAO,MAAM,MAAM,MAAM,IAAI,OAAO,KAAA;CAC1C,MAAM,eAAe,KAAK,MAAM;CAChC,MAAM,SAAS,KAAK;CAEpB,MAAM,WAAW,OAAO,MAAM,KAC5B,OAAO,OACP,KAAK,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,SAAS,CAAC,GAAG,OAAO,eAAe,GAClF;EAAE,OAAO;EAAI,SAAS,cAAc,MAAM;EAAG,SAAS,IAAI,OAAO,OAAO,OAAO,YAAY;CAAE,CAC/F,EAAA,CAAG;CAEH,MAAM,WAAW,oBAAoB,iBAAiB;EACpD;EACA,kBAAkB,IAAI,MAAM;EAC5B,aAAa,QAAQ,KAAK,WAAW;GACnC,cAAc,MAAM,OAAO;GAC3B,UAAU,MAAM,OAAO;EACzB,EAAE;CACJ,CAAC;CAED,UACE,IAAI,IAAI,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAC7D,SAAS,YAAY,MACzB;CAEA,OAAO;EAAE;EAAW;EAAU;EAAK;CAAS;AAC9C,CAAC;AAED,MAAa,iBAAiB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WACrE,SACA,SACA,MACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,QAAQ,KAAK;CAE3B,QAAQ,OAAO,MAAM,KACnB,MAAM,OACN,KACE,MAAM,MAAM,OAAO,GAAG,MAAM,YAAY,QAAQ,SAAS,CAAC,GAC1D,MAAM,iBACN,SAAS,KAAA,IAAY,KAAA,IAAY,MAAM,MAAM,OAAO,GAAG,MAAM,OAAO,KAAK,CAAC,CAC5E,GACA;EAAE,OAAO;EAAI,SAAS,IAAI,MAAM,OAAO,MAAM,YAAY;CAAE,CAC7D,EAAA,CAAG;AACL,CAAC;AAED,MAAa,WAAW,SAAc,QAAa;CACjD,MAAM,QAAQ,QAAQ,KAAK;CAC3B,MAAM,QAAQ,QAAQ,MAAM;CAC5B,MAAM,UAAU,MAAM,OAAO,UAAU,GAAG,CAAC;CAE3C,OAAO,oBAAoB,0BAA0B;EACnD,cAAc,QAAQ;EACtB,MAAM,IAAI,MAAM;EAChB,eAAe,QAAQ;EACvB,iBAAiB,QAAQ,MAAM,cAAc,IAAI,MAAM,UAAU;EACjE,GAAI,IAAI,QAAQ,UAAU,gBAAgB,QAC1C,IAAI,QAAQ,UAAU,gBAAgB,KAAA,IAClC,CAAC,IACD,EAAE,kBAAkB,QAAQ,MAAM,cAAc,IAAI,QAAQ,UAAU,WAAW,EAAE;CACzF,CAAC;AACH;AAEA,MAAa,kBAAkB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACvE,SACA,SACA,KACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,OAAO,QAAQ;CACrB,MAAM,QAAQ,KAAK;CAEnB,MAAM,UAAU,oBAAoB,mBAAmB;EACrD,GAAG,MAAM,OAAO,UAAU,GAAG,CAAC;EAC9B,UAAU,QAAQ;EAClB,QAAQ;CACV,CAAC;CAED,UACE,QAAQ,iBAAiB,IAAI,MAAM,iBACjC,QAAQ,QAAQ,SAAS,QAAQ,QACjC,KAAK,WAAW,OAAO,MAAM,gBAAgB,UAAU,GAAG,CAAC,GAAG,QAAQ,QAAQ,CAClF;CACA,MAAM,YAAY,KAAK;CACvB,MAAM,MAAM,cAAc,QAAQ,MAAM,QAAQ,oBAAoB;CAEpE,MAAM,SAAS,OAAO,MAAM,KAC1B,UAAU,OACV,MAAM,UAAU,OAAO,GAAG,UAAU,gBAAgB,IAAI,CAAC,GACzD;EAAE,OAAO;EAAG,SAAS,cAAc,SAAS;CAAE,CAChD,EAAA,CAAG,KAAK;CAER,IACE,UAAU,KAAA,KACV,CAAC,UAAU,aAAa,MAAM,UAAU,MAAM,KAC9C,CAAC,KAAK,WAAW,OAAO,UAAU,gBAAgB,UAAU,KAAK,CAAC,GAAG,QAAQ,QAAQ,GAErF,OAAO,KAAA;CACT,UACE,MAAM,UAAU,UAAU,QAAQ,QAChC,MAAM,UAAU,0BAA0B,QAAQ,wBAClD,MAAM,UAAU,kBAAkB,QAAQ,gBAC1C,IAAI,MAAM,mBAAmB,GACjC;CACA,MAAM,SAAS,KAAK;CACpB,MAAM,eAAe,UAAU,QAAQ,MAAM,QAAQ,UAAU;CAE/D,MAAM,QAAQ,OAAO,MAAM,KACzB,OAAO,OACP,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,aAAa,CAAC,GACxD;EAAE,OAAO;EAAG,SAAS,cAAc,MAAM;CAAE,CAC7C,EAAA,CAAG,KAAK;CAER,IACE,SAAS,KAAA,KACT,CAAC,OAAO,aAAa,KAAK,OAAO,MAAM,KACvC,CAAC,KAAK,WAAW,OAAO,OAAO,gBAAgB,UAAU,IAAI,CAAC,GAAG,QAAQ,QAAQ,GAEjF,OAAO,KAAA;CACT,UACE,KAAK,OAAO,UAAU,QAAQ,QAC5B,KAAK,OAAO,gBAAgB,QAAQ,cACpC,IAAI,MAAM,eAAe,YAC7B;CACA,UACE,QAAQ,SAAS,YAAY,MAC1B,SACC,KAAK,iBAAiB,QAAQ,gBAC9B,KAAK,aAAa,IAAI,MAAM,mBAChC,CACF;CAEA,OAAO;AACT,CAAC;AAED,MAAa,oBAAoB,SAAc,YAC7C,oBACE,yBACA,QAAQ,MAAM,OAAO,WAAW,UAAU,QAAQ,GAAG,CAAC,CACxD;AAEF,MAAa,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAClE,SACA,SACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,YAAY,QAAQ,MAAM,OAAO,SAAS,QAAQ,QAAQ;CAChE,MAAM,UAAU,OAAO,MAAM,MAAM,SAAS;CAE5C,IAAI,SAAS,MAAM,eAAe,KAAK,SAAS;CAEhD,OAAO;AACT,CAAC;AAED,MAAa,oBAAoB,aAA8B;CAC7D,UAAU,SAAS,QAAQ,SAAS,YAAY;CAChD,MAAM,UAAU,SAAS;CAEzB,OAAO,OACL,OAAO,MAAM;EACX;EACA,OAAO,QAAQ,YAAY;EAC3B,OAAO,OAAO;GAAE,GAAG,aAAa;GAAQ,MAAM;EAAa,CAAC;EAC5D;EACA;EACA;EACA,OAAO,MAAM,iBAAiB;CAChC,CAAC,GACD;EACE,SAAS;EACT;EACA;GACE,QAAQ,SAAS;GACjB,WAAW,SAAS;GACpB,WAAW,SAAS,QAAQ;GAC5B,MAAM,QAAQ;EAChB;EACA,SAAS;EACT,QAAQ;EACR,QAAQ;EACR,SAAS;CACX,CACF;AACF;AAEA,MAAa,gBAAgB,UAAkB,WAAmB,eAChE,OACE,OAAO,MAAM;CACX;CACA,OAAO,QAAQ,QAAQ;CACvB,aAAa,OAAO;CACpB;AACF,CAAC,GACD;CACE,gBAAgB,KAAK,QAAQ;CAC7B;CACA,aAAa,OAAO,UAAU,KAAK,SAAS;CAC5C;AACF,CACF;AAEF,MAAa,kBAAkB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACvE,SACA,SACA,eACA,UAOA,QACA,UACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,EAAE,WAAW,aAAa;CAEhC,IACE,UAAU,aAAa,QAAQ,YAC/B,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,WAAW,SAAS,UAC9B,UAAU,kBAAkB,SAAS,iBACrC,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,SAAS,iBACpC,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,QAAQ,SAAS,cAAc,SAAS,SAAS,aACjD,QAAQ,SAAS,qBAAqB,SAAS,SAAS,oBACxD,SAAS,SAAS,cAAc,QAAQ,aACxC,SAAS,SAAS,qBAAqB,QAAQ,SAAS,kBAExD,OAAO;CACT,KAAK,MAAM,YAAY,CAAC,SAAS,UAAU,SAAS,QAAQ,GAC1D,IACE,SAAS,YAAY,MAClB,SACC,CAAC,QAAQ,SAAS,YAAY,MAC3B,YACC,QAAQ,iBAAiB,KAAK,gBAAgB,QAAQ,aAAa,KAAK,QAC5E,CACJ,GAEA,OAAO;CACX,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;CAE1C,IACE,SAAS,OAAO,MACb,UACC,SAAS,cAAc,MAAM,UAAU,IAAI,OAC3C,CAAC,SAAS,SAAS,YAAY,MAAM,SAAS,KAAK,iBAAiB,MAAM,YAAY,CAC1F,GAEA,OAAO;CAET,MAAM,UAAU,oBACd,oBACA,QAAQ,MAAM,OAAO,YAAY,UAAU,QAAQ,GAAG,GAAG,SAAS,MAAM,CAC1E;CAEA,KAAK,MAAM,eAAe;EACxB,cAAc;EACd;EACA,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,CAAC,QAAQ;CAC7C,GAAG;EACD,MAAM,MAAM,KAAK,IAAI,OAAO,0BAA0B,YAAY,gBAAgB;EAElF,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;EAEA,MAAM,UAAU,IAAI,IAAI,MAAM,SAAS,UAAU,MAAM,OAAO,CAAC;EAE/D,IACE,CAAC,YAAY,aAAa,MACvB,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,IAAI,IAAI,MAAM,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,QAChD,YAAY,sBACd,MAAM,MACH,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ,GAEA,OAAO;EACT,MAAM,eAAe,KACnB,KACE,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAC1C,GAAG,MAAM,KACN,UACC,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KACxF,CACF,CACF;CACF;CACA,MAAM,YAAY,QAAQ,MAAM,OAAO,OAAO,QAAQ,UAAU,aAAa;CAE7E,IAAI,EAAE,OAAO,MAAM,MAAM,SAAS,IAAI,OAAO;CAC7C,MAAM,eAAe,KAAK,SAAS;CAEnC,OAAO;AACT,CAAC;AAED,MAAa,uBACX,SACA,UACA,WAEA,YAAY,yBAAyB,CAAC,CAAC,OAAO,QAAQ,MACpD,YAAY,yBAAyB,CAAC,CAAC,OAAO,QAAQ,aAAa,MAAM,MAC1E,CAAC,OAAO,gCAAgC,SAAS,qBAAqB;AAEzE,MAAa,aAAa,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACxE,SACA,SACA,cACA;CACA,MAAM,QAAQ,OAAO;CACrB,MAAM,QAAQ,QAAQ,KAAK;CAC3B,MAAM,WAAW,gBAAgB,OAAO,iBAAiB,KAAK,MAAM,MAAM;CAE1E,OAAO,MAAM,OACX,MAAM,OACN,GAAG,MAAM,KAAK,QAAQ,SAAS,GAC/B,GAAG,MAAM,mBAAmB,SAAS,CACvC;CAEA,MAAM,QAAQ;EACZ,WAAW,QAAQ;EACnB,kBAAkB,QAAQ,SAAS;EACnC,kBAAkB;EAClB;CACF;CAEA,KAAK,MAAM,YAAY,QAAQ,aAAa,WAAW;EACrD,OAAO,MAAM,MACX,MAAM,SACH,OAAO,SAAS,KAAK,CAAC,CACtB,IAAI,SAAS,OAAO,KAAK,CAAC,CAAC,CAC3B,MAAM,SAAS,MAAM,KAAK,CAAC,CAChC;EACA,MAAM,eAAe,KAAK,SAAS,cAAc,KAAK,CAAC;CACzD;CACA,MAAM,eAAe,KAAK,QAAQ,aAAa,cAAc,KAAK,CAAC;CACnE,MAAM,OAAO,QAAQ;CAErB,MAAM,QAAQ,KACZ,MAAM,KAAK,OAAO,GAAG,KAAK,eAAe,aAAa,QAAQ,SAAS,EAAE,CAAC,GAC1E,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,QAAQ,IAAI,KAAK,OAAO,QAAQ,EACvF;CAEA,OAAO,MAAM,MACX,MAAM,SACH,OAAO,KAAK,KAAK,CAAC,CAClB,IAAI;GAAG,KAAK,QAAQ,KAAK,OAAO;GAAW,KAAK,UAAU,MAAM;CAAO,CAAC,CAAC,CACzE,MAAM,KAAK,CAChB;CACA,KAAK,MAAM,eAAe,MAAM,cAC9B,IAAI,YAAY,UAAU,KAAK,OAC7B,YAAY,OAAO,YAAY,KAAK,KAAK,QACvC,IAAI,KAAK,kBAAkB,aAAa,QAAQ,SAAS,KACzD,CAAC,KAAK,OAAO,SAAS,KAAK,OAAO,OAAO,CAAC,CAAC,SAAS,IAAI,KAAK,MAAM,IAC/D;EAAE,GAAG;GAAM,KAAK,QAAQ,KAAK,OAAO;GAAW,KAAK,UAAU,MAAM;CAAO,IAC3E,GACN;CACJ,MAAM,eAAe,KAAK,GAAG,4BAA4B,KAAK,MAAM,SAAS,MAAM,EAAE;CAErF,OAAO;AACT,CAAC;AAED,MAAa,qBACX,UACA,aAQA,SAAS,QAAQ,WAAW,MAAM,cAAc,cAAc,SAAS,SAAS,MAC/E,SAAS,QAAQ,qBAAqB,cAAc,SAAS,kBAC7D,CAAC,SAAS,eAAe,SAAS,mBACnC,CAAC,SAAS,mBAAmB,MAAM,SAAS,KAAK,OAAO,SAAS,oBAAoB;AAEvF,MAAa,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACpE,SACA,SACA,UACA,UACA,KACA;CACA,MAAM,QAAQ,OAAO;CAErB,UAAU,SAAS,QAAQ,SAAS,gBAAgB,SAAS,QAAQ,SAAS,cAAc;CAC5F,MAAM,OAAO,QAAQ;CACrB,MAAM,QAAQ,QAAQ;CACtB,MAAM,KAAK,kBAAkB,OAAO,aAAa,KAAK,MAAM,MAAM;CAElE,MAAM,aAAa,oBAAoB,mBAAmB;EACxD,cAAc;EACd,MAAM,SAAS,QAAQ;EACvB,sBAAsB,SAAS;EAC/B,YAAY,SAAS,QAAQ;EAC7B,WAAW,SAAS;EACpB,WAAW,SAAS;EACpB,SAAS,SAAS;EAClB,UAAU;GACR,GAAG,QAAQ;GACX,aAAa,CACX,GAAG,QAAQ,SAAS,aACpB;IAAE,cAAc;IAAI,UAAU,gBAAgB,OAAO,iBAAiB,KAAK,MAAM,MAAM;GAAE,CAC3F;EACF;EACA,QAAQ;EACR,eAAe,SAAS,QAAQ,iBAAiB,SAAS;EAC1D,wBAAwB,SAAS;EACjC,gBAAgB,SAAS;EACzB,aAAa,SAAS;EACtB,SAAS,SAAS;EAClB,gBAAgB,SAAS;CAC3B,CAAC;CAED,MAAM,OAAO,oBAAoB,0BAA0B;EACzD,cAAc;EACd,MAAM,SAAS,QAAQ;EACvB,eAAe,WAAW;EAC1B,iBAAiB;CACnB,CAAC;CAED,MAAM,QAAQ;EAAE,WAAW,QAAQ;EAAU;EAAY,SAAS;EAAM,QAAQ,MAAM;CAAO;CAC7F,MAAM,WAAW,cAAc,WAAW,MAAM,WAAW,oBAAoB;CAC/E,MAAM,eAAe,UAAU,WAAW,MAAM,WAAW,UAAU;CACrE,MAAM,QAAQ,KAAK;CAEnB,MAAM,SAAS,OAAO,MAAM,KAC1B,MAAM,OACN,MAAM,MAAM,OAAO,GAAG,MAAM,gBAAgB,SAAS,CAAC,GACtD,EAAE,OAAO,EAAE,CACb;CAEA,UAAU,OAAO,KAAK,WAAW,CAAC;CAElC,MAAM,WAAW,OAAO,MAAM,OAC5B,MAAM,OACN;EACE,GAAG,MAAM,oBAAoB,aAAa,KAAK;GAC9C,MAAM,gBAAgB;GACtB,MAAM,OAAO,WAAW;GACxB,MAAM,uBAAuB,WAAW;GACxC,MAAM,YAAY,QAAQ;GAC1B,MAAM,eAAe;GACrB,MAAM,QAAQ,MAAM,oBAAoB;GACxC,MAAM,UAAU,MAAM;GACtB,MAAM,gBAAgB;CACzB,GACA,GAAG,MAAM,gBAAgB,SAAS,CACpC;CAEA,OAAO,OAAO,SAAS;CACvB,MAAM,QAAQ,KAAK;CAEnB,MAAM,SAAS;EACb,GAAG,MAAM,WAAW,aAAa,KAAK;GACrC,MAAM,eAAe;GACrB,MAAM,YAAY,QAAQ;GAC1B,MAAM,OAAO,WAAW;GACxB,MAAM,uBAAuB,WAAW;GACxC,MAAM,gBAAgB;GACtB,MAAM,YAAY;GAClB,MAAM,aAAa,WAAW;GAC9B,MAAM,YAAY,WAAW;GAC7B,MAAM,qBAAqB,MAAM;GACjC,MAAM,SAAS,MAAM,WAAW;GAChC,MAAM,gBAAgB,MAAM,WAAW,oBAAoB,WAAW,aAAa;GACnF,MAAM,yBAAyB,MAAM,WAAW,6BAC/C,WAAW,sBACb;GACC,MAAM,iBAAiB,MAAM,WAAW,qBAAqB,WAAW,cAAc;GACtF,MAAM,cAAc,QAAQ,UAAU,kBAAkB,WAAW,WAAW;GAC9E,MAAM,UAAU,WAAW;GAC3B,MAAM,iBAAiB,WAAW;GAClC,MAAM,WAAW,OAAO,KAAK;GAC7B,MAAM,WAAW,YAAY,QAAQ,MAAM,cAAc,GAAG;GAC5D,QAAQ,UAAU,aAAa;CAClC;CAEA,OAAO,MAAM,OAAO,MAAM,OAAO,QAAQ,GAAG,MAAM,eAAe,GAAG,CAAC;CACrE,KAAK,MAAM,eAAe,MAAM,cAC9B,IACE,YAAY,UAAU,MAAM,SAC5B,YAAY,SAAS,SAAS,QAC9B,CAAC,YAAY,KAAK,MAAM,QAAQ,IAAI,MAAM,kBAAkB,EAAE,GAE9D,YAAY,OAAO,CAAC,GAAG,YAAY,MAAM,MAAM;CACnD,MAAM,SAAS,KAAK;CAEpB,MAAM,eAAe;EACnB,GAAG,MAAM,UAAU,aAAa,KAAK;GACpC,OAAO,YAAY,QAAQ;GAC3B,OAAO,eAAe;GACtB,OAAO,WAAW,MAAM;GACxB,OAAO,SAAS,MAAM,UAAU;CACnC;CAEA,OAAO,MAAM,OAAO,OAAO,OAAO,cAAc;GAC7C,OAAO,YAAY,QAAQ;GAC3B,OAAO,eAAe;CACzB,CAAC;CACD,KAAK,MAAM,eAAe,MAAM,cAC9B,IACE,YAAY,UAAU,OAAO,SAC7B,CAAC,YAAY,KAAK,MAAM,QAAQ,IAAI,OAAO,kBAAkB,EAAE,GAE/D,YAAY,OAAO,CAAC,GAAG,YAAY,MAAM,YAAY;CAEzD,MAAM,UAAU,oBAAoB,mBAAmB;EACrD,GAAG,MAAM,OAAO,UAAU,MAAM,CAAC;EACjC,UAAU,WAAW;EACrB,QAAQ;CACV,CAAC;CAED,UACE,eAAe,SAAS,UAAU,KAChC,QAAQ,YAAY,WAAW,WAC/B,QAAQ,mBAAmB,WAAW,kBACtC,QAAQ,gBAAgB,WAAW,WACvC;CACA,UAAU,QAAQ,SAAS,MAAM,CAAC,CAAC,iBAAiB,EAAE;CACtD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK;CAEzE,OAAO;AACT,CAAC"}

package/dist/drizzle/passkey-write-target.d.mts

@@ -0,0 +1,14 @@
+import "../hooks/LifecycleHooks.mjs";
+import "./model.mjs";
+import "../passkey/errors.mjs";
+import "./passkey-model.mjs";
+import { PasskeyManagementPersistence } from "../passkey/PasskeyManagementPersistence.mjs";
+import { PasskeyManagementServices } from "./passkey-write-model.mjs";
+import "./passkey-target.mjs";
+import { Effect, Layer } from "effect";
+import { Statement } from "effect/unstable/sql/Statement";
+//#region src/drizzle/passkey-write-target.d.ts
+declare const passkeyManagementPersistenceLayer: <E, R>(services: Effect.Effect<PasskeyManagementServices, E, R>) => Layer.Layer<PasskeyManagementPersistence, E, Exclude<R, import("effect/Scope").Scope>>;
+//#endregion
+export { passkeyManagementPersistenceLayer };
+//# sourceMappingURL=passkey-write-target.d.mts.map

package/dist/drizzle/passkey-write-target.mjs

@@ -0,0 +1,185 @@
+import { SubjectId } from "../Schema.mjs";
+import { SessionInvalidationWindow } from "../sessions/invalidation.mjs";
+import { LifecycleHooks } from "../hooks/LifecycleHooks.mjs";
+import { coordinateTransactionOwner } from "./transaction-execution.mjs";
+import { PasskeyConfigurationError } from "../passkey/errors.mjs";
+import { PasskeyActionAuthorization, PasskeyCeremony, PasskeyClaim, PasskeyCommandId, PasskeyCredential, PasskeyCredentialId, PasskeyCredentialSummary, PasskeyInstant, PasskeyIssueDecision, PasskeyLabel, PasskeyModuleId, PasskeyRegistrationResult, PasskeyRegistrationVerified, PasskeyRemoved } from "../passkey/models.mjs";
+import { PasskeyManagementPersistence } from "../passkey/PasskeyManagementPersistence.mjs";
+import { snapshotPasskeySync } from "../passkey/snapshot.mjs";
+import { PasskeyManagementPolicy, PasskeyMethodPolicy } from "../passkey/policy.mjs";
+import { CurrentPasskeyTransaction, invariant, nonce, unavailable } from "./passkey-state.mjs";
+import { completeEnrollment, issueEnrollment } from "./passkey-enrollment.mjs";
+import { inspectRemove, listCredentials, removeCredential, renameCredential } from "./passkey-management.mjs";
+import { completeRegistration, inspectRegistration, issueRegistration } from "./passkey-registration-write.mjs";
+import { capturedMapping, capturedService, makePasskeyExecution, makePasskeyPersistence, observationalContext, prepareValue } from "./passkey-target.mjs";
+import { Effect, Layer, Schema } from "effect";
+import { getTableColumns } from "drizzle-orm";
+//#region src/drizzle/passkey-write-target.ts
+const passkeyManagementPersistenceLayer = (services) => Layer.effect(PasskeyManagementPersistence, Effect.map(services, (value) => value.passkeyManagementPersistence));
+const issueSchema = Schema.Struct({
+	ceremony: PasskeyCeremony,
+	policy: PasskeyMethodPolicy,
+	management: PasskeyManagementPolicy,
+	authorization: PasskeyActionAuthorization
+});
+const completeSchema = Schema.Struct({
+	claim: PasskeyClaim,
+	verified: PasskeyRegistrationVerified,
+	authorization: PasskeyActionAuthorization,
+	management: PasskeyManagementPolicy,
+	invalidation: SessionInvalidationWindow,
+	nowMillis: PasskeyInstant
+});
+const metadata = {
+	moduleId: PasskeyModuleId,
+	subjectId: SubjectId
+};
+const identity = {
+	...metadata,
+	commandId: PasskeyCommandId,
+	credentialId: PasskeyCredentialId
+};
+const retention = {
+	nowMillis: PasskeyInstant,
+	retentionUntilMillis: PasskeyInstant
+};
+const managementSchemas = {
+	list: Schema.Struct({
+		...metadata,
+		cursor: Schema.optionalKey(PasskeyCredentialId),
+		limit: Schema.Int.check(Schema.isBetween({
+			minimum: 1,
+			maximum: 64
+		}))
+	}),
+	issueEnrollment: issueSchema,
+	completeEnrollment: completeSchema,
+	inspectRemove: Schema.Struct(identity),
+	rename: Schema.Struct({
+		...identity,
+		...retention,
+		name: PasskeyLabel
+	}),
+	remove: Schema.Struct({
+		moduleId: PasskeyModuleId,
+		commandId: PasskeyCommandId,
+		credential: PasskeyCredential,
+		authorization: PasskeyActionAuthorization,
+		management: PasskeyManagementPolicy,
+		invalidation: SessionInvalidationWindow,
+		...retention
+	})
+};
+const enrolled = Schema.Union([Schema.TaggedStruct("Enrolled", { credential: PasskeyCredentialSummary }), Schema.TaggedStruct("Rejected", {})]);
+const renamed = Schema.Union([Schema.TaggedStruct("Renamed", {
+	credential: PasskeyCredentialSummary,
+	replayed: Schema.Boolean
+}), Schema.TaggedStruct("Rejected", {})]);
+const removed = Schema.Union([
+	Schema.TaggedStruct("Removed", { result: PasskeyRemoved }),
+	Schema.TaggedStruct("Rejected", {}),
+	Schema.TaggedStruct("LastSignInMethod", {})
+]);
+const registrationDecision = Schema.Union([PasskeyRegistrationResult, Schema.TaggedStruct("Rejected", {})]);
+const managementService = (mapping, execute) => capturedService({
+	list: (input) => execute.run(observationalContext(listCredentials(mapping, input)), false),
+	inspectRemove: (input) => execute.run(observationalContext(inspectRemove(mapping, input)), false),
+	issueEnrollment: (input, prepare) => execute.run(Effect.gen(function* () {
+		return yield* prepareValue(snapshotPasskeySync(PasskeyIssueDecision, yield* issueEnrollment(mapping, input)), prepare);
+	})),
+	completeEnrollment: (input, prepare) => execute.run(Effect.gen(function* () {
+		return yield* prepareValue(snapshotPasskeySync(enrolled, yield* completeEnrollment(mapping, input)), prepare);
+	})),
+	rename: (input, prepare) => execute.run(Effect.gen(function* () {
+		return yield* prepareValue(snapshotPasskeySync(renamed, yield* renameCredential(mapping, input)), prepare);
+	})),
+	remove: (input, prepare) => execute.run(Effect.gen(function* () {
+		return yield* prepareValue(snapshotPasskeySync(removed, yield* removeCredential(mapping, input)), prepare);
+	}))
+}, managementSchemas, execute);
+const registrationService = (mapping, execute) => capturedService({
+	inspect: (registration) => execute.run(observationalContext(inspectRegistration(mapping, registration)), false),
+	issueRegistration: (input, prepare) => execute.run(Effect.gen(function* () {
+		return yield* prepareValue(snapshotPasskeySync(PasskeyIssueDecision, yield* issueRegistration(mapping, input)), prepare);
+	})),
+	completeRegistration: (input, prepare) => execute.run(Effect.gen(function* () {
+		return yield* prepareValue(snapshotPasskeySync(registrationDecision, yield* completeRegistration(mapping, input)), prepare);
+	}))
+}, {
+	inspect: Schema.toType(mapping.registration.schema),
+	issueRegistration: Schema.Struct({
+		ceremony: PasskeyCeremony,
+		policy: PasskeyMethodPolicy,
+		registration: Schema.toType(mapping.registration.schema)
+	}),
+	completeRegistration: Schema.Struct({
+		claim: PasskeyClaim,
+		verified: PasskeyRegistrationVerified,
+		nowMillis: PasskeyInstant
+	})
+}, execute);
+const descriptor = (table) => {
+	const columns = getTableColumns(table.table);
+	for (const [field, name] of Object.entries(table)) if (typeof name === "string" && !field.endsWith("State")) invariant(columns[name] !== void 0);
+};
+const writeMapping = (source, configuration, registration) => Effect.flatMap(capturedMapping(source, "assertion", configuration), (mapping) => Effect.try({
+	try: () => {
+		const m = mapping;
+		for (const name of [m.write.credential.name, m.write.credential.createdAt]) invariant(getTableColumns(m.read.credential.table)[name] !== void 0);
+		for (const name of m.write.policy.subjectColumns) invariant(getTableColumns(m.read.subject.table)[name] !== void 0);
+		invariant(m.write.credential.activeStatus !== m.write.credential.removedStatus && m.write.authority.activeStatus !== m.write.authority.removedStatus && m.write.credentialOwnership.ownedState !== m.write.credentialOwnership.removedState);
+		invariant(m.read.credential.isActiveStatus(m.write.credential.activeStatus) && !m.read.credential.isActiveStatus(m.write.credential.removedStatus) && m.read.authority.isActiveStatus(m.write.authority.activeStatus) && !m.read.authority.isActiveStatus(m.write.authority.removedStatus) && m.read.credentialOwnership.isOwnedState(m.write.credentialOwnership.ownedState) && !m.read.credentialOwnership.isOwnedState(m.write.credentialOwnership.removedState) && m.read.handleOwnership.isOwnedState(m.write.handleOwnership.ownedState));
+		if (registration) {
+			descriptor(m.intent);
+			descriptor(m.handle);
+			invariant(m.handle.table === m.read.handleOwnership.table);
+			invariant(m.handle.reservedState !== m.write.handleOwnership.ownedState && m.intent.pendingState !== m.intent.acceptedState && m.intent.rejectedState !== m.intent.pendingState && m.intent.rejectedState !== m.intent.acceptedState);
+			invariant(m.registrationConstraints.intentFlow.join("/") === "moduleId/flowId" && m.registrationConstraints.intentCommand.join("/") === "moduleId/commandId" && m.registrationConstraints.handle.join("/") === "handleKey");
+		} else {
+			descriptor(m.command);
+			invariant(m.managementConstraints.command.join("/") === "moduleId/commandId");
+			snapshotPasskeySync(SessionInvalidationWindow, m.invalidation.window);
+			invariant(m.invalidation.window.trigger === "credential-change" && m.invalidation.mutations.length <= 32);
+		}
+		return mapping;
+	},
+	catch: () => PasskeyConfigurationError.make({})
+}));
+const managementServices = (mapping, execute, configuration) => ({
+	passkeyManagementPersistence: managementService(mapping, execute),
+	passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, false, true)
+});
+const registrationServices = (mapping, execute, configuration) => ({
+	passkeyRegistrationAuthority: registrationService(mapping, execute),
+	passkeyPersistence: makePasskeyPersistence(mapping, execute, configuration, true)
+});
+const makeTargetPasskeyManagement = (database, source, configuration) => Effect.gen(function* () {
+	const mapping = yield* writeMapping(source, configuration, false);
+	const hooks = yield* LifecycleHooks;
+	return managementServices(mapping, makePasskeyExecution(database, hooks, configuration), configuration);
+});
+const makeTargetPasskeyRegistrationWriter = (database, source, configuration) => Effect.gen(function* () {
+	const mapping = yield* writeMapping(source, configuration, true);
+	const hooks = yield* LifecycleHooks;
+	return registrationServices(mapping, makePasskeyExecution(database, hooks, configuration), configuration);
+});
+const coordinateTargetPasskeyManagement = (database, source, configuration, body) => Effect.gen(function* () {
+	const mapping = yield* writeMapping(source, configuration, false);
+	const hooks = yield* LifecycleHooks;
+	return yield* coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, Effect.void, unavailable, nonce, (execute) => managementServices(mapping, {
+		...execute,
+		run: (operation, mutation) => execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
+	}, configuration), body).pipe(Effect.provideService(LifecycleHooks, hooks));
+});
+const coordinateTargetPasskeyRegistrationWriter = (database, source, configuration, body) => Effect.gen(function* () {
+	const mapping = yield* writeMapping(source, configuration, true);
+	const hooks = yield* LifecycleHooks;
+	return yield* coordinateTransactionOwner(database, CurrentPasskeyTransaction, configuration, Effect.void, unavailable, nonce, (execute) => registrationServices(mapping, {
+		...execute,
+		run: (operation, mutation) => execute.run(operation, mutation).pipe(Effect.provideService(LifecycleHooks, hooks))
+	}, configuration), body).pipe(Effect.provideService(LifecycleHooks, hooks));
+});
+//#endregion
+export { coordinateTargetPasskeyManagement, coordinateTargetPasskeyRegistrationWriter, makeTargetPasskeyManagement, makeTargetPasskeyRegistrationWriter, passkeyManagementPersistenceLayer };
+
+//# sourceMappingURL=passkey-write-target.mjs.map