@yielded/auth-persistence 0.1.0-beta.18 → 0.1.0-beta.20

package/dist/internal/passkey/enrollment.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"enrollment.mjs","names":["Ceremony"],"sources":["../../../src/internal/passkey/enrollment.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport {\n  type PasskeyCeremony,\n  PasskeyCeremony as Ceremony,\n  type PasskeyManagementPersistence,\n} from \"@yielded/auth/Passkey\";\nimport { Effect } from \"effect\";\n\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport type { makePasskeyAdmissionKernel } from \"./admission\";\nimport type { makePasskeyCredentialsKernel } from \"./credentials\";\nimport type { makePasskeyFlowKernel } from \"./flow\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\nimport type { WriteSubject, makePasskeyWriteStateKernel } from \"./write-state\";\n\ntype Issue = Parameters<PasskeyManagementPersistence[\"Service\"][\"issueEnrollment\"]>[0];\n\ntype Complete = Parameters<PasskeyManagementPersistence[\"Service\"][\"completeEnrollment\"]>[0];\n\nexport const makePasskeyEnrollmentKernel = (\n  operations: QueryOperations,\n  admission: Pick<\n    ReturnType<typeof makePasskeyAdmissionKernel>,\n    \"lockAdmission\" | \"readCharges\" | \"guardChargeSet\"\n  >,\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"readModule\" | \"readPolicyGuards\"\n  >,\n  flow: Pick<\n    ReturnType<typeof makePasskeyFlowKernel>,\n    | \"compatiblePolicy\"\n    | \"exactClaim\"\n    | \"issueAssertion\"\n    | \"liveCondition\"\n    | \"readFlow\"\n    | \"terminalFlow\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    \"equal\" | \"handleKey\" | \"invariant\" | \"sameRevision\" | \"credentialKey\"\n  >,\n  writeState: Pick<\n    ReturnType<typeof makePasskeyWriteStateKernel>,\n    | \"authorizeAction\"\n    | \"credentialRows\"\n    | \"currentSubject\"\n    | \"enrollmentDigest\"\n    | \"digest\"\n    | \"insertCredential\"\n    | \"managementPolicy\"\n    | \"validRegistration\"\n  >,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n  const { sql } = operations;\n  const { lockAdmission, readCharges, guardChargeSet } = admission;\n  const { readModule, readPolicyGuards } = credentials;\n\n  const { compatiblePolicy, exactClaim, issueAssertion, liveCondition, readFlow, terminalFlow } =\n    flow;\n\n  const { equal, handleKey, sameRevision, credentialKey: credentialKeyFor } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    authorizeAction,\n    credentialRows,\n    currentSubject,\n    enrollmentDigest,\n    digest,\n    insertCredential,\n    managementPolicy,\n    validRegistration,\n  } = writeState;\n\n  const { both } = transactions;\n\n  const enrollmentHandle = Effect.fn(\"passkey.enrollmentHandle\")(function* (\n    mapping: any,\n    subject: WriteSubject,\n    ceremony: PasskeyCeremony,\n    create: boolean,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    invariant(ceremony.context._tag === \"Enrollment\");\n    const table = mapping.read.handleOwnership;\n\n    const where = equal(table.table, {\n      [table.rpId]: ceremony.profile.rpId,\n      [table.subjectId]: subject.nativeId,\n    });\n\n    const found = yield* owner.read(table.table, where, { limit: 1 });\n    const row = found.rows[0];\n    const hashed = handleKey(ceremony.profile.rpId, ceremony.context.userHandle);\n\n    if (row !== undefined)\n      return (\n        table.isOwnedState(row[table.state]) &&\n        row[table.handleKey] === hashed &&\n        row[table.userHandle] === ceremony.context.userHandle &&\n        mapping.read.subjectIds.equals(table.decodeSubjectId(row), subject.nativeId)\n      );\n    if (!create) return false;\n\n    const absent = yield* owner.read(\n      table.table,\n      equal(table.table, { [table.handleKey]: hashed }),\n      {\n        limit: 1,\n      },\n    );\n\n    if (absent.rows.length !== 0) return false;\n\n    const inserted = yield* owner.insert(\n      table.table,\n      {\n        ...mapping.write.handleOwnership.encodeInsert({\n          subjectId: subject.nativeId,\n          rpId: ceremony.profile.rpId,\n          userHandle: ceremony.context.userHandle,\n          marker: owner.marker,\n        }),\n        [table.handleKey]: hashed,\n        [table.rpId]: ceremony.profile.rpId,\n        [table.userHandle]: ceremony.context.userHandle,\n        [table.subjectId]: subject.nativeId,\n        [table.state]: mapping.write.handleOwnership.ownedState,\n        [table.version]: owner.marker,\n        [table.reservationId]: null,\n      },\n      { [table.handleKey]: hashed },\n    );\n\n    found.rows = inserted.rows;\n    absent.rows = inserted.rows;\n\n    return true;\n  });\n\n  const capCondition = (mapping: any, subject: WriteSubject, maximum: number, addition: number) => {\n    const table = mapping.read.credential;\n\n    return sql`(select count(*) from ${table.table} where ${both(equal(table.table, { [table.subjectId]: subject.nativeId }), table.activeCondition)}) + ${addition} <= ${maximum}`;\n  };\n\n  const issueEnrollment = Effect.fn(\"passkey.issueEnrollment\")(function* (\n    mapping: any,\n    input: Issue,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const ceremony = input.ceremony;\n\n    if (\n      ceremony.context._tag !== \"Enrollment\" ||\n      ceremony.purpose !== \"enrollment\" ||\n      ceremony.moduleId !== mapping.moduleId\n    )\n      return { _tag: \"Rejected\" } as const;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined || !compatiblePolicy(ceremony, input.policy, current))\n      return { _tag: \"Rejected\" } as const;\n    yield* lockAdmission(mapping);\n    const subject = yield* currentSubject(mapping, ceremony.context.revision.subjectId);\n\n    if (subject === undefined || !sameRevision(subject.revision, ceremony.context.revision))\n      return { _tag: \"Rejected\" } as const;\n    yield* readPolicyGuards(mapping);\n    const policy = managementPolicy(mapping, subject);\n    const maximum = Math.min(policy.maximumCredentials, input.management.maximumCredentials);\n    const rows = yield* credentialRows(mapping, subject, ceremony.profile.rpId);\n    const ids = rows.map((row) => row[mapping.read.credential.protocolCredentialId]);\n\n    if (\n      ids.length !== ceremony.allowedCredentials.length ||\n      !ids.every((id) => ceremony.allowedCredentials.some((item) => item.id === id)) ||\n      !(yield* owner.check(capCondition(mapping, subject, maximum, 1)))\n    )\n      return { _tag: \"Rejected\" } as const;\n    if (\n      !(yield* authorizeAction(\n        mapping,\n        subject,\n        input.authorization,\n        {\n          action: \"enroll-begin\",\n          commandId: ceremony.commandId,\n          flowId: ceremony.flowId,\n          bindingDigest: enrollmentDigest(ceremony),\n          revision: ceremony.context.revision,\n        },\n        {\n          ...policy,\n          maximumEvidenceAgeMillis: Math.min(\n            policy.maximumEvidenceAgeMillis,\n            input.management.maximumEvidenceAgeMillis,\n          ),\n        },\n      ))\n    )\n      return { _tag: \"Rejected\" } as const;\n    invariant(\n      digest(Ceremony.fields.context, ceremony.context) ===\n        digest(Ceremony.fields.context, {\n          ...ceremony.context,\n          authorization: input.authorization,\n        }),\n    );\n    const issued = yield* issueAssertion(mapping, ceremony, input.policy);\n\n    if (issued._tag !== \"Issued\") return issued;\n    invariant(yield* enrollmentHandle(mapping, subject, ceremony, true));\n    owner.postconditions.push(capCondition(mapping, subject, maximum, 1));\n\n    return issued;\n  });\n\n  const completeEnrollment = Effect.fn(\"passkey.completeEnrollment\")(function* (\n    mapping: any,\n    input: Complete,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const ceremony = input.claim.ceremony;\n\n    if (\n      ceremony.context._tag !== \"Enrollment\" ||\n      ceremony.purpose !== \"enrollment\" ||\n      ceremony.moduleId !== mapping.moduleId\n    )\n      return { _tag: \"Rejected\" } as const;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined) return { _tag: \"Rejected\" } as const;\n    yield* lockAdmission(mapping);\n    const subject = yield* currentSubject(mapping, ceremony.context.revision.subjectId);\n\n    yield* readPolicyGuards(mapping);\n    const read = yield* readFlow(mapping, ceremony.flowId);\n\n    if (read === undefined || !exactClaim(read, input.claim)) return { _tag: \"Rejected\" } as const;\n\n    const reject = Effect.gen(function* () {\n      yield* terminalFlow(mapping, read, \"Rejected\");\n\n      return { _tag: \"Rejected\" } as const;\n    });\n\n    if (\n      subject === undefined ||\n      !sameRevision(subject.revision, ceremony.context.revision) ||\n      !compatiblePolicy(ceremony, read.policy, current) ||\n      !validRegistration(ceremony, input.verified) ||\n      !(yield* owner.check(liveCondition(mapping, ceremony, input.claim)))\n    )\n      return yield* reject;\n    const policy = managementPolicy(mapping, subject);\n    const maximum = Math.min(policy.maximumCredentials, input.management.maximumCredentials);\n\n    if (\n      !(yield* owner.check(capCondition(mapping, subject, maximum, 1))) ||\n      !(yield* enrollmentHandle(mapping, subject, ceremony, false))\n    )\n      return yield* reject;\n    if (\n      !(yield* authorizeAction(\n        mapping,\n        subject,\n        input.authorization,\n        {\n          action: \"enroll-complete\",\n          commandId: ceremony.commandId,\n          flowId: ceremony.flowId,\n          bindingDigest: digest(Ceremony, ceremony),\n          revision: ceremony.context.revision,\n        },\n        {\n          ...policy,\n          maximumEvidenceAgeMillis: Math.min(\n            policy.maximumEvidenceAgeMillis,\n            input.management.maximumEvidenceAgeMillis,\n          ),\n        },\n        ceremony.context.authorization.requirement,\n      ))\n    )\n      return yield* reject;\n    const tuple = mapping.read.credentialOwnership;\n    // Credential ownership is RP-global, including retained registration custody.\n    const key = credentialKeyFor(ceremony.profile.rpId, input.verified.protocolCredentialId);\n\n    if (\n      (yield* owner.read(tuple.table, equal(tuple.table, { [tuple.credentialKey]: key }), {\n        limit: 1,\n        observe: false,\n      })).rows.length !== 0\n    )\n      return yield* reject;\n    yield* readCharges(mapping, ceremony, read.policy, subject.subjectId);\n    yield* guardChargeSet(mapping, ceremony, subject.subjectId);\n\n    const safe = yield* insertCredential(\n      mapping,\n      subject,\n      ceremony,\n      input.verified,\n      yield* owner.now(mapping.clock),\n    );\n\n    yield* terminalFlow(mapping, read, \"Verified\");\n    owner.postconditions.push(\n      liveCondition(mapping, ceremony, input.claim),\n      capCondition(mapping, subject, maximum, 0),\n    );\n\n    return { _tag: \"Enrolled\", credential: safe } as const;\n  });\n\n  return { enrollmentHandle, issueEnrollment, completeEnrollment };\n};\n"],"mappings":";;;;AAsBA,MAAa,+BACX,YACA,WAIA,aAIA,MASA,OAIA,YAWA,iBACG;CACH,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,eAAe,aAAa,mBAAmB;CACvD,MAAM,EAAE,YAAY,qBAAqB;CAEzC,MAAM,EAAE,kBAAkB,YAAY,gBAAgB,eAAe,UAAU,iBAC7E;CAEF,MAAM,EAAE,OAAO,WAAW,cAAc,eAAe,qBAAqB;CAC5E,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,iBACA,gBACA,gBACA,kBACA,QACA,kBACA,kBACA,sBACE;CAEJ,MAAM,EAAE,SAAS;CAEjB,MAAM,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,SACA,UACA,QACA;EACA,MAAM,QAAQ,OAAO;EAErB,UAAU,SAAS,QAAQ,SAAS,YAAY;EAChD,MAAM,QAAQ,QAAQ,KAAK;EAE3B,MAAM,QAAQ,MAAM,MAAM,OAAO;IAC9B,MAAM,OAAO,SAAS,QAAQ;IAC9B,MAAM,YAAY,QAAQ;EAC7B,CAAC;EAED,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM,OAAO,OAAO,EAAE,OAAO,EAAE,CAAC;EAChE,MAAM,MAAM,MAAM,KAAK;EACvB,MAAM,SAAS,UAAU,SAAS,QAAQ,MAAM,SAAS,QAAQ,UAAU;EAE3E,IAAI,QAAQ,KAAA,GACV,OACE,MAAM,aAAa,IAAI,MAAM,MAAM,KACnC,IAAI,MAAM,eAAe,UACzB,IAAI,MAAM,gBAAgB,SAAS,QAAQ,cAC3C,QAAQ,KAAK,WAAW,OAAO,MAAM,gBAAgB,GAAG,GAAG,QAAQ,QAAQ;EAE/E,IAAI,CAAC,QAAQ,OAAO;EAEpB,MAAM,SAAS,OAAO,MAAM,KAC1B,MAAM,OACN,MAAM,MAAM,OAAO,GAAG,MAAM,YAAY,OAAO,CAAC,GAChD,EACE,OAAO,EACT,CACF;EAEA,IAAI,OAAO,KAAK,WAAW,GAAG,OAAO;EAErC,MAAM,WAAW,OAAO,MAAM,OAC5B,MAAM,OACN;GACE,GAAG,QAAQ,MAAM,gBAAgB,aAAa;IAC5C,WAAW,QAAQ;IACnB,MAAM,SAAS,QAAQ;IACvB,YAAY,SAAS,QAAQ;IAC7B,QAAQ,MAAM;GAChB,CAAC;IACA,MAAM,YAAY;IAClB,MAAM,OAAO,SAAS,QAAQ;IAC9B,MAAM,aAAa,SAAS,QAAQ;IACpC,MAAM,YAAY,QAAQ;IAC1B,MAAM,QAAQ,QAAQ,MAAM,gBAAgB;IAC5C,MAAM,UAAU,MAAM;IACtB,MAAM,gBAAgB;EACzB,GACA,GAAG,MAAM,YAAY,OAAO,CAC9B;EAEA,MAAM,OAAO,SAAS;EACtB,OAAO,OAAO,SAAS;EAEvB,OAAO;CACT,CAAC;CAED,MAAM,gBAAgB,SAAc,SAAuB,SAAiB,aAAqB;EAC/F,MAAM,QAAQ,QAAQ,KAAK;EAE3B,OAAO,GAAG,yBAAyB,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,GAAG,MAAM,YAAY,QAAQ,SAAS,CAAC,GAAG,MAAM,eAAe,EAAE,MAAM,SAAS,MAAM;CACxK;CA8KA,OAAO;EAAE;EAAkB,iBA5KH,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,WAAW,MAAM;GAEvB,IACE,SAAS,QAAQ,SAAS,gBAC1B,SAAS,YAAY,gBACrB,SAAS,aAAa,QAAQ,UAE9B,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,UAAU,OAAO,WAAW,OAAO;GAEzC,IAAI,YAAY,KAAA,KAAa,CAAC,iBAAiB,UAAU,MAAM,QAAQ,OAAO,GAC5E,OAAO,EAAE,MAAM,WAAW;GAC5B,OAAO,cAAc,OAAO;GAC5B,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS,QAAQ,SAAS,SAAS;GAElF,IAAI,YAAY,KAAA,KAAa,CAAC,aAAa,QAAQ,UAAU,SAAS,QAAQ,QAAQ,GACpF,OAAO,EAAE,MAAM,WAAW;GAC5B,OAAO,iBAAiB,OAAO;GAC/B,MAAM,SAAS,iBAAiB,SAAS,OAAO;GAChD,MAAM,UAAU,KAAK,IAAI,OAAO,oBAAoB,MAAM,WAAW,kBAAkB;GAEvF,MAAM,OAAM,OADQ,eAAe,SAAS,SAAS,SAAS,QAAQ,IAAI,EAAA,CACzD,KAAK,QAAQ,IAAI,QAAQ,KAAK,WAAW,qBAAqB;GAE/E,IACE,IAAI,WAAW,SAAS,mBAAmB,UAC3C,CAAC,IAAI,OAAO,OAAO,SAAS,mBAAmB,MAAM,SAAS,KAAK,OAAO,EAAE,CAAC,KAC7E,EAAE,OAAO,MAAM,MAAM,aAAa,SAAS,SAAS,SAAS,CAAC,CAAC,IAE/D,OAAO,EAAE,MAAM,WAAW;GAC5B,IACE,EAAE,OAAO,gBACP,SACA,SACA,MAAM,eACN;IACE,QAAQ;IACR,WAAW,SAAS;IACpB,QAAQ,SAAS;IACjB,eAAe,iBAAiB,QAAQ;IACxC,UAAU,SAAS,QAAQ;GAC7B,GACA;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,CACF,IAEA,OAAO,EAAE,MAAM,WAAW;GAC5B,UACE,OAAOA,gBAAS,OAAO,SAAS,SAAS,OAAO,MAC9C,OAAOA,gBAAS,OAAO,SAAS;IAC9B,GAAG,SAAS;IACZ,eAAe,MAAM;GACvB,CAAC,CACL;GACA,MAAM,SAAS,OAAO,eAAe,SAAS,UAAU,MAAM,MAAM;GAEpE,IAAI,OAAO,SAAS,UAAU,OAAO;GACrC,UAAU,OAAO,iBAAiB,SAAS,SAAS,UAAU,IAAI,CAAC;GACnE,MAAM,eAAe,KAAK,aAAa,SAAS,SAAS,SAAS,CAAC,CAAC;GAEpE,OAAO;EACT,CAsGyC;EAAG,oBApGjB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACjE,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,WAAW,MAAM,MAAM;GAE7B,IACE,SAAS,QAAQ,SAAS,gBAC1B,SAAS,YAAY,gBACrB,SAAS,aAAa,QAAQ,UAE9B,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,UAAU,OAAO,WAAW,OAAO;GAEzC,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACrD,OAAO,cAAc,OAAO;GAC5B,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS,QAAQ,SAAS,SAAS;GAElF,OAAO,iBAAiB,OAAO;GAC/B,MAAM,OAAO,OAAO,SAAS,SAAS,SAAS,MAAM;GAErD,IAAI,SAAS,KAAA,KAAa,CAAC,WAAW,MAAM,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,WAAW;GAEpF,MAAM,SAAS,OAAO,IAAI,aAAa;IACrC,OAAO,aAAa,SAAS,MAAM,UAAU;IAE7C,OAAO,EAAE,MAAM,WAAW;GAC5B,CAAC;GAED,IACE,YAAY,KAAA,KACZ,CAAC,aAAa,QAAQ,UAAU,SAAS,QAAQ,QAAQ,KACzD,CAAC,iBAAiB,UAAU,KAAK,QAAQ,OAAO,KAChD,CAAC,kBAAkB,UAAU,MAAM,QAAQ,KAC3C,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,UAAU,MAAM,KAAK,CAAC,IAElE,OAAO,OAAO;GAChB,MAAM,SAAS,iBAAiB,SAAS,OAAO;GAChD,MAAM,UAAU,KAAK,IAAI,OAAO,oBAAoB,MAAM,WAAW,kBAAkB;GAEvF,IACE,EAAE,OAAO,MAAM,MAAM,aAAa,SAAS,SAAS,SAAS,CAAC,CAAC,MAC/D,EAAE,OAAO,iBAAiB,SAAS,SAAS,UAAU,KAAK,IAE3D,OAAO,OAAO;GAChB,IACE,EAAE,OAAO,gBACP,SACA,SACA,MAAM,eACN;IACE,QAAQ;IACR,WAAW,SAAS;IACpB,QAAQ,SAAS;IACjB,eAAe,OAAOA,iBAAU,QAAQ;IACxC,UAAU,SAAS,QAAQ;GAC7B,GACA;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,GACA,SAAS,QAAQ,cAAc,WACjC,IAEA,OAAO,OAAO;GAChB,MAAM,QAAQ,QAAQ,KAAK;GAE3B,MAAM,MAAM,iBAAiB,SAAS,QAAQ,MAAM,MAAM,SAAS,oBAAoB;GAEvF,KACG,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,OAAO,GAAG,MAAM,gBAAgB,IAAI,CAAC,GAAG;IAClF,OAAO;IACP,SAAS;GACX,CAAC,EAAA,CAAG,KAAK,WAAW,GAEpB,OAAO,OAAO;GAChB,OAAO,YAAY,SAAS,UAAU,KAAK,QAAQ,QAAQ,SAAS;GACpE,OAAO,eAAe,SAAS,UAAU,QAAQ,SAAS;GAE1D,MAAM,OAAO,OAAO,iBAClB,SACA,SACA,UACA,MAAM,UACN,OAAO,MAAM,IAAI,QAAQ,KAAK,CAChC;GAEA,OAAO,aAAa,SAAS,MAAM,UAAU;GAC7C,MAAM,eAAe,KACnB,cAAc,SAAS,UAAU,MAAM,KAAK,GAC5C,aAAa,SAAS,SAAS,SAAS,CAAC,CAC3C;GAEA,OAAO;IAAE,MAAM;IAAY,YAAY;GAAK;EAC9C,CAE6D;CAAE;AACjE"}
+{"version":3,"file":"enrollment.mjs","names":["Ceremony"],"sources":["../../../src/internal/passkey/enrollment.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport {\n  type PasskeyCeremony,\n  PasskeyCeremony as Ceremony,\n  type PasskeyManagementPersistence,\n} from \"@yielded/auth/Passkey\";\nimport { Effect } from \"effect\";\n\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport type { makePasskeyAdmissionKernel } from \"./admission\";\nimport type { makePasskeyCredentialsKernel } from \"./credentials\";\nimport type { makePasskeyFlowKernel } from \"./flow\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\nimport type { WriteSubject, makePasskeyWriteStateKernel } from \"./write-state\";\n\ntype Issue = Parameters<PasskeyManagementPersistence[\"Service\"][\"issueEnrollment\"]>[0];\n\ntype Complete = Parameters<PasskeyManagementPersistence[\"Service\"][\"completeEnrollment\"]>[0];\n\nexport const makePasskeyEnrollmentKernel = (\n  operations: QueryOperations,\n  admission: Pick<\n    ReturnType<typeof makePasskeyAdmissionKernel>,\n    \"lockAdmission\" | \"readCharges\" | \"guardChargeSet\"\n  >,\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"readModule\" | \"readPolicyGuards\"\n  >,\n  flow: Pick<\n    ReturnType<typeof makePasskeyFlowKernel>,\n    | \"compatiblePolicy\"\n    | \"exactClaim\"\n    | \"issueAssertion\"\n    | \"liveCondition\"\n    | \"readFlow\"\n    | \"terminalFlow\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    \"equal\" | \"handleKey\" | \"invariant\" | \"sameRevision\" | \"credentialKey\"\n  >,\n  writeState: Pick<\n    ReturnType<typeof makePasskeyWriteStateKernel>,\n    | \"authorizeAction\"\n    | \"credentialRows\"\n    | \"currentSubject\"\n    | \"enrollmentDigest\"\n    | \"digest\"\n    | \"insertCredential\"\n    | \"managementPolicy\"\n    | \"validRegistration\"\n  >,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n  const { sql } = operations;\n  const { lockAdmission, readCharges, guardChargeSet } = admission;\n  const { readModule, readPolicyGuards } = credentials;\n\n  const { compatiblePolicy, exactClaim, issueAssertion, liveCondition, readFlow, terminalFlow } =\n    flow;\n\n  const { equal, handleKey, sameRevision, credentialKey: credentialKeyFor } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    authorizeAction,\n    credentialRows,\n    currentSubject,\n    enrollmentDigest,\n    digest,\n    insertCredential,\n    managementPolicy,\n    validRegistration,\n  } = writeState;\n\n  const { both } = transactions;\n\n  const enrollmentHandle = Effect.fn(\"passkey.enrollmentHandle\")(function* (\n    mapping: any,\n    subject: WriteSubject,\n    ceremony: PasskeyCeremony,\n    create: boolean,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    invariant(ceremony.context._tag === \"Enrollment\");\n    const table = mapping.read.handleOwnership;\n\n    const where = equal(table.table, {\n      [table.rpId]: ceremony.profile.rpId,\n      [table.subjectId]: subject.nativeId,\n    });\n\n    const found = yield* owner.read(table.table, where, { limit: 1 });\n    const row = found.rows[0];\n    const hashed = yield* handleKey(ceremony.profile.rpId, ceremony.context.userHandle);\n\n    if (row !== undefined)\n      return (\n        table.isOwnedState(row[table.state]) &&\n        row[table.handleKey] === hashed &&\n        row[table.userHandle] === ceremony.context.userHandle &&\n        mapping.read.subjectIds.equals(table.decodeSubjectId(row), subject.nativeId)\n      );\n    if (!create) return false;\n\n    const absent = yield* owner.read(\n      table.table,\n      equal(table.table, { [table.handleKey]: hashed }),\n      {\n        limit: 1,\n      },\n    );\n\n    if (absent.rows.length !== 0) return false;\n\n    const inserted = yield* owner.insert(\n      table.table,\n      {\n        ...mapping.write.handleOwnership.encodeInsert({\n          subjectId: subject.nativeId,\n          rpId: ceremony.profile.rpId,\n          userHandle: ceremony.context.userHandle,\n          marker: owner.marker,\n        }),\n        [table.handleKey]: hashed,\n        [table.rpId]: ceremony.profile.rpId,\n        [table.userHandle]: ceremony.context.userHandle,\n        [table.subjectId]: subject.nativeId,\n        [table.state]: mapping.write.handleOwnership.ownedState,\n        [table.version]: owner.marker,\n        [table.reservationId]: null,\n      },\n      { [table.handleKey]: hashed },\n    );\n\n    found.rows = inserted.rows;\n    absent.rows = inserted.rows;\n\n    return true;\n  });\n\n  const capCondition = (mapping: any, subject: WriteSubject, maximum: number, addition: number) => {\n    const table = mapping.read.credential;\n\n    return sql`(select count(*) from ${table.table} where ${both(equal(table.table, { [table.subjectId]: subject.nativeId }), table.activeCondition)}) + ${addition} <= ${maximum}`;\n  };\n\n  const issueEnrollment = Effect.fn(\"passkey.issueEnrollment\")(function* (\n    mapping: any,\n    input: Issue,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const ceremony = input.ceremony;\n\n    if (\n      ceremony.context._tag !== \"Enrollment\" ||\n      ceremony.purpose !== \"enrollment\" ||\n      ceremony.moduleId !== mapping.moduleId\n    )\n      return { _tag: \"Rejected\" } as const;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined || !compatiblePolicy(ceremony, input.policy, current))\n      return { _tag: \"Rejected\" } as const;\n    yield* lockAdmission(mapping);\n    const subject = yield* currentSubject(mapping, ceremony.context.revision.subjectId);\n\n    if (subject === undefined || !sameRevision(subject.revision, ceremony.context.revision))\n      return { _tag: \"Rejected\" } as const;\n    yield* readPolicyGuards(mapping);\n    const policy = managementPolicy(mapping, subject);\n    const maximum = Math.min(policy.maximumCredentials, input.management.maximumCredentials);\n    const rows = yield* credentialRows(mapping, subject, ceremony.profile.rpId);\n    const ids = rows.map((row) => row[mapping.read.credential.protocolCredentialId]);\n\n    if (\n      ids.length !== ceremony.allowedCredentials.length ||\n      !ids.every((id) => ceremony.allowedCredentials.some((item) => item.id === id)) ||\n      !(yield* owner.check(capCondition(mapping, subject, maximum, 1)))\n    )\n      return { _tag: \"Rejected\" } as const;\n    if (\n      !(yield* authorizeAction(\n        mapping,\n        subject,\n        input.authorization,\n        {\n          action: \"enroll-begin\",\n          commandId: ceremony.commandId,\n          flowId: ceremony.flowId,\n          bindingDigest: yield* enrollmentDigest(ceremony),\n          revision: ceremony.context.revision,\n        },\n        {\n          ...policy,\n          maximumEvidenceAgeMillis: Math.min(\n            policy.maximumEvidenceAgeMillis,\n            input.management.maximumEvidenceAgeMillis,\n          ),\n        },\n      ))\n    )\n      return { _tag: \"Rejected\" } as const;\n    invariant(\n      (yield* digest(Ceremony.fields.context, ceremony.context)) ===\n        (yield* digest(Ceremony.fields.context, {\n          ...ceremony.context,\n          authorization: input.authorization,\n        })),\n    );\n    const issued = yield* issueAssertion(mapping, ceremony, input.policy);\n\n    if (issued._tag !== \"Issued\") return issued;\n    invariant(yield* enrollmentHandle(mapping, subject, ceremony, true));\n    owner.postconditions.push(capCondition(mapping, subject, maximum, 1));\n\n    return issued;\n  });\n\n  const completeEnrollment = Effect.fn(\"passkey.completeEnrollment\")(function* (\n    mapping: any,\n    input: Complete,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const ceremony = input.claim.ceremony;\n\n    if (\n      ceremony.context._tag !== \"Enrollment\" ||\n      ceremony.purpose !== \"enrollment\" ||\n      ceremony.moduleId !== mapping.moduleId\n    )\n      return { _tag: \"Rejected\" } as const;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined) return { _tag: \"Rejected\" } as const;\n    yield* lockAdmission(mapping);\n    const subject = yield* currentSubject(mapping, ceremony.context.revision.subjectId);\n\n    yield* readPolicyGuards(mapping);\n    const read = yield* readFlow(mapping, ceremony.flowId);\n\n    if (read === undefined || !exactClaim(read, input.claim)) return { _tag: \"Rejected\" } as const;\n\n    const reject = Effect.gen(function* () {\n      yield* terminalFlow(mapping, read, \"Rejected\");\n\n      return { _tag: \"Rejected\" } as const;\n    });\n\n    if (\n      subject === undefined ||\n      !sameRevision(subject.revision, ceremony.context.revision) ||\n      !compatiblePolicy(ceremony, read.policy, current) ||\n      !validRegistration(ceremony, input.verified) ||\n      !(yield* owner.check(liveCondition(mapping, ceremony, input.claim)))\n    )\n      return yield* reject;\n    const policy = managementPolicy(mapping, subject);\n    const maximum = Math.min(policy.maximumCredentials, input.management.maximumCredentials);\n\n    if (\n      !(yield* owner.check(capCondition(mapping, subject, maximum, 1))) ||\n      !(yield* enrollmentHandle(mapping, subject, ceremony, false))\n    )\n      return yield* reject;\n    if (\n      !(yield* authorizeAction(\n        mapping,\n        subject,\n        input.authorization,\n        {\n          action: \"enroll-complete\",\n          commandId: ceremony.commandId,\n          flowId: ceremony.flowId,\n          bindingDigest: yield* digest(Ceremony, ceremony),\n          revision: ceremony.context.revision,\n        },\n        {\n          ...policy,\n          maximumEvidenceAgeMillis: Math.min(\n            policy.maximumEvidenceAgeMillis,\n            input.management.maximumEvidenceAgeMillis,\n          ),\n        },\n        ceremony.context.authorization.requirement,\n      ))\n    )\n      return yield* reject;\n    const tuple = mapping.read.credentialOwnership;\n    // Credential ownership is RP-global, including retained registration custody.\n    const key = yield* credentialKeyFor(ceremony.profile.rpId, input.verified.protocolCredentialId);\n\n    if (\n      (yield* owner.read(tuple.table, equal(tuple.table, { [tuple.credentialKey]: key }), {\n        limit: 1,\n        observe: false,\n      })).rows.length !== 0\n    )\n      return yield* reject;\n    yield* readCharges(mapping, ceremony, read.policy, subject.subjectId);\n    yield* guardChargeSet(mapping, ceremony, subject.subjectId);\n\n    const safe = yield* insertCredential(\n      mapping,\n      subject,\n      ceremony,\n      input.verified,\n      yield* owner.now(mapping.clock),\n    );\n\n    yield* terminalFlow(mapping, read, \"Verified\");\n    owner.postconditions.push(\n      liveCondition(mapping, ceremony, input.claim),\n      capCondition(mapping, subject, maximum, 0),\n    );\n\n    return { _tag: \"Enrolled\", credential: safe } as const;\n  });\n\n  return { enrollmentHandle, issueEnrollment, completeEnrollment };\n};\n"],"mappings":";;;;AAsBA,MAAa,+BACX,YACA,WAIA,aAIA,MASA,OAIA,YAWA,iBACG;CACH,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,eAAe,aAAa,mBAAmB;CACvD,MAAM,EAAE,YAAY,qBAAqB;CAEzC,MAAM,EAAE,kBAAkB,YAAY,gBAAgB,eAAe,UAAU,iBAC7E;CAEF,MAAM,EAAE,OAAO,WAAW,cAAc,eAAe,qBAAqB;CAC5E,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,iBACA,gBACA,gBACA,kBACA,QACA,kBACA,kBACA,sBACE;CAEJ,MAAM,EAAE,SAAS;CAEjB,MAAM,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,SACA,UACA,QACA;EACA,MAAM,QAAQ,OAAO;EAErB,UAAU,SAAS,QAAQ,SAAS,YAAY;EAChD,MAAM,QAAQ,QAAQ,KAAK;EAE3B,MAAM,QAAQ,MAAM,MAAM,OAAO;IAC9B,MAAM,OAAO,SAAS,QAAQ;IAC9B,MAAM,YAAY,QAAQ;EAC7B,CAAC;EAED,MAAM,QAAQ,OAAO,MAAM,KAAK,MAAM,OAAO,OAAO,EAAE,OAAO,EAAE,CAAC;EAChE,MAAM,MAAM,MAAM,KAAK;EACvB,MAAM,SAAS,OAAO,UAAU,SAAS,QAAQ,MAAM,SAAS,QAAQ,UAAU;EAElF,IAAI,QAAQ,KAAA,GACV,OACE,MAAM,aAAa,IAAI,MAAM,MAAM,KACnC,IAAI,MAAM,eAAe,UACzB,IAAI,MAAM,gBAAgB,SAAS,QAAQ,cAC3C,QAAQ,KAAK,WAAW,OAAO,MAAM,gBAAgB,GAAG,GAAG,QAAQ,QAAQ;EAE/E,IAAI,CAAC,QAAQ,OAAO;EAEpB,MAAM,SAAS,OAAO,MAAM,KAC1B,MAAM,OACN,MAAM,MAAM,OAAO,GAAG,MAAM,YAAY,OAAO,CAAC,GAChD,EACE,OAAO,EACT,CACF;EAEA,IAAI,OAAO,KAAK,WAAW,GAAG,OAAO;EAErC,MAAM,WAAW,OAAO,MAAM,OAC5B,MAAM,OACN;GACE,GAAG,QAAQ,MAAM,gBAAgB,aAAa;IAC5C,WAAW,QAAQ;IACnB,MAAM,SAAS,QAAQ;IACvB,YAAY,SAAS,QAAQ;IAC7B,QAAQ,MAAM;GAChB,CAAC;IACA,MAAM,YAAY;IAClB,MAAM,OAAO,SAAS,QAAQ;IAC9B,MAAM,aAAa,SAAS,QAAQ;IACpC,MAAM,YAAY,QAAQ;IAC1B,MAAM,QAAQ,QAAQ,MAAM,gBAAgB;IAC5C,MAAM,UAAU,MAAM;IACtB,MAAM,gBAAgB;EACzB,GACA,GAAG,MAAM,YAAY,OAAO,CAC9B;EAEA,MAAM,OAAO,SAAS;EACtB,OAAO,OAAO,SAAS;EAEvB,OAAO;CACT,CAAC;CAED,MAAM,gBAAgB,SAAc,SAAuB,SAAiB,aAAqB;EAC/F,MAAM,QAAQ,QAAQ,KAAK;EAE3B,OAAO,GAAG,yBAAyB,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,GAAG,MAAM,YAAY,QAAQ,SAAS,CAAC,GAAG,MAAM,eAAe,EAAE,MAAM,SAAS,MAAM;CACxK;CA8KA,OAAO;EAAE;EAAkB,iBA5KH,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,WAAW,MAAM;GAEvB,IACE,SAAS,QAAQ,SAAS,gBAC1B,SAAS,YAAY,gBACrB,SAAS,aAAa,QAAQ,UAE9B,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,UAAU,OAAO,WAAW,OAAO;GAEzC,IAAI,YAAY,KAAA,KAAa,CAAC,iBAAiB,UAAU,MAAM,QAAQ,OAAO,GAC5E,OAAO,EAAE,MAAM,WAAW;GAC5B,OAAO,cAAc,OAAO;GAC5B,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS,QAAQ,SAAS,SAAS;GAElF,IAAI,YAAY,KAAA,KAAa,CAAC,aAAa,QAAQ,UAAU,SAAS,QAAQ,QAAQ,GACpF,OAAO,EAAE,MAAM,WAAW;GAC5B,OAAO,iBAAiB,OAAO;GAC/B,MAAM,SAAS,iBAAiB,SAAS,OAAO;GAChD,MAAM,UAAU,KAAK,IAAI,OAAO,oBAAoB,MAAM,WAAW,kBAAkB;GAEvF,MAAM,OAAM,OADQ,eAAe,SAAS,SAAS,SAAS,QAAQ,IAAI,EAAA,CACzD,KAAK,QAAQ,IAAI,QAAQ,KAAK,WAAW,qBAAqB;GAE/E,IACE,IAAI,WAAW,SAAS,mBAAmB,UAC3C,CAAC,IAAI,OAAO,OAAO,SAAS,mBAAmB,MAAM,SAAS,KAAK,OAAO,EAAE,CAAC,KAC7E,EAAE,OAAO,MAAM,MAAM,aAAa,SAAS,SAAS,SAAS,CAAC,CAAC,IAE/D,OAAO,EAAE,MAAM,WAAW;GAC5B,IACE,EAAE,OAAO,gBACP,SACA,SACA,MAAM,eACN;IACE,QAAQ;IACR,WAAW,SAAS;IACpB,QAAQ,SAAS;IACjB,eAAe,OAAO,iBAAiB,QAAQ;IAC/C,UAAU,SAAS,QAAQ;GAC7B,GACA;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,CACF,IAEA,OAAO,EAAE,MAAM,WAAW;GAC5B,WACG,OAAO,OAAOA,gBAAS,OAAO,SAAS,SAAS,OAAO,QACrD,OAAO,OAAOA,gBAAS,OAAO,SAAS;IACtC,GAAG,SAAS;IACZ,eAAe,MAAM;GACvB,CAAC,EACL;GACA,MAAM,SAAS,OAAO,eAAe,SAAS,UAAU,MAAM,MAAM;GAEpE,IAAI,OAAO,SAAS,UAAU,OAAO;GACrC,UAAU,OAAO,iBAAiB,SAAS,SAAS,UAAU,IAAI,CAAC;GACnE,MAAM,eAAe,KAAK,aAAa,SAAS,SAAS,SAAS,CAAC,CAAC;GAEpE,OAAO;EACT,CAsGyC;EAAG,oBApGjB,OAAO,GAAG,4BAA4B,CAAC,CAAC,WACjE,SACA,OACA;GACA,MAAM,QAAQ,OAAO;GACrB,MAAM,WAAW,MAAM,MAAM;GAE7B,IACE,SAAS,QAAQ,SAAS,gBAC1B,SAAS,YAAY,gBACrB,SAAS,aAAa,QAAQ,UAE9B,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,UAAU,OAAO,WAAW,OAAO;GAEzC,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACrD,OAAO,cAAc,OAAO;GAC5B,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS,QAAQ,SAAS,SAAS;GAElF,OAAO,iBAAiB,OAAO;GAC/B,MAAM,OAAO,OAAO,SAAS,SAAS,SAAS,MAAM;GAErD,IAAI,SAAS,KAAA,KAAa,CAAC,WAAW,MAAM,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,WAAW;GAEpF,MAAM,SAAS,OAAO,IAAI,aAAa;IACrC,OAAO,aAAa,SAAS,MAAM,UAAU;IAE7C,OAAO,EAAE,MAAM,WAAW;GAC5B,CAAC;GAED,IACE,YAAY,KAAA,KACZ,CAAC,aAAa,QAAQ,UAAU,SAAS,QAAQ,QAAQ,KACzD,CAAC,iBAAiB,UAAU,KAAK,QAAQ,OAAO,KAChD,CAAC,kBAAkB,UAAU,MAAM,QAAQ,KAC3C,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,UAAU,MAAM,KAAK,CAAC,IAElE,OAAO,OAAO;GAChB,MAAM,SAAS,iBAAiB,SAAS,OAAO;GAChD,MAAM,UAAU,KAAK,IAAI,OAAO,oBAAoB,MAAM,WAAW,kBAAkB;GAEvF,IACE,EAAE,OAAO,MAAM,MAAM,aAAa,SAAS,SAAS,SAAS,CAAC,CAAC,MAC/D,EAAE,OAAO,iBAAiB,SAAS,SAAS,UAAU,KAAK,IAE3D,OAAO,OAAO;GAChB,IACE,EAAE,OAAO,gBACP,SACA,SACA,MAAM,eACN;IACE,QAAQ;IACR,WAAW,SAAS;IACpB,QAAQ,SAAS;IACjB,eAAe,OAAO,OAAOA,iBAAU,QAAQ;IAC/C,UAAU,SAAS,QAAQ;GAC7B,GACA;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,GACA,SAAS,QAAQ,cAAc,WACjC,IAEA,OAAO,OAAO;GAChB,MAAM,QAAQ,QAAQ,KAAK;GAE3B,MAAM,MAAM,OAAO,iBAAiB,SAAS,QAAQ,MAAM,MAAM,SAAS,oBAAoB;GAE9F,KACG,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,OAAO,GAAG,MAAM,gBAAgB,IAAI,CAAC,GAAG;IAClF,OAAO;IACP,SAAS;GACX,CAAC,EAAA,CAAG,KAAK,WAAW,GAEpB,OAAO,OAAO;GAChB,OAAO,YAAY,SAAS,UAAU,KAAK,QAAQ,QAAQ,SAAS;GACpE,OAAO,eAAe,SAAS,UAAU,QAAQ,SAAS;GAE1D,MAAM,OAAO,OAAO,iBAClB,SACA,SACA,UACA,MAAM,UACN,OAAO,MAAM,IAAI,QAAQ,KAAK,CAChC;GAEA,OAAO,aAAa,SAAS,MAAM,UAAU;GAC7C,MAAM,eAAe,KACnB,cAAc,SAAS,UAAU,MAAM,KAAK,GAC5C,aAAa,SAAS,SAAS,SAAS,CAAC,CAC3C;GAEA,OAAO;IAAE,MAAM;IAAY,YAAY;GAAK;EAC9C,CAE6D;CAAE;AACjE"}

package/dist/internal/passkey/flow.mjs

@@ -57,7 +57,7 @@ const makePasskeyFlowKernel = (operations, admission, credentials, registrationC
 		invariant(compatiblePolicy(ceremony, policy, policy));
 		const credential = row[table.credentialSnapshot] === null ? void 0 : credentialStorage.decode(row[table.credentialSnapshot]);
 		const subject = credential?.revision.subjectId ?? knownSubject(ceremony);
-		invariant(row[table.subjectScope] === (subject === void 0 ? null : subjectScope(subject)) && row[table.targetScope] === targetScope(ceremony));
+		invariant(row[table.subjectScope] === (subject === void 0 ? null : yield* subjectScope(subject)) && row[table.targetScope] === (yield* targetScope(ceremony)));
 		if (state === "Pending") {
 			invariant(row[table.claimId] === null && row[table.claimedAt] === null && row[table.claimExpiresAt] === null && credential === void 0);
 			return {
@@ -127,8 +127,8 @@ const makePasskeyFlowKernel = (operations, admission, credentials, registrationC
 		}), { limit: 1 });
 		const sameFlow = yield* readFlow(mapping, ceremony.flowId);
 		if (sameCommand.rows.length !== 0 || sameFlow !== void 0) return { _tag: "Rejected" };
-		const kinds = chargeScopes(ceremony, subjectId).map((item) => item.kind);
-		if (!(yield* owner.check(liveCondition(mapping, ceremony))) || !(yield* owner.check(admissionCondition(mapping, [current], ceremony, subjectId, kinds, true, false)))) return { _tag: "Rejected" };
+		const kinds = (yield* chargeScopes(ceremony, subjectId)).map((item) => item.kind);
+		if (!(yield* owner.check(liveCondition(mapping, ceremony))) || !(yield* owner.check(yield* admissionCondition(mapping, [current], ceremony, subjectId, kinds, true, false)))) return { _tag: "Rejected" };
 		const values = {
 			...table.encodeInsert({
 				ceremony,
@@ -153,8 +153,8 @@ const makePasskeyFlowKernel = (operations, admission, credentials, registrationC
 			[table.claimedAt]: null,
 			[table.claimExpiresAt]: null,
 			[table.credentialSnapshot]: null,
-			[table.subjectScope]: subjectId === void 0 ? null : subjectScope(subjectId),
-			[table.targetScope]: targetScope(ceremony)
+			[table.subjectScope]: subjectId === void 0 ? null : yield* subjectScope(subjectId),
+			[table.targetScope]: yield* targetScope(ceremony)
 		};
 		const inserted = yield* owner.insert(table.table, values, {
 			[table.moduleId]: mapping.moduleId,
@@ -216,7 +216,7 @@ const makePasskeyFlowKernel = (operations, admission, credentials, registrationC
 		if (!(yield* owner.check(liveCondition(mapping, read.ceremony)))) return yield* reject;
 		yield* readCharges(mapping, read.ceremony, read.policy, expectedSubject);
 		const resolved = expectedSubject === void 0 && subjectId !== void 0;
-		if (!(yield* owner.check(admissionCondition(mapping, [read.policy, current], read.ceremony, subjectId, resolved ? ["subject"] : [], false, resolved)))) return yield* reject;
+		if (!(yield* owner.check(yield* admissionCondition(mapping, [read.policy, current], read.ceremony, subjectId, resolved ? ["subject"] : [], false, resolved)))) return yield* reject;
 		const claimedAtMillis = yield* owner.now(mapping.clock);
 		const claim = snapshotPasskeySync(PasskeyClaim, {
 			ceremony: read.ceremony,
@@ -235,7 +235,7 @@ const makePasskeyFlowKernel = (operations, admission, credentials, registrationC
 			[table.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),
 			[table.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),
 			[table.credentialSnapshot]: input.credential === void 0 ? null : credentialStorage.encode(input.credential),
-			[table.subjectScope]: subjectId === void 0 ? null : subjectScope(subjectId)
+			[table.subjectScope]: subjectId === void 0 ? null : yield* subjectScope(subjectId)
 		});
 		if (resolved) yield* insertCharges(mapping, read.ceremony, read.policy, ["subject"], subjectId);
 		yield* guardChargeSet(mapping, read.ceremony, subjectId);

package/dist/internal/passkey/flow.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"flow.mjs","names":[],"sources":["../../../src/internal/passkey/flow.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport {\n  PasskeyClaim,\n  type PasskeyAccess,\n  type PasskeyAssertionVerified,\n  type PasskeyCeremony,\n  type PasskeyCredential,\n  type PasskeyEvidence,\n  type PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport { DateTime, Effect } from \"effect\";\n\nimport type { PasskeyFlowState } from \"../models/passkey-model\";\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport type { makePasskeyAdmissionKernel } from \"./admission\";\nimport type { CredentialRead, SubjectRead, makePasskeyCredentialsKernel } from \"./credentials\";\nimport type { makePasskeyRegistrationCustodyKernel } from \"./registration-custody\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport interface FlowRead {\n  readonly row: Record<string, any>;\n  readonly ceremony: PasskeyCeremony;\n  readonly policy: PasskeyMethodPolicy;\n  readonly state: PasskeyFlowState;\n  readonly claim?: PasskeyClaim;\n  readonly credential?: PasskeyCredential;\n}\n\nexport const makePasskeyFlowKernel = (\n  operations: QueryOperations,\n  admission: Pick<\n    ReturnType<typeof makePasskeyAdmissionKernel>,\n    | \"admissionCondition\"\n    | \"chargeScopes\"\n    | \"guardAdmission\"\n    | \"guardChargeSet\"\n    | \"insertCharges\"\n    | \"lockAdmission\"\n    | \"readCharges\"\n  >,\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"readCredential\" | \"readModule\" | \"readPolicyGuards\" | \"readRevision\" | \"readSubject\"\n  >,\n  registrationCustody: Pick<\n    ReturnType<typeof makePasskeyRegistrationCustodyKernel>,\n    \"releaseRegistrationCustody\" | \"scrubRegistrationIntent\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    | \"ceremonyStorage\"\n    | \"col\"\n    | \"credentialStorage\"\n    | \"equal\"\n    | \"existsExact\"\n    | \"invariant\"\n    | \"mappedColumns\"\n    | \"policyStorage\"\n    | \"profileStorage\"\n    | \"sameCredential\"\n    | \"sameRevision\"\n    | \"semanticCredentialColumns\"\n    | \"subjectScope\"\n    | \"targetScope\"\n  >,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n  const { sql } = operations;\n\n  const {\n    admissionCondition,\n    chargeScopes,\n    guardAdmission,\n    guardChargeSet,\n    insertCharges,\n    lockAdmission,\n    readCharges,\n  } = admission;\n\n  const { readCredential, readModule, readPolicyGuards, readRevision, readSubject } = credentials;\n  const { releaseRegistrationCustody, scrubRegistrationIntent } = registrationCustody;\n\n  const {\n    ceremonyStorage,\n    col,\n    credentialStorage,\n    equal,\n    existsExact,\n    mappedColumns,\n    policyStorage,\n    profileStorage,\n    sameCredential,\n    sameRevision,\n    semanticCredentialColumns,\n    subjectScope,\n    targetScope,\n  } = state;\n\n  const invariant: (value: unknown) => asserts value = state.invariant;\n  const { both } = transactions;\n\n  const assertionPurposes = [\"sign-in\", \"pending\", \"step-up\", \"action\"] as const;\n\n  const contextPurpose = {\n    SignIn: \"sign-in\",\n    Pending: \"pending\",\n    StepUp: \"step-up\",\n    Action: \"action\",\n    Enrollment: \"enrollment\",\n    Registration: \"registration\",\n  } as const;\n\n  const knownSubject = (ceremony: PasskeyCeremony): SubjectId | undefined =>\n    \"target\" in ceremony.context\n      ? ceremony.context.target.revision.subjectId\n      : ceremony.context._tag === \"Enrollment\"\n        ? ceremony.context.revision.subjectId\n        : undefined;\n\n  const compatiblePolicy = (\n    ceremony: PasskeyCeremony,\n    original: PasskeyMethodPolicy,\n    current: PasskeyMethodPolicy,\n  ) => {\n    const selected = current.profiles.find(\n      (profile) => profile.profileId === ceremony.profile.profileId,\n    );\n\n    const issued = original.profiles.find(\n      (profile) => profile.profileId === ceremony.profile.profileId,\n    );\n\n    return (\n      ceremony.generation === current.generation &&\n      ceremony.generation === original.generation &&\n      selected !== undefined &&\n      issued !== undefined &&\n      profileStorage.encode(selected) === profileStorage.encode(ceremony.profile) &&\n      profileStorage.encode(issued) === profileStorage.encode(ceremony.profile) &&\n      ceremony.claimLifetimeMillis === original.claimLifetimeMillis &&\n      ceremony.expiresAtMillis > ceremony.issuedAtMillis &&\n      ceremony.expiresAtMillis <= ceremony.requestBindingExpiresAtMillis &&\n      ceremony.expiresAtMillis - ceremony.issuedAtMillis <= original.lifetimeMillis &&\n      ceremony.expiresAtMillis - ceremony.issuedAtMillis <= current.lifetimeMillis &&\n      ceremony.retentionUntilMillis === ceremony.issuedAtMillis + original.retentionMillis &&\n      contextPurpose[ceremony.context._tag] === ceremony.purpose &&\n      new Set(ceremony.allowedCredentials.map((item) => item.id)).size ===\n        ceremony.allowedCredentials.length\n    );\n  };\n\n  const liveCondition = (mapping: any, ceremony: PasskeyCeremony, claim?: PasskeyClaim) => {\n    const now = mapping.clock.engineNowMillis;\n\n    return both(\n      sql`${now} >= ${ceremony.issuedAtMillis}`,\n      sql`${now} < ${ceremony.expiresAtMillis}`,\n      sql`${now} < ${ceremony.requestBindingExpiresAtMillis}`,\n      \"target\" in ceremony.context\n        ? sql`${now} < ${ceremony.context.target.expiresAtMillis}`\n        : undefined,\n      claim === undefined\n        ? undefined\n        : both(\n            sql`${now} >= ${claim.claimedAtMillis}`,\n            sql`${now} < ${claim.claimExpiresAtMillis}`,\n          ),\n    );\n  };\n\n  const matchesAccess = (ceremony: PasskeyCeremony, access: PasskeyAccess) =>\n    ceremony.moduleId === access.moduleId &&\n    ceremony.generation === access.generation &&\n    ceremony.purpose === access.purpose &&\n    ceremony.flowId === access.flowId &&\n    ceremony.requestBindingVerifier === access.requestBindingVerifier &&\n    ceremony.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis;\n\n  const readFlow = Effect.fn(\"passkey.readFlow\")(function* (mapping: any, flowId: string) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.flow;\n\n    const row = (yield* owner.read(\n      table.table,\n      equal(table.table, {\n        [table.moduleId]: mapping.moduleId,\n        [table.flowId]: flowId,\n      }),\n      { limit: 1, columns: mappedColumns(table) },\n    )).rows[0];\n\n    if (row === undefined) return undefined;\n    const ceremony = ceremonyStorage.decode(row[table.snapshot]);\n    const policy = policyStorage.decode(row[table.policySnapshot]);\n\n    const state = Object.keys(table.states).find(\n      (name) => table.states[name] === row[table.state],\n    ) as PasskeyFlowState | undefined;\n\n    invariant(\n      state !== undefined && ceremony.moduleId === mapping.moduleId && ceremony.flowId === flowId,\n    );\n    invariant(\n      row[table.moduleId] === ceremony.moduleId &&\n        row[table.flowId] === ceremony.flowId &&\n        row[table.commandId] === ceremony.commandId,\n    );\n    invariant(\n      row[table.purpose] === ceremony.purpose && row[table.generation] === ceremony.generation,\n    );\n    invariant(\n      row[table.requestBindingVerifier] === ceremony.requestBindingVerifier &&\n        mapping.clock.decodeInstant(row[table.requestBindingExpiresAt]) ===\n          ceremony.requestBindingExpiresAtMillis,\n    );\n    invariant(\n      mapping.clock.decodeInstant(row[table.issuedAt]) === ceremony.issuedAtMillis &&\n        mapping.clock.decodeInstant(row[table.expiresAt]) === ceremony.expiresAtMillis &&\n        mapping.clock.decodeInstant(row[table.retentionUntil]) === ceremony.retentionUntilMillis,\n    );\n    invariant(compatiblePolicy(ceremony, policy, policy));\n\n    const credential =\n      row[table.credentialSnapshot] === null\n        ? undefined\n        : credentialStorage.decode(row[table.credentialSnapshot]);\n\n    const subject = credential?.revision.subjectId ?? knownSubject(ceremony);\n\n    invariant(\n      row[table.subjectScope] === (subject === undefined ? null : subjectScope(subject)) &&\n        row[table.targetScope] === targetScope(ceremony),\n    );\n    if (state === \"Pending\") {\n      invariant(\n        row[table.claimId] === null &&\n          row[table.claimedAt] === null &&\n          row[table.claimExpiresAt] === null &&\n          credential === undefined,\n      );\n\n      return { row, ceremony, policy, state };\n    }\n\n    const claim =\n      row[table.claimId] === null\n        ? undefined\n        : snapshotPasskeySync(PasskeyClaim, {\n            ceremony,\n            claimId: row[table.claimId],\n            claimedAtMillis: mapping.clock.decodeInstant(row[table.claimedAt]),\n            claimExpiresAtMillis: mapping.clock.decodeInstant(row[table.claimExpiresAt]),\n          });\n\n    invariant(state !== \"Claimed\" || claim !== undefined);\n    if (claim !== undefined)\n      invariant(\n        claim.claimExpiresAtMillis ===\n          Math.min(claim.claimedAtMillis + ceremony.claimLifetimeMillis, ceremony.expiresAtMillis),\n      );\n\n    return {\n      row,\n      ceremony,\n      policy,\n      state,\n      ...(claim === undefined ? {} : { claim }),\n      ...(credential === undefined ? {} : { credential }),\n    };\n  });\n\n  const terminalFlow = Effect.fn(\"passkey.terminalFlow\")(function* (\n    mapping: any,\n    read: FlowRead,\n    state: \"Verified\" | \"Rejected\" | \"Ambiguous\",\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.flow;\n\n    yield* owner.update(\n      table.table,\n      { [table.moduleId]: mapping.moduleId, [table.flowId]: read.ceremony.flowId },\n      {\n        [table.state]: table.states[state],\n        [table.version]: owner.marker,\n      },\n    );\n    owner.postconditions.push(\n      yield* existsExact(table.table, {\n        [table.moduleId]: mapping.moduleId,\n        [table.flowId]: read.ceremony.flowId,\n        [table.state]: table.states[state],\n        [table.version]: owner.marker,\n      }),\n    );\n\n    return state;\n  });\n\n  const targetRevision = (ceremony: PasskeyCeremony) =>\n    \"target\" in ceremony.context\n      ? ceremony.context.target.revision\n      : ceremony.context._tag === \"Enrollment\"\n        ? ceremony.context.revision\n        : undefined;\n\n  const currentTarget = Effect.fn(\"passkey.currentTarget\")(function* (\n    mapping: any,\n    subject: SubjectRead | undefined,\n    ceremony: PasskeyCeremony,\n  ) {\n    const target = targetRevision(ceremony);\n\n    if (target === undefined) return true;\n    if (\n      subject === undefined ||\n      subject.subjectId !== target.subjectId ||\n      subject.securityRevision !== target.securityRevision\n    )\n      return false;\n\n    const current = yield* readRevision(\n      mapping.read,\n      subject,\n      target.credentials.map((item) => item.credentialId),\n    );\n\n    return current !== undefined && sameRevision(current, target);\n  });\n\n  const issueAssertion = Effect.fn(\"passkey.issueAssertion\")(function* (\n    mapping: any,\n    ceremony: PasskeyCeremony,\n    suppliedPolicy: PasskeyMethodPolicy,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const current = yield* readModule(mapping);\n\n    if (\n      current === undefined ||\n      ceremony.moduleId !== mapping.moduleId ||\n      !compatiblePolicy(ceremony, suppliedPolicy, current) ||\n      policyStorage.encode(suppliedPolicy) !== policyStorage.encode(current)\n    )\n      return { _tag: \"Rejected\" } as const;\n    yield* lockAdmission(mapping);\n    const subjectId = knownSubject(ceremony);\n\n    const subject =\n      subjectId === undefined ? undefined : yield* readSubject(mapping.read, subjectId);\n\n    yield* readPolicyGuards(mapping);\n    if (!(yield* currentTarget(mapping, subject, ceremony))) return { _tag: \"Rejected\" } as const;\n    if (\n      ceremony.context._tag === \"SignIn\" &&\n      (!ceremony.profile.primarySignIn ||\n        ceremony.profile.userVerification !== \"required\" ||\n        ceremony.profile.residentKey !== \"required\")\n    )\n      return { _tag: \"Rejected\" } as const;\n    const table = mapping.flow;\n\n    const sameCommand = yield* owner.read(\n      table.table,\n      equal(table.table, {\n        [table.moduleId]: mapping.moduleId,\n        [table.commandId]: ceremony.commandId,\n      }),\n      { limit: 1 },\n    );\n\n    const sameFlow = yield* readFlow(mapping, ceremony.flowId);\n\n    if (sameCommand.rows.length !== 0 || sameFlow !== undefined)\n      return { _tag: \"Rejected\" } as const;\n    const kinds = chargeScopes(ceremony, subjectId).map((item) => item.kind);\n\n    if (\n      !(yield* owner.check(liveCondition(mapping, ceremony))) ||\n      !(yield* owner.check(\n        admissionCondition(mapping, [current], ceremony, subjectId, kinds, true, false),\n      ))\n    )\n      return { _tag: \"Rejected\" } as const;\n\n    const values = {\n      ...table.encodeInsert({ ceremony, policy: suppliedPolicy, marker: owner.marker }),\n      [table.moduleId]: ceremony.moduleId,\n      [table.flowId]: ceremony.flowId,\n      [table.commandId]: ceremony.commandId,\n      [table.purpose]: ceremony.purpose,\n      [table.state]: table.states.Pending,\n      [table.version]: owner.marker,\n      [table.generation]: ceremony.generation,\n      [table.snapshot]: ceremonyStorage.encode(ceremony),\n      [table.policySnapshot]: policyStorage.encode(suppliedPolicy),\n      [table.requestBindingVerifier]: ceremony.requestBindingVerifier,\n      [table.requestBindingExpiresAt]: mapping.clock.encodeInstant(\n        ceremony.requestBindingExpiresAtMillis,\n      ),\n      [table.issuedAt]: mapping.clock.encodeInstant(ceremony.issuedAtMillis),\n      [table.expiresAt]: mapping.clock.encodeInstant(ceremony.expiresAtMillis),\n      [table.retentionUntil]: mapping.clock.encodeInstant(ceremony.retentionUntilMillis),\n      [table.claimId]: null,\n      [table.claimedAt]: null,\n      [table.claimExpiresAt]: null,\n      [table.credentialSnapshot]: null,\n      [table.subjectScope]: subjectId === undefined ? null : subjectScope(subjectId),\n      [table.targetScope]: targetScope(ceremony),\n    };\n\n    // Empty-key observations now expect this exact inserted row as well.\n    const inserted = yield* owner.insert(table.table, values, {\n      [table.moduleId]: mapping.moduleId,\n      [table.flowId]: ceremony.flowId,\n    });\n\n    sameCommand.rows = inserted.rows;\n    for (const observation of owner.observations)\n      if (observation.table === table.table && observation.rows.length === 0)\n        observation.rows = inserted.rows;\n    yield* insertCharges(mapping, ceremony, suppliedPolicy, kinds, subjectId);\n    yield* guardChargeSet(mapping, ceremony, subjectId);\n    yield* guardAdmission(mapping, [current], ceremony, subjectId);\n    owner.postconditions.push(liveCondition(mapping, ceremony));\n\n    return { _tag: \"Issued\", ceremony } as const;\n  });\n\n  const contextAssertion = Effect.fn(\"passkey.contextAssertion\")(function* (\n    mapping: any,\n    access: PasskeyAccess,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    if (access.moduleId !== mapping.moduleId) return undefined;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined) return undefined;\n    yield* readPolicyGuards(mapping);\n    const read = yield* readFlow(mapping, access.flowId);\n\n    if (\n      read === undefined ||\n      read.state !== \"Pending\" ||\n      !matchesAccess(read.ceremony, access) ||\n      !compatiblePolicy(read.ceremony, read.policy, current)\n    )\n      return undefined;\n    if (!(yield* owner.check(liveCondition(mapping, read.ceremony)))) return undefined;\n    owner.postconditions.push(liveCondition(mapping, read.ceremony));\n\n    return read.ceremony;\n  });\n\n  const claimAssertion = Effect.fn(\"passkey.claimAssertion\")(function* (\n    mapping: any,\n    input: {\n      readonly access: PasskeyAccess;\n      readonly policy: PasskeyMethodPolicy;\n      readonly ceremony: PasskeyCeremony;\n      readonly claimId: string;\n      readonly credential?: PasskeyCredential;\n    },\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined || input.access.moduleId !== mapping.moduleId)\n      return { _tag: \"Rejected\" } as const;\n    yield* lockAdmission(mapping);\n    const expectedSubject = knownSubject(input.ceremony);\n    const subjectId = expectedSubject ?? input.credential?.revision.subjectId;\n\n    const subject =\n      subjectId === undefined ? undefined : yield* readSubject(mapping.read, subjectId);\n\n    yield* readPolicyGuards(mapping);\n\n    const requested =\n      targetRevision(input.ceremony)?.credentials.map((item) => item.credentialId) ??\n      input.credential?.revision.credentials.map((item) => item.credentialId);\n\n    const credential =\n      input.credential === undefined || subject === undefined\n        ? undefined\n        : yield* readCredential(\n            mapping.read,\n            subject,\n            input.ceremony.profile.rpId,\n            input.credential.protocolCredentialId,\n            requested,\n          );\n\n    const read = yield* readFlow(mapping, input.access.flowId);\n\n    if (\n      read === undefined ||\n      read.state !== \"Pending\" ||\n      !matchesAccess(read.ceremony, input.access)\n    )\n      return { _tag: \"Rejected\" } as const;\n    invariant(ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(input.ceremony));\n\n    const reject = Effect.gen(function* () {\n      yield* terminalFlow(mapping, read, \"Rejected\");\n\n      return { _tag: \"Rejected\" } as const;\n    });\n\n    if (\n      !compatiblePolicy(read.ceremony, read.policy, current) ||\n      policyStorage.encode(input.policy) !== policyStorage.encode(current) ||\n      !(yield* currentTarget(mapping, subject, read.ceremony))\n    )\n      return yield* reject;\n    if (\n      input.credential !== undefined &&\n      (credential === undefined || !sameCredential(input.credential, credential.credential))\n    )\n      return yield* reject;\n    if (input.credential !== undefined && credential !== undefined) {\n      const original = input.credential.revision;\n      const actual = credential.credential.revision;\n      const ids = [...new Set([...(requested ?? []), input.credential.credentialId])];\n\n      if (\n        original.subjectId !== actual.subjectId ||\n        original.securityRevision !== actual.securityRevision ||\n        ids.some((id) => {\n          const before = original.credentials.find((item) => item.credentialId === id);\n          const after = actual.credentials.find((item) => item.credentialId === id);\n\n          // A target can include non-passkey factors absent from the minimum\n          // lookup snapshot; currentTarget independently checks those originals.\n          return (\n            after === undefined ||\n            (before === undefined\n              ? id === input.credential?.credentialId || targetRevision(read.ceremony) === undefined\n              : before.revision !== after.revision)\n          );\n        })\n      )\n        return yield* reject;\n    }\n    if (!(yield* owner.check(liveCondition(mapping, read.ceremony)))) return yield* reject;\n    yield* readCharges(mapping, read.ceremony, read.policy, expectedSubject);\n    const resolved = expectedSubject === undefined && subjectId !== undefined;\n\n    if (\n      !(yield* owner.check(\n        admissionCondition(\n          mapping,\n          [read.policy, current],\n          read.ceremony,\n          subjectId,\n          resolved ? [\"subject\"] : [],\n          false,\n          resolved,\n        ),\n      ))\n    )\n      return yield* reject;\n    const claimedAtMillis = yield* owner.now(mapping.clock);\n\n    const claim = snapshotPasskeySync(PasskeyClaim, {\n      ceremony: read.ceremony,\n      claimId: input.claimId,\n      claimedAtMillis,\n      claimExpiresAtMillis: Math.min(\n        claimedAtMillis + read.ceremony.claimLifetimeMillis,\n        read.ceremony.expiresAtMillis,\n      ),\n    });\n\n    const table = mapping.flow;\n\n    yield* owner.update(\n      table.table,\n      { [table.moduleId]: mapping.moduleId, [table.flowId]: read.ceremony.flowId },\n      {\n        [table.state]: table.states.Claimed,\n        [table.version]: owner.marker,\n        [table.claimId]: claim.claimId,\n        [table.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),\n        [table.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),\n        [table.credentialSnapshot]:\n          input.credential === undefined ? null : credentialStorage.encode(input.credential),\n        [table.subjectScope]: subjectId === undefined ? null : subjectScope(subjectId),\n      },\n    );\n    if (resolved) yield* insertCharges(mapping, read.ceremony, read.policy, [\"subject\"], subjectId);\n    yield* guardChargeSet(mapping, read.ceremony, subjectId);\n    yield* guardAdmission(mapping, [read.policy, current], read.ceremony, subjectId);\n    owner.postconditions.push(liveCondition(mapping, read.ceremony, claim));\n\n    return { _tag: \"Claimed\", claim } as const;\n  });\n\n  const exactClaim = (read: FlowRead, claim: PasskeyClaim) =>\n    read.state === \"Claimed\" &&\n    read.claim !== undefined &&\n    read.claim.claimId === claim.claimId &&\n    read.claim.claimedAtMillis === claim.claimedAtMillis &&\n    read.claim.claimExpiresAtMillis === claim.claimExpiresAtMillis &&\n    ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(claim.ceremony);\n\n  const evidenceMatches = (\n    ceremony: PasskeyCeremony,\n    captured: PasskeyCredential,\n    credential: PasskeyCredential,\n    assertion: PasskeyAssertionVerified,\n    evidence: typeof PasskeyEvidence.Type,\n  ) => {\n    const proof = evidence.proofs[0];\n    const target = targetRevision(ceremony);\n    const original = target ?? captured.revision;\n\n    const ids = [\n      ...new Set([\n        ...original.credentials.map((item) => item.credentialId),\n        credential.credentialId,\n      ]),\n    ];\n\n    const expected = {\n      ...credential.revision,\n      credentials: credential.revision.credentials.filter((item) =>\n        ids.includes(item.credentialId),\n      ),\n    };\n\n    const selected = captured.revision.credentials.find(\n      (item) => item.credentialId === credential.credentialId,\n    );\n\n    return (\n      evidence.proofs.length === 1 &&\n      proof !== undefined &&\n      proof.method === \"passkey\" &&\n      proof.credentialId === credential.credentialId &&\n      proof.factors.length === 1 &&\n      proof.factors[0] === \"possession\" &&\n      proof.userVerified === assertion.userVerified &&\n      proof.phishingResistant &&\n      DateTime.toEpochMillis(proof.verifiedAt) === ceremony.issuedAtMillis &&\n      evidence.flowId ===\n        (\"target\" in ceremony.context ? ceremony.context.target.flowId : ceremony.flowId) &&\n      evidence.bindingDigest ===\n        (\"target\" in ceremony.context\n          ? ceremony.context.target.bindingDigest\n          : ceremony.requestBindingVerifier) &&\n      expected.credentials.length === ids.length &&\n      sameRevision(evidence.revision, expected) &&\n      original.subjectId === expected.subjectId &&\n      original.securityRevision === expected.securityRevision &&\n      original.credentials.every((item) =>\n        expected.credentials.some(\n          (current) =>\n            current.credentialId === item.credentialId && current.revision === item.revision,\n        ),\n      ) &&\n      selected !== undefined &&\n      expected.credentials.some(\n        (item) =>\n          item.credentialId === selected.credentialId && item.revision === selected.revision,\n      )\n    );\n  };\n\n  const updateTelemetry = Effect.fn(\"passkey.updateTelemetry\")(function* (\n    mapping: any,\n    found: CredentialRead,\n    assertion: PasskeyAssertionVerified,\n    dialect: \"pg\" | \"mysql\" | \"sqlite\",\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.read.credential;\n    const counter = sql`${col(table.table, table.counter)}`;\n    const maximum = sql`${col(table.table, table.maximumCounter)}`;\n\n    const max = (...values: ReadonlyArray<ReturnType<QueryOperations[\"sql\"]>>) =>\n      dialect === \"sqlite\"\n        ? sql`max(${sql.join([...values], sql`, `)})`\n        : sql`greatest(${sql.join([...values], sql`, `)})`;\n\n    const semantic = Object.fromEntries(\n      semanticCredentialColumns(table).map((column) => [column, found.row[column]]),\n    );\n\n    const bs = mapping.telemetry.encodeBackupState(assertion.backupState);\n    const synced = found.credential.backupEligible;\n    const merged = max(counter, maximum, sql`${assertion.counter}`);\n\n    const currentCounter = synced\n      ? sql`1 = 1`\n      : sql`((${counter} = 0 and ${assertion.counter} = 0) or ${counter} < ${assertion.counter})`;\n\n    yield* owner.updateGuarded(\n      table.table,\n      both(owner.exact(table.table, semantic), table.activeCondition, currentCounter),\n      {\n        [table.counter]: synced ? merged : assertion.counter,\n        [table.maximumCounter]: merged,\n        [table.backupState]: bs,\n      },\n      {\n        rows: 1,\n        postcondition: yield* existsExact(\n          table.table,\n          { ...semantic, [table.backupState]: bs },\n          both(\n            synced ? sql`${counter} = ${maximum}` : sql`${counter} = ${assertion.counter}`,\n            sql`${maximum} >= ${assertion.counter}`,\n          ),\n        ),\n      },\n    );\n    const earliest = yield* owner.now(mapping.clock);\n    const lastUsed = sql`${col(table.table, mapping.telemetry.lastUsedAt)}`;\n    const millis = mapping.clock.toMillis(lastUsed);\n\n    yield* owner.finalUpdate(\n      table.table,\n      owner.exact(table.table, semantic),\n      {\n        [mapping.telemetry.lastUsedAt]: mapping.clock.fromMillis(\n          max(sql`coalesce(${millis}, 0)`, mapping.clock.engineNowMillis),\n        ),\n      },\n      {\n        rows: 1,\n        postcondition: yield* existsExact(\n          table.table,\n          semantic,\n          both(sql`${millis} >= ${earliest}`, sql`${millis} <= ${mapping.clock.engineNowMillis}`),\n        ),\n      },\n    );\n  });\n\n  const settleAssertion = Effect.fn(\"passkey.settleAssertion\")(function* (\n    mapping: any,\n    claim: PasskeyClaim,\n    outcome:\n      | { readonly _tag: \"Rejected\" | \"Ambiguous\" }\n      | {\n          readonly _tag: \"Assertion\";\n          readonly credential: PasskeyCredential;\n          readonly assertion: PasskeyAssertionVerified;\n          readonly evidence: typeof PasskeyEvidence.Type;\n        },\n    dialect: \"pg\" | \"mysql\" | \"sqlite\",\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const assertedCredential = outcome._tag === \"Assertion\" ? outcome.credential : undefined;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined || claim.ceremony.moduleId !== mapping.moduleId)\n      return \"Rejected\" as const;\n    yield* lockAdmission(mapping);\n\n    const originalIds =\n      targetRevision(claim.ceremony)?.credentials.map((item) => item.credentialId) ??\n      (outcome._tag === \"Assertion\"\n        ? outcome.credential.revision.credentials.map((item) => item.credentialId)\n        : undefined);\n\n    const subjectId =\n      outcome._tag === \"Assertion\"\n        ? outcome.credential.revision.subjectId\n        : knownSubject(claim.ceremony);\n\n    const subject =\n      subjectId === undefined ? undefined : yield* readSubject(mapping.read, subjectId);\n\n    yield* readPolicyGuards(mapping);\n\n    const found =\n      outcome._tag !== \"Assertion\" || subject === undefined\n        ? undefined\n        : yield* readCredential(\n            mapping.read,\n            subject,\n            claim.ceremony.profile.rpId,\n            outcome.credential.protocolCredentialId,\n            originalIds,\n          );\n\n    const read = yield* readFlow(mapping, claim.ceremony.flowId);\n\n    if (read === undefined || !exactClaim(read, claim)) return \"Rejected\" as const;\n    if (outcome._tag !== \"Assertion\") return yield* terminalFlow(mapping, read, outcome._tag);\n    invariant(assertedCredential !== undefined);\n    const captured = \"credential\" in read ? read.credential : undefined;\n    const assertion = outcome.assertion;\n\n    if (\n      captured === undefined ||\n      found === undefined ||\n      !compatiblePolicy(read.ceremony, read.policy, current) ||\n      !sameCredential(captured, assertedCredential) ||\n      !sameCredential(captured, found.credential)\n    )\n      return yield* terminalFlow(mapping, read, \"Rejected\");\n    const credential = found.credential;\n    const profile = read.ceremony.profile;\n\n    if (\n      assertion.protocolCredentialId !== credential.protocolCredentialId ||\n      (assertion.userHandle !== undefined && assertion.userHandle !== credential.userHandle) ||\n      assertion.backupEligible !== credential.backupEligible ||\n      (assertion.backupState && !assertion.backupEligible) ||\n      (profile.userVerification === \"required\" && !assertion.userVerified) ||\n      !profile.algorithms.includes(credential.algorithm) ||\n      (read.ceremony.allowedCredentials.length !== 0 &&\n        !read.ceremony.allowedCredentials.some(\n          (item) => item.id === credential.protocolCredentialId,\n        )) ||\n      (read.ceremony.purpose === \"sign-in\" &&\n        (assertion.userHandle !== credential.userHandle ||\n          !credential.primarySignIn ||\n          !credential.enrollmentUserVerified ||\n          !credential.profile.primarySignIn ||\n          credential.profile.userVerification !== \"required\" ||\n          !assertion.userVerified)) ||\n      !evidenceMatches(read.ceremony, captured, credential, assertion, outcome.evidence) ||\n      !(yield* owner.check(liveCondition(mapping, read.ceremony, claim)))\n    )\n      return yield* terminalFlow(mapping, read, \"Rejected\");\n    yield* readCharges(mapping, read.ceremony, read.policy, credential.revision.subjectId);\n    yield* guardChargeSet(mapping, read.ceremony, credential.revision.subjectId);\n    yield* updateTelemetry(mapping, found, assertion, dialect);\n    yield* terminalFlow(mapping, read, \"Verified\");\n    owner.postconditions.push(liveCondition(mapping, read.ceremony, claim));\n\n    return \"Verified\" as const;\n  });\n\n  const purposeCondition = (table: any, purposes: ReadonlyArray<string>) =>\n    sql`${col(table.table, table.purpose)} in (${sql.join(\n      purposes.map((purpose) => sql`${purpose}`),\n      sql`, `,\n    )})`;\n\n  const custodyFree = (mapping: any, flowExpression: ReturnType<QueryOperations[\"sql\"]>) => {\n    if (mapping.intent === undefined) return sql`1 = 1`;\n    const intent = mapping.intent;\n\n    return sql`not exists (select 1 from ${intent.table} where ${both(\n      equal(intent.table, { [intent.moduleId]: mapping.moduleId }),\n      sql`${col(intent.table, intent.flowId)} = ${flowExpression}`,\n      intent.custodyCondition,\n    )})`;\n  };\n\n  const flowDue = (mapping: any, purposes: ReadonlyArray<string>) => {\n    const flow = mapping.flow,\n      charge = mapping.charge,\n      now = mapping.clock.engineNowMillis;\n\n    const state = sql`${col(flow.table, flow.state)}`;\n    const retained = sql`${mapping.clock.toMillis(sql`${col(flow.table, flow.retentionUntil)}`)} <= ${now}`;\n\n    const chargeLive = sql`exists (select 1 from ${charge.table} where ${both(\n      equal(charge.table, { [charge.moduleId]: mapping.moduleId }),\n      sql`${col(charge.table, charge.flowId)} = ${col(flow.table, flow.flowId)}`,\n      sql`(${col(charge.table, charge.retainUntil)} is null or ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${now})`,\n    )})`;\n\n    return both(\n      equal(flow.table, { [flow.moduleId]: mapping.moduleId }),\n      purposeCondition(flow, purposes),\n      sql`((${state} = ${flow.states.Pending} and ${mapping.clock.toMillis(sql`${col(flow.table, flow.expiresAt)}`)} <= ${now}) or\n        (${state} = ${flow.states.Claimed} and ${mapping.clock.toMillis(sql`${col(flow.table, flow.claimExpiresAt)}`)} <= ${now}) or\n        (${state} in (${flow.states.Verified}, ${flow.states.Rejected}, ${flow.states.Ambiguous}, ${flow.states.RegistrationAccepted}) and ${retained} and not (${chargeLive}) and ${custodyFree(mapping, sql`${col(flow.table, flow.flowId)}`)}))`,\n    );\n  };\n\n  const chargeDue = (mapping: any, purposes: ReadonlyArray<string>) => {\n    const charge = mapping.charge;\n\n    return both(\n      equal(charge.table, { [charge.moduleId]: mapping.moduleId }),\n      purposeCondition(charge, purposes),\n      sql`${col(charge.table, charge.admittedAt)} is not null and ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} <= ${mapping.clock.engineNowMillis}`,\n      custodyFree(mapping, sql`${col(charge.table, charge.flowId)}`),\n    );\n  };\n\n  /** Flow transitions and row removals share one bound. Prepared hasMore is\n   * predicted from this owner's staged changes, then asserted after final writes. */\n  const cleanupCeremonies = Effect.fn(\"passkey.cleanupCeremonies\")(function* (\n    mapping: any,\n    input: { readonly moduleId: string; readonly nowMillis: number; readonly limit: number },\n    purposes: ReadonlyArray<string>,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    invariant(\n      input.moduleId === mapping.moduleId &&\n        Number.isSafeInteger(input.nowMillis) &&\n        input.nowMillis >= 0 &&\n        Number.isSafeInteger(input.limit) &&\n        input.limit >= 1 &&\n        input.limit <= 1000,\n    );\n    yield* readModule(mapping);\n    yield* lockAdmission(mapping);\n    yield* readPolicyGuards(mapping);\n\n    const flow = mapping.flow,\n      charge = mapping.charge;\n\n    const rows = (yield* owner.read(flow.table, flowDue(mapping, purposes), {\n      limit: input.limit,\n      takeOnly: true,\n      observe: false,\n      orderBy: sql`${col(flow.table, flow.flowId)}`,\n    })).rows;\n\n    const touched: string[] = [];\n    const transitioned: FlowRead[] = [];\n\n    let terminalized = 0,\n      removed = 0;\n\n    for (const candidate of rows) {\n      const read = yield* readFlow(mapping, candidate[flow.flowId]);\n\n      if (read === undefined) continue;\n      invariant(\n        yield* owner.check(\n          sql`exists (select 1 from ${flow.table} where ${both(equal(flow.table, { [flow.moduleId]: mapping.moduleId, [flow.flowId]: read.ceremony.flowId }), flowDue(mapping, purposes))})`,\n        ),\n      );\n      touched.push(read.ceremony.flowId);\n      if (read.state === \"Pending\" || read.state === \"Claimed\") {\n        const deadline =\n          read.state === \"Pending\"\n            ? read.ceremony.expiresAtMillis\n            : read.claim!.claimExpiresAtMillis;\n\n        if (read.state === \"Pending\") yield* releaseRegistrationCustody(mapping, read.ceremony);\n        yield* terminalFlow(mapping, read, read.state === \"Pending\" ? \"Rejected\" : \"Ambiguous\");\n        owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${deadline}`);\n        transitioned.push(read);\n        terminalized++;\n      } else {\n        yield* scrubRegistrationIntent(mapping, read.ceremony);\n        yield* owner.remove(flow.table, {\n          [flow.moduleId]: mapping.moduleId,\n          [flow.flowId]: read.ceremony.flowId,\n        });\n        owner.postconditions.push(\n          sql`${mapping.clock.engineNowMillis} >= ${read.ceremony.retentionUntilMillis}`,\n          custodyFree(mapping, sql`${read.ceremony.flowId}`),\n          sql`not exists (select 1 from ${charge.table} where ${both(\n            equal(charge.table, {\n              [charge.moduleId]: mapping.moduleId,\n              [charge.flowId]: read.ceremony.flowId,\n            }),\n            sql`(${col(charge.table, charge.retainUntil)} is null or ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${mapping.clock.engineNowMillis})`,\n          )})`,\n        );\n        removed++;\n      }\n    }\n    const removedCharges: Array<{ flowId: string; kind: string }> = [];\n    const remaining = input.limit - terminalized - removed;\n\n    if (remaining > 0) {\n      const charges = (yield* owner.read(charge.table, chargeDue(mapping, purposes), {\n        limit: remaining,\n        takeOnly: true,\n        observe: false,\n        orderBy: sql`${col(charge.table, charge.flowId)}, ${col(charge.table, charge.kind)}`,\n      })).rows;\n\n      for (const candidate of charges) {\n        const identity = {\n          [charge.moduleId]: mapping.moduleId,\n          [charge.flowId]: candidate[charge.flowId],\n          [charge.kind]: candidate[charge.kind],\n        };\n\n        const selected = (yield* owner.read(charge.table, equal(charge.table, identity), {\n          limit: 1,\n        })).rows[0];\n\n        invariant(selected !== undefined);\n        const horizon = mapping.clock.decodeInstant(selected[charge.retainUntil]);\n\n        invariant(Number.isSafeInteger(horizon));\n        yield* owner.remove(charge.table, identity);\n        owner.postconditions.push(\n          sql`${mapping.clock.engineNowMillis} >= ${horizon}`,\n          custodyFree(mapping, sql`${candidate[charge.flowId]}`),\n        );\n        removedCharges.push({ flowId: candidate[charge.flowId], kind: candidate[charge.kind] });\n        removed++;\n      }\n    }\n\n    const excludeFlows =\n      touched.length === 0\n        ? undefined\n        : sql`${col(flow.table, flow.flowId)} not in (${sql.join(\n            touched.map((id) => sql`${id}`),\n            sql`, `,\n          )})`;\n\n    const excludeCharges = removedCharges.map(\n      (item) =>\n        sql`not (${equal(charge.table, { [charge.flowId]: item.flowId, [charge.kind]: item.kind })})`,\n    );\n\n    const predicted = sql`exists (select 1 from ${flow.table} where ${both(flowDue(mapping, purposes), excludeFlows)}) or exists (select 1 from ${charge.table} where ${both(chargeDue(mapping, purposes), ...excludeCharges)})`;\n    // A transitioned row cannot also be removed by this call, but may be due now.\n    // Read through check only for unchanged rows; D1's prebatch assertion must use\n    // this predictive predicate, while the final assertion uses actual states.\n    let hasMore = yield* owner.check(predicted);\n\n    for (const read of transitioned) {\n      if (read.ceremony.retentionUntilMillis > (yield* owner.now(mapping.clock))) continue;\n      const liveCharges = sql`exists (select 1 from ${charge.table} where ${both(equal(charge.table, { [charge.moduleId]: mapping.moduleId, [charge.flowId]: read.ceremony.flowId }), sql`${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${mapping.clock.engineNowMillis}`, ...excludeCharges)})`;\n\n      if (\n        !(yield* owner.check(liveCharges)) &&\n        (yield* owner.check(custodyFree(mapping, sql`${read.ceremony.flowId}`)))\n      )\n        hasMore = true;\n    }\n    const actual = sql`exists (select 1 from ${flow.table} where ${flowDue(mapping, purposes)}) or exists (select 1 from ${charge.table} where ${chargeDue(mapping, purposes)})`;\n\n    owner.postconditions.push(hasMore ? actual : sql`not (${actual})`);\n\n    return { terminalized, removed, hasMore };\n  });\n\n  return {\n    assertionPurposes,\n    contextPurpose,\n    knownSubject,\n    compatiblePolicy,\n    liveCondition,\n    matchesAccess,\n    readFlow,\n    terminalFlow,\n    issueAssertion,\n    contextAssertion,\n    claimAssertion,\n    exactClaim,\n    settleAssertion,\n    cleanupCeremonies,\n  };\n};\n"],"mappings":";;;;AAiCA,MAAa,yBACX,YACA,WAUA,aAIA,qBAIA,OAiBA,iBACG;CACH,MAAM,EAAE,QAAQ;CAEhB,MAAM,EACJ,oBACA,cACA,gBACA,gBACA,eACA,eACA,gBACE;CAEJ,MAAM,EAAE,gBAAgB,YAAY,kBAAkB,cAAc,gBAAgB;CACpF,MAAM,EAAE,4BAA4B,4BAA4B;CAEhE,MAAM,EACJ,iBACA,KACA,mBACA,OACA,aACA,eACA,eACA,gBACA,gBACA,cACA,2BACA,cACA,gBACE;CAEJ,MAAM,YAA+C,MAAM;CAC3D,MAAM,EAAE,SAAS;CAEjB,MAAM,oBAAoB;EAAC;EAAW;EAAW;EAAW;CAAQ;CAEpE,MAAM,iBAAiB;EACrB,QAAQ;EACR,SAAS;EACT,QAAQ;EACR,QAAQ;EACR,YAAY;EACZ,cAAc;CAChB;CAEA,MAAM,gBAAgB,aACpB,YAAY,SAAS,UACjB,SAAS,QAAQ,OAAO,SAAS,YACjC,SAAS,QAAQ,SAAS,eACxB,SAAS,QAAQ,SAAS,YAC1B,KAAA;CAER,MAAM,oBACJ,UACA,UACA,YACG;EACH,MAAM,WAAW,QAAQ,SAAS,MAC/B,YAAY,QAAQ,cAAc,SAAS,QAAQ,SACtD;EAEA,MAAM,SAAS,SAAS,SAAS,MAC9B,YAAY,QAAQ,cAAc,SAAS,QAAQ,SACtD;EAEA,OACE,SAAS,eAAe,QAAQ,cAChC,SAAS,eAAe,SAAS,cACjC,aAAa,KAAA,KACb,WAAW,KAAA,KACX,eAAe,OAAO,QAAQ,MAAM,eAAe,OAAO,SAAS,OAAO,KAC1E,eAAe,OAAO,MAAM,MAAM,eAAe,OAAO,SAAS,OAAO,KACxE,SAAS,wBAAwB,SAAS,uBAC1C,SAAS,kBAAkB,SAAS,kBACpC,SAAS,mBAAmB,SAAS,iCACrC,SAAS,kBAAkB,SAAS,kBAAkB,SAAS,kBAC/D,SAAS,kBAAkB,SAAS,kBAAkB,QAAQ,kBAC9D,SAAS,yBAAyB,SAAS,iBAAiB,SAAS,mBACrE,eAAe,SAAS,QAAQ,UAAU,SAAS,WACnD,IAAI,IAAI,SAAS,mBAAmB,KAAK,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,SAC1D,SAAS,mBAAmB;CAElC;CAEA,MAAM,iBAAiB,SAAc,UAA2B,UAAyB;EACvF,MAAM,MAAM,QAAQ,MAAM;EAE1B,OAAO,KACL,GAAG,GAAG,IAAI,MAAM,SAAS,kBACzB,GAAG,GAAG,IAAI,KAAK,SAAS,mBACxB,GAAG,GAAG,IAAI,KAAK,SAAS,iCACxB,YAAY,SAAS,UACjB,GAAG,GAAG,IAAI,KAAK,SAAS,QAAQ,OAAO,oBACvC,KAAA,GACJ,UAAU,KAAA,IACN,KAAA,IACA,KACE,GAAG,GAAG,IAAI,MAAM,MAAM,mBACtB,GAAG,GAAG,IAAI,KAAK,MAAM,sBACvB,CACN;CACF;CAEA,MAAM,iBAAiB,UAA2B,WAChD,SAAS,aAAa,OAAO,YAC7B,SAAS,eAAe,OAAO,cAC/B,SAAS,YAAY,OAAO,WAC5B,SAAS,WAAW,OAAO,UAC3B,SAAS,2BAA2B,OAAO,0BAC3C,SAAS,kCAAkC,OAAO;CAEpD,MAAM,WAAW,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAAW,SAAc,QAAgB;EACtF,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAEtB,MAAM,OAAO,OAAO,MAAM,KACxB,MAAM,OACN,MAAM,MAAM,OAAO;IAChB,MAAM,WAAW,QAAQ;IACzB,MAAM,SAAS;EAClB,CAAC,GACD;GAAE,OAAO;GAAG,SAAS,cAAc,KAAK;EAAE,CAC5C,EAAA,CAAG,KAAK;EAER,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAC9B,MAAM,WAAW,gBAAgB,OAAO,IAAI,MAAM,SAAS;EAC3D,MAAM,SAAS,cAAc,OAAO,IAAI,MAAM,eAAe;EAE7D,MAAM,QAAQ,OAAO,KAAK,MAAM,MAAM,CAAC,CAAC,MACrC,SAAS,MAAM,OAAO,UAAU,IAAI,MAAM,MAC7C;EAEA,UACE,UAAU,KAAA,KAAa,SAAS,aAAa,QAAQ,YAAY,SAAS,WAAW,MACvF;EACA,UACE,IAAI,MAAM,cAAc,SAAS,YAC/B,IAAI,MAAM,YAAY,SAAS,UAC/B,IAAI,MAAM,eAAe,SAAS,SACtC;EACA,UACE,IAAI,MAAM,aAAa,SAAS,WAAW,IAAI,MAAM,gBAAgB,SAAS,UAChF;EACA,UACE,IAAI,MAAM,4BAA4B,SAAS,0BAC7C,QAAQ,MAAM,cAAc,IAAI,MAAM,wBAAwB,MAC5D,SAAS,6BACf;EACA,UACE,QAAQ,MAAM,cAAc,IAAI,MAAM,SAAS,MAAM,SAAS,kBAC5D,QAAQ,MAAM,cAAc,IAAI,MAAM,UAAU,MAAM,SAAS,mBAC/D,QAAQ,MAAM,cAAc,IAAI,MAAM,eAAe,MAAM,SAAS,oBACxE;EACA,UAAU,iBAAiB,UAAU,QAAQ,MAAM,CAAC;EAEpD,MAAM,aACJ,IAAI,MAAM,wBAAwB,OAC9B,KAAA,IACA,kBAAkB,OAAO,IAAI,MAAM,mBAAmB;EAE5D,MAAM,UAAU,YAAY,SAAS,aAAa,aAAa,QAAQ;EAEvE,UACE,IAAI,MAAM,mBAAmB,YAAY,KAAA,IAAY,OAAO,aAAa,OAAO,MAC9E,IAAI,MAAM,iBAAiB,YAAY,QAAQ,CACnD;EACA,IAAI,UAAU,WAAW;GACvB,UACE,IAAI,MAAM,aAAa,QACrB,IAAI,MAAM,eAAe,QACzB,IAAI,MAAM,oBAAoB,QAC9B,eAAe,KAAA,CACnB;GAEA,OAAO;IAAE;IAAK;IAAU;IAAQ;GAAM;EACxC;EAEA,MAAM,QACJ,IAAI,MAAM,aAAa,OACnB,KAAA,IACA,oBAAoB,cAAc;GAChC;GACA,SAAS,IAAI,MAAM;GACnB,iBAAiB,QAAQ,MAAM,cAAc,IAAI,MAAM,UAAU;GACjE,sBAAsB,QAAQ,MAAM,cAAc,IAAI,MAAM,eAAe;EAC7E,CAAC;EAEP,UAAU,UAAU,aAAa,UAAU,KAAA,CAAS;EACpD,IAAI,UAAU,KAAA,GACZ,UACE,MAAM,yBACJ,KAAK,IAAI,MAAM,kBAAkB,SAAS,qBAAqB,SAAS,eAAe,CAC3F;EAEF,OAAO;GACL;GACA;GACA;GACA;GACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;GACvC,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;EACnD;CACF,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,MACA,OACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAEtB,OAAO,MAAM,OACX,MAAM,OACN;IAAG,MAAM,WAAW,QAAQ;IAAW,MAAM,SAAS,KAAK,SAAS;EAAO,GAC3E;IACG,MAAM,QAAQ,MAAM,OAAO;IAC3B,MAAM,UAAU,MAAM;EACzB,CACF;EACA,MAAM,eAAe,KACnB,OAAO,YAAY,MAAM,OAAO;IAC7B,MAAM,WAAW,QAAQ;IACzB,MAAM,SAAS,KAAK,SAAS;IAC7B,MAAM,QAAQ,MAAM,OAAO;IAC3B,MAAM,UAAU,MAAM;EACzB,CAAC,CACH;EAEA,OAAO;CACT,CAAC;CAED,MAAM,kBAAkB,aACtB,YAAY,SAAS,UACjB,SAAS,QAAQ,OAAO,WACxB,SAAS,QAAQ,SAAS,eACxB,SAAS,QAAQ,WACjB,KAAA;CAER,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,SACA,UACA;EACA,MAAM,SAAS,eAAe,QAAQ;EAEtC,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,IACE,YAAY,KAAA,KACZ,QAAQ,cAAc,OAAO,aAC7B,QAAQ,qBAAqB,OAAO,kBAEpC,OAAO;EAET,MAAM,UAAU,OAAO,aACrB,QAAQ,MACR,SACA,OAAO,YAAY,KAAK,SAAS,KAAK,YAAY,CACpD;EAEA,OAAO,YAAY,KAAA,KAAa,aAAa,SAAS,MAAM;CAC9D,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,UACA,gBACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,UAAU,OAAO,WAAW,OAAO;EAEzC,IACE,YAAY,KAAA,KACZ,SAAS,aAAa,QAAQ,YAC9B,CAAC,iBAAiB,UAAU,gBAAgB,OAAO,KACnD,cAAc,OAAO,cAAc,MAAM,cAAc,OAAO,OAAO,GAErE,OAAO,EAAE,MAAM,WAAW;EAC5B,OAAO,cAAc,OAAO;EAC5B,MAAM,YAAY,aAAa,QAAQ;EAEvC,MAAM,UACJ,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,YAAY,QAAQ,MAAM,SAAS;EAElF,OAAO,iBAAiB,OAAO;EAC/B,IAAI,EAAE,OAAO,cAAc,SAAS,SAAS,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;EACnF,IACE,SAAS,QAAQ,SAAS,aACzB,CAAC,SAAS,QAAQ,iBACjB,SAAS,QAAQ,qBAAqB,cACtC,SAAS,QAAQ,gBAAgB,aAEnC,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,QAAQ,QAAQ;EAEtB,MAAM,cAAc,OAAO,MAAM,KAC/B,MAAM,OACN,MAAM,MAAM,OAAO;IAChB,MAAM,WAAW,QAAQ;IACzB,MAAM,YAAY,SAAS;EAC9B,CAAC,GACD,EAAE,OAAO,EAAE,CACb;EAEA,MAAM,WAAW,OAAO,SAAS,SAAS,SAAS,MAAM;EAEzD,IAAI,YAAY,KAAK,WAAW,KAAK,aAAa,KAAA,GAChD,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,QAAQ,aAAa,UAAU,SAAS,CAAC,CAAC,KAAK,SAAS,KAAK,IAAI;EAEvE,IACE,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,QAAQ,CAAC,MACrD,EAAE,OAAO,MAAM,MACb,mBAAmB,SAAS,CAAC,OAAO,GAAG,UAAU,WAAW,OAAO,MAAM,KAAK,CAChF,IAEA,OAAO,EAAE,MAAM,WAAW;EAE5B,MAAM,SAAS;GACb,GAAG,MAAM,aAAa;IAAE;IAAU,QAAQ;IAAgB,QAAQ,MAAM;GAAO,CAAC;IAC/E,MAAM,WAAW,SAAS;IAC1B,MAAM,SAAS,SAAS;IACxB,MAAM,YAAY,SAAS;IAC3B,MAAM,UAAU,SAAS;IACzB,MAAM,QAAQ,MAAM,OAAO;IAC3B,MAAM,UAAU,MAAM;IACtB,MAAM,aAAa,SAAS;IAC5B,MAAM,WAAW,gBAAgB,OAAO,QAAQ;IAChD,MAAM,iBAAiB,cAAc,OAAO,cAAc;IAC1D,MAAM,yBAAyB,SAAS;IACxC,MAAM,0BAA0B,QAAQ,MAAM,cAC7C,SAAS,6BACX;IACC,MAAM,WAAW,QAAQ,MAAM,cAAc,SAAS,cAAc;IACpE,MAAM,YAAY,QAAQ,MAAM,cAAc,SAAS,eAAe;IACtE,MAAM,iBAAiB,QAAQ,MAAM,cAAc,SAAS,oBAAoB;IAChF,MAAM,UAAU;IAChB,MAAM,YAAY;IAClB,MAAM,iBAAiB;IACvB,MAAM,qBAAqB;IAC3B,MAAM,eAAe,cAAc,KAAA,IAAY,OAAO,aAAa,SAAS;IAC5E,MAAM,cAAc,YAAY,QAAQ;EAC3C;EAGA,MAAM,WAAW,OAAO,MAAM,OAAO,MAAM,OAAO,QAAQ;IACvD,MAAM,WAAW,QAAQ;IACzB,MAAM,SAAS,SAAS;EAC3B,CAAC;EAED,YAAY,OAAO,SAAS;EAC5B,KAAK,MAAM,eAAe,MAAM,cAC9B,IAAI,YAAY,UAAU,MAAM,SAAS,YAAY,KAAK,WAAW,GACnE,YAAY,OAAO,SAAS;EAChC,OAAO,cAAc,SAAS,UAAU,gBAAgB,OAAO,SAAS;EACxE,OAAO,eAAe,SAAS,UAAU,SAAS;EAClD,OAAO,eAAe,SAAS,CAAC,OAAO,GAAG,UAAU,SAAS;EAC7D,MAAM,eAAe,KAAK,cAAc,SAAS,QAAQ,CAAC;EAE1D,OAAO;GAAE,MAAM;GAAU;EAAS;CACpC,CAAC;CAED,MAAM,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,QACA;EACA,MAAM,QAAQ,OAAO;EAErB,IAAI,OAAO,aAAa,QAAQ,UAAU,OAAO,KAAA;EACjD,MAAM,UAAU,OAAO,WAAW,OAAO;EAEzC,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;EAClC,OAAO,iBAAiB,OAAO;EAC/B,MAAM,OAAO,OAAO,SAAS,SAAS,OAAO,MAAM;EAEnD,IACE,SAAS,KAAA,KACT,KAAK,UAAU,aACf,CAAC,cAAc,KAAK,UAAU,MAAM,KACpC,CAAC,iBAAiB,KAAK,UAAU,KAAK,QAAQ,OAAO,GAErD,OAAO,KAAA;EACT,IAAI,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,KAAK,QAAQ,CAAC,IAAI,OAAO,KAAA;EACzE,MAAM,eAAe,KAAK,cAAc,SAAS,KAAK,QAAQ,CAAC;EAE/D,OAAO,KAAK;CACd,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,OAOA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,UAAU,OAAO,WAAW,OAAO;EAEzC,IAAI,YAAY,KAAA,KAAa,MAAM,OAAO,aAAa,QAAQ,UAC7D,OAAO,EAAE,MAAM,WAAW;EAC5B,OAAO,cAAc,OAAO;EAC5B,MAAM,kBAAkB,aAAa,MAAM,QAAQ;EACnD,MAAM,YAAY,mBAAmB,MAAM,YAAY,SAAS;EAEhE,MAAM,UACJ,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,YAAY,QAAQ,MAAM,SAAS;EAElF,OAAO,iBAAiB,OAAO;EAE/B,MAAM,YACJ,eAAe,MAAM,QAAQ,CAAC,EAAE,YAAY,KAAK,SAAS,KAAK,YAAY,KAC3E,MAAM,YAAY,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY;EAExE,MAAM,aACJ,MAAM,eAAe,KAAA,KAAa,YAAY,KAAA,IAC1C,KAAA,IACA,OAAO,eACL,QAAQ,MACR,SACA,MAAM,SAAS,QAAQ,MACvB,MAAM,WAAW,sBACjB,SACF;EAEN,MAAM,OAAO,OAAO,SAAS,SAAS,MAAM,OAAO,MAAM;EAEzD,IACE,SAAS,KAAA,KACT,KAAK,UAAU,aACf,CAAC,cAAc,KAAK,UAAU,MAAM,MAAM,GAE1C,OAAO,EAAE,MAAM,WAAW;EAC5B,UAAU,gBAAgB,OAAO,KAAK,QAAQ,MAAM,gBAAgB,OAAO,MAAM,QAAQ,CAAC;EAE1F,MAAM,SAAS,OAAO,IAAI,aAAa;GACrC,OAAO,aAAa,SAAS,MAAM,UAAU;GAE7C,OAAO,EAAE,MAAM,WAAW;EAC5B,CAAC;EAED,IACE,CAAC,iBAAiB,KAAK,UAAU,KAAK,QAAQ,OAAO,KACrD,cAAc,OAAO,MAAM,MAAM,MAAM,cAAc,OAAO,OAAO,KACnE,EAAE,OAAO,cAAc,SAAS,SAAS,KAAK,QAAQ,IAEtD,OAAO,OAAO;EAChB,IACE,MAAM,eAAe,KAAA,MACpB,eAAe,KAAA,KAAa,CAAC,eAAe,MAAM,YAAY,WAAW,UAAU,IAEpF,OAAO,OAAO;EAChB,IAAI,MAAM,eAAe,KAAA,KAAa,eAAe,KAAA,GAAW;GAC9D,MAAM,WAAW,MAAM,WAAW;GAClC,MAAM,SAAS,WAAW,WAAW;GACrC,MAAM,MAAM,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAI,aAAa,CAAC,GAAI,MAAM,WAAW,YAAY,CAAC,CAAC;GAE9E,IACE,SAAS,cAAc,OAAO,aAC9B,SAAS,qBAAqB,OAAO,oBACrC,IAAI,MAAM,OAAO;IACf,MAAM,SAAS,SAAS,YAAY,MAAM,SAAS,KAAK,iBAAiB,EAAE;IAC3E,MAAM,QAAQ,OAAO,YAAY,MAAM,SAAS,KAAK,iBAAiB,EAAE;IAIxE,OACE,UAAU,KAAA,MACT,WAAW,KAAA,IACR,OAAO,MAAM,YAAY,gBAAgB,eAAe,KAAK,QAAQ,MAAM,KAAA,IAC3E,OAAO,aAAa,MAAM;GAElC,CAAC,GAED,OAAO,OAAO;EAClB;EACA,IAAI,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,KAAK,QAAQ,CAAC,IAAI,OAAO,OAAO;EAChF,OAAO,YAAY,SAAS,KAAK,UAAU,KAAK,QAAQ,eAAe;EACvE,MAAM,WAAW,oBAAoB,KAAA,KAAa,cAAc,KAAA;EAEhE,IACE,EAAE,OAAO,MAAM,MACb,mBACE,SACA,CAAC,KAAK,QAAQ,OAAO,GACrB,KAAK,UACL,WACA,WAAW,CAAC,SAAS,IAAI,CAAC,GAC1B,OACA,QACF,CACF,IAEA,OAAO,OAAO;EAChB,MAAM,kBAAkB,OAAO,MAAM,IAAI,QAAQ,KAAK;EAEtD,MAAM,QAAQ,oBAAoB,cAAc;GAC9C,UAAU,KAAK;GACf,SAAS,MAAM;GACf;GACA,sBAAsB,KAAK,IACzB,kBAAkB,KAAK,SAAS,qBAChC,KAAK,SAAS,eAChB;EACF,CAAC;EAED,MAAM,QAAQ,QAAQ;EAEtB,OAAO,MAAM,OACX,MAAM,OACN;IAAG,MAAM,WAAW,QAAQ;IAAW,MAAM,SAAS,KAAK,SAAS;EAAO,GAC3E;IACG,MAAM,QAAQ,MAAM,OAAO;IAC3B,MAAM,UAAU,MAAM;IACtB,MAAM,UAAU,MAAM;IACtB,MAAM,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;IACnE,MAAM,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;IAC7E,MAAM,qBACL,MAAM,eAAe,KAAA,IAAY,OAAO,kBAAkB,OAAO,MAAM,UAAU;IAClF,MAAM,eAAe,cAAc,KAAA,IAAY,OAAO,aAAa,SAAS;EAC/E,CACF;EACA,IAAI,UAAU,OAAO,cAAc,SAAS,KAAK,UAAU,KAAK,QAAQ,CAAC,SAAS,GAAG,SAAS;EAC9F,OAAO,eAAe,SAAS,KAAK,UAAU,SAAS;EACvD,OAAO,eAAe,SAAS,CAAC,KAAK,QAAQ,OAAO,GAAG,KAAK,UAAU,SAAS;EAC/E,MAAM,eAAe,KAAK,cAAc,SAAS,KAAK,UAAU,KAAK,CAAC;EAEtE,OAAO;GAAE,MAAM;GAAW;EAAM;CAClC,CAAC;CAED,MAAM,cAAc,MAAgB,UAClC,KAAK,UAAU,aACf,KAAK,UAAU,KAAA,KACf,KAAK,MAAM,YAAY,MAAM,WAC7B,KAAK,MAAM,oBAAoB,MAAM,mBACrC,KAAK,MAAM,yBAAyB,MAAM,wBAC1C,gBAAgB,OAAO,KAAK,QAAQ,MAAM,gBAAgB,OAAO,MAAM,QAAQ;CAEjF,MAAM,mBACJ,UACA,UACA,YACA,WACA,aACG;EACH,MAAM,QAAQ,SAAS,OAAO;EAE9B,MAAM,WADS,eAAe,QACR,KAAK,SAAS;EAEpC,MAAM,MAAM,CACV,mBAAG,IAAI,IAAI,CACT,GAAG,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,GACvD,WAAW,YACb,CAAC,CACH;EAEA,MAAM,WAAW;GACf,GAAG,WAAW;GACd,aAAa,WAAW,SAAS,YAAY,QAAQ,SACnD,IAAI,SAAS,KAAK,YAAY,CAChC;EACF;EAEA,MAAM,WAAW,SAAS,SAAS,YAAY,MAC5C,SAAS,KAAK,iBAAiB,WAAW,YAC7C;EAEA,OACE,SAAS,OAAO,WAAW,KAC3B,UAAU,KAAA,KACV,MAAM,WAAW,aACjB,MAAM,iBAAiB,WAAW,gBAClC,MAAM,QAAQ,WAAW,KACzB,MAAM,QAAQ,OAAO,gBACrB,MAAM,iBAAiB,UAAU,gBACjC,MAAM,qBACN,SAAS,cAAc,MAAM,UAAU,MAAM,SAAS,kBACtD,SAAS,YACN,YAAY,SAAS,UAAU,SAAS,QAAQ,OAAO,SAAS,SAAS,WAC5E,SAAS,mBACN,YAAY,SAAS,UAClB,SAAS,QAAQ,OAAO,gBACxB,SAAS,2BACf,SAAS,YAAY,WAAW,IAAI,UACpC,aAAa,SAAS,UAAU,QAAQ,KACxC,SAAS,cAAc,SAAS,aAChC,SAAS,qBAAqB,SAAS,oBACvC,SAAS,YAAY,OAAO,SAC1B,SAAS,YAAY,MAClB,YACC,QAAQ,iBAAiB,KAAK,gBAAgB,QAAQ,aAAa,KAAK,QAC5E,CACF,KACA,aAAa,KAAA,KACb,SAAS,YAAY,MAClB,SACC,KAAK,iBAAiB,SAAS,gBAAgB,KAAK,aAAa,SAAS,QAC9E;CAEJ;CAEA,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA,WACA,SACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,KAAK;EAC3B,MAAM,UAAU,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,OAAO;EACpD,MAAM,UAAU,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,cAAc;EAE3D,MAAM,OAAO,GAAG,WACd,YAAY,WACR,GAAG,OAAO,IAAI,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG,IAAI,EAAE,KACzC,GAAG,YAAY,IAAI,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG,IAAI,EAAE;EAEpD,MAAM,WAAW,OAAO,YACtB,0BAA0B,KAAK,CAAC,CAAC,KAAK,WAAW,CAAC,QAAQ,MAAM,IAAI,OAAO,CAAC,CAC9E;EAEA,MAAM,KAAK,QAAQ,UAAU,kBAAkB,UAAU,WAAW;EACpE,MAAM,SAAS,MAAM,WAAW;EAChC,MAAM,SAAS,IAAI,SAAS,SAAS,GAAG,GAAG,UAAU,SAAS;EAE9D,MAAM,iBAAiB,SACnB,GAAG,UACH,GAAG,KAAK,QAAQ,WAAW,UAAU,QAAQ,WAAW,QAAQ,KAAK,UAAU,QAAQ;EAE3F,OAAO,MAAM,cACX,MAAM,OACN,KAAK,MAAM,MAAM,MAAM,OAAO,QAAQ,GAAG,MAAM,iBAAiB,cAAc,GAC9E;IACG,MAAM,UAAU,SAAS,SAAS,UAAU;IAC5C,MAAM,iBAAiB;IACvB,MAAM,cAAc;EACvB,GACA;GACE,MAAM;GACN,eAAe,OAAO,YACpB,MAAM,OACN;IAAE,GAAG;KAAW,MAAM,cAAc;GAAG,GACvC,KACE,SAAS,GAAG,GAAG,QAAQ,KAAK,YAAY,GAAG,GAAG,QAAQ,KAAK,UAAU,WACrE,GAAG,GAAG,QAAQ,MAAM,UAAU,SAChC,CACF;EACF,CACF;EACA,MAAM,WAAW,OAAO,MAAM,IAAI,QAAQ,KAAK;EAC/C,MAAM,WAAW,GAAG,GAAG,IAAI,MAAM,OAAO,QAAQ,UAAU,UAAU;EACpE,MAAM,SAAS,QAAQ,MAAM,SAAS,QAAQ;EAE9C,OAAO,MAAM,YACX,MAAM,OACN,MAAM,MAAM,MAAM,OAAO,QAAQ,GACjC,GACG,QAAQ,UAAU,aAAa,QAAQ,MAAM,WAC5C,IAAI,GAAG,YAAY,OAAO,OAAO,QAAQ,MAAM,eAAe,CAChE,EACF,GACA;GACE,MAAM;GACN,eAAe,OAAO,YACpB,MAAM,OACN,UACA,KAAK,GAAG,GAAG,OAAO,MAAM,YAAY,GAAG,GAAG,OAAO,MAAM,QAAQ,MAAM,iBAAiB,CACxF;EACF,CACF;CACF,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA,SAQA,SACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,qBAAqB,QAAQ,SAAS,cAAc,QAAQ,aAAa,KAAA;EAC/E,MAAM,UAAU,OAAO,WAAW,OAAO;EAEzC,IAAI,YAAY,KAAA,KAAa,MAAM,SAAS,aAAa,QAAQ,UAC/D,OAAO;EACT,OAAO,cAAc,OAAO;EAE5B,MAAM,cACJ,eAAe,MAAM,QAAQ,CAAC,EAAE,YAAY,KAAK,SAAS,KAAK,YAAY,MAC1E,QAAQ,SAAS,cACd,QAAQ,WAAW,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,IACvE,KAAA;EAEN,MAAM,YACJ,QAAQ,SAAS,cACb,QAAQ,WAAW,SAAS,YAC5B,aAAa,MAAM,QAAQ;EAEjC,MAAM,UACJ,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,YAAY,QAAQ,MAAM,SAAS;EAElF,OAAO,iBAAiB,OAAO;EAE/B,MAAM,QACJ,QAAQ,SAAS,eAAe,YAAY,KAAA,IACxC,KAAA,IACA,OAAO,eACL,QAAQ,MACR,SACA,MAAM,SAAS,QAAQ,MACvB,QAAQ,WAAW,sBACnB,WACF;EAEN,MAAM,OAAO,OAAO,SAAS,SAAS,MAAM,SAAS,MAAM;EAE3D,IAAI,SAAS,KAAA,KAAa,CAAC,WAAW,MAAM,KAAK,GAAG,OAAO;EAC3D,IAAI,QAAQ,SAAS,aAAa,OAAO,OAAO,aAAa,SAAS,MAAM,QAAQ,IAAI;EACxF,UAAU,uBAAuB,KAAA,CAAS;EAC1C,MAAM,WAAW,gBAAgB,OAAO,KAAK,aAAa,KAAA;EAC1D,MAAM,YAAY,QAAQ;EAE1B,IACE,aAAa,KAAA,KACb,UAAU,KAAA,KACV,CAAC,iBAAiB,KAAK,UAAU,KAAK,QAAQ,OAAO,KACrD,CAAC,eAAe,UAAU,kBAAkB,KAC5C,CAAC,eAAe,UAAU,MAAM,UAAU,GAE1C,OAAO,OAAO,aAAa,SAAS,MAAM,UAAU;EACtD,MAAM,aAAa,MAAM;EACzB,MAAM,UAAU,KAAK,SAAS;EAE9B,IACE,UAAU,yBAAyB,WAAW,wBAC7C,UAAU,eAAe,KAAA,KAAa,UAAU,eAAe,WAAW,cAC3E,UAAU,mBAAmB,WAAW,kBACvC,UAAU,eAAe,CAAC,UAAU,kBACpC,QAAQ,qBAAqB,cAAc,CAAC,UAAU,gBACvD,CAAC,QAAQ,WAAW,SAAS,WAAW,SAAS,KAChD,KAAK,SAAS,mBAAmB,WAAW,KAC3C,CAAC,KAAK,SAAS,mBAAmB,MAC/B,SAAS,KAAK,OAAO,WAAW,oBACnC,KACD,KAAK,SAAS,YAAY,cACxB,UAAU,eAAe,WAAW,cACnC,CAAC,WAAW,iBACZ,CAAC,WAAW,0BACZ,CAAC,WAAW,QAAQ,iBACpB,WAAW,QAAQ,qBAAqB,cACxC,CAAC,UAAU,iBACf,CAAC,gBAAgB,KAAK,UAAU,UAAU,YAAY,WAAW,QAAQ,QAAQ,KACjF,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,KAAK,UAAU,KAAK,CAAC,IAEjE,OAAO,OAAO,aAAa,SAAS,MAAM,UAAU;EACtD,OAAO,YAAY,SAAS,KAAK,UAAU,KAAK,QAAQ,WAAW,SAAS,SAAS;EACrF,OAAO,eAAe,SAAS,KAAK,UAAU,WAAW,SAAS,SAAS;EAC3E,OAAO,gBAAgB,SAAS,OAAO,WAAW,OAAO;EACzD,OAAO,aAAa,SAAS,MAAM,UAAU;EAC7C,MAAM,eAAe,KAAK,cAAc,SAAS,KAAK,UAAU,KAAK,CAAC;EAEtE,OAAO;CACT,CAAC;CAED,MAAM,oBAAoB,OAAY,aACpC,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,OAAO,EAAE,OAAO,IAAI,KAC/C,SAAS,KAAK,YAAY,GAAG,GAAG,SAAS,GACzC,GAAG,IACL,EAAE;CAEJ,MAAM,eAAe,SAAc,mBAAuD;EACxF,IAAI,QAAQ,WAAW,KAAA,GAAW,OAAO,GAAG;EAC5C,MAAM,SAAS,QAAQ;EAEvB,OAAO,GAAG,6BAA6B,OAAO,MAAM,SAAS,KAC3D,MAAM,OAAO,OAAO,GAAG,OAAO,WAAW,QAAQ,SAAS,CAAC,GAC3D,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,MAAM,EAAE,KAAK,kBAC5C,OAAO,gBACT,EAAE;CACJ;CAEA,MAAM,WAAW,SAAc,aAAoC;EACjE,MAAM,OAAO,QAAQ,MACnB,SAAS,QAAQ,QACjB,MAAM,QAAQ,MAAM;EAEtB,MAAM,QAAQ,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,KAAK;EAC9C,MAAM,WAAW,GAAG,GAAG,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,cAAc,GAAG,EAAE,MAAM;EAElG,MAAM,aAAa,GAAG,yBAAyB,OAAO,MAAM,SAAS,KACnE,MAAM,OAAO,OAAO,GAAG,OAAO,WAAW,QAAQ,SAAS,CAAC,GAC3D,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,MAAM,EAAE,KAAK,IAAI,KAAK,OAAO,KAAK,MAAM,KACvE,GAAG,IAAI,IAAI,OAAO,OAAO,OAAO,WAAW,EAAE,cAAc,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,WAAW,GAAG,EAAE,KAAK,IAAI,EAC5I,EAAE;EAEF,OAAO,KACL,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,QAAQ,SAAS,CAAC,GACvD,iBAAiB,MAAM,QAAQ,GAC/B,GAAG,KAAK,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,SAAS,GAAG,EAAE,MAAM,IAAI;WACnH,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,cAAc,GAAG,EAAE,MAAM,IAAI;WACrH,MAAM,OAAO,KAAK,OAAO,SAAS,IAAI,KAAK,OAAO,SAAS,IAAI,KAAK,OAAO,UAAU,IAAI,KAAK,OAAO,qBAAqB,QAAQ,SAAS,YAAY,WAAW,QAAQ,YAAY,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE,GAC5O;CACF;CAEA,MAAM,aAAa,SAAc,aAAoC;EACnE,MAAM,SAAS,QAAQ;EAEvB,OAAO,KACL,MAAM,OAAO,OAAO,GAAG,OAAO,WAAW,QAAQ,SAAS,CAAC,GAC3D,iBAAiB,QAAQ,QAAQ,GACjC,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,UAAU,EAAE,mBAAmB,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,WAAW,GAAG,EAAE,MAAM,QAAQ,MAAM,mBACxJ,YAAY,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,MAAM,GAAG,CAC/D;CACF;CAwJA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,mBAlKwB,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,OACA,UACA;GACA,MAAM,QAAQ,OAAO;GAErB,UACE,MAAM,aAAa,QAAQ,YACzB,OAAO,cAAc,MAAM,SAAS,KACpC,MAAM,aAAa,KACnB,OAAO,cAAc,MAAM,KAAK,KAChC,MAAM,SAAS,KACf,MAAM,SAAS,GACnB;GACA,OAAO,WAAW,OAAO;GACzB,OAAO,cAAc,OAAO;GAC5B,OAAO,iBAAiB,OAAO;GAE/B,MAAM,OAAO,QAAQ,MACnB,SAAS,QAAQ;GAEnB,MAAM,QAAQ,OAAO,MAAM,KAAK,KAAK,OAAO,QAAQ,SAAS,QAAQ,GAAG;IACtE,OAAO,MAAM;IACb,UAAU;IACV,SAAS;IACT,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,MAAM;GAC5C,CAAC,EAAA,CAAG;GAEJ,MAAM,UAAoB,CAAC;GAC3B,MAAM,eAA2B,CAAC;GAElC,IAAI,eAAe,GACjB,UAAU;GAEZ,KAAK,MAAM,aAAa,MAAM;IAC5B,MAAM,OAAO,OAAO,SAAS,SAAS,UAAU,KAAK,OAAO;IAE5D,IAAI,SAAS,KAAA,GAAW;IACxB,UACE,OAAO,MAAM,MACX,GAAG,yBAAyB,KAAK,MAAM,SAAS,KAAK,MAAM,KAAK,OAAO;MAAG,KAAK,WAAW,QAAQ;MAAW,KAAK,SAAS,KAAK,SAAS;IAAO,CAAC,GAAG,QAAQ,SAAS,QAAQ,CAAC,EAAE,EAClL,CACF;IACA,QAAQ,KAAK,KAAK,SAAS,MAAM;IACjC,IAAI,KAAK,UAAU,aAAa,KAAK,UAAU,WAAW;KACxD,MAAM,WACJ,KAAK,UAAU,YACX,KAAK,SAAS,kBACd,KAAK,MAAO;KAElB,IAAI,KAAK,UAAU,WAAW,OAAO,2BAA2B,SAAS,KAAK,QAAQ;KACtF,OAAO,aAAa,SAAS,MAAM,KAAK,UAAU,YAAY,aAAa,WAAW;KACtF,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,UAAU;KAC9E,aAAa,KAAK,IAAI;KACtB;IACF,OAAO;KACL,OAAO,wBAAwB,SAAS,KAAK,QAAQ;KACrD,OAAO,MAAM,OAAO,KAAK,OAAO;OAC7B,KAAK,WAAW,QAAQ;OACxB,KAAK,SAAS,KAAK,SAAS;KAC/B,CAAC;KACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,SAAS,wBACxD,YAAY,SAAS,GAAG,GAAG,KAAK,SAAS,QAAQ,GACjD,GAAG,6BAA6B,OAAO,MAAM,SAAS,KACpD,MAAM,OAAO,OAAO;OACjB,OAAO,WAAW,QAAQ;OAC1B,OAAO,SAAS,KAAK,SAAS;KACjC,CAAC,GACD,GAAG,IAAI,IAAI,OAAO,OAAO,OAAO,WAAW,EAAE,cAAc,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,WAAW,GAAG,EAAE,KAAK,QAAQ,MAAM,gBAAgB,EACtK,EAAE,EACJ;KACA;IACF;GACF;GACA,MAAM,iBAA0D,CAAC;GACjE,MAAM,YAAY,MAAM,QAAQ,eAAe;GAE/C,IAAI,YAAY,GAAG;IACjB,MAAM,WAAW,OAAO,MAAM,KAAK,OAAO,OAAO,UAAU,SAAS,QAAQ,GAAG;KAC7E,OAAO;KACP,UAAU;KACV,SAAS;KACT,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,MAAM,EAAE,IAAI,IAAI,OAAO,OAAO,OAAO,IAAI;IACnF,CAAC,EAAA,CAAG;IAEJ,KAAK,MAAM,aAAa,SAAS;KAC/B,MAAM,WAAW;OACd,OAAO,WAAW,QAAQ;OAC1B,OAAO,SAAS,UAAU,OAAO;OACjC,OAAO,OAAO,UAAU,OAAO;KAClC;KAEA,MAAM,YAAY,OAAO,MAAM,KAAK,OAAO,OAAO,MAAM,OAAO,OAAO,QAAQ,GAAG,EAC/E,OAAO,EACT,CAAC,EAAA,CAAG,KAAK;KAET,UAAU,aAAa,KAAA,CAAS;KAChC,MAAM,UAAU,QAAQ,MAAM,cAAc,SAAS,OAAO,YAAY;KAExE,UAAU,OAAO,cAAc,OAAO,CAAC;KACvC,OAAO,MAAM,OAAO,OAAO,OAAO,QAAQ;KAC1C,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,WAC1C,YAAY,SAAS,GAAG,GAAG,UAAU,OAAO,SAAS,CACvD;KACA,eAAe,KAAK;MAAE,QAAQ,UAAU,OAAO;MAAS,MAAM,UAAU,OAAO;KAAM,CAAC;KACtF;IACF;GACF;GAEA,MAAM,eACJ,QAAQ,WAAW,IACf,KAAA,IACA,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,MAAM,EAAE,WAAW,IAAI,KAChD,QAAQ,KAAK,OAAO,GAAG,GAAG,IAAI,GAC9B,GAAG,IACL,EAAE;GAER,MAAM,iBAAiB,eAAe,KACnC,SACC,GAAG,QAAQ,MAAM,OAAO,OAAO;KAAG,OAAO,SAAS,KAAK;KAAS,OAAO,OAAO,KAAK;GAAK,CAAC,EAAE,EAC/F;GAEA,MAAM,YAAY,GAAG,yBAAyB,KAAK,MAAM,SAAS,KAAK,QAAQ,SAAS,QAAQ,GAAG,YAAY,EAAE,6BAA6B,OAAO,MAAM,SAAS,KAAK,UAAU,SAAS,QAAQ,GAAG,GAAG,cAAc,EAAE;GAI1N,IAAI,UAAU,OAAO,MAAM,MAAM,SAAS;GAE1C,KAAK,MAAM,QAAQ,cAAc;IAC/B,IAAI,KAAK,SAAS,wBAAwB,OAAO,MAAM,IAAI,QAAQ,KAAK,IAAI;IAC5E,MAAM,cAAc,GAAG,yBAAyB,OAAO,MAAM,SAAS,KAAK,MAAM,OAAO,OAAO;MAAG,OAAO,WAAW,QAAQ;MAAW,OAAO,SAAS,KAAK,SAAS;IAAO,CAAC,GAAG,GAAG,GAAG,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,WAAW,GAAG,EAAE,KAAK,QAAQ,MAAM,mBAAmB,GAAG,cAAc,EAAE;IAErT,IACE,EAAE,OAAO,MAAM,MAAM,WAAW,OAC/B,OAAO,MAAM,MAAM,YAAY,SAAS,GAAG,GAAG,KAAK,SAAS,QAAQ,CAAC,IAEtE,UAAU;GACd;GACA,MAAM,SAAS,GAAG,yBAAyB,KAAK,MAAM,SAAS,QAAQ,SAAS,QAAQ,EAAE,6BAA6B,OAAO,MAAM,SAAS,UAAU,SAAS,QAAQ,EAAE;GAE1K,MAAM,eAAe,KAAK,UAAU,SAAS,GAAG,QAAQ,OAAO,EAAE;GAEjE,OAAO;IAAE;IAAc;IAAS;GAAQ;EAC1C,CAgBkB;CAClB;AACF"}
+{"version":3,"file":"flow.mjs","names":[],"sources":["../../../src/internal/passkey/flow.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport {\n  PasskeyClaim,\n  type PasskeyAccess,\n  type PasskeyAssertionVerified,\n  type PasskeyCeremony,\n  type PasskeyCredential,\n  type PasskeyEvidence,\n  type PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport { DateTime, Effect } from \"effect\";\n\nimport type { PasskeyFlowState } from \"../models/passkey-model\";\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport type { makePasskeyAdmissionKernel } from \"./admission\";\nimport type { CredentialRead, SubjectRead, makePasskeyCredentialsKernel } from \"./credentials\";\nimport type { makePasskeyRegistrationCustodyKernel } from \"./registration-custody\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport interface FlowRead {\n  readonly row: Record<string, any>;\n  readonly ceremony: PasskeyCeremony;\n  readonly policy: PasskeyMethodPolicy;\n  readonly state: PasskeyFlowState;\n  readonly claim?: PasskeyClaim;\n  readonly credential?: PasskeyCredential;\n}\n\nexport const makePasskeyFlowKernel = (\n  operations: QueryOperations,\n  admission: Pick<\n    ReturnType<typeof makePasskeyAdmissionKernel>,\n    | \"admissionCondition\"\n    | \"chargeScopes\"\n    | \"guardAdmission\"\n    | \"guardChargeSet\"\n    | \"insertCharges\"\n    | \"lockAdmission\"\n    | \"readCharges\"\n  >,\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"readCredential\" | \"readModule\" | \"readPolicyGuards\" | \"readRevision\" | \"readSubject\"\n  >,\n  registrationCustody: Pick<\n    ReturnType<typeof makePasskeyRegistrationCustodyKernel>,\n    \"releaseRegistrationCustody\" | \"scrubRegistrationIntent\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    | \"ceremonyStorage\"\n    | \"col\"\n    | \"credentialStorage\"\n    | \"equal\"\n    | \"existsExact\"\n    | \"invariant\"\n    | \"mappedColumns\"\n    | \"policyStorage\"\n    | \"profileStorage\"\n    | \"sameCredential\"\n    | \"sameRevision\"\n    | \"semanticCredentialColumns\"\n    | \"subjectScope\"\n    | \"targetScope\"\n  >,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n  const { sql } = operations;\n\n  const {\n    admissionCondition,\n    chargeScopes,\n    guardAdmission,\n    guardChargeSet,\n    insertCharges,\n    lockAdmission,\n    readCharges,\n  } = admission;\n\n  const { readCredential, readModule, readPolicyGuards, readRevision, readSubject } = credentials;\n  const { releaseRegistrationCustody, scrubRegistrationIntent } = registrationCustody;\n\n  const {\n    ceremonyStorage,\n    col,\n    credentialStorage,\n    equal,\n    existsExact,\n    mappedColumns,\n    policyStorage,\n    profileStorage,\n    sameCredential,\n    sameRevision,\n    semanticCredentialColumns,\n    subjectScope,\n    targetScope,\n  } = state;\n\n  const invariant: (value: unknown) => asserts value = state.invariant;\n  const { both } = transactions;\n\n  const assertionPurposes = [\"sign-in\", \"pending\", \"step-up\", \"action\"] as const;\n\n  const contextPurpose = {\n    SignIn: \"sign-in\",\n    Pending: \"pending\",\n    StepUp: \"step-up\",\n    Action: \"action\",\n    Enrollment: \"enrollment\",\n    Registration: \"registration\",\n  } as const;\n\n  const knownSubject = (ceremony: PasskeyCeremony): SubjectId | undefined =>\n    \"target\" in ceremony.context\n      ? ceremony.context.target.revision.subjectId\n      : ceremony.context._tag === \"Enrollment\"\n        ? ceremony.context.revision.subjectId\n        : undefined;\n\n  const compatiblePolicy = (\n    ceremony: PasskeyCeremony,\n    original: PasskeyMethodPolicy,\n    current: PasskeyMethodPolicy,\n  ) => {\n    const selected = current.profiles.find(\n      (profile) => profile.profileId === ceremony.profile.profileId,\n    );\n\n    const issued = original.profiles.find(\n      (profile) => profile.profileId === ceremony.profile.profileId,\n    );\n\n    return (\n      ceremony.generation === current.generation &&\n      ceremony.generation === original.generation &&\n      selected !== undefined &&\n      issued !== undefined &&\n      profileStorage.encode(selected) === profileStorage.encode(ceremony.profile) &&\n      profileStorage.encode(issued) === profileStorage.encode(ceremony.profile) &&\n      ceremony.claimLifetimeMillis === original.claimLifetimeMillis &&\n      ceremony.expiresAtMillis > ceremony.issuedAtMillis &&\n      ceremony.expiresAtMillis <= ceremony.requestBindingExpiresAtMillis &&\n      ceremony.expiresAtMillis - ceremony.issuedAtMillis <= original.lifetimeMillis &&\n      ceremony.expiresAtMillis - ceremony.issuedAtMillis <= current.lifetimeMillis &&\n      ceremony.retentionUntilMillis === ceremony.issuedAtMillis + original.retentionMillis &&\n      contextPurpose[ceremony.context._tag] === ceremony.purpose &&\n      new Set(ceremony.allowedCredentials.map((item) => item.id)).size ===\n        ceremony.allowedCredentials.length\n    );\n  };\n\n  const liveCondition = (mapping: any, ceremony: PasskeyCeremony, claim?: PasskeyClaim) => {\n    const now = mapping.clock.engineNowMillis;\n\n    return both(\n      sql`${now} >= ${ceremony.issuedAtMillis}`,\n      sql`${now} < ${ceremony.expiresAtMillis}`,\n      sql`${now} < ${ceremony.requestBindingExpiresAtMillis}`,\n      \"target\" in ceremony.context\n        ? sql`${now} < ${ceremony.context.target.expiresAtMillis}`\n        : undefined,\n      claim === undefined\n        ? undefined\n        : both(\n            sql`${now} >= ${claim.claimedAtMillis}`,\n            sql`${now} < ${claim.claimExpiresAtMillis}`,\n          ),\n    );\n  };\n\n  const matchesAccess = (ceremony: PasskeyCeremony, access: PasskeyAccess) =>\n    ceremony.moduleId === access.moduleId &&\n    ceremony.generation === access.generation &&\n    ceremony.purpose === access.purpose &&\n    ceremony.flowId === access.flowId &&\n    ceremony.requestBindingVerifier === access.requestBindingVerifier &&\n    ceremony.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis;\n\n  const readFlow = Effect.fn(\"passkey.readFlow\")(function* (mapping: any, flowId: string) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.flow;\n\n    const row = (yield* owner.read(\n      table.table,\n      equal(table.table, {\n        [table.moduleId]: mapping.moduleId,\n        [table.flowId]: flowId,\n      }),\n      { limit: 1, columns: mappedColumns(table) },\n    )).rows[0];\n\n    if (row === undefined) return undefined;\n    const ceremony = ceremonyStorage.decode(row[table.snapshot]);\n    const policy = policyStorage.decode(row[table.policySnapshot]);\n\n    const state = Object.keys(table.states).find(\n      (name) => table.states[name] === row[table.state],\n    ) as PasskeyFlowState | undefined;\n\n    invariant(\n      state !== undefined && ceremony.moduleId === mapping.moduleId && ceremony.flowId === flowId,\n    );\n    invariant(\n      row[table.moduleId] === ceremony.moduleId &&\n        row[table.flowId] === ceremony.flowId &&\n        row[table.commandId] === ceremony.commandId,\n    );\n    invariant(\n      row[table.purpose] === ceremony.purpose && row[table.generation] === ceremony.generation,\n    );\n    invariant(\n      row[table.requestBindingVerifier] === ceremony.requestBindingVerifier &&\n        mapping.clock.decodeInstant(row[table.requestBindingExpiresAt]) ===\n          ceremony.requestBindingExpiresAtMillis,\n    );\n    invariant(\n      mapping.clock.decodeInstant(row[table.issuedAt]) === ceremony.issuedAtMillis &&\n        mapping.clock.decodeInstant(row[table.expiresAt]) === ceremony.expiresAtMillis &&\n        mapping.clock.decodeInstant(row[table.retentionUntil]) === ceremony.retentionUntilMillis,\n    );\n    invariant(compatiblePolicy(ceremony, policy, policy));\n\n    const credential =\n      row[table.credentialSnapshot] === null\n        ? undefined\n        : credentialStorage.decode(row[table.credentialSnapshot]);\n\n    const subject = credential?.revision.subjectId ?? knownSubject(ceremony);\n\n    invariant(\n      row[table.subjectScope] === (subject === undefined ? null : yield* subjectScope(subject)) &&\n        row[table.targetScope] === (yield* targetScope(ceremony)),\n    );\n    if (state === \"Pending\") {\n      invariant(\n        row[table.claimId] === null &&\n          row[table.claimedAt] === null &&\n          row[table.claimExpiresAt] === null &&\n          credential === undefined,\n      );\n\n      return { row, ceremony, policy, state };\n    }\n\n    const claim =\n      row[table.claimId] === null\n        ? undefined\n        : snapshotPasskeySync(PasskeyClaim, {\n            ceremony,\n            claimId: row[table.claimId],\n            claimedAtMillis: mapping.clock.decodeInstant(row[table.claimedAt]),\n            claimExpiresAtMillis: mapping.clock.decodeInstant(row[table.claimExpiresAt]),\n          });\n\n    invariant(state !== \"Claimed\" || claim !== undefined);\n    if (claim !== undefined)\n      invariant(\n        claim.claimExpiresAtMillis ===\n          Math.min(claim.claimedAtMillis + ceremony.claimLifetimeMillis, ceremony.expiresAtMillis),\n      );\n\n    return {\n      row,\n      ceremony,\n      policy,\n      state,\n      ...(claim === undefined ? {} : { claim }),\n      ...(credential === undefined ? {} : { credential }),\n    };\n  });\n\n  const terminalFlow = Effect.fn(\"passkey.terminalFlow\")(function* (\n    mapping: any,\n    read: FlowRead,\n    state: \"Verified\" | \"Rejected\" | \"Ambiguous\",\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.flow;\n\n    yield* owner.update(\n      table.table,\n      { [table.moduleId]: mapping.moduleId, [table.flowId]: read.ceremony.flowId },\n      {\n        [table.state]: table.states[state],\n        [table.version]: owner.marker,\n      },\n    );\n    owner.postconditions.push(\n      yield* existsExact(table.table, {\n        [table.moduleId]: mapping.moduleId,\n        [table.flowId]: read.ceremony.flowId,\n        [table.state]: table.states[state],\n        [table.version]: owner.marker,\n      }),\n    );\n\n    return state;\n  });\n\n  const targetRevision = (ceremony: PasskeyCeremony) =>\n    \"target\" in ceremony.context\n      ? ceremony.context.target.revision\n      : ceremony.context._tag === \"Enrollment\"\n        ? ceremony.context.revision\n        : undefined;\n\n  const currentTarget = Effect.fn(\"passkey.currentTarget\")(function* (\n    mapping: any,\n    subject: SubjectRead | undefined,\n    ceremony: PasskeyCeremony,\n  ) {\n    const target = targetRevision(ceremony);\n\n    if (target === undefined) return true;\n    if (\n      subject === undefined ||\n      subject.subjectId !== target.subjectId ||\n      subject.securityRevision !== target.securityRevision\n    )\n      return false;\n\n    const current = yield* readRevision(\n      mapping.read,\n      subject,\n      target.credentials.map((item) => item.credentialId),\n    );\n\n    return current !== undefined && sameRevision(current, target);\n  });\n\n  const issueAssertion = Effect.fn(\"passkey.issueAssertion\")(function* (\n    mapping: any,\n    ceremony: PasskeyCeremony,\n    suppliedPolicy: PasskeyMethodPolicy,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const current = yield* readModule(mapping);\n\n    if (\n      current === undefined ||\n      ceremony.moduleId !== mapping.moduleId ||\n      !compatiblePolicy(ceremony, suppliedPolicy, current) ||\n      policyStorage.encode(suppliedPolicy) !== policyStorage.encode(current)\n    )\n      return { _tag: \"Rejected\" } as const;\n    yield* lockAdmission(mapping);\n    const subjectId = knownSubject(ceremony);\n\n    const subject =\n      subjectId === undefined ? undefined : yield* readSubject(mapping.read, subjectId);\n\n    yield* readPolicyGuards(mapping);\n    if (!(yield* currentTarget(mapping, subject, ceremony))) return { _tag: \"Rejected\" } as const;\n    if (\n      ceremony.context._tag === \"SignIn\" &&\n      (!ceremony.profile.primarySignIn ||\n        ceremony.profile.userVerification !== \"required\" ||\n        ceremony.profile.residentKey !== \"required\")\n    )\n      return { _tag: \"Rejected\" } as const;\n    const table = mapping.flow;\n\n    const sameCommand = yield* owner.read(\n      table.table,\n      equal(table.table, {\n        [table.moduleId]: mapping.moduleId,\n        [table.commandId]: ceremony.commandId,\n      }),\n      { limit: 1 },\n    );\n\n    const sameFlow = yield* readFlow(mapping, ceremony.flowId);\n\n    if (sameCommand.rows.length !== 0 || sameFlow !== undefined)\n      return { _tag: \"Rejected\" } as const;\n    const kinds = (yield* chargeScopes(ceremony, subjectId)).map((item) => item.kind);\n\n    if (\n      !(yield* owner.check(liveCondition(mapping, ceremony))) ||\n      !(yield* owner.check(\n        yield* admissionCondition(mapping, [current], ceremony, subjectId, kinds, true, false),\n      ))\n    )\n      return { _tag: \"Rejected\" } as const;\n\n    const values = {\n      ...table.encodeInsert({ ceremony, policy: suppliedPolicy, marker: owner.marker }),\n      [table.moduleId]: ceremony.moduleId,\n      [table.flowId]: ceremony.flowId,\n      [table.commandId]: ceremony.commandId,\n      [table.purpose]: ceremony.purpose,\n      [table.state]: table.states.Pending,\n      [table.version]: owner.marker,\n      [table.generation]: ceremony.generation,\n      [table.snapshot]: ceremonyStorage.encode(ceremony),\n      [table.policySnapshot]: policyStorage.encode(suppliedPolicy),\n      [table.requestBindingVerifier]: ceremony.requestBindingVerifier,\n      [table.requestBindingExpiresAt]: mapping.clock.encodeInstant(\n        ceremony.requestBindingExpiresAtMillis,\n      ),\n      [table.issuedAt]: mapping.clock.encodeInstant(ceremony.issuedAtMillis),\n      [table.expiresAt]: mapping.clock.encodeInstant(ceremony.expiresAtMillis),\n      [table.retentionUntil]: mapping.clock.encodeInstant(ceremony.retentionUntilMillis),\n      [table.claimId]: null,\n      [table.claimedAt]: null,\n      [table.claimExpiresAt]: null,\n      [table.credentialSnapshot]: null,\n      [table.subjectScope]: subjectId === undefined ? null : yield* subjectScope(subjectId),\n      [table.targetScope]: yield* targetScope(ceremony),\n    };\n\n    // Empty-key observations now expect this exact inserted row as well.\n    const inserted = yield* owner.insert(table.table, values, {\n      [table.moduleId]: mapping.moduleId,\n      [table.flowId]: ceremony.flowId,\n    });\n\n    sameCommand.rows = inserted.rows;\n    for (const observation of owner.observations)\n      if (observation.table === table.table && observation.rows.length === 0)\n        observation.rows = inserted.rows;\n    yield* insertCharges(mapping, ceremony, suppliedPolicy, kinds, subjectId);\n    yield* guardChargeSet(mapping, ceremony, subjectId);\n    yield* guardAdmission(mapping, [current], ceremony, subjectId);\n    owner.postconditions.push(liveCondition(mapping, ceremony));\n\n    return { _tag: \"Issued\", ceremony } as const;\n  });\n\n  const contextAssertion = Effect.fn(\"passkey.contextAssertion\")(function* (\n    mapping: any,\n    access: PasskeyAccess,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    if (access.moduleId !== mapping.moduleId) return undefined;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined) return undefined;\n    yield* readPolicyGuards(mapping);\n    const read = yield* readFlow(mapping, access.flowId);\n\n    if (\n      read === undefined ||\n      read.state !== \"Pending\" ||\n      !matchesAccess(read.ceremony, access) ||\n      !compatiblePolicy(read.ceremony, read.policy, current)\n    )\n      return undefined;\n    if (!(yield* owner.check(liveCondition(mapping, read.ceremony)))) return undefined;\n    owner.postconditions.push(liveCondition(mapping, read.ceremony));\n\n    return read.ceremony;\n  });\n\n  const claimAssertion = Effect.fn(\"passkey.claimAssertion\")(function* (\n    mapping: any,\n    input: {\n      readonly access: PasskeyAccess;\n      readonly policy: PasskeyMethodPolicy;\n      readonly ceremony: PasskeyCeremony;\n      readonly claimId: string;\n      readonly credential?: PasskeyCredential;\n    },\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined || input.access.moduleId !== mapping.moduleId)\n      return { _tag: \"Rejected\" } as const;\n    yield* lockAdmission(mapping);\n    const expectedSubject = knownSubject(input.ceremony);\n    const subjectId = expectedSubject ?? input.credential?.revision.subjectId;\n\n    const subject =\n      subjectId === undefined ? undefined : yield* readSubject(mapping.read, subjectId);\n\n    yield* readPolicyGuards(mapping);\n\n    const requested =\n      targetRevision(input.ceremony)?.credentials.map((item) => item.credentialId) ??\n      input.credential?.revision.credentials.map((item) => item.credentialId);\n\n    const credential =\n      input.credential === undefined || subject === undefined\n        ? undefined\n        : yield* readCredential(\n            mapping.read,\n            subject,\n            input.ceremony.profile.rpId,\n            input.credential.protocolCredentialId,\n            requested,\n          );\n\n    const read = yield* readFlow(mapping, input.access.flowId);\n\n    if (\n      read === undefined ||\n      read.state !== \"Pending\" ||\n      !matchesAccess(read.ceremony, input.access)\n    )\n      return { _tag: \"Rejected\" } as const;\n    invariant(ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(input.ceremony));\n\n    const reject = Effect.gen(function* () {\n      yield* terminalFlow(mapping, read, \"Rejected\");\n\n      return { _tag: \"Rejected\" } as const;\n    });\n\n    if (\n      !compatiblePolicy(read.ceremony, read.policy, current) ||\n      policyStorage.encode(input.policy) !== policyStorage.encode(current) ||\n      !(yield* currentTarget(mapping, subject, read.ceremony))\n    )\n      return yield* reject;\n    if (\n      input.credential !== undefined &&\n      (credential === undefined || !sameCredential(input.credential, credential.credential))\n    )\n      return yield* reject;\n    if (input.credential !== undefined && credential !== undefined) {\n      const original = input.credential.revision;\n      const actual = credential.credential.revision;\n      const ids = [...new Set([...(requested ?? []), input.credential.credentialId])];\n\n      if (\n        original.subjectId !== actual.subjectId ||\n        original.securityRevision !== actual.securityRevision ||\n        ids.some((id) => {\n          const before = original.credentials.find((item) => item.credentialId === id);\n          const after = actual.credentials.find((item) => item.credentialId === id);\n\n          // A target can include non-passkey factors absent from the minimum\n          // lookup snapshot; currentTarget independently checks those originals.\n          return (\n            after === undefined ||\n            (before === undefined\n              ? id === input.credential?.credentialId || targetRevision(read.ceremony) === undefined\n              : before.revision !== after.revision)\n          );\n        })\n      )\n        return yield* reject;\n    }\n    if (!(yield* owner.check(liveCondition(mapping, read.ceremony)))) return yield* reject;\n    yield* readCharges(mapping, read.ceremony, read.policy, expectedSubject);\n    const resolved = expectedSubject === undefined && subjectId !== undefined;\n\n    if (\n      !(yield* owner.check(\n        yield* admissionCondition(\n          mapping,\n          [read.policy, current],\n          read.ceremony,\n          subjectId,\n          resolved ? [\"subject\"] : [],\n          false,\n          resolved,\n        ),\n      ))\n    )\n      return yield* reject;\n    const claimedAtMillis = yield* owner.now(mapping.clock);\n\n    const claim = snapshotPasskeySync(PasskeyClaim, {\n      ceremony: read.ceremony,\n      claimId: input.claimId,\n      claimedAtMillis,\n      claimExpiresAtMillis: Math.min(\n        claimedAtMillis + read.ceremony.claimLifetimeMillis,\n        read.ceremony.expiresAtMillis,\n      ),\n    });\n\n    const table = mapping.flow;\n\n    yield* owner.update(\n      table.table,\n      { [table.moduleId]: mapping.moduleId, [table.flowId]: read.ceremony.flowId },\n      {\n        [table.state]: table.states.Claimed,\n        [table.version]: owner.marker,\n        [table.claimId]: claim.claimId,\n        [table.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),\n        [table.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),\n        [table.credentialSnapshot]:\n          input.credential === undefined ? null : credentialStorage.encode(input.credential),\n        [table.subjectScope]: subjectId === undefined ? null : yield* subjectScope(subjectId),\n      },\n    );\n    if (resolved) yield* insertCharges(mapping, read.ceremony, read.policy, [\"subject\"], subjectId);\n    yield* guardChargeSet(mapping, read.ceremony, subjectId);\n    yield* guardAdmission(mapping, [read.policy, current], read.ceremony, subjectId);\n    owner.postconditions.push(liveCondition(mapping, read.ceremony, claim));\n\n    return { _tag: \"Claimed\", claim } as const;\n  });\n\n  const exactClaim = (read: FlowRead, claim: PasskeyClaim) =>\n    read.state === \"Claimed\" &&\n    read.claim !== undefined &&\n    read.claim.claimId === claim.claimId &&\n    read.claim.claimedAtMillis === claim.claimedAtMillis &&\n    read.claim.claimExpiresAtMillis === claim.claimExpiresAtMillis &&\n    ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(claim.ceremony);\n\n  const evidenceMatches = (\n    ceremony: PasskeyCeremony,\n    captured: PasskeyCredential,\n    credential: PasskeyCredential,\n    assertion: PasskeyAssertionVerified,\n    evidence: typeof PasskeyEvidence.Type,\n  ) => {\n    const proof = evidence.proofs[0];\n    const target = targetRevision(ceremony);\n    const original = target ?? captured.revision;\n\n    const ids = [\n      ...new Set([\n        ...original.credentials.map((item) => item.credentialId),\n        credential.credentialId,\n      ]),\n    ];\n\n    const expected = {\n      ...credential.revision,\n      credentials: credential.revision.credentials.filter((item) =>\n        ids.includes(item.credentialId),\n      ),\n    };\n\n    const selected = captured.revision.credentials.find(\n      (item) => item.credentialId === credential.credentialId,\n    );\n\n    return (\n      evidence.proofs.length === 1 &&\n      proof !== undefined &&\n      proof.method === \"passkey\" &&\n      proof.credentialId === credential.credentialId &&\n      proof.factors.length === 1 &&\n      proof.factors[0] === \"possession\" &&\n      proof.userVerified === assertion.userVerified &&\n      proof.phishingResistant &&\n      DateTime.toEpochMillis(proof.verifiedAt) === ceremony.issuedAtMillis &&\n      evidence.flowId ===\n        (\"target\" in ceremony.context ? ceremony.context.target.flowId : ceremony.flowId) &&\n      evidence.bindingDigest ===\n        (\"target\" in ceremony.context\n          ? ceremony.context.target.bindingDigest\n          : ceremony.requestBindingVerifier) &&\n      expected.credentials.length === ids.length &&\n      sameRevision(evidence.revision, expected) &&\n      original.subjectId === expected.subjectId &&\n      original.securityRevision === expected.securityRevision &&\n      original.credentials.every((item) =>\n        expected.credentials.some(\n          (current) =>\n            current.credentialId === item.credentialId && current.revision === item.revision,\n        ),\n      ) &&\n      selected !== undefined &&\n      expected.credentials.some(\n        (item) =>\n          item.credentialId === selected.credentialId && item.revision === selected.revision,\n      )\n    );\n  };\n\n  const updateTelemetry = Effect.fn(\"passkey.updateTelemetry\")(function* (\n    mapping: any,\n    found: CredentialRead,\n    assertion: PasskeyAssertionVerified,\n    dialect: \"pg\" | \"mysql\" | \"sqlite\",\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.read.credential;\n    const counter = sql`${col(table.table, table.counter)}`;\n    const maximum = sql`${col(table.table, table.maximumCounter)}`;\n\n    const max = (...values: ReadonlyArray<ReturnType<QueryOperations[\"sql\"]>>) =>\n      dialect === \"sqlite\"\n        ? sql`max(${sql.join([...values], sql`, `)})`\n        : sql`greatest(${sql.join([...values], sql`, `)})`;\n\n    const semantic = Object.fromEntries(\n      semanticCredentialColumns(table).map((column) => [column, found.row[column]]),\n    );\n\n    const bs = mapping.telemetry.encodeBackupState(assertion.backupState);\n    const synced = found.credential.backupEligible;\n    const merged = max(counter, maximum, sql`${assertion.counter}`);\n\n    const currentCounter = synced\n      ? sql`1 = 1`\n      : sql`((${counter} = 0 and ${assertion.counter} = 0) or ${counter} < ${assertion.counter})`;\n\n    yield* owner.updateGuarded(\n      table.table,\n      both(owner.exact(table.table, semantic), table.activeCondition, currentCounter),\n      {\n        [table.counter]: synced ? merged : assertion.counter,\n        [table.maximumCounter]: merged,\n        [table.backupState]: bs,\n      },\n      {\n        rows: 1,\n        postcondition: yield* existsExact(\n          table.table,\n          { ...semantic, [table.backupState]: bs },\n          both(\n            synced ? sql`${counter} = ${maximum}` : sql`${counter} = ${assertion.counter}`,\n            sql`${maximum} >= ${assertion.counter}`,\n          ),\n        ),\n      },\n    );\n    const earliest = yield* owner.now(mapping.clock);\n    const lastUsed = sql`${col(table.table, mapping.telemetry.lastUsedAt)}`;\n    const millis = mapping.clock.toMillis(lastUsed);\n\n    yield* owner.finalUpdate(\n      table.table,\n      owner.exact(table.table, semantic),\n      {\n        [mapping.telemetry.lastUsedAt]: mapping.clock.fromMillis(\n          max(sql`coalesce(${millis}, 0)`, mapping.clock.engineNowMillis),\n        ),\n      },\n      {\n        rows: 1,\n        postcondition: yield* existsExact(\n          table.table,\n          semantic,\n          both(sql`${millis} >= ${earliest}`, sql`${millis} <= ${mapping.clock.engineNowMillis}`),\n        ),\n      },\n    );\n  });\n\n  const settleAssertion = Effect.fn(\"passkey.settleAssertion\")(function* (\n    mapping: any,\n    claim: PasskeyClaim,\n    outcome:\n      | { readonly _tag: \"Rejected\" | \"Ambiguous\" }\n      | {\n          readonly _tag: \"Assertion\";\n          readonly credential: PasskeyCredential;\n          readonly assertion: PasskeyAssertionVerified;\n          readonly evidence: typeof PasskeyEvidence.Type;\n        },\n    dialect: \"pg\" | \"mysql\" | \"sqlite\",\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const assertedCredential = outcome._tag === \"Assertion\" ? outcome.credential : undefined;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined || claim.ceremony.moduleId !== mapping.moduleId)\n      return \"Rejected\" as const;\n    yield* lockAdmission(mapping);\n\n    const originalIds =\n      targetRevision(claim.ceremony)?.credentials.map((item) => item.credentialId) ??\n      (outcome._tag === \"Assertion\"\n        ? outcome.credential.revision.credentials.map((item) => item.credentialId)\n        : undefined);\n\n    const subjectId =\n      outcome._tag === \"Assertion\"\n        ? outcome.credential.revision.subjectId\n        : knownSubject(claim.ceremony);\n\n    const subject =\n      subjectId === undefined ? undefined : yield* readSubject(mapping.read, subjectId);\n\n    yield* readPolicyGuards(mapping);\n\n    const found =\n      outcome._tag !== \"Assertion\" || subject === undefined\n        ? undefined\n        : yield* readCredential(\n            mapping.read,\n            subject,\n            claim.ceremony.profile.rpId,\n            outcome.credential.protocolCredentialId,\n            originalIds,\n          );\n\n    const read = yield* readFlow(mapping, claim.ceremony.flowId);\n\n    if (read === undefined || !exactClaim(read, claim)) return \"Rejected\" as const;\n    if (outcome._tag !== \"Assertion\") return yield* terminalFlow(mapping, read, outcome._tag);\n    invariant(assertedCredential !== undefined);\n    const captured = \"credential\" in read ? read.credential : undefined;\n    const assertion = outcome.assertion;\n\n    if (\n      captured === undefined ||\n      found === undefined ||\n      !compatiblePolicy(read.ceremony, read.policy, current) ||\n      !sameCredential(captured, assertedCredential) ||\n      !sameCredential(captured, found.credential)\n    )\n      return yield* terminalFlow(mapping, read, \"Rejected\");\n    const credential = found.credential;\n    const profile = read.ceremony.profile;\n\n    if (\n      assertion.protocolCredentialId !== credential.protocolCredentialId ||\n      (assertion.userHandle !== undefined && assertion.userHandle !== credential.userHandle) ||\n      assertion.backupEligible !== credential.backupEligible ||\n      (assertion.backupState && !assertion.backupEligible) ||\n      (profile.userVerification === \"required\" && !assertion.userVerified) ||\n      !profile.algorithms.includes(credential.algorithm) ||\n      (read.ceremony.allowedCredentials.length !== 0 &&\n        !read.ceremony.allowedCredentials.some(\n          (item) => item.id === credential.protocolCredentialId,\n        )) ||\n      (read.ceremony.purpose === \"sign-in\" &&\n        (assertion.userHandle !== credential.userHandle ||\n          !credential.primarySignIn ||\n          !credential.enrollmentUserVerified ||\n          !credential.profile.primarySignIn ||\n          credential.profile.userVerification !== \"required\" ||\n          !assertion.userVerified)) ||\n      !evidenceMatches(read.ceremony, captured, credential, assertion, outcome.evidence) ||\n      !(yield* owner.check(liveCondition(mapping, read.ceremony, claim)))\n    )\n      return yield* terminalFlow(mapping, read, \"Rejected\");\n    yield* readCharges(mapping, read.ceremony, read.policy, credential.revision.subjectId);\n    yield* guardChargeSet(mapping, read.ceremony, credential.revision.subjectId);\n    yield* updateTelemetry(mapping, found, assertion, dialect);\n    yield* terminalFlow(mapping, read, \"Verified\");\n    owner.postconditions.push(liveCondition(mapping, read.ceremony, claim));\n\n    return \"Verified\" as const;\n  });\n\n  const purposeCondition = (table: any, purposes: ReadonlyArray<string>) =>\n    sql`${col(table.table, table.purpose)} in (${sql.join(\n      purposes.map((purpose) => sql`${purpose}`),\n      sql`, `,\n    )})`;\n\n  const custodyFree = (mapping: any, flowExpression: ReturnType<QueryOperations[\"sql\"]>) => {\n    if (mapping.intent === undefined) return sql`1 = 1`;\n    const intent = mapping.intent;\n\n    return sql`not exists (select 1 from ${intent.table} where ${both(\n      equal(intent.table, { [intent.moduleId]: mapping.moduleId }),\n      sql`${col(intent.table, intent.flowId)} = ${flowExpression}`,\n      intent.custodyCondition,\n    )})`;\n  };\n\n  const flowDue = (mapping: any, purposes: ReadonlyArray<string>) => {\n    const flow = mapping.flow,\n      charge = mapping.charge,\n      now = mapping.clock.engineNowMillis;\n\n    const state = sql`${col(flow.table, flow.state)}`;\n    const retained = sql`${mapping.clock.toMillis(sql`${col(flow.table, flow.retentionUntil)}`)} <= ${now}`;\n\n    const chargeLive = sql`exists (select 1 from ${charge.table} where ${both(\n      equal(charge.table, { [charge.moduleId]: mapping.moduleId }),\n      sql`${col(charge.table, charge.flowId)} = ${col(flow.table, flow.flowId)}`,\n      sql`(${col(charge.table, charge.retainUntil)} is null or ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${now})`,\n    )})`;\n\n    return both(\n      equal(flow.table, { [flow.moduleId]: mapping.moduleId }),\n      purposeCondition(flow, purposes),\n      sql`((${state} = ${flow.states.Pending} and ${mapping.clock.toMillis(sql`${col(flow.table, flow.expiresAt)}`)} <= ${now}) or\n        (${state} = ${flow.states.Claimed} and ${mapping.clock.toMillis(sql`${col(flow.table, flow.claimExpiresAt)}`)} <= ${now}) or\n        (${state} in (${flow.states.Verified}, ${flow.states.Rejected}, ${flow.states.Ambiguous}, ${flow.states.RegistrationAccepted}) and ${retained} and not (${chargeLive}) and ${custodyFree(mapping, sql`${col(flow.table, flow.flowId)}`)}))`,\n    );\n  };\n\n  const chargeDue = (mapping: any, purposes: ReadonlyArray<string>) => {\n    const charge = mapping.charge;\n\n    return both(\n      equal(charge.table, { [charge.moduleId]: mapping.moduleId }),\n      purposeCondition(charge, purposes),\n      sql`${col(charge.table, charge.admittedAt)} is not null and ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} <= ${mapping.clock.engineNowMillis}`,\n      custodyFree(mapping, sql`${col(charge.table, charge.flowId)}`),\n    );\n  };\n\n  /** Flow transitions and row removals share one bound. Prepared hasMore is\n   * predicted from this owner's staged changes, then asserted after final writes. */\n  const cleanupCeremonies = Effect.fn(\"passkey.cleanupCeremonies\")(function* (\n    mapping: any,\n    input: { readonly moduleId: string; readonly nowMillis: number; readonly limit: number },\n    purposes: ReadonlyArray<string>,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    invariant(\n      input.moduleId === mapping.moduleId &&\n        Number.isSafeInteger(input.nowMillis) &&\n        input.nowMillis >= 0 &&\n        Number.isSafeInteger(input.limit) &&\n        input.limit >= 1 &&\n        input.limit <= 1000,\n    );\n    yield* readModule(mapping);\n    yield* lockAdmission(mapping);\n    yield* readPolicyGuards(mapping);\n\n    const flow = mapping.flow,\n      charge = mapping.charge;\n\n    const rows = (yield* owner.read(flow.table, flowDue(mapping, purposes), {\n      limit: input.limit,\n      takeOnly: true,\n      observe: false,\n      orderBy: sql`${col(flow.table, flow.flowId)}`,\n    })).rows;\n\n    const touched: string[] = [];\n    const transitioned: FlowRead[] = [];\n\n    let terminalized = 0,\n      removed = 0;\n\n    for (const candidate of rows) {\n      const read = yield* readFlow(mapping, candidate[flow.flowId]);\n\n      if (read === undefined) continue;\n      invariant(\n        yield* owner.check(\n          sql`exists (select 1 from ${flow.table} where ${both(equal(flow.table, { [flow.moduleId]: mapping.moduleId, [flow.flowId]: read.ceremony.flowId }), flowDue(mapping, purposes))})`,\n        ),\n      );\n      touched.push(read.ceremony.flowId);\n      if (read.state === \"Pending\" || read.state === \"Claimed\") {\n        const deadline =\n          read.state === \"Pending\"\n            ? read.ceremony.expiresAtMillis\n            : read.claim!.claimExpiresAtMillis;\n\n        if (read.state === \"Pending\") yield* releaseRegistrationCustody(mapping, read.ceremony);\n        yield* terminalFlow(mapping, read, read.state === \"Pending\" ? \"Rejected\" : \"Ambiguous\");\n        owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${deadline}`);\n        transitioned.push(read);\n        terminalized++;\n      } else {\n        yield* scrubRegistrationIntent(mapping, read.ceremony);\n        yield* owner.remove(flow.table, {\n          [flow.moduleId]: mapping.moduleId,\n          [flow.flowId]: read.ceremony.flowId,\n        });\n        owner.postconditions.push(\n          sql`${mapping.clock.engineNowMillis} >= ${read.ceremony.retentionUntilMillis}`,\n          custodyFree(mapping, sql`${read.ceremony.flowId}`),\n          sql`not exists (select 1 from ${charge.table} where ${both(\n            equal(charge.table, {\n              [charge.moduleId]: mapping.moduleId,\n              [charge.flowId]: read.ceremony.flowId,\n            }),\n            sql`(${col(charge.table, charge.retainUntil)} is null or ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${mapping.clock.engineNowMillis})`,\n          )})`,\n        );\n        removed++;\n      }\n    }\n    const removedCharges: Array<{ flowId: string; kind: string }> = [];\n    const remaining = input.limit - terminalized - removed;\n\n    if (remaining > 0) {\n      const charges = (yield* owner.read(charge.table, chargeDue(mapping, purposes), {\n        limit: remaining,\n        takeOnly: true,\n        observe: false,\n        orderBy: sql`${col(charge.table, charge.flowId)}, ${col(charge.table, charge.kind)}`,\n      })).rows;\n\n      for (const candidate of charges) {\n        const identity = {\n          [charge.moduleId]: mapping.moduleId,\n          [charge.flowId]: candidate[charge.flowId],\n          [charge.kind]: candidate[charge.kind],\n        };\n\n        const selected = (yield* owner.read(charge.table, equal(charge.table, identity), {\n          limit: 1,\n        })).rows[0];\n\n        invariant(selected !== undefined);\n        const horizon = mapping.clock.decodeInstant(selected[charge.retainUntil]);\n\n        invariant(Number.isSafeInteger(horizon));\n        yield* owner.remove(charge.table, identity);\n        owner.postconditions.push(\n          sql`${mapping.clock.engineNowMillis} >= ${horizon}`,\n          custodyFree(mapping, sql`${candidate[charge.flowId]}`),\n        );\n        removedCharges.push({ flowId: candidate[charge.flowId], kind: candidate[charge.kind] });\n        removed++;\n      }\n    }\n\n    const excludeFlows =\n      touched.length === 0\n        ? undefined\n        : sql`${col(flow.table, flow.flowId)} not in (${sql.join(\n            touched.map((id) => sql`${id}`),\n            sql`, `,\n          )})`;\n\n    const excludeCharges = removedCharges.map(\n      (item) =>\n        sql`not (${equal(charge.table, { [charge.flowId]: item.flowId, [charge.kind]: item.kind })})`,\n    );\n\n    const predicted = sql`exists (select 1 from ${flow.table} where ${both(flowDue(mapping, purposes), excludeFlows)}) or exists (select 1 from ${charge.table} where ${both(chargeDue(mapping, purposes), ...excludeCharges)})`;\n    // A transitioned row cannot also be removed by this call, but may be due now.\n    // Read through check only for unchanged rows; D1's prebatch assertion must use\n    // this predictive predicate, while the final assertion uses actual states.\n    let hasMore = yield* owner.check(predicted);\n\n    for (const read of transitioned) {\n      if (read.ceremony.retentionUntilMillis > (yield* owner.now(mapping.clock))) continue;\n      const liveCharges = sql`exists (select 1 from ${charge.table} where ${both(equal(charge.table, { [charge.moduleId]: mapping.moduleId, [charge.flowId]: read.ceremony.flowId }), sql`${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${mapping.clock.engineNowMillis}`, ...excludeCharges)})`;\n\n      if (\n        !(yield* owner.check(liveCharges)) &&\n        (yield* owner.check(custodyFree(mapping, sql`${read.ceremony.flowId}`)))\n      )\n        hasMore = true;\n    }\n    const actual = sql`exists (select 1 from ${flow.table} where ${flowDue(mapping, purposes)}) or exists (select 1 from ${charge.table} where ${chargeDue(mapping, purposes)})`;\n\n    owner.postconditions.push(hasMore ? actual : sql`not (${actual})`);\n\n    return { terminalized, removed, hasMore };\n  });\n\n  return {\n    assertionPurposes,\n    contextPurpose,\n    knownSubject,\n    compatiblePolicy,\n    liveCondition,\n    matchesAccess,\n    readFlow,\n    terminalFlow,\n    issueAssertion,\n    contextAssertion,\n    claimAssertion,\n    exactClaim,\n    settleAssertion,\n    cleanupCeremonies,\n  };\n};\n"],"mappings":";;;;AAiCA,MAAa,yBACX,YACA,WAUA,aAIA,qBAIA,OAiBA,iBACG;CACH,MAAM,EAAE,QAAQ;CAEhB,MAAM,EACJ,oBACA,cACA,gBACA,gBACA,eACA,eACA,gBACE;CAEJ,MAAM,EAAE,gBAAgB,YAAY,kBAAkB,cAAc,gBAAgB;CACpF,MAAM,EAAE,4BAA4B,4BAA4B;CAEhE,MAAM,EACJ,iBACA,KACA,mBACA,OACA,aACA,eACA,eACA,gBACA,gBACA,cACA,2BACA,cACA,gBACE;CAEJ,MAAM,YAA+C,MAAM;CAC3D,MAAM,EAAE,SAAS;CAEjB,MAAM,oBAAoB;EAAC;EAAW;EAAW;EAAW;CAAQ;CAEpE,MAAM,iBAAiB;EACrB,QAAQ;EACR,SAAS;EACT,QAAQ;EACR,QAAQ;EACR,YAAY;EACZ,cAAc;CAChB;CAEA,MAAM,gBAAgB,aACpB,YAAY,SAAS,UACjB,SAAS,QAAQ,OAAO,SAAS,YACjC,SAAS,QAAQ,SAAS,eACxB,SAAS,QAAQ,SAAS,YAC1B,KAAA;CAER,MAAM,oBACJ,UACA,UACA,YACG;EACH,MAAM,WAAW,QAAQ,SAAS,MAC/B,YAAY,QAAQ,cAAc,SAAS,QAAQ,SACtD;EAEA,MAAM,SAAS,SAAS,SAAS,MAC9B,YAAY,QAAQ,cAAc,SAAS,QAAQ,SACtD;EAEA,OACE,SAAS,eAAe,QAAQ,cAChC,SAAS,eAAe,SAAS,cACjC,aAAa,KAAA,KACb,WAAW,KAAA,KACX,eAAe,OAAO,QAAQ,MAAM,eAAe,OAAO,SAAS,OAAO,KAC1E,eAAe,OAAO,MAAM,MAAM,eAAe,OAAO,SAAS,OAAO,KACxE,SAAS,wBAAwB,SAAS,uBAC1C,SAAS,kBAAkB,SAAS,kBACpC,SAAS,mBAAmB,SAAS,iCACrC,SAAS,kBAAkB,SAAS,kBAAkB,SAAS,kBAC/D,SAAS,kBAAkB,SAAS,kBAAkB,QAAQ,kBAC9D,SAAS,yBAAyB,SAAS,iBAAiB,SAAS,mBACrE,eAAe,SAAS,QAAQ,UAAU,SAAS,WACnD,IAAI,IAAI,SAAS,mBAAmB,KAAK,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,SAC1D,SAAS,mBAAmB;CAElC;CAEA,MAAM,iBAAiB,SAAc,UAA2B,UAAyB;EACvF,MAAM,MAAM,QAAQ,MAAM;EAE1B,OAAO,KACL,GAAG,GAAG,IAAI,MAAM,SAAS,kBACzB,GAAG,GAAG,IAAI,KAAK,SAAS,mBACxB,GAAG,GAAG,IAAI,KAAK,SAAS,iCACxB,YAAY,SAAS,UACjB,GAAG,GAAG,IAAI,KAAK,SAAS,QAAQ,OAAO,oBACvC,KAAA,GACJ,UAAU,KAAA,IACN,KAAA,IACA,KACE,GAAG,GAAG,IAAI,MAAM,MAAM,mBACtB,GAAG,GAAG,IAAI,KAAK,MAAM,sBACvB,CACN;CACF;CAEA,MAAM,iBAAiB,UAA2B,WAChD,SAAS,aAAa,OAAO,YAC7B,SAAS,eAAe,OAAO,cAC/B,SAAS,YAAY,OAAO,WAC5B,SAAS,WAAW,OAAO,UAC3B,SAAS,2BAA2B,OAAO,0BAC3C,SAAS,kCAAkC,OAAO;CAEpD,MAAM,WAAW,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAAW,SAAc,QAAgB;EACtF,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAEtB,MAAM,OAAO,OAAO,MAAM,KACxB,MAAM,OACN,MAAM,MAAM,OAAO;IAChB,MAAM,WAAW,QAAQ;IACzB,MAAM,SAAS;EAClB,CAAC,GACD;GAAE,OAAO;GAAG,SAAS,cAAc,KAAK;EAAE,CAC5C,EAAA,CAAG,KAAK;EAER,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAC9B,MAAM,WAAW,gBAAgB,OAAO,IAAI,MAAM,SAAS;EAC3D,MAAM,SAAS,cAAc,OAAO,IAAI,MAAM,eAAe;EAE7D,MAAM,QAAQ,OAAO,KAAK,MAAM,MAAM,CAAC,CAAC,MACrC,SAAS,MAAM,OAAO,UAAU,IAAI,MAAM,MAC7C;EAEA,UACE,UAAU,KAAA,KAAa,SAAS,aAAa,QAAQ,YAAY,SAAS,WAAW,MACvF;EACA,UACE,IAAI,MAAM,cAAc,SAAS,YAC/B,IAAI,MAAM,YAAY,SAAS,UAC/B,IAAI,MAAM,eAAe,SAAS,SACtC;EACA,UACE,IAAI,MAAM,aAAa,SAAS,WAAW,IAAI,MAAM,gBAAgB,SAAS,UAChF;EACA,UACE,IAAI,MAAM,4BAA4B,SAAS,0BAC7C,QAAQ,MAAM,cAAc,IAAI,MAAM,wBAAwB,MAC5D,SAAS,6BACf;EACA,UACE,QAAQ,MAAM,cAAc,IAAI,MAAM,SAAS,MAAM,SAAS,kBAC5D,QAAQ,MAAM,cAAc,IAAI,MAAM,UAAU,MAAM,SAAS,mBAC/D,QAAQ,MAAM,cAAc,IAAI,MAAM,eAAe,MAAM,SAAS,oBACxE;EACA,UAAU,iBAAiB,UAAU,QAAQ,MAAM,CAAC;EAEpD,MAAM,aACJ,IAAI,MAAM,wBAAwB,OAC9B,KAAA,IACA,kBAAkB,OAAO,IAAI,MAAM,mBAAmB;EAE5D,MAAM,UAAU,YAAY,SAAS,aAAa,aAAa,QAAQ;EAEvE,UACE,IAAI,MAAM,mBAAmB,YAAY,KAAA,IAAY,OAAO,OAAO,aAAa,OAAO,MACrF,IAAI,MAAM,kBAAkB,OAAO,YAAY,QAAQ,EAC3D;EACA,IAAI,UAAU,WAAW;GACvB,UACE,IAAI,MAAM,aAAa,QACrB,IAAI,MAAM,eAAe,QACzB,IAAI,MAAM,oBAAoB,QAC9B,eAAe,KAAA,CACnB;GAEA,OAAO;IAAE;IAAK;IAAU;IAAQ;GAAM;EACxC;EAEA,MAAM,QACJ,IAAI,MAAM,aAAa,OACnB,KAAA,IACA,oBAAoB,cAAc;GAChC;GACA,SAAS,IAAI,MAAM;GACnB,iBAAiB,QAAQ,MAAM,cAAc,IAAI,MAAM,UAAU;GACjE,sBAAsB,QAAQ,MAAM,cAAc,IAAI,MAAM,eAAe;EAC7E,CAAC;EAEP,UAAU,UAAU,aAAa,UAAU,KAAA,CAAS;EACpD,IAAI,UAAU,KAAA,GACZ,UACE,MAAM,yBACJ,KAAK,IAAI,MAAM,kBAAkB,SAAS,qBAAqB,SAAS,eAAe,CAC3F;EAEF,OAAO;GACL;GACA;GACA;GACA;GACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;GACvC,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;EACnD;CACF,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,MACA,OACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAEtB,OAAO,MAAM,OACX,MAAM,OACN;IAAG,MAAM,WAAW,QAAQ;IAAW,MAAM,SAAS,KAAK,SAAS;EAAO,GAC3E;IACG,MAAM,QAAQ,MAAM,OAAO;IAC3B,MAAM,UAAU,MAAM;EACzB,CACF;EACA,MAAM,eAAe,KACnB,OAAO,YAAY,MAAM,OAAO;IAC7B,MAAM,WAAW,QAAQ;IACzB,MAAM,SAAS,KAAK,SAAS;IAC7B,MAAM,QAAQ,MAAM,OAAO;IAC3B,MAAM,UAAU,MAAM;EACzB,CAAC,CACH;EAEA,OAAO;CACT,CAAC;CAED,MAAM,kBAAkB,aACtB,YAAY,SAAS,UACjB,SAAS,QAAQ,OAAO,WACxB,SAAS,QAAQ,SAAS,eACxB,SAAS,QAAQ,WACjB,KAAA;CAER,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,SACA,UACA;EACA,MAAM,SAAS,eAAe,QAAQ;EAEtC,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,IACE,YAAY,KAAA,KACZ,QAAQ,cAAc,OAAO,aAC7B,QAAQ,qBAAqB,OAAO,kBAEpC,OAAO;EAET,MAAM,UAAU,OAAO,aACrB,QAAQ,MACR,SACA,OAAO,YAAY,KAAK,SAAS,KAAK,YAAY,CACpD;EAEA,OAAO,YAAY,KAAA,KAAa,aAAa,SAAS,MAAM;CAC9D,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,UACA,gBACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,UAAU,OAAO,WAAW,OAAO;EAEzC,IACE,YAAY,KAAA,KACZ,SAAS,aAAa,QAAQ,YAC9B,CAAC,iBAAiB,UAAU,gBAAgB,OAAO,KACnD,cAAc,OAAO,cAAc,MAAM,cAAc,OAAO,OAAO,GAErE,OAAO,EAAE,MAAM,WAAW;EAC5B,OAAO,cAAc,OAAO;EAC5B,MAAM,YAAY,aAAa,QAAQ;EAEvC,MAAM,UACJ,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,YAAY,QAAQ,MAAM,SAAS;EAElF,OAAO,iBAAiB,OAAO;EAC/B,IAAI,EAAE,OAAO,cAAc,SAAS,SAAS,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;EACnF,IACE,SAAS,QAAQ,SAAS,aACzB,CAAC,SAAS,QAAQ,iBACjB,SAAS,QAAQ,qBAAqB,cACtC,SAAS,QAAQ,gBAAgB,aAEnC,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,QAAQ,QAAQ;EAEtB,MAAM,cAAc,OAAO,MAAM,KAC/B,MAAM,OACN,MAAM,MAAM,OAAO;IAChB,MAAM,WAAW,QAAQ;IACzB,MAAM,YAAY,SAAS;EAC9B,CAAC,GACD,EAAE,OAAO,EAAE,CACb;EAEA,MAAM,WAAW,OAAO,SAAS,SAAS,SAAS,MAAM;EAEzD,IAAI,YAAY,KAAK,WAAW,KAAK,aAAa,KAAA,GAChD,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,SAAS,OAAO,aAAa,UAAU,SAAS,EAAA,CAAG,KAAK,SAAS,KAAK,IAAI;EAEhF,IACE,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,QAAQ,CAAC,MACrD,EAAE,OAAO,MAAM,MACb,OAAO,mBAAmB,SAAS,CAAC,OAAO,GAAG,UAAU,WAAW,OAAO,MAAM,KAAK,CACvF,IAEA,OAAO,EAAE,MAAM,WAAW;EAE5B,MAAM,SAAS;GACb,GAAG,MAAM,aAAa;IAAE;IAAU,QAAQ;IAAgB,QAAQ,MAAM;GAAO,CAAC;IAC/E,MAAM,WAAW,SAAS;IAC1B,MAAM,SAAS,SAAS;IACxB,MAAM,YAAY,SAAS;IAC3B,MAAM,UAAU,SAAS;IACzB,MAAM,QAAQ,MAAM,OAAO;IAC3B,MAAM,UAAU,MAAM;IACtB,MAAM,aAAa,SAAS;IAC5B,MAAM,WAAW,gBAAgB,OAAO,QAAQ;IAChD,MAAM,iBAAiB,cAAc,OAAO,cAAc;IAC1D,MAAM,yBAAyB,SAAS;IACxC,MAAM,0BAA0B,QAAQ,MAAM,cAC7C,SAAS,6BACX;IACC,MAAM,WAAW,QAAQ,MAAM,cAAc,SAAS,cAAc;IACpE,MAAM,YAAY,QAAQ,MAAM,cAAc,SAAS,eAAe;IACtE,MAAM,iBAAiB,QAAQ,MAAM,cAAc,SAAS,oBAAoB;IAChF,MAAM,UAAU;IAChB,MAAM,YAAY;IAClB,MAAM,iBAAiB;IACvB,MAAM,qBAAqB;IAC3B,MAAM,eAAe,cAAc,KAAA,IAAY,OAAO,OAAO,aAAa,SAAS;IACnF,MAAM,cAAc,OAAO,YAAY,QAAQ;EAClD;EAGA,MAAM,WAAW,OAAO,MAAM,OAAO,MAAM,OAAO,QAAQ;IACvD,MAAM,WAAW,QAAQ;IACzB,MAAM,SAAS,SAAS;EAC3B,CAAC;EAED,YAAY,OAAO,SAAS;EAC5B,KAAK,MAAM,eAAe,MAAM,cAC9B,IAAI,YAAY,UAAU,MAAM,SAAS,YAAY,KAAK,WAAW,GACnE,YAAY,OAAO,SAAS;EAChC,OAAO,cAAc,SAAS,UAAU,gBAAgB,OAAO,SAAS;EACxE,OAAO,eAAe,SAAS,UAAU,SAAS;EAClD,OAAO,eAAe,SAAS,CAAC,OAAO,GAAG,UAAU,SAAS;EAC7D,MAAM,eAAe,KAAK,cAAc,SAAS,QAAQ,CAAC;EAE1D,OAAO;GAAE,MAAM;GAAU;EAAS;CACpC,CAAC;CAED,MAAM,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,QACA;EACA,MAAM,QAAQ,OAAO;EAErB,IAAI,OAAO,aAAa,QAAQ,UAAU,OAAO,KAAA;EACjD,MAAM,UAAU,OAAO,WAAW,OAAO;EAEzC,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;EAClC,OAAO,iBAAiB,OAAO;EAC/B,MAAM,OAAO,OAAO,SAAS,SAAS,OAAO,MAAM;EAEnD,IACE,SAAS,KAAA,KACT,KAAK,UAAU,aACf,CAAC,cAAc,KAAK,UAAU,MAAM,KACpC,CAAC,iBAAiB,KAAK,UAAU,KAAK,QAAQ,OAAO,GAErD,OAAO,KAAA;EACT,IAAI,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,KAAK,QAAQ,CAAC,IAAI,OAAO,KAAA;EACzE,MAAM,eAAe,KAAK,cAAc,SAAS,KAAK,QAAQ,CAAC;EAE/D,OAAO,KAAK;CACd,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,OAOA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,UAAU,OAAO,WAAW,OAAO;EAEzC,IAAI,YAAY,KAAA,KAAa,MAAM,OAAO,aAAa,QAAQ,UAC7D,OAAO,EAAE,MAAM,WAAW;EAC5B,OAAO,cAAc,OAAO;EAC5B,MAAM,kBAAkB,aAAa,MAAM,QAAQ;EACnD,MAAM,YAAY,mBAAmB,MAAM,YAAY,SAAS;EAEhE,MAAM,UACJ,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,YAAY,QAAQ,MAAM,SAAS;EAElF,OAAO,iBAAiB,OAAO;EAE/B,MAAM,YACJ,eAAe,MAAM,QAAQ,CAAC,EAAE,YAAY,KAAK,SAAS,KAAK,YAAY,KAC3E,MAAM,YAAY,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY;EAExE,MAAM,aACJ,MAAM,eAAe,KAAA,KAAa,YAAY,KAAA,IAC1C,KAAA,IACA,OAAO,eACL,QAAQ,MACR,SACA,MAAM,SAAS,QAAQ,MACvB,MAAM,WAAW,sBACjB,SACF;EAEN,MAAM,OAAO,OAAO,SAAS,SAAS,MAAM,OAAO,MAAM;EAEzD,IACE,SAAS,KAAA,KACT,KAAK,UAAU,aACf,CAAC,cAAc,KAAK,UAAU,MAAM,MAAM,GAE1C,OAAO,EAAE,MAAM,WAAW;EAC5B,UAAU,gBAAgB,OAAO,KAAK,QAAQ,MAAM,gBAAgB,OAAO,MAAM,QAAQ,CAAC;EAE1F,MAAM,SAAS,OAAO,IAAI,aAAa;GACrC,OAAO,aAAa,SAAS,MAAM,UAAU;GAE7C,OAAO,EAAE,MAAM,WAAW;EAC5B,CAAC;EAED,IACE,CAAC,iBAAiB,KAAK,UAAU,KAAK,QAAQ,OAAO,KACrD,cAAc,OAAO,MAAM,MAAM,MAAM,cAAc,OAAO,OAAO,KACnE,EAAE,OAAO,cAAc,SAAS,SAAS,KAAK,QAAQ,IAEtD,OAAO,OAAO;EAChB,IACE,MAAM,eAAe,KAAA,MACpB,eAAe,KAAA,KAAa,CAAC,eAAe,MAAM,YAAY,WAAW,UAAU,IAEpF,OAAO,OAAO;EAChB,IAAI,MAAM,eAAe,KAAA,KAAa,eAAe,KAAA,GAAW;GAC9D,MAAM,WAAW,MAAM,WAAW;GAClC,MAAM,SAAS,WAAW,WAAW;GACrC,MAAM,MAAM,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAI,aAAa,CAAC,GAAI,MAAM,WAAW,YAAY,CAAC,CAAC;GAE9E,IACE,SAAS,cAAc,OAAO,aAC9B,SAAS,qBAAqB,OAAO,oBACrC,IAAI,MAAM,OAAO;IACf,MAAM,SAAS,SAAS,YAAY,MAAM,SAAS,KAAK,iBAAiB,EAAE;IAC3E,MAAM,QAAQ,OAAO,YAAY,MAAM,SAAS,KAAK,iBAAiB,EAAE;IAIxE,OACE,UAAU,KAAA,MACT,WAAW,KAAA,IACR,OAAO,MAAM,YAAY,gBAAgB,eAAe,KAAK,QAAQ,MAAM,KAAA,IAC3E,OAAO,aAAa,MAAM;GAElC,CAAC,GAED,OAAO,OAAO;EAClB;EACA,IAAI,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,KAAK,QAAQ,CAAC,IAAI,OAAO,OAAO;EAChF,OAAO,YAAY,SAAS,KAAK,UAAU,KAAK,QAAQ,eAAe;EACvE,MAAM,WAAW,oBAAoB,KAAA,KAAa,cAAc,KAAA;EAEhE,IACE,EAAE,OAAO,MAAM,MACb,OAAO,mBACL,SACA,CAAC,KAAK,QAAQ,OAAO,GACrB,KAAK,UACL,WACA,WAAW,CAAC,SAAS,IAAI,CAAC,GAC1B,OACA,QACF,CACF,IAEA,OAAO,OAAO;EAChB,MAAM,kBAAkB,OAAO,MAAM,IAAI,QAAQ,KAAK;EAEtD,MAAM,QAAQ,oBAAoB,cAAc;GAC9C,UAAU,KAAK;GACf,SAAS,MAAM;GACf;GACA,sBAAsB,KAAK,IACzB,kBAAkB,KAAK,SAAS,qBAChC,KAAK,SAAS,eAChB;EACF,CAAC;EAED,MAAM,QAAQ,QAAQ;EAEtB,OAAO,MAAM,OACX,MAAM,OACN;IAAG,MAAM,WAAW,QAAQ;IAAW,MAAM,SAAS,KAAK,SAAS;EAAO,GAC3E;IACG,MAAM,QAAQ,MAAM,OAAO;IAC3B,MAAM,UAAU,MAAM;IACtB,MAAM,UAAU,MAAM;IACtB,MAAM,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;IACnE,MAAM,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;IAC7E,MAAM,qBACL,MAAM,eAAe,KAAA,IAAY,OAAO,kBAAkB,OAAO,MAAM,UAAU;IAClF,MAAM,eAAe,cAAc,KAAA,IAAY,OAAO,OAAO,aAAa,SAAS;EACtF,CACF;EACA,IAAI,UAAU,OAAO,cAAc,SAAS,KAAK,UAAU,KAAK,QAAQ,CAAC,SAAS,GAAG,SAAS;EAC9F,OAAO,eAAe,SAAS,KAAK,UAAU,SAAS;EACvD,OAAO,eAAe,SAAS,CAAC,KAAK,QAAQ,OAAO,GAAG,KAAK,UAAU,SAAS;EAC/E,MAAM,eAAe,KAAK,cAAc,SAAS,KAAK,UAAU,KAAK,CAAC;EAEtE,OAAO;GAAE,MAAM;GAAW;EAAM;CAClC,CAAC;CAED,MAAM,cAAc,MAAgB,UAClC,KAAK,UAAU,aACf,KAAK,UAAU,KAAA,KACf,KAAK,MAAM,YAAY,MAAM,WAC7B,KAAK,MAAM,oBAAoB,MAAM,mBACrC,KAAK,MAAM,yBAAyB,MAAM,wBAC1C,gBAAgB,OAAO,KAAK,QAAQ,MAAM,gBAAgB,OAAO,MAAM,QAAQ;CAEjF,MAAM,mBACJ,UACA,UACA,YACA,WACA,aACG;EACH,MAAM,QAAQ,SAAS,OAAO;EAE9B,MAAM,WADS,eAAe,QACR,KAAK,SAAS;EAEpC,MAAM,MAAM,CACV,mBAAG,IAAI,IAAI,CACT,GAAG,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,GACvD,WAAW,YACb,CAAC,CACH;EAEA,MAAM,WAAW;GACf,GAAG,WAAW;GACd,aAAa,WAAW,SAAS,YAAY,QAAQ,SACnD,IAAI,SAAS,KAAK,YAAY,CAChC;EACF;EAEA,MAAM,WAAW,SAAS,SAAS,YAAY,MAC5C,SAAS,KAAK,iBAAiB,WAAW,YAC7C;EAEA,OACE,SAAS,OAAO,WAAW,KAC3B,UAAU,KAAA,KACV,MAAM,WAAW,aACjB,MAAM,iBAAiB,WAAW,gBAClC,MAAM,QAAQ,WAAW,KACzB,MAAM,QAAQ,OAAO,gBACrB,MAAM,iBAAiB,UAAU,gBACjC,MAAM,qBACN,SAAS,cAAc,MAAM,UAAU,MAAM,SAAS,kBACtD,SAAS,YACN,YAAY,SAAS,UAAU,SAAS,QAAQ,OAAO,SAAS,SAAS,WAC5E,SAAS,mBACN,YAAY,SAAS,UAClB,SAAS,QAAQ,OAAO,gBACxB,SAAS,2BACf,SAAS,YAAY,WAAW,IAAI,UACpC,aAAa,SAAS,UAAU,QAAQ,KACxC,SAAS,cAAc,SAAS,aAChC,SAAS,qBAAqB,SAAS,oBACvC,SAAS,YAAY,OAAO,SAC1B,SAAS,YAAY,MAClB,YACC,QAAQ,iBAAiB,KAAK,gBAAgB,QAAQ,aAAa,KAAK,QAC5E,CACF,KACA,aAAa,KAAA,KACb,SAAS,YAAY,MAClB,SACC,KAAK,iBAAiB,SAAS,gBAAgB,KAAK,aAAa,SAAS,QAC9E;CAEJ;CAEA,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA,WACA,SACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,KAAK;EAC3B,MAAM,UAAU,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,OAAO;EACpD,MAAM,UAAU,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,cAAc;EAE3D,MAAM,OAAO,GAAG,WACd,YAAY,WACR,GAAG,OAAO,IAAI,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG,IAAI,EAAE,KACzC,GAAG,YAAY,IAAI,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG,IAAI,EAAE;EAEpD,MAAM,WAAW,OAAO,YACtB,0BAA0B,KAAK,CAAC,CAAC,KAAK,WAAW,CAAC,QAAQ,MAAM,IAAI,OAAO,CAAC,CAC9E;EAEA,MAAM,KAAK,QAAQ,UAAU,kBAAkB,UAAU,WAAW;EACpE,MAAM,SAAS,MAAM,WAAW;EAChC,MAAM,SAAS,IAAI,SAAS,SAAS,GAAG,GAAG,UAAU,SAAS;EAE9D,MAAM,iBAAiB,SACnB,GAAG,UACH,GAAG,KAAK,QAAQ,WAAW,UAAU,QAAQ,WAAW,QAAQ,KAAK,UAAU,QAAQ;EAE3F,OAAO,MAAM,cACX,MAAM,OACN,KAAK,MAAM,MAAM,MAAM,OAAO,QAAQ,GAAG,MAAM,iBAAiB,cAAc,GAC9E;IACG,MAAM,UAAU,SAAS,SAAS,UAAU;IAC5C,MAAM,iBAAiB;IACvB,MAAM,cAAc;EACvB,GACA;GACE,MAAM;GACN,eAAe,OAAO,YACpB,MAAM,OACN;IAAE,GAAG;KAAW,MAAM,cAAc;GAAG,GACvC,KACE,SAAS,GAAG,GAAG,QAAQ,KAAK,YAAY,GAAG,GAAG,QAAQ,KAAK,UAAU,WACrE,GAAG,GAAG,QAAQ,MAAM,UAAU,SAChC,CACF;EACF,CACF;EACA,MAAM,WAAW,OAAO,MAAM,IAAI,QAAQ,KAAK;EAC/C,MAAM,WAAW,GAAG,GAAG,IAAI,MAAM,OAAO,QAAQ,UAAU,UAAU;EACpE,MAAM,SAAS,QAAQ,MAAM,SAAS,QAAQ;EAE9C,OAAO,MAAM,YACX,MAAM,OACN,MAAM,MAAM,MAAM,OAAO,QAAQ,GACjC,GACG,QAAQ,UAAU,aAAa,QAAQ,MAAM,WAC5C,IAAI,GAAG,YAAY,OAAO,OAAO,QAAQ,MAAM,eAAe,CAChE,EACF,GACA;GACE,MAAM;GACN,eAAe,OAAO,YACpB,MAAM,OACN,UACA,KAAK,GAAG,GAAG,OAAO,MAAM,YAAY,GAAG,GAAG,OAAO,MAAM,QAAQ,MAAM,iBAAiB,CACxF;EACF,CACF;CACF,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA,SAQA,SACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,qBAAqB,QAAQ,SAAS,cAAc,QAAQ,aAAa,KAAA;EAC/E,MAAM,UAAU,OAAO,WAAW,OAAO;EAEzC,IAAI,YAAY,KAAA,KAAa,MAAM,SAAS,aAAa,QAAQ,UAC/D,OAAO;EACT,OAAO,cAAc,OAAO;EAE5B,MAAM,cACJ,eAAe,MAAM,QAAQ,CAAC,EAAE,YAAY,KAAK,SAAS,KAAK,YAAY,MAC1E,QAAQ,SAAS,cACd,QAAQ,WAAW,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,IACvE,KAAA;EAEN,MAAM,YACJ,QAAQ,SAAS,cACb,QAAQ,WAAW,SAAS,YAC5B,aAAa,MAAM,QAAQ;EAEjC,MAAM,UACJ,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,YAAY,QAAQ,MAAM,SAAS;EAElF,OAAO,iBAAiB,OAAO;EAE/B,MAAM,QACJ,QAAQ,SAAS,eAAe,YAAY,KAAA,IACxC,KAAA,IACA,OAAO,eACL,QAAQ,MACR,SACA,MAAM,SAAS,QAAQ,MACvB,QAAQ,WAAW,sBACnB,WACF;EAEN,MAAM,OAAO,OAAO,SAAS,SAAS,MAAM,SAAS,MAAM;EAE3D,IAAI,SAAS,KAAA,KAAa,CAAC,WAAW,MAAM,KAAK,GAAG,OAAO;EAC3D,IAAI,QAAQ,SAAS,aAAa,OAAO,OAAO,aAAa,SAAS,MAAM,QAAQ,IAAI;EACxF,UAAU,uBAAuB,KAAA,CAAS;EAC1C,MAAM,WAAW,gBAAgB,OAAO,KAAK,aAAa,KAAA;EAC1D,MAAM,YAAY,QAAQ;EAE1B,IACE,aAAa,KAAA,KACb,UAAU,KAAA,KACV,CAAC,iBAAiB,KAAK,UAAU,KAAK,QAAQ,OAAO,KACrD,CAAC,eAAe,UAAU,kBAAkB,KAC5C,CAAC,eAAe,UAAU,MAAM,UAAU,GAE1C,OAAO,OAAO,aAAa,SAAS,MAAM,UAAU;EACtD,MAAM,aAAa,MAAM;EACzB,MAAM,UAAU,KAAK,SAAS;EAE9B,IACE,UAAU,yBAAyB,WAAW,wBAC7C,UAAU,eAAe,KAAA,KAAa,UAAU,eAAe,WAAW,cAC3E,UAAU,mBAAmB,WAAW,kBACvC,UAAU,eAAe,CAAC,UAAU,kBACpC,QAAQ,qBAAqB,cAAc,CAAC,UAAU,gBACvD,CAAC,QAAQ,WAAW,SAAS,WAAW,SAAS,KAChD,KAAK,SAAS,mBAAmB,WAAW,KAC3C,CAAC,KAAK,SAAS,mBAAmB,MAC/B,SAAS,KAAK,OAAO,WAAW,oBACnC,KACD,KAAK,SAAS,YAAY,cACxB,UAAU,eAAe,WAAW,cACnC,CAAC,WAAW,iBACZ,CAAC,WAAW,0BACZ,CAAC,WAAW,QAAQ,iBACpB,WAAW,QAAQ,qBAAqB,cACxC,CAAC,UAAU,iBACf,CAAC,gBAAgB,KAAK,UAAU,UAAU,YAAY,WAAW,QAAQ,QAAQ,KACjF,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,KAAK,UAAU,KAAK,CAAC,IAEjE,OAAO,OAAO,aAAa,SAAS,MAAM,UAAU;EACtD,OAAO,YAAY,SAAS,KAAK,UAAU,KAAK,QAAQ,WAAW,SAAS,SAAS;EACrF,OAAO,eAAe,SAAS,KAAK,UAAU,WAAW,SAAS,SAAS;EAC3E,OAAO,gBAAgB,SAAS,OAAO,WAAW,OAAO;EACzD,OAAO,aAAa,SAAS,MAAM,UAAU;EAC7C,MAAM,eAAe,KAAK,cAAc,SAAS,KAAK,UAAU,KAAK,CAAC;EAEtE,OAAO;CACT,CAAC;CAED,MAAM,oBAAoB,OAAY,aACpC,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,OAAO,EAAE,OAAO,IAAI,KAC/C,SAAS,KAAK,YAAY,GAAG,GAAG,SAAS,GACzC,GAAG,IACL,EAAE;CAEJ,MAAM,eAAe,SAAc,mBAAuD;EACxF,IAAI,QAAQ,WAAW,KAAA,GAAW,OAAO,GAAG;EAC5C,MAAM,SAAS,QAAQ;EAEvB,OAAO,GAAG,6BAA6B,OAAO,MAAM,SAAS,KAC3D,MAAM,OAAO,OAAO,GAAG,OAAO,WAAW,QAAQ,SAAS,CAAC,GAC3D,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,MAAM,EAAE,KAAK,kBAC5C,OAAO,gBACT,EAAE;CACJ;CAEA,MAAM,WAAW,SAAc,aAAoC;EACjE,MAAM,OAAO,QAAQ,MACnB,SAAS,QAAQ,QACjB,MAAM,QAAQ,MAAM;EAEtB,MAAM,QAAQ,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,KAAK;EAC9C,MAAM,WAAW,GAAG,GAAG,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,cAAc,GAAG,EAAE,MAAM;EAElG,MAAM,aAAa,GAAG,yBAAyB,OAAO,MAAM,SAAS,KACnE,MAAM,OAAO,OAAO,GAAG,OAAO,WAAW,QAAQ,SAAS,CAAC,GAC3D,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,MAAM,EAAE,KAAK,IAAI,KAAK,OAAO,KAAK,MAAM,KACvE,GAAG,IAAI,IAAI,OAAO,OAAO,OAAO,WAAW,EAAE,cAAc,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,WAAW,GAAG,EAAE,KAAK,IAAI,EAC5I,EAAE;EAEF,OAAO,KACL,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,QAAQ,SAAS,CAAC,GACvD,iBAAiB,MAAM,QAAQ,GAC/B,GAAG,KAAK,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,SAAS,GAAG,EAAE,MAAM,IAAI;WACnH,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,cAAc,GAAG,EAAE,MAAM,IAAI;WACrH,MAAM,OAAO,KAAK,OAAO,SAAS,IAAI,KAAK,OAAO,SAAS,IAAI,KAAK,OAAO,UAAU,IAAI,KAAK,OAAO,qBAAqB,QAAQ,SAAS,YAAY,WAAW,QAAQ,YAAY,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE,GAC5O;CACF;CAEA,MAAM,aAAa,SAAc,aAAoC;EACnE,MAAM,SAAS,QAAQ;EAEvB,OAAO,KACL,MAAM,OAAO,OAAO,GAAG,OAAO,WAAW,QAAQ,SAAS,CAAC,GAC3D,iBAAiB,QAAQ,QAAQ,GACjC,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,UAAU,EAAE,mBAAmB,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,WAAW,GAAG,EAAE,MAAM,QAAQ,MAAM,mBACxJ,YAAY,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,MAAM,GAAG,CAC/D;CACF;CAwJA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,mBAlKwB,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,OACA,UACA;GACA,MAAM,QAAQ,OAAO;GAErB,UACE,MAAM,aAAa,QAAQ,YACzB,OAAO,cAAc,MAAM,SAAS,KACpC,MAAM,aAAa,KACnB,OAAO,cAAc,MAAM,KAAK,KAChC,MAAM,SAAS,KACf,MAAM,SAAS,GACnB;GACA,OAAO,WAAW,OAAO;GACzB,OAAO,cAAc,OAAO;GAC5B,OAAO,iBAAiB,OAAO;GAE/B,MAAM,OAAO,QAAQ,MACnB,SAAS,QAAQ;GAEnB,MAAM,QAAQ,OAAO,MAAM,KAAK,KAAK,OAAO,QAAQ,SAAS,QAAQ,GAAG;IACtE,OAAO,MAAM;IACb,UAAU;IACV,SAAS;IACT,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,MAAM;GAC5C,CAAC,EAAA,CAAG;GAEJ,MAAM,UAAoB,CAAC;GAC3B,MAAM,eAA2B,CAAC;GAElC,IAAI,eAAe,GACjB,UAAU;GAEZ,KAAK,MAAM,aAAa,MAAM;IAC5B,MAAM,OAAO,OAAO,SAAS,SAAS,UAAU,KAAK,OAAO;IAE5D,IAAI,SAAS,KAAA,GAAW;IACxB,UACE,OAAO,MAAM,MACX,GAAG,yBAAyB,KAAK,MAAM,SAAS,KAAK,MAAM,KAAK,OAAO;MAAG,KAAK,WAAW,QAAQ;MAAW,KAAK,SAAS,KAAK,SAAS;IAAO,CAAC,GAAG,QAAQ,SAAS,QAAQ,CAAC,EAAE,EAClL,CACF;IACA,QAAQ,KAAK,KAAK,SAAS,MAAM;IACjC,IAAI,KAAK,UAAU,aAAa,KAAK,UAAU,WAAW;KACxD,MAAM,WACJ,KAAK,UAAU,YACX,KAAK,SAAS,kBACd,KAAK,MAAO;KAElB,IAAI,KAAK,UAAU,WAAW,OAAO,2BAA2B,SAAS,KAAK,QAAQ;KACtF,OAAO,aAAa,SAAS,MAAM,KAAK,UAAU,YAAY,aAAa,WAAW;KACtF,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,UAAU;KAC9E,aAAa,KAAK,IAAI;KACtB;IACF,OAAO;KACL,OAAO,wBAAwB,SAAS,KAAK,QAAQ;KACrD,OAAO,MAAM,OAAO,KAAK,OAAO;OAC7B,KAAK,WAAW,QAAQ;OACxB,KAAK,SAAS,KAAK,SAAS;KAC/B,CAAC;KACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,SAAS,wBACxD,YAAY,SAAS,GAAG,GAAG,KAAK,SAAS,QAAQ,GACjD,GAAG,6BAA6B,OAAO,MAAM,SAAS,KACpD,MAAM,OAAO,OAAO;OACjB,OAAO,WAAW,QAAQ;OAC1B,OAAO,SAAS,KAAK,SAAS;KACjC,CAAC,GACD,GAAG,IAAI,IAAI,OAAO,OAAO,OAAO,WAAW,EAAE,cAAc,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,WAAW,GAAG,EAAE,KAAK,QAAQ,MAAM,gBAAgB,EACtK,EAAE,EACJ;KACA;IACF;GACF;GACA,MAAM,iBAA0D,CAAC;GACjE,MAAM,YAAY,MAAM,QAAQ,eAAe;GAE/C,IAAI,YAAY,GAAG;IACjB,MAAM,WAAW,OAAO,MAAM,KAAK,OAAO,OAAO,UAAU,SAAS,QAAQ,GAAG;KAC7E,OAAO;KACP,UAAU;KACV,SAAS;KACT,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,MAAM,EAAE,IAAI,IAAI,OAAO,OAAO,OAAO,IAAI;IACnF,CAAC,EAAA,CAAG;IAEJ,KAAK,MAAM,aAAa,SAAS;KAC/B,MAAM,WAAW;OACd,OAAO,WAAW,QAAQ;OAC1B,OAAO,SAAS,UAAU,OAAO;OACjC,OAAO,OAAO,UAAU,OAAO;KAClC;KAEA,MAAM,YAAY,OAAO,MAAM,KAAK,OAAO,OAAO,MAAM,OAAO,OAAO,QAAQ,GAAG,EAC/E,OAAO,EACT,CAAC,EAAA,CAAG,KAAK;KAET,UAAU,aAAa,KAAA,CAAS;KAChC,MAAM,UAAU,QAAQ,MAAM,cAAc,SAAS,OAAO,YAAY;KAExE,UAAU,OAAO,cAAc,OAAO,CAAC;KACvC,OAAO,MAAM,OAAO,OAAO,OAAO,QAAQ;KAC1C,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,WAC1C,YAAY,SAAS,GAAG,GAAG,UAAU,OAAO,SAAS,CACvD;KACA,eAAe,KAAK;MAAE,QAAQ,UAAU,OAAO;MAAS,MAAM,UAAU,OAAO;KAAM,CAAC;KACtF;IACF;GACF;GAEA,MAAM,eACJ,QAAQ,WAAW,IACf,KAAA,IACA,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,MAAM,EAAE,WAAW,IAAI,KAChD,QAAQ,KAAK,OAAO,GAAG,GAAG,IAAI,GAC9B,GAAG,IACL,EAAE;GAER,MAAM,iBAAiB,eAAe,KACnC,SACC,GAAG,QAAQ,MAAM,OAAO,OAAO;KAAG,OAAO,SAAS,KAAK;KAAS,OAAO,OAAO,KAAK;GAAK,CAAC,EAAE,EAC/F;GAEA,MAAM,YAAY,GAAG,yBAAyB,KAAK,MAAM,SAAS,KAAK,QAAQ,SAAS,QAAQ,GAAG,YAAY,EAAE,6BAA6B,OAAO,MAAM,SAAS,KAAK,UAAU,SAAS,QAAQ,GAAG,GAAG,cAAc,EAAE;GAI1N,IAAI,UAAU,OAAO,MAAM,MAAM,SAAS;GAE1C,KAAK,MAAM,QAAQ,cAAc;IAC/B,IAAI,KAAK,SAAS,wBAAwB,OAAO,MAAM,IAAI,QAAQ,KAAK,IAAI;IAC5E,MAAM,cAAc,GAAG,yBAAyB,OAAO,MAAM,SAAS,KAAK,MAAM,OAAO,OAAO;MAAG,OAAO,WAAW,QAAQ;MAAW,OAAO,SAAS,KAAK,SAAS;IAAO,CAAC,GAAG,GAAG,GAAG,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,WAAW,GAAG,EAAE,KAAK,QAAQ,MAAM,mBAAmB,GAAG,cAAc,EAAE;IAErT,IACE,EAAE,OAAO,MAAM,MAAM,WAAW,OAC/B,OAAO,MAAM,MAAM,YAAY,SAAS,GAAG,GAAG,KAAK,SAAS,QAAQ,CAAC,IAEtE,UAAU;GACd;GACA,MAAM,SAAS,GAAG,yBAAyB,KAAK,MAAM,SAAS,QAAQ,SAAS,QAAQ,EAAE,6BAA6B,OAAO,MAAM,SAAS,UAAU,SAAS,QAAQ,EAAE;GAE1K,MAAM,eAAe,KAAK,UAAU,SAAS,GAAG,QAAQ,OAAO,EAAE;GAEjE,OAAO;IAAE;IAAc;IAAS;GAAQ;EAC1C,CAgBkB;CAClB;AACF"}

package/dist/internal/passkey/management.mjs

@@ -169,7 +169,7 @@ const makePasskeyManagementKernel = (operations, admission, credentials, state,
 				action: "remove",
 				commandId: input.commandId,
 				flowId: input.commandId,
-				bindingDigest: removeDigest(mapping.moduleId, input.commandId, input.credential),
+				bindingDigest: yield* removeDigest(mapping.moduleId, input.commandId, input.credential),
 				revision: input.credential.revision
 			}, {
 				...policy,
@@ -200,7 +200,7 @@ const makePasskeyManagementKernel = (operations, admission, credentials, state,
 				if (observation.table === factor.table) observation.rows = observation.rows.filter((item) => item[factor.credentialId] !== id);
 			}
 			const tuple = read.credentialOwnership;
-			yield* owner.update(tuple.table, { [tuple.credentialKey]: credentialKey(credential.rpId, credential.protocolCredentialId) }, {
+			yield* owner.update(tuple.table, { [tuple.credentialKey]: yield* credentialKey(credential.rpId, credential.protocolCredentialId) }, {
 				[tuple.state]: mapping.write.credentialOwnership.removedState,
 				[tuple.version]: owner.marker
 			});

package/dist/internal/passkey/management.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"management.mjs","names":[],"sources":["../../../src/internal/passkey/management.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport {\n  PasskeyCredentialSummary,\n  PasskeyRemoved,\n  type PasskeyManagementPersistence,\n} from \"@yielded/auth/Passkey\";\nimport { Effect, Schema } from \"effect\";\n\nimport type { PersistenceMappingError } from \"../mapping-error\";\nimport type { SqlExpression as SQL, QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport type { makePasskeyAdmissionKernel } from \"./admission\";\nimport type { makePasskeyCredentialsKernel } from \"./credentials\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\nimport type { WriteSubject, makePasskeyWriteStateKernel } from \"./write-state\";\n\ntype Port = PasskeyManagementPersistence[\"Service\"];\n\nexport const makePasskeyManagementKernel = (\n  operations: QueryOperations,\n  admission: Pick<ReturnType<typeof makePasskeyAdmissionKernel>, \"lockAdmission\">,\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"readModule\" | \"readPolicyGuards\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    \"credentialKey\" | \"copiedRow\" | \"equal\" | \"invariant\" | \"sameCredential\" | \"sameRevision\"\n  >,\n  writeState: Pick<\n    ReturnType<typeof makePasskeyWriteStateKernel>,\n    | \"authorizeAction\"\n    | \"credentialRows\"\n    | \"currentSubject\"\n    | \"invalidate\"\n    | \"invalidationMatches\"\n    | \"jsonStorage\"\n    | \"managementPolicy\"\n    | \"metadataAllowed\"\n    | \"ownedCredential\"\n    | \"removeDigest\"\n    | \"summary\"\n  >,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n  const { sql } = operations;\n  const { lockAdmission } = admission;\n  const { readModule, readPolicyGuards } = credentials;\n  const { credentialKey, copiedRow, equal, sameCredential, sameRevision } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    authorizeAction,\n    credentialRows,\n    currentSubject,\n    invalidate,\n    invalidationMatches,\n    jsonStorage,\n    managementPolicy,\n    metadataAllowed,\n    ownedCredential,\n    removeDigest,\n    summary,\n  } = writeState;\n\n  const { both } = transactions;\n\n  const decisionCodec = jsonStorage(\n    Schema.Union([\n      Schema.TaggedStruct(\"Renamed\", { credential: PasskeyCredentialSummary }),\n      Schema.TaggedStruct(\"Removed\", { result: PasskeyRemoved }),\n    ]),\n  );\n\n  const intentCodec = jsonStorage(\n    Schema.Struct({\n      operation: Schema.Literals([\"rename\", \"remove\"]),\n      credentialId: Schema.String,\n      name: Schema.optionalKey(Schema.String),\n    }),\n  );\n\n  const command = Effect.fn(\"passkey.managementCommand\")(function* (\n    mapping: any,\n    subject: WriteSubject,\n    commandId: string,\n    credentialId: string,\n    intent: string,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.command;\n\n    const observation = yield* owner.read(\n      table.table,\n      equal(table.table, { [table.moduleId]: mapping.moduleId, [table.commandId]: commandId }),\n      { limit: 1 },\n    );\n\n    const row = observation.rows[0];\n\n    if (row === undefined) return { _tag: \"New\", observation } as const;\n    if (\n      !mapping.read.subjectIds.equals(row[table.subjectId], subject.nativeId) ||\n      row[table.credentialId] !== credentialId ||\n      row[table.intent] !== intent\n    )\n      return { _tag: \"Rejected\" } as const;\n\n    return { _tag: \"Replay\", decision: decisionCodec.decode(row[table.decision]) } as const;\n  });\n\n  const record = Effect.fn(\"passkey.recordManagementCommand\")(function* (\n    mapping: any,\n    subject: WriteSubject,\n    commandId: string,\n    credentialId: string,\n    intent: string,\n    decision: Parameters<typeof decisionCodec.encode>[0],\n    retentionUntilMillis: number,\n    observation: any,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.command;\n\n    const inserted = yield* owner.insert(\n      table.table,\n      {\n        ...table.encodeInsert({\n          moduleId: mapping.moduleId,\n          subjectId: subject.nativeId,\n          commandId,\n          credentialId,\n        }),\n        [table.moduleId]: mapping.moduleId,\n        [table.commandId]: commandId,\n        [table.subjectId]: subject.nativeId,\n        [table.credentialId]: credentialId,\n        [table.intent]: intent,\n        [table.decision]: decisionCodec.encode(decision),\n        [table.retentionUntil]: mapping.clock.encodeInstant(retentionUntilMillis),\n        [table.version]: owner.marker,\n      },\n      { [table.moduleId]: mapping.moduleId, [table.commandId]: commandId },\n    );\n\n    observation.rows = inserted.rows;\n  });\n\n  const access = Effect.fn(\"passkey.managementAccess\")(function* (\n    mapping: any,\n    moduleId: string,\n    subjectId: Parameters<Port[\"list\"]>[0][\"subjectId\"],\n    mutation: boolean,\n  ) {\n    if (moduleId !== mapping.moduleId || (yield* readModule(mapping)) === undefined)\n      return undefined;\n    if (mutation) yield* lockAdmission(mapping);\n    const subject = yield* currentSubject(mapping, subjectId);\n\n    if (subject === undefined) return undefined;\n    yield* readPolicyGuards(mapping);\n\n    return (yield* metadataAllowed(mapping, subject)) ? subject : undefined;\n  });\n\n  const listCredentials = Effect.fn(\"passkey.listCredentials\")(function* (\n    mapping: any,\n    input: Parameters<Port[\"list\"]>[0],\n  ) {\n    const subject = yield* access(mapping, input.moduleId, input.subjectId, false);\n\n    invariant(subject !== undefined);\n    const rows = [...(yield* credentialRows(mapping, subject))];\n\n    rows.sort((left, right) => {\n      const a = left[mapping.read.credential.credentialId],\n        b = right[mapping.read.credential.credentialId];\n\n      return a < b ? -1 : a > b ? 1 : 0;\n    });\n\n    const eligible = rows.filter(\n      (row) =>\n        input.cursor === undefined || row[mapping.read.credential.credentialId] > input.cursor,\n    );\n\n    const page = eligible.slice(0, input.limit);\n    const credentials = [];\n\n    for (const row of page) {\n      invariant((yield* ownedCredential(mapping, subject, row)) !== undefined);\n      credentials.push(summary(mapping, row));\n    }\n\n    return {\n      credentials,\n      ...(eligible.length > input.limit ? { cursor: credentials.at(-1)!.credentialId } : {}),\n    };\n  });\n\n  const renameCredential = Effect.fn(\"passkey.renameCredential\")(function* (\n    mapping: any,\n    input: Parameters<Port[\"rename\"]>[0],\n  ) {\n    const subject = yield* access(mapping, input.moduleId, input.subjectId, true);\n\n    if (subject === undefined) return { _tag: \"Rejected\" } as const;\n\n    const intent = intentCodec.encode({\n      operation: \"rename\",\n      credentialId: input.credentialId,\n      name: input.name,\n    });\n\n    const prior = yield* command(mapping, subject, input.commandId, input.credentialId, intent);\n\n    if (prior._tag === \"Rejected\") return prior;\n    const rows = yield* credentialRows(mapping, subject);\n\n    const row = rows.find(\n      (item) => item[mapping.read.credential.credentialId] === input.credentialId,\n    );\n\n    if (row === undefined || (yield* ownedCredential(mapping, subject, row)) === undefined)\n      return { _tag: \"Rejected\" } as const;\n    if (prior._tag === \"Replay\")\n      return prior.decision._tag === \"Renamed\"\n        ? { ...prior.decision, replayed: true }\n        : ({ _tag: \"Rejected\" } as const);\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.read.credential;\n\n    yield* owner.update(\n      table.table,\n      { [table.credentialId]: input.credentialId, [table.subjectId]: subject.nativeId },\n      { [mapping.write.credential.name]: input.name },\n    );\n    const credential = summary(mapping, { ...row, [mapping.write.credential.name]: input.name });\n\n    yield* record(\n      mapping,\n      subject,\n      input.commandId,\n      input.credentialId,\n      intent,\n      { _tag: \"Renamed\", credential },\n      input.retentionUntilMillis,\n      prior.observation,\n    );\n\n    return { _tag: \"Renamed\", credential, replayed: false } as const;\n  });\n\n  const inspectRemove = Effect.fn(\"passkey.inspectRemove\")(function* (\n    mapping: any,\n    input: Parameters<Port[\"inspectRemove\"]>[0],\n  ) {\n    const subject = yield* access(mapping, input.moduleId, input.subjectId, false);\n\n    if (subject === undefined) return { _tag: \"Rejected\" } as const;\n\n    const prior = yield* command(\n      mapping,\n      subject,\n      input.commandId,\n      input.credentialId,\n      intentCodec.encode({ operation: \"remove\", credentialId: input.credentialId }),\n    );\n\n    if (prior._tag === \"Rejected\") return prior;\n    if (prior._tag === \"Replay\")\n      return prior.decision._tag === \"Removed\"\n        ? ({ _tag: \"Replay\", result: { ...prior.decision.result, replayed: true } } as const)\n        : ({ _tag: \"Rejected\" } as const);\n\n    const row = (yield* credentialRows(mapping, subject)).find(\n      (item) => item[mapping.read.credential.credentialId] === input.credentialId,\n    );\n\n    const credential =\n      row === undefined ? undefined : yield* ownedCredential(mapping, subject, row);\n\n    return credential === undefined\n      ? ({ _tag: \"Rejected\" } as const)\n      : ({ _tag: \"Target\", credential } as const);\n  });\n\n  const removeCredential = Effect.fn(\"passkey.removeCredential\")(function* (\n    mapping: any,\n    input: Parameters<Port[\"remove\"]>[0],\n  ) {\n    const subject = yield* access(\n      mapping,\n      input.moduleId,\n      input.credential.revision.subjectId,\n      true,\n    );\n\n    if (subject === undefined) return { _tag: \"Rejected\" } as const;\n    const id = input.credential.credentialId;\n    const intent = intentCodec.encode({ operation: \"remove\", credentialId: id });\n    const prior = yield* command(mapping, subject, input.commandId, id, intent);\n\n    if (prior._tag === \"Rejected\") return prior;\n    if (prior._tag === \"Replay\")\n      return prior.decision._tag === \"Removed\"\n        ? ({ _tag: \"Removed\", result: { ...prior.decision.result, replayed: true } } as const)\n        : ({ _tag: \"Rejected\" } as const);\n\n    const row = (yield* credentialRows(mapping, subject)).find(\n      (item) => item[mapping.read.credential.credentialId] === id,\n    );\n\n    const credential =\n      row === undefined ? undefined : yield* ownedCredential(mapping, subject, row);\n\n    const policy = managementPolicy(mapping, subject);\n\n    if (\n      credential === undefined ||\n      !sameCredential(input.credential, credential) ||\n      !sameRevision(input.credential.revision, credential.revision) ||\n      !invalidationMatches(mapping, input.invalidation, policy) ||\n      !invalidationMatches(mapping, input.invalidation, input.management)\n    )\n      return { _tag: \"Rejected\" } as const;\n    if (\n      !(yield* authorizeAction(\n        mapping,\n        subject,\n        input.authorization,\n        {\n          action: \"remove\",\n          commandId: input.commandId,\n          flowId: input.commandId,\n          bindingDigest: removeDigest(mapping.moduleId, input.commandId, input.credential),\n          revision: input.credential.revision,\n        },\n        {\n          ...policy,\n          maximumEvidenceAgeMillis: Math.min(\n            policy.maximumEvidenceAgeMillis,\n            input.management.maximumEvidenceAgeMillis,\n          ),\n        },\n      ))\n    )\n      return { _tag: \"Rejected\" } as const;\n    const owner = yield* CurrentPasskeyTransaction;\n\n    const remainingEffect: Effect.Effect<SQL, PersistenceMappingError> =\n      mapping.write.policy.remainingSignIn(subject.nativeId, id, copiedRow(subject.row));\n\n    const remaining = yield* remainingEffect;\n\n    if (!(yield* owner.check(remaining))) return { _tag: \"LastSignInMethod\" } as const;\n    const read = mapping.read;\n    const table = read.credential;\n\n    yield* owner.update(\n      table.table,\n      { [table.credentialId]: id, [table.subjectId]: subject.nativeId },\n      {\n        [table.status]: mapping.write.credential.removedStatus,\n        [table.credentialRevision]: owner.marker,\n      },\n    );\n    const factor = read.authority;\n\n    yield* owner.update(\n      factor.table,\n      { [factor.subjectId]: subject.nativeId, [factor.credentialId]: id },\n      { [factor.status]: mapping.write.authority.removedStatus, [factor.revision]: owner.marker },\n    );\n    for (const observation of owner.observations) {\n      if (observation.table === table.table)\n        observation.rows = observation.rows.filter((item) => item[table.credentialId] !== id);\n      if (observation.table === factor.table)\n        observation.rows = observation.rows.filter((item) => item[factor.credentialId] !== id);\n    }\n    const tuple = read.credentialOwnership;\n\n    yield* owner.update(\n      tuple.table,\n      { [tuple.credentialKey]: credentialKey(credential.rpId, credential.protocolCredentialId) },\n      {\n        [tuple.state]: mapping.write.credentialOwnership.removedState,\n        [tuple.version]: owner.marker,\n      },\n    );\n    yield* invalidate(mapping, subject, input.invalidation);\n    owner.postconditions.push(\n      remaining,\n      sql`not exists(select 1 from ${table.table} where ${both(equal(table.table, { [table.credentialId]: id }), table.activeCondition)})`,\n      sql`not exists(select 1 from ${factor.table} where ${both(equal(factor.table, { [factor.subjectId]: subject.nativeId, [factor.credentialId]: id }), factor.activeCondition)})`,\n    );\n\n    const result = {\n      credentialId: credential.credentialId,\n      replayed: false,\n      invalidation: input.invalidation,\n    };\n\n    yield* record(\n      mapping,\n      subject,\n      input.commandId,\n      id,\n      intent,\n      { _tag: \"Removed\", result },\n      input.retentionUntilMillis,\n      prior.observation,\n    );\n\n    return { _tag: \"Removed\", result } as const;\n  });\n\n  return { listCredentials, renameCredential, inspectRemove, removeCredential };\n};\n"],"mappings":";;;;AAoBA,MAAa,+BACX,YACA,WACA,aAIA,OAIA,YAcA,iBACG;CACH,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,kBAAkB;CAC1B,MAAM,EAAE,YAAY,qBAAqB;CACzC,MAAM,EAAE,eAAe,WAAW,OAAO,gBAAgB,iBAAiB;CAC1E,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,iBACA,gBACA,gBACA,YACA,qBACA,aACA,kBACA,iBACA,iBACA,cACA,YACE;CAEJ,MAAM,EAAE,SAAS;CAEjB,MAAM,gBAAgB,YACpB,OAAO,MAAM,CACX,OAAO,aAAa,WAAW,EAAE,YAAY,yBAAyB,CAAC,GACvE,OAAO,aAAa,WAAW,EAAE,QAAQ,eAAe,CAAC,CAC3D,CAAC,CACH;CAEA,MAAM,cAAc,YAClB,OAAO,OAAO;EACZ,WAAW,OAAO,SAAS,CAAC,UAAU,QAAQ,CAAC;EAC/C,cAAc,OAAO;EACrB,MAAM,OAAO,YAAY,OAAO,MAAM;CACxC,CAAC,CACH;CAEA,MAAM,UAAU,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACrD,SACA,SACA,WACA,cACA,QACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAEtB,MAAM,cAAc,OAAO,MAAM,KAC/B,MAAM,OACN,MAAM,MAAM,OAAO;IAAG,MAAM,WAAW,QAAQ;IAAW,MAAM,YAAY;EAAU,CAAC,GACvF,EAAE,OAAO,EAAE,CACb;EAEA,MAAM,MAAM,YAAY,KAAK;EAE7B,IAAI,QAAQ,KAAA,GAAW,OAAO;GAAE,MAAM;GAAO;EAAY;EACzD,IACE,CAAC,QAAQ,KAAK,WAAW,OAAO,IAAI,MAAM,YAAY,QAAQ,QAAQ,KACtE,IAAI,MAAM,kBAAkB,gBAC5B,IAAI,MAAM,YAAY,QAEtB,OAAO,EAAE,MAAM,WAAW;EAE5B,OAAO;GAAE,MAAM;GAAU,UAAU,cAAc,OAAO,IAAI,MAAM,SAAS;EAAE;CAC/E,CAAC;CAED,MAAM,SAAS,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC1D,SACA,SACA,WACA,cACA,QACA,UACA,sBACA,aACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAuBtB,YAAY,QAAO,OArBK,MAAM,OAC5B,MAAM,OACN;GACE,GAAG,MAAM,aAAa;IACpB,UAAU,QAAQ;IAClB,WAAW,QAAQ;IACnB;IACA;GACF,CAAC;IACA,MAAM,WAAW,QAAQ;IACzB,MAAM,YAAY;IAClB,MAAM,YAAY,QAAQ;IAC1B,MAAM,eAAe;IACrB,MAAM,SAAS;IACf,MAAM,WAAW,cAAc,OAAO,QAAQ;IAC9C,MAAM,iBAAiB,QAAQ,MAAM,cAAc,oBAAoB;IACvE,MAAM,UAAU,MAAM;EACzB,GACA;IAAG,MAAM,WAAW,QAAQ;IAAW,MAAM,YAAY;EAAU,CACrE,EAAA,CAE4B;CAC9B,CAAC;CAED,MAAM,SAAS,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACnD,SACA,UACA,WACA,UACA;EACA,IAAI,aAAa,QAAQ,aAAa,OAAO,WAAW,OAAO,OAAO,KAAA,GACpE,OAAO,KAAA;EACT,IAAI,UAAU,OAAO,cAAc,OAAO;EAC1C,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS;EAExD,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;EAClC,OAAO,iBAAiB,OAAO;EAE/B,QAAQ,OAAO,gBAAgB,SAAS,OAAO,KAAK,UAAU,KAAA;CAChE,CAAC;CA8PD,OAAO;EAAE,iBA5Pe,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA;GACA,MAAM,UAAU,OAAO,OAAO,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;GAE7E,UAAU,YAAY,KAAA,CAAS;GAC/B,MAAM,OAAO,CAAC,GAAI,OAAO,eAAe,SAAS,OAAO,CAAE;GAE1D,KAAK,MAAM,MAAM,UAAU;IACzB,MAAM,IAAI,KAAK,QAAQ,KAAK,WAAW,eACrC,IAAI,MAAM,QAAQ,KAAK,WAAW;IAEpC,OAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;GAClC,CAAC;GAED,MAAM,WAAW,KAAK,QACnB,QACC,MAAM,WAAW,KAAA,KAAa,IAAI,QAAQ,KAAK,WAAW,gBAAgB,MAAM,MACpF;GAEA,MAAM,OAAO,SAAS,MAAM,GAAG,MAAM,KAAK;GAC1C,MAAM,cAAc,CAAC;GAErB,KAAK,MAAM,OAAO,MAAM;IACtB,WAAW,OAAO,gBAAgB,SAAS,SAAS,GAAG,OAAO,KAAA,CAAS;IACvE,YAAY,KAAK,QAAQ,SAAS,GAAG,CAAC;GACxC;GAEA,OAAO;IACL;IACA,GAAI,SAAS,SAAS,MAAM,QAAQ,EAAE,QAAQ,YAAY,GAAG,EAAE,CAAC,CAAE,aAAa,IAAI,CAAC;GACtF;EACF,CA2NuB;EAAG,kBAzND,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;GACA,MAAM,UAAU,OAAO,OAAO,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI;GAE5E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAErD,MAAM,SAAS,YAAY,OAAO;IAChC,WAAW;IACX,cAAc,MAAM;IACpB,MAAM,MAAM;GACd,CAAC;GAED,MAAM,QAAQ,OAAO,QAAQ,SAAS,SAAS,MAAM,WAAW,MAAM,cAAc,MAAM;GAE1F,IAAI,MAAM,SAAS,YAAY,OAAO;GAGtC,MAAM,OAAM,OAFQ,eAAe,SAAS,OAAO,EAAA,CAElC,MACd,SAAS,KAAK,QAAQ,KAAK,WAAW,kBAAkB,MAAM,YACjE;GAEA,IAAI,QAAQ,KAAA,MAAc,OAAO,gBAAgB,SAAS,SAAS,GAAG,OAAO,KAAA,GAC3E,OAAO,EAAE,MAAM,WAAW;GAC5B,IAAI,MAAM,SAAS,UACjB,OAAO,MAAM,SAAS,SAAS,YAC3B;IAAE,GAAG,MAAM;IAAU,UAAU;GAAK,IACnC,EAAE,MAAM,WAAW;GAC1B,MAAM,QAAQ,OAAO;GACrB,MAAM,QAAQ,QAAQ,KAAK;GAE3B,OAAO,MAAM,OACX,MAAM,OACN;KAAG,MAAM,eAAe,MAAM;KAAe,MAAM,YAAY,QAAQ;GAAS,GAChF,GAAG,QAAQ,MAAM,WAAW,OAAO,MAAM,KAAK,CAChD;GACA,MAAM,aAAa,QAAQ,SAAS;IAAE,GAAG;KAAM,QAAQ,MAAM,WAAW,OAAO,MAAM;GAAK,CAAC;GAE3F,OAAO,OACL,SACA,SACA,MAAM,WACN,MAAM,cACN,QACA;IAAE,MAAM;IAAW;GAAW,GAC9B,MAAM,sBACN,MAAM,WACR;GAEA,OAAO;IAAE,MAAM;IAAW;IAAY,UAAU;GAAM;EACxD,CAsKyC;EAAG,eApKtB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA;GACA,MAAM,UAAU,OAAO,OAAO,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;GAE7E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAErD,MAAM,QAAQ,OAAO,QACnB,SACA,SACA,MAAM,WACN,MAAM,cACN,YAAY,OAAO;IAAE,WAAW;IAAU,cAAc,MAAM;GAAa,CAAC,CAC9E;GAEA,IAAI,MAAM,SAAS,YAAY,OAAO;GACtC,IAAI,MAAM,SAAS,UACjB,OAAO,MAAM,SAAS,SAAS,YAC1B;IAAE,MAAM;IAAU,QAAQ;KAAE,GAAG,MAAM,SAAS;KAAQ,UAAU;IAAK;GAAE,IACvE,EAAE,MAAM,WAAW;GAE1B,MAAM,OAAO,OAAO,eAAe,SAAS,OAAO,EAAA,CAAG,MACnD,SAAS,KAAK,QAAQ,KAAK,WAAW,kBAAkB,MAAM,YACjE;GAEA,MAAM,aACJ,QAAQ,KAAA,IAAY,KAAA,IAAY,OAAO,gBAAgB,SAAS,SAAS,GAAG;GAE9E,OAAO,eAAe,KAAA,IACjB,EAAE,MAAM,WAAW,IACnB;IAAE,MAAM;IAAU;GAAW;EACpC,CAoIwD;EAAG,kBAlIlC,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;GACA,MAAM,UAAU,OAAO,OACrB,SACA,MAAM,UACN,MAAM,WAAW,SAAS,WAC1B,IACF;GAEA,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACrD,MAAM,KAAK,MAAM,WAAW;GAC5B,MAAM,SAAS,YAAY,OAAO;IAAE,WAAW;IAAU,cAAc;GAAG,CAAC;GAC3E,MAAM,QAAQ,OAAO,QAAQ,SAAS,SAAS,MAAM,WAAW,IAAI,MAAM;GAE1E,IAAI,MAAM,SAAS,YAAY,OAAO;GACtC,IAAI,MAAM,SAAS,UACjB,OAAO,MAAM,SAAS,SAAS,YAC1B;IAAE,MAAM;IAAW,QAAQ;KAAE,GAAG,MAAM,SAAS;KAAQ,UAAU;IAAK;GAAE,IACxE,EAAE,MAAM,WAAW;GAE1B,MAAM,OAAO,OAAO,eAAe,SAAS,OAAO,EAAA,CAAG,MACnD,SAAS,KAAK,QAAQ,KAAK,WAAW,kBAAkB,EAC3D;GAEA,MAAM,aACJ,QAAQ,KAAA,IAAY,KAAA,IAAY,OAAO,gBAAgB,SAAS,SAAS,GAAG;GAE9E,MAAM,SAAS,iBAAiB,SAAS,OAAO;GAEhD,IACE,eAAe,KAAA,KACf,CAAC,eAAe,MAAM,YAAY,UAAU,KAC5C,CAAC,aAAa,MAAM,WAAW,UAAU,WAAW,QAAQ,KAC5D,CAAC,oBAAoB,SAAS,MAAM,cAAc,MAAM,KACxD,CAAC,oBAAoB,SAAS,MAAM,cAAc,MAAM,UAAU,GAElE,OAAO,EAAE,MAAM,WAAW;GAC5B,IACE,EAAE,OAAO,gBACP,SACA,SACA,MAAM,eACN;IACE,QAAQ;IACR,WAAW,MAAM;IACjB,QAAQ,MAAM;IACd,eAAe,aAAa,QAAQ,UAAU,MAAM,WAAW,MAAM,UAAU;IAC/E,UAAU,MAAM,WAAW;GAC7B,GACA;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,CACF,IAEA,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,QAAQ,OAAO;GAKrB,MAAM,YAAY,OAFhB,QAAQ,MAAM,OAAO,gBAAgB,QAAQ,UAAU,IAAI,UAAU,QAAQ,GAAG,CAE3C;GAEvC,IAAI,EAAE,OAAO,MAAM,MAAM,SAAS,IAAI,OAAO,EAAE,MAAM,mBAAmB;GACxE,MAAM,OAAO,QAAQ;GACrB,MAAM,QAAQ,KAAK;GAEnB,OAAO,MAAM,OACX,MAAM,OACN;KAAG,MAAM,eAAe;KAAK,MAAM,YAAY,QAAQ;GAAS,GAChE;KACG,MAAM,SAAS,QAAQ,MAAM,WAAW;KACxC,MAAM,qBAAqB,MAAM;GACpC,CACF;GACA,MAAM,SAAS,KAAK;GAEpB,OAAO,MAAM,OACX,OAAO,OACP;KAAG,OAAO,YAAY,QAAQ;KAAW,OAAO,eAAe;GAAG,GAClE;KAAG,OAAO,SAAS,QAAQ,MAAM,UAAU;KAAgB,OAAO,WAAW,MAAM;GAAO,CAC5F;GACA,KAAK,MAAM,eAAe,MAAM,cAAc;IAC5C,IAAI,YAAY,UAAU,MAAM,OAC9B,YAAY,OAAO,YAAY,KAAK,QAAQ,SAAS,KAAK,MAAM,kBAAkB,EAAE;IACtF,IAAI,YAAY,UAAU,OAAO,OAC/B,YAAY,OAAO,YAAY,KAAK,QAAQ,SAAS,KAAK,OAAO,kBAAkB,EAAE;GACzF;GACA,MAAM,QAAQ,KAAK;GAEnB,OAAO,MAAM,OACX,MAAM,OACN,GAAG,MAAM,gBAAgB,cAAc,WAAW,MAAM,WAAW,oBAAoB,EAAE,GACzF;KACG,MAAM,QAAQ,QAAQ,MAAM,oBAAoB;KAChD,MAAM,UAAU,MAAM;GACzB,CACF;GACA,OAAO,WAAW,SAAS,SAAS,MAAM,YAAY;GACtD,MAAM,eAAe,KACnB,WACA,GAAG,4BAA4B,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,GAAG,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,eAAe,EAAE,IAClI,GAAG,4BAA4B,OAAO,MAAM,SAAS,KAAK,MAAM,OAAO,OAAO;KAAG,OAAO,YAAY,QAAQ;KAAW,OAAO,eAAe;GAAG,CAAC,GAAG,OAAO,eAAe,EAAE,EAC9K;GAEA,MAAM,SAAS;IACb,cAAc,WAAW;IACzB,UAAU;IACV,cAAc,MAAM;GACtB;GAEA,OAAO,OACL,SACA,SACA,MAAM,WACN,IACA,QACA;IAAE,MAAM;IAAW;GAAO,GAC1B,MAAM,sBACN,MAAM,WACR;GAEA,OAAO;IAAE,MAAM;IAAW;GAAO;EACnC,CAE0E;CAAE;AAC9E"}
+{"version":3,"file":"management.mjs","names":[],"sources":["../../../src/internal/passkey/management.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport {\n  PasskeyCredentialSummary,\n  PasskeyRemoved,\n  type PasskeyManagementPersistence,\n} from \"@yielded/auth/Passkey\";\nimport { Effect, Schema } from \"effect\";\n\nimport type { PersistenceMappingError } from \"../mapping-error\";\nimport type { SqlExpression as SQL, QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport type { makePasskeyAdmissionKernel } from \"./admission\";\nimport type { makePasskeyCredentialsKernel } from \"./credentials\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\nimport type { WriteSubject, makePasskeyWriteStateKernel } from \"./write-state\";\n\ntype Port = PasskeyManagementPersistence[\"Service\"];\n\nexport const makePasskeyManagementKernel = (\n  operations: QueryOperations,\n  admission: Pick<ReturnType<typeof makePasskeyAdmissionKernel>, \"lockAdmission\">,\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"readModule\" | \"readPolicyGuards\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    \"credentialKey\" | \"copiedRow\" | \"equal\" | \"invariant\" | \"sameCredential\" | \"sameRevision\"\n  >,\n  writeState: Pick<\n    ReturnType<typeof makePasskeyWriteStateKernel>,\n    | \"authorizeAction\"\n    | \"credentialRows\"\n    | \"currentSubject\"\n    | \"invalidate\"\n    | \"invalidationMatches\"\n    | \"jsonStorage\"\n    | \"managementPolicy\"\n    | \"metadataAllowed\"\n    | \"ownedCredential\"\n    | \"removeDigest\"\n    | \"summary\"\n  >,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n  const { sql } = operations;\n  const { lockAdmission } = admission;\n  const { readModule, readPolicyGuards } = credentials;\n  const { credentialKey, copiedRow, equal, sameCredential, sameRevision } = state;\n  const invariant: (value: unknown) => asserts value = state.invariant;\n\n  const {\n    authorizeAction,\n    credentialRows,\n    currentSubject,\n    invalidate,\n    invalidationMatches,\n    jsonStorage,\n    managementPolicy,\n    metadataAllowed,\n    ownedCredential,\n    removeDigest,\n    summary,\n  } = writeState;\n\n  const { both } = transactions;\n\n  const decisionCodec = jsonStorage(\n    Schema.Union([\n      Schema.TaggedStruct(\"Renamed\", { credential: PasskeyCredentialSummary }),\n      Schema.TaggedStruct(\"Removed\", { result: PasskeyRemoved }),\n    ]),\n  );\n\n  const intentCodec = jsonStorage(\n    Schema.Struct({\n      operation: Schema.Literals([\"rename\", \"remove\"]),\n      credentialId: Schema.String,\n      name: Schema.optionalKey(Schema.String),\n    }),\n  );\n\n  const command = Effect.fn(\"passkey.managementCommand\")(function* (\n    mapping: any,\n    subject: WriteSubject,\n    commandId: string,\n    credentialId: string,\n    intent: string,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.command;\n\n    const observation = yield* owner.read(\n      table.table,\n      equal(table.table, { [table.moduleId]: mapping.moduleId, [table.commandId]: commandId }),\n      { limit: 1 },\n    );\n\n    const row = observation.rows[0];\n\n    if (row === undefined) return { _tag: \"New\", observation } as const;\n    if (\n      !mapping.read.subjectIds.equals(row[table.subjectId], subject.nativeId) ||\n      row[table.credentialId] !== credentialId ||\n      row[table.intent] !== intent\n    )\n      return { _tag: \"Rejected\" } as const;\n\n    return { _tag: \"Replay\", decision: decisionCodec.decode(row[table.decision]) } as const;\n  });\n\n  const record = Effect.fn(\"passkey.recordManagementCommand\")(function* (\n    mapping: any,\n    subject: WriteSubject,\n    commandId: string,\n    credentialId: string,\n    intent: string,\n    decision: Parameters<typeof decisionCodec.encode>[0],\n    retentionUntilMillis: number,\n    observation: any,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.command;\n\n    const inserted = yield* owner.insert(\n      table.table,\n      {\n        ...table.encodeInsert({\n          moduleId: mapping.moduleId,\n          subjectId: subject.nativeId,\n          commandId,\n          credentialId,\n        }),\n        [table.moduleId]: mapping.moduleId,\n        [table.commandId]: commandId,\n        [table.subjectId]: subject.nativeId,\n        [table.credentialId]: credentialId,\n        [table.intent]: intent,\n        [table.decision]: decisionCodec.encode(decision),\n        [table.retentionUntil]: mapping.clock.encodeInstant(retentionUntilMillis),\n        [table.version]: owner.marker,\n      },\n      { [table.moduleId]: mapping.moduleId, [table.commandId]: commandId },\n    );\n\n    observation.rows = inserted.rows;\n  });\n\n  const access = Effect.fn(\"passkey.managementAccess\")(function* (\n    mapping: any,\n    moduleId: string,\n    subjectId: Parameters<Port[\"list\"]>[0][\"subjectId\"],\n    mutation: boolean,\n  ) {\n    if (moduleId !== mapping.moduleId || (yield* readModule(mapping)) === undefined)\n      return undefined;\n    if (mutation) yield* lockAdmission(mapping);\n    const subject = yield* currentSubject(mapping, subjectId);\n\n    if (subject === undefined) return undefined;\n    yield* readPolicyGuards(mapping);\n\n    return (yield* metadataAllowed(mapping, subject)) ? subject : undefined;\n  });\n\n  const listCredentials = Effect.fn(\"passkey.listCredentials\")(function* (\n    mapping: any,\n    input: Parameters<Port[\"list\"]>[0],\n  ) {\n    const subject = yield* access(mapping, input.moduleId, input.subjectId, false);\n\n    invariant(subject !== undefined);\n    const rows = [...(yield* credentialRows(mapping, subject))];\n\n    rows.sort((left, right) => {\n      const a = left[mapping.read.credential.credentialId],\n        b = right[mapping.read.credential.credentialId];\n\n      return a < b ? -1 : a > b ? 1 : 0;\n    });\n\n    const eligible = rows.filter(\n      (row) =>\n        input.cursor === undefined || row[mapping.read.credential.credentialId] > input.cursor,\n    );\n\n    const page = eligible.slice(0, input.limit);\n    const credentials = [];\n\n    for (const row of page) {\n      invariant((yield* ownedCredential(mapping, subject, row)) !== undefined);\n      credentials.push(summary(mapping, row));\n    }\n\n    return {\n      credentials,\n      ...(eligible.length > input.limit ? { cursor: credentials.at(-1)!.credentialId } : {}),\n    };\n  });\n\n  const renameCredential = Effect.fn(\"passkey.renameCredential\")(function* (\n    mapping: any,\n    input: Parameters<Port[\"rename\"]>[0],\n  ) {\n    const subject = yield* access(mapping, input.moduleId, input.subjectId, true);\n\n    if (subject === undefined) return { _tag: \"Rejected\" } as const;\n\n    const intent = intentCodec.encode({\n      operation: \"rename\",\n      credentialId: input.credentialId,\n      name: input.name,\n    });\n\n    const prior = yield* command(mapping, subject, input.commandId, input.credentialId, intent);\n\n    if (prior._tag === \"Rejected\") return prior;\n    const rows = yield* credentialRows(mapping, subject);\n\n    const row = rows.find(\n      (item) => item[mapping.read.credential.credentialId] === input.credentialId,\n    );\n\n    if (row === undefined || (yield* ownedCredential(mapping, subject, row)) === undefined)\n      return { _tag: \"Rejected\" } as const;\n    if (prior._tag === \"Replay\")\n      return prior.decision._tag === \"Renamed\"\n        ? { ...prior.decision, replayed: true }\n        : ({ _tag: \"Rejected\" } as const);\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.read.credential;\n\n    yield* owner.update(\n      table.table,\n      { [table.credentialId]: input.credentialId, [table.subjectId]: subject.nativeId },\n      { [mapping.write.credential.name]: input.name },\n    );\n    const credential = summary(mapping, { ...row, [mapping.write.credential.name]: input.name });\n\n    yield* record(\n      mapping,\n      subject,\n      input.commandId,\n      input.credentialId,\n      intent,\n      { _tag: \"Renamed\", credential },\n      input.retentionUntilMillis,\n      prior.observation,\n    );\n\n    return { _tag: \"Renamed\", credential, replayed: false } as const;\n  });\n\n  const inspectRemove = Effect.fn(\"passkey.inspectRemove\")(function* (\n    mapping: any,\n    input: Parameters<Port[\"inspectRemove\"]>[0],\n  ) {\n    const subject = yield* access(mapping, input.moduleId, input.subjectId, false);\n\n    if (subject === undefined) return { _tag: \"Rejected\" } as const;\n\n    const prior = yield* command(\n      mapping,\n      subject,\n      input.commandId,\n      input.credentialId,\n      intentCodec.encode({ operation: \"remove\", credentialId: input.credentialId }),\n    );\n\n    if (prior._tag === \"Rejected\") return prior;\n    if (prior._tag === \"Replay\")\n      return prior.decision._tag === \"Removed\"\n        ? ({ _tag: \"Replay\", result: { ...prior.decision.result, replayed: true } } as const)\n        : ({ _tag: \"Rejected\" } as const);\n\n    const row = (yield* credentialRows(mapping, subject)).find(\n      (item) => item[mapping.read.credential.credentialId] === input.credentialId,\n    );\n\n    const credential =\n      row === undefined ? undefined : yield* ownedCredential(mapping, subject, row);\n\n    return credential === undefined\n      ? ({ _tag: \"Rejected\" } as const)\n      : ({ _tag: \"Target\", credential } as const);\n  });\n\n  const removeCredential = Effect.fn(\"passkey.removeCredential\")(function* (\n    mapping: any,\n    input: Parameters<Port[\"remove\"]>[0],\n  ) {\n    const subject = yield* access(\n      mapping,\n      input.moduleId,\n      input.credential.revision.subjectId,\n      true,\n    );\n\n    if (subject === undefined) return { _tag: \"Rejected\" } as const;\n    const id = input.credential.credentialId;\n    const intent = intentCodec.encode({ operation: \"remove\", credentialId: id });\n    const prior = yield* command(mapping, subject, input.commandId, id, intent);\n\n    if (prior._tag === \"Rejected\") return prior;\n    if (prior._tag === \"Replay\")\n      return prior.decision._tag === \"Removed\"\n        ? ({ _tag: \"Removed\", result: { ...prior.decision.result, replayed: true } } as const)\n        : ({ _tag: \"Rejected\" } as const);\n\n    const row = (yield* credentialRows(mapping, subject)).find(\n      (item) => item[mapping.read.credential.credentialId] === id,\n    );\n\n    const credential =\n      row === undefined ? undefined : yield* ownedCredential(mapping, subject, row);\n\n    const policy = managementPolicy(mapping, subject);\n\n    if (\n      credential === undefined ||\n      !sameCredential(input.credential, credential) ||\n      !sameRevision(input.credential.revision, credential.revision) ||\n      !invalidationMatches(mapping, input.invalidation, policy) ||\n      !invalidationMatches(mapping, input.invalidation, input.management)\n    )\n      return { _tag: \"Rejected\" } as const;\n    if (\n      !(yield* authorizeAction(\n        mapping,\n        subject,\n        input.authorization,\n        {\n          action: \"remove\",\n          commandId: input.commandId,\n          flowId: input.commandId,\n          bindingDigest: yield* removeDigest(mapping.moduleId, input.commandId, input.credential),\n          revision: input.credential.revision,\n        },\n        {\n          ...policy,\n          maximumEvidenceAgeMillis: Math.min(\n            policy.maximumEvidenceAgeMillis,\n            input.management.maximumEvidenceAgeMillis,\n          ),\n        },\n      ))\n    )\n      return { _tag: \"Rejected\" } as const;\n    const owner = yield* CurrentPasskeyTransaction;\n\n    const remainingEffect: Effect.Effect<SQL, PersistenceMappingError> =\n      mapping.write.policy.remainingSignIn(subject.nativeId, id, copiedRow(subject.row));\n\n    const remaining = yield* remainingEffect;\n\n    if (!(yield* owner.check(remaining))) return { _tag: \"LastSignInMethod\" } as const;\n    const read = mapping.read;\n    const table = read.credential;\n\n    yield* owner.update(\n      table.table,\n      { [table.credentialId]: id, [table.subjectId]: subject.nativeId },\n      {\n        [table.status]: mapping.write.credential.removedStatus,\n        [table.credentialRevision]: owner.marker,\n      },\n    );\n    const factor = read.authority;\n\n    yield* owner.update(\n      factor.table,\n      { [factor.subjectId]: subject.nativeId, [factor.credentialId]: id },\n      { [factor.status]: mapping.write.authority.removedStatus, [factor.revision]: owner.marker },\n    );\n    for (const observation of owner.observations) {\n      if (observation.table === table.table)\n        observation.rows = observation.rows.filter((item) => item[table.credentialId] !== id);\n      if (observation.table === factor.table)\n        observation.rows = observation.rows.filter((item) => item[factor.credentialId] !== id);\n    }\n    const tuple = read.credentialOwnership;\n\n    yield* owner.update(\n      tuple.table,\n      {\n        [tuple.credentialKey]: yield* credentialKey(\n          credential.rpId,\n          credential.protocolCredentialId,\n        ),\n      },\n      {\n        [tuple.state]: mapping.write.credentialOwnership.removedState,\n        [tuple.version]: owner.marker,\n      },\n    );\n    yield* invalidate(mapping, subject, input.invalidation);\n    owner.postconditions.push(\n      remaining,\n      sql`not exists(select 1 from ${table.table} where ${both(equal(table.table, { [table.credentialId]: id }), table.activeCondition)})`,\n      sql`not exists(select 1 from ${factor.table} where ${both(equal(factor.table, { [factor.subjectId]: subject.nativeId, [factor.credentialId]: id }), factor.activeCondition)})`,\n    );\n\n    const result = {\n      credentialId: credential.credentialId,\n      replayed: false,\n      invalidation: input.invalidation,\n    };\n\n    yield* record(\n      mapping,\n      subject,\n      input.commandId,\n      id,\n      intent,\n      { _tag: \"Removed\", result },\n      input.retentionUntilMillis,\n      prior.observation,\n    );\n\n    return { _tag: \"Removed\", result } as const;\n  });\n\n  return { listCredentials, renameCredential, inspectRemove, removeCredential };\n};\n"],"mappings":";;;;AAoBA,MAAa,+BACX,YACA,WACA,aAIA,OAIA,YAcA,iBACG;CACH,MAAM,EAAE,QAAQ;CAChB,MAAM,EAAE,kBAAkB;CAC1B,MAAM,EAAE,YAAY,qBAAqB;CACzC,MAAM,EAAE,eAAe,WAAW,OAAO,gBAAgB,iBAAiB;CAC1E,MAAM,YAA+C,MAAM;CAE3D,MAAM,EACJ,iBACA,gBACA,gBACA,YACA,qBACA,aACA,kBACA,iBACA,iBACA,cACA,YACE;CAEJ,MAAM,EAAE,SAAS;CAEjB,MAAM,gBAAgB,YACpB,OAAO,MAAM,CACX,OAAO,aAAa,WAAW,EAAE,YAAY,yBAAyB,CAAC,GACvE,OAAO,aAAa,WAAW,EAAE,QAAQ,eAAe,CAAC,CAC3D,CAAC,CACH;CAEA,MAAM,cAAc,YAClB,OAAO,OAAO;EACZ,WAAW,OAAO,SAAS,CAAC,UAAU,QAAQ,CAAC;EAC/C,cAAc,OAAO;EACrB,MAAM,OAAO,YAAY,OAAO,MAAM;CACxC,CAAC,CACH;CAEA,MAAM,UAAU,OAAO,GAAG,2BAA2B,CAAC,CAAC,WACrD,SACA,SACA,WACA,cACA,QACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAEtB,MAAM,cAAc,OAAO,MAAM,KAC/B,MAAM,OACN,MAAM,MAAM,OAAO;IAAG,MAAM,WAAW,QAAQ;IAAW,MAAM,YAAY;EAAU,CAAC,GACvF,EAAE,OAAO,EAAE,CACb;EAEA,MAAM,MAAM,YAAY,KAAK;EAE7B,IAAI,QAAQ,KAAA,GAAW,OAAO;GAAE,MAAM;GAAO;EAAY;EACzD,IACE,CAAC,QAAQ,KAAK,WAAW,OAAO,IAAI,MAAM,YAAY,QAAQ,QAAQ,KACtE,IAAI,MAAM,kBAAkB,gBAC5B,IAAI,MAAM,YAAY,QAEtB,OAAO,EAAE,MAAM,WAAW;EAE5B,OAAO;GAAE,MAAM;GAAU,UAAU,cAAc,OAAO,IAAI,MAAM,SAAS;EAAE;CAC/E,CAAC;CAED,MAAM,SAAS,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAC1D,SACA,SACA,WACA,cACA,QACA,UACA,sBACA,aACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAuBtB,YAAY,QAAO,OArBK,MAAM,OAC5B,MAAM,OACN;GACE,GAAG,MAAM,aAAa;IACpB,UAAU,QAAQ;IAClB,WAAW,QAAQ;IACnB;IACA;GACF,CAAC;IACA,MAAM,WAAW,QAAQ;IACzB,MAAM,YAAY;IAClB,MAAM,YAAY,QAAQ;IAC1B,MAAM,eAAe;IACrB,MAAM,SAAS;IACf,MAAM,WAAW,cAAc,OAAO,QAAQ;IAC9C,MAAM,iBAAiB,QAAQ,MAAM,cAAc,oBAAoB;IACvE,MAAM,UAAU,MAAM;EACzB,GACA;IAAG,MAAM,WAAW,QAAQ;IAAW,MAAM,YAAY;EAAU,CACrE,EAAA,CAE4B;CAC9B,CAAC;CAED,MAAM,SAAS,OAAO,GAAG,0BAA0B,CAAC,CAAC,WACnD,SACA,UACA,WACA,UACA;EACA,IAAI,aAAa,QAAQ,aAAa,OAAO,WAAW,OAAO,OAAO,KAAA,GACpE,OAAO,KAAA;EACT,IAAI,UAAU,OAAO,cAAc,OAAO;EAC1C,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS;EAExD,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;EAClC,OAAO,iBAAiB,OAAO;EAE/B,QAAQ,OAAO,gBAAgB,SAAS,OAAO,KAAK,UAAU,KAAA;CAChE,CAAC;CAmQD,OAAO;EAAE,iBAjQe,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA;GACA,MAAM,UAAU,OAAO,OAAO,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;GAE7E,UAAU,YAAY,KAAA,CAAS;GAC/B,MAAM,OAAO,CAAC,GAAI,OAAO,eAAe,SAAS,OAAO,CAAE;GAE1D,KAAK,MAAM,MAAM,UAAU;IACzB,MAAM,IAAI,KAAK,QAAQ,KAAK,WAAW,eACrC,IAAI,MAAM,QAAQ,KAAK,WAAW;IAEpC,OAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;GAClC,CAAC;GAED,MAAM,WAAW,KAAK,QACnB,QACC,MAAM,WAAW,KAAA,KAAa,IAAI,QAAQ,KAAK,WAAW,gBAAgB,MAAM,MACpF;GAEA,MAAM,OAAO,SAAS,MAAM,GAAG,MAAM,KAAK;GAC1C,MAAM,cAAc,CAAC;GAErB,KAAK,MAAM,OAAO,MAAM;IACtB,WAAW,OAAO,gBAAgB,SAAS,SAAS,GAAG,OAAO,KAAA,CAAS;IACvE,YAAY,KAAK,QAAQ,SAAS,GAAG,CAAC;GACxC;GAEA,OAAO;IACL;IACA,GAAI,SAAS,SAAS,MAAM,QAAQ,EAAE,QAAQ,YAAY,GAAG,EAAE,CAAC,CAAE,aAAa,IAAI,CAAC;GACtF;EACF,CAgOuB;EAAG,kBA9ND,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;GACA,MAAM,UAAU,OAAO,OAAO,SAAS,MAAM,UAAU,MAAM,WAAW,IAAI;GAE5E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAErD,MAAM,SAAS,YAAY,OAAO;IAChC,WAAW;IACX,cAAc,MAAM;IACpB,MAAM,MAAM;GACd,CAAC;GAED,MAAM,QAAQ,OAAO,QAAQ,SAAS,SAAS,MAAM,WAAW,MAAM,cAAc,MAAM;GAE1F,IAAI,MAAM,SAAS,YAAY,OAAO;GAGtC,MAAM,OAAM,OAFQ,eAAe,SAAS,OAAO,EAAA,CAElC,MACd,SAAS,KAAK,QAAQ,KAAK,WAAW,kBAAkB,MAAM,YACjE;GAEA,IAAI,QAAQ,KAAA,MAAc,OAAO,gBAAgB,SAAS,SAAS,GAAG,OAAO,KAAA,GAC3E,OAAO,EAAE,MAAM,WAAW;GAC5B,IAAI,MAAM,SAAS,UACjB,OAAO,MAAM,SAAS,SAAS,YAC3B;IAAE,GAAG,MAAM;IAAU,UAAU;GAAK,IACnC,EAAE,MAAM,WAAW;GAC1B,MAAM,QAAQ,OAAO;GACrB,MAAM,QAAQ,QAAQ,KAAK;GAE3B,OAAO,MAAM,OACX,MAAM,OACN;KAAG,MAAM,eAAe,MAAM;KAAe,MAAM,YAAY,QAAQ;GAAS,GAChF,GAAG,QAAQ,MAAM,WAAW,OAAO,MAAM,KAAK,CAChD;GACA,MAAM,aAAa,QAAQ,SAAS;IAAE,GAAG;KAAM,QAAQ,MAAM,WAAW,OAAO,MAAM;GAAK,CAAC;GAE3F,OAAO,OACL,SACA,SACA,MAAM,WACN,MAAM,cACN,QACA;IAAE,MAAM;IAAW;GAAW,GAC9B,MAAM,sBACN,MAAM,WACR;GAEA,OAAO;IAAE,MAAM;IAAW;IAAY,UAAU;GAAM;EACxD,CA2KyC;EAAG,eAzKtB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,OACA;GACA,MAAM,UAAU,OAAO,OAAO,SAAS,MAAM,UAAU,MAAM,WAAW,KAAK;GAE7E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GAErD,MAAM,QAAQ,OAAO,QACnB,SACA,SACA,MAAM,WACN,MAAM,cACN,YAAY,OAAO;IAAE,WAAW;IAAU,cAAc,MAAM;GAAa,CAAC,CAC9E;GAEA,IAAI,MAAM,SAAS,YAAY,OAAO;GACtC,IAAI,MAAM,SAAS,UACjB,OAAO,MAAM,SAAS,SAAS,YAC1B;IAAE,MAAM;IAAU,QAAQ;KAAE,GAAG,MAAM,SAAS;KAAQ,UAAU;IAAK;GAAE,IACvE,EAAE,MAAM,WAAW;GAE1B,MAAM,OAAO,OAAO,eAAe,SAAS,OAAO,EAAA,CAAG,MACnD,SAAS,KAAK,QAAQ,KAAK,WAAW,kBAAkB,MAAM,YACjE;GAEA,MAAM,aACJ,QAAQ,KAAA,IAAY,KAAA,IAAY,OAAO,gBAAgB,SAAS,SAAS,GAAG;GAE9E,OAAO,eAAe,KAAA,IACjB,EAAE,MAAM,WAAW,IACnB;IAAE,MAAM;IAAU;GAAW;EACpC,CAyIwD;EAAG,kBAvIlC,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,OACA;GACA,MAAM,UAAU,OAAO,OACrB,SACA,MAAM,UACN,MAAM,WAAW,SAAS,WAC1B,IACF;GAEA,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;GACrD,MAAM,KAAK,MAAM,WAAW;GAC5B,MAAM,SAAS,YAAY,OAAO;IAAE,WAAW;IAAU,cAAc;GAAG,CAAC;GAC3E,MAAM,QAAQ,OAAO,QAAQ,SAAS,SAAS,MAAM,WAAW,IAAI,MAAM;GAE1E,IAAI,MAAM,SAAS,YAAY,OAAO;GACtC,IAAI,MAAM,SAAS,UACjB,OAAO,MAAM,SAAS,SAAS,YAC1B;IAAE,MAAM;IAAW,QAAQ;KAAE,GAAG,MAAM,SAAS;KAAQ,UAAU;IAAK;GAAE,IACxE,EAAE,MAAM,WAAW;GAE1B,MAAM,OAAO,OAAO,eAAe,SAAS,OAAO,EAAA,CAAG,MACnD,SAAS,KAAK,QAAQ,KAAK,WAAW,kBAAkB,EAC3D;GAEA,MAAM,aACJ,QAAQ,KAAA,IAAY,KAAA,IAAY,OAAO,gBAAgB,SAAS,SAAS,GAAG;GAE9E,MAAM,SAAS,iBAAiB,SAAS,OAAO;GAEhD,IACE,eAAe,KAAA,KACf,CAAC,eAAe,MAAM,YAAY,UAAU,KAC5C,CAAC,aAAa,MAAM,WAAW,UAAU,WAAW,QAAQ,KAC5D,CAAC,oBAAoB,SAAS,MAAM,cAAc,MAAM,KACxD,CAAC,oBAAoB,SAAS,MAAM,cAAc,MAAM,UAAU,GAElE,OAAO,EAAE,MAAM,WAAW;GAC5B,IACE,EAAE,OAAO,gBACP,SACA,SACA,MAAM,eACN;IACE,QAAQ;IACR,WAAW,MAAM;IACjB,QAAQ,MAAM;IACd,eAAe,OAAO,aAAa,QAAQ,UAAU,MAAM,WAAW,MAAM,UAAU;IACtF,UAAU,MAAM,WAAW;GAC7B,GACA;IACE,GAAG;IACH,0BAA0B,KAAK,IAC7B,OAAO,0BACP,MAAM,WAAW,wBACnB;GACF,CACF,IAEA,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,QAAQ,OAAO;GAKrB,MAAM,YAAY,OAFhB,QAAQ,MAAM,OAAO,gBAAgB,QAAQ,UAAU,IAAI,UAAU,QAAQ,GAAG,CAE3C;GAEvC,IAAI,EAAE,OAAO,MAAM,MAAM,SAAS,IAAI,OAAO,EAAE,MAAM,mBAAmB;GACxE,MAAM,OAAO,QAAQ;GACrB,MAAM,QAAQ,KAAK;GAEnB,OAAO,MAAM,OACX,MAAM,OACN;KAAG,MAAM,eAAe;KAAK,MAAM,YAAY,QAAQ;GAAS,GAChE;KACG,MAAM,SAAS,QAAQ,MAAM,WAAW;KACxC,MAAM,qBAAqB,MAAM;GACpC,CACF;GACA,MAAM,SAAS,KAAK;GAEpB,OAAO,MAAM,OACX,OAAO,OACP;KAAG,OAAO,YAAY,QAAQ;KAAW,OAAO,eAAe;GAAG,GAClE;KAAG,OAAO,SAAS,QAAQ,MAAM,UAAU;KAAgB,OAAO,WAAW,MAAM;GAAO,CAC5F;GACA,KAAK,MAAM,eAAe,MAAM,cAAc;IAC5C,IAAI,YAAY,UAAU,MAAM,OAC9B,YAAY,OAAO,YAAY,KAAK,QAAQ,SAAS,KAAK,MAAM,kBAAkB,EAAE;IACtF,IAAI,YAAY,UAAU,OAAO,OAC/B,YAAY,OAAO,YAAY,KAAK,QAAQ,SAAS,KAAK,OAAO,kBAAkB,EAAE;GACzF;GACA,MAAM,QAAQ,KAAK;GAEnB,OAAO,MAAM,OACX,MAAM,OACN,GACG,MAAM,gBAAgB,OAAO,cAC5B,WAAW,MACX,WAAW,oBACb,EACF,GACA;KACG,MAAM,QAAQ,QAAQ,MAAM,oBAAoB;KAChD,MAAM,UAAU,MAAM;GACzB,CACF;GACA,OAAO,WAAW,SAAS,SAAS,MAAM,YAAY;GACtD,MAAM,eAAe,KACnB,WACA,GAAG,4BAA4B,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,GAAG,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,eAAe,EAAE,IAClI,GAAG,4BAA4B,OAAO,MAAM,SAAS,KAAK,MAAM,OAAO,OAAO;KAAG,OAAO,YAAY,QAAQ;KAAW,OAAO,eAAe;GAAG,CAAC,GAAG,OAAO,eAAe,EAAE,EAC9K;GAEA,MAAM,SAAS;IACb,cAAc,WAAW;IACzB,UAAU;IACV,cAAc,MAAM;GACtB;GAEA,OAAO,OACL,SACA,SACA,MAAM,WACN,IACA,QACA;IAAE,MAAM;IAAW;GAAO,GAC1B,MAAM,sBACN,MAAM,WACR;GAEA,OAAO;IAAE,MAAM;IAAW;GAAO;EACnC,CAE0E;CAAE;AAC9E"}

package/dist/internal/passkey/registration-ceremony.mjs

@@ -27,7 +27,7 @@ const makePasskeyRegistrationCeremonyKernel = (operations, admission, credential
 			observe: false
 		})).rows[0];
 		if (advisory === void 0) return false;
-		const hashedHandle = handleKey(ceremony.profile.rpId, context.userHandle);
+		const hashedHandle = yield* handleKey(ceremony.profile.rpId, context.userHandle);
 		const held = (yield* owner.read(handle.table, equal(handle.table, { [handle.handleKey]: hashedHandle }), {
 			limit: 1,
 			columns: mappedColumns(handle)
@@ -80,7 +80,7 @@ const makePasskeyRegistrationCeremonyKernel = (operations, admission, credential
 			const read = yield* readFlow(mapping, input.access.flowId);
 			if (read === void 0 || read.state !== "Pending" || !matchesAccess(read.ceremony, input.access)) return { _tag: "Rejected" };
 			invariant(ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(input.ceremony));
-			if (!held || !compatiblePolicy(read.ceremony, read.policy, current) || policyStorage.encode(current) !== policyStorage.encode(input.policy) || !(yield* owner.check(liveCondition(mapping, read.ceremony))) || !(yield* owner.check(admissionCondition(mapping, [read.policy, current], read.ceremony, void 0, [], false, false)))) {
+			if (!held || !compatiblePolicy(read.ceremony, read.policy, current) || policyStorage.encode(current) !== policyStorage.encode(input.policy) || !(yield* owner.check(liveCondition(mapping, read.ceremony))) || !(yield* owner.check(yield* admissionCondition(mapping, [read.policy, current], read.ceremony, void 0, [], false, false)))) {
 				if (held) yield* releaseRegistrationCustody(mapping, read.ceremony);
 				yield* terminalFlow(mapping, read, "Rejected");
 				return { _tag: "Rejected" };