npm - @yielded/auth-persistence - Versions diffs - 0.1.0-beta.24 → 0.1.0-beta.25 - Mend

@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.25

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (20) hide show

package/dist/internal/email-kernel.d.mts +1 -1
package/dist/internal/email-kernel.mjs +1 -1
package/dist/internal/email-kernel.mjs.map +1 -1
package/dist/internal/models/password-model.d.mts +2 -1
package/dist/internal/models/password-model.mjs.map +1 -1
package/dist/internal/oauth/accounts.mjs +1 -1
package/dist/internal/oauth/accounts.mjs.map +1 -1
package/dist/internal/oauth-kernel.d.mts +8 -8
package/dist/internal/passkey/write-state.mjs +9 -1
package/dist/internal/passkey/write-state.mjs.map +1 -1
package/dist/internal/passkey-kernel.d.mts +4 -4
package/dist/internal/password-kernel.d.mts +2 -2
package/dist/internal/password-kernel.mjs +1 -1
package/dist/internal/password-kernel.mjs.map +1 -1
package/package.json +1 -1
package/src/internal/email-kernel.ts +2 -1
package/src/internal/models/password-model.ts +2 -1
package/src/internal/oauth/accounts.ts +2 -1
package/src/internal/passkey/write-state.ts +18 -4
package/src/internal/password-kernel.ts +2 -1

package/dist/internal/oauth/accounts.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"accounts.mjs","names":["make"],"sources":["../../../src/internal/oauth/accounts.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- compiler table shapes are erased; domain codecs and error channels remain typed. /\nimport {\n OAuthAccountRevision,\n OAuthActionAuthorization,\n OAuthLinkAccess,\n OAuthLinkClaim,\n OAuthLinkPendingFlow,\n OAuthLinkTransactionContext,\n OAuthUnlinked,\n OAuthCredentialSnapshot,\n snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport {\n SessionInvalidationWindow,\n AuthenticationRequirement,\n SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Context, Layer } from \"effect\";\n\nimport type { SubjectIdCodec } from \"../models/common\";\nimport type { OAuthReferenceGuardDescriptor, OAuthEligibilityFact } from \"../models/oauth-model\";\nimport { OAuthFlow } from \"./flow\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { OAuthRegistration } from \"./registration\";\nimport {\n invariant,\n oauthIdentityKey,\n sameRevision,\n satisfies,\n storage,\n validAction,\n} from \"./state\";\n\nconst make = Effect.gen(function () {\n const operations = yield* OAuthQueryCompiler;\n const flow = yield* OAuthFlow;\n const registration = yield* OAuthRegistration;\n\n const { eq, sql } = operations;\n\n const {\n claimFlow,\n credentialStorage,\n currentSubject,\n exactClaim,\n issueFlow,\n linkStorage,\n matchesAccess,\n readFlow,\n terminalFlow,\n } = flow;\n\n const { both, col, copiedRow, equal } = operations;\n const { acquireTuple, readTuple } = registration;\n\n const contextStorage = storage(OAuthLinkTransactionContext);\n\n const unlinkedStorage = storage(OAuthUnlinked);\n\n const accountCurrent = (mapping: any, subjectId: OAuthAccountRevision[\"subjectId\"]) =>\n Effect.gen(function* () {\n const native = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toNative(subjectId);\n\n return yield* currentSubject(mapping, native);\n });\n\n const authorization = (\n mapping: any,\n current: any,\n auth: OAuthActionAuthorization,\n action: OAuthActionAuthorization[\"challenge\"][\"action\"],\n flowId: string,\n commandId: string,\n intent: string,\n maximumAge: number,\n ) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n Effect.gen(function* () {\n const now = yield* owner.now(mapping.clock);\n\n const currentRequirement = snapshotOAuthSync(\n AuthenticationRequirement,\n mapping.subject.decodeActionRequirement(copiedRow(current.row), action),\n );\n\n const accepted = yield* validAction(\n auth,\n {\n moduleId: auth.challenge.moduleId,\n action,\n flowId,\n commandId,\n revision: current.revision,\n intent,\n },\n currentRequirement,\n now,\n maximumAge,\n );\n\n if (!accepted) return false;\n\n const age = Math.min(\n maximumAge,\n auth.requirement.maximumAgeMillis,\n currentRequirement.maximumAgeMillis,\n );\n\n const fresh = auth.evidence.proofs.filter(\n (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n );\n\n invariant(fresh.length > 0);\n\n const deadline = Math.min(\n ...fresh.map((proof) => DateTime.toEpochMillis(proof.verifiedAt) + age),\n );\n\n owner.postconditions.push(\n sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${deadline}`,\n );\n\n return true;\n }),\n );\n\n const currentLink = (mapping: any, flow: typeof OAuthLinkPendingFlow.Type) =>\n Effect.gen(function* () {\n const current = yield* accountCurrent(mapping, flow.context.revision.subjectId);\n\n return current !== undefined && sameRevision(current.revision, flow.context.revision)\n ? current\n : undefined;\n });\n\n const issueLink = (mapping: any, input: any) =>\n Effect.gen(function* () {\n const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow),\n c = flow.context;\n\n const current = yield* currentLink(mapping, flow);\n const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n if (\n current === undefined \|\|\n auth.challenge.moduleId !== c.moduleId \|\|\n !(yield* authorization(\n mapping,\n current,\n auth,\n \"link-begin\",\n c.flowId,\n c.commandId,\n contextStorage.encode(c),\n c.maximumEvidenceAgeMillis,\n ))\n )\n return { _tag: \"Rejected\" } as const;\n\n return yield* issueFlow(mapping, flow, \"link\");\n });\n\n const preflightLink = (mapping: any, original: typeof OAuthLinkAccess.Type) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n Effect.gen(function* () {\n const input = snapshotOAuthSync(OAuthLinkAccess, original);\n // The authenticated subject is known before discovering/locking any flow.\n const current = yield* accountCurrent(mapping, input.subjectId);\n const found = yield* readFlow(mapping, input, \"link\");\n const now = yield* owner.now(mapping.clock);\n\n if (\n current === undefined \|\|\n found.flow === undefined \|\|\n found.row?.[mapping.flow.state] !== \"Pending\" \|\|\n !matchesAccess(found.flow, input)\n )\n return undefined;\n\n const flow = snapshotOAuthSync(OAuthLinkPendingFlow, found.flow as never),\n c = flow.context;\n\n if (\n c.revision.subjectId !== input.subjectId \|\|\n !sameRevision(current.revision, c.revision) \|\|\n now < c.issuedAtMillis \|\|\n now >= c.expiresAtMillis\n )\n return undefined;\n owner.postconditions.push(\n sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,\n );\n\n return { current, flow, row: found.row };\n }),\n );\n\n const claimLink = (mapping: any, input: any) =>\n Effect.gen(function* () {\n const found = yield* preflightLink(mapping, input.access);\n const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow);\n\n const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization),\n c = flow.context;\n\n if (\n found === undefined \|\|\n linkStorage.encode(found.flow) !== linkStorage.encode(flow) \|\|\n auth.challenge.moduleId !== c.moduleId \|\|\n !(yield* authorization(\n mapping,\n found.current,\n auth,\n \"link-complete\",\n c.flowId,\n c.commandId,\n contextStorage.encode(c),\n c.maximumEvidenceAgeMillis,\n ))\n )\n return { _tag: \"Rejected\" } as const;\n const claim = yield* claimFlow(mapping, { row: found.row!, flow }, input.claimId);\n\n return claim === undefined\n ? ({ _tag: \"Rejected\" } as const)\n : ({ _tag: \"Claimed\", claim } as const);\n });\n\n const checkInvalidation = (mapping: any, original: SessionInvalidationWindow) => {\n const value = snapshotOAuthSync(SessionInvalidationWindow, original);\n\n invariant(\n value.trigger === \"credential-change\" &&\n value.oldAuthenticationEvidence === \"rejected\" &&\n (mapping.sessionInvalidation === \"same-authority-immediate\"\n ? value.existingSessions === \"immediate\" && value.maximumExposureMillis === 0\n : value.existingSessions === \"original-absolute-expiry\"),\n );\n\n return value;\n };\n\n const advance = (mapping: any, current: any, removed?: string) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n Effect.gen(function* () {\n const revision = mapping.subject.nextSecurityRevision(current.revision.securityRevision);\n\n invariant(\n typeof revision === \"string\" &&\n revision.length > 0 &&\n revision.length <= 256 &&\n revision !== current.revision.securityRevision,\n );\n const subject = mapping.subject;\n\n yield* owner.update(\n subject.table,\n { [subject.id]: current.nativeId },\n { [subject.securityRevision]: revision },\n );\n for (const cleanup of mapping.cleanup) {\n const condition = both(\n eq(col(cleanup.table, cleanup.subjectId), current.nativeId),\n cleanup.condition({\n subjectId: current.nativeId,\n revision: snapshotOAuthSync(OAuthAccountRevision, current.revision),\n ...(removed === undefined ? {} : { removedCredentialId: removed }),\n }),\n );\n\n yield* owner.write(owner.database.delete(cleanup.table).where(condition));\n owner.postconditions.push(\n sql`not exists(select 1 from ${cleanup.table} where ${condition})`,\n );\n }\n\n return SecurityRevision.make(revision);\n }),\n );\n\n const settleLink = (\n mapping: any,\n input: any,\n allocated: { readonly credentialId: string; readonly revision: SecurityRevision },\n ) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n Effect.gen(function* () {\n const claim = snapshotOAuthSync(OAuthLinkClaim, input.claim),\n flow = claim.flow,\n c = flow.context;\n\n const current = yield* currentLink(mapping, flow);\n\n // Known subject is always locked before tuple/flow; even a rejected outcome\n // settles its exact original claim without adopting a newer revision.\n const identity =\n input.outcome._tag === \"Verified\" ? input.outcome.identity.identity : undefined;\n\n if (identity !== undefined)\n invariant(identity.provider === c.provider && identity.issuer === c.issuer);\n\n const tuple =\n identity !== undefined && current !== undefined\n ? yield* readTuple(mapping.ownership, identity)\n : undefined;\n\n const exact = yield* exactClaim(mapping, claim, \"link\");\n\n if (exact === undefined) return { _tag: \"Rejected\" } as const;\n let decision: any = { _tag: input.outcome._tag };\n\n if (input.outcome._tag === \"Verified\") {\n decision = { _tag: \"Rejected\" };\n const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n if (\n current !== undefined &&\n tuple !== undefined &&\n auth.challenge.moduleId === c.moduleId &&\n (yield* authorization(\n mapping,\n current,\n auth,\n \"link-complete\",\n c.flowId,\n c.commandId,\n contextStorage.encode(c),\n c.maximumEvidenceAgeMillis,\n ))\n ) {\n const t = mapping.ownership.tuple,\n cr = mapping.credential,\n a = mapping.authority;\n\n const login = yield* owner.read(\n cr.table,\n eq(col(cr.table, cr.identityKey), tuple.key),\n {\n limit: 1,\n },\n );\n\n const previous = login.rows[0];\n\n if (\n tuple.row[t.state] === \"Reserved\" \|\|\n (tuple.row[t.state] === \"Owned\" &&\n !mapping.subjectId.equals(tuple.row[t.subjectId], current.nativeId)) \|\|\n (previous !== undefined &&\n (previous[cr.moduleId] !== c.moduleId \|\|\n !mapping.subjectId.equals(previous[cr.subjectId], current.nativeId) \|\|\n !cr.isActiveStatus(previous[cr.status])))\n )\n decision = { _tag: \"Conflict\" };\n else if (previous !== undefined) {\n const shared = current.revision.credentials.find(\n (item: any) => item.credentialId === previous[cr.credentialId],\n );\n\n if (\n tuple.row[t.state] !== \"Owned\" \|\|\n shared?.revision !== previous[cr.credentialRevision] \|\|\n !(yield* owner.check(\n sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.identityKey), tuple.key), cr.activeCondition)})`,\n ))\n )\n decision = { _tag: \"Conflict\" };\n else\n decision = {\n _tag: \"Linked\",\n changed: false,\n credential: snapshotOAuthSync(OAuthCredentialSnapshot, {\n moduleId: c.moduleId,\n identity,\n credentialId: previous[cr.credentialId],\n credentialRevision: previous[cr.credentialRevision],\n revision: current.revision,\n }),\n };\n } else {\n checkInvalidation(mapping, input.invalidation);\n\n const values = {\n ...cr.encodeInsert({\n moduleId: c.moduleId,\n subjectId: current.nativeId,\n identityKey: tuple.key,\n credentialId: allocated.credentialId,\n credentialRevision: allocated.revision,\n }),\n [cr.moduleId]: c.moduleId,\n [cr.subjectId]: current.nativeId,\n [cr.identityKey]: tuple.key,\n [cr.credentialId]: allocated.credentialId,\n [cr.credentialRevision]: allocated.revision,\n };\n\n invariant(cr.isActiveStatus(values[cr.status]));\n\n const inserted = yield* owner.insert(cr.table, values, {\n [cr.credentialId]: allocated.credentialId,\n });\n\n login.rows = inserted.rows;\n\n const sharedValues = {\n ...a.encodeInsert({\n subjectId: current.nativeId,\n credentialId: allocated.credentialId,\n revision: allocated.revision,\n }),\n [a.subjectId]: current.nativeId,\n [a.credentialId]: allocated.credentialId,\n [a.revision]: allocated.revision,\n };\n\n invariant(a.isActiveStatus(sharedValues[a.status]));\n\n const shared = yield* owner.insert(a.table, sharedValues, {\n [a.subjectId]: current.nativeId,\n [a.credentialId]: allocated.credentialId,\n });\n\n current.authorities.rows = [...current.authorities.rows, ...shared.rows];\n owner.postconditions.push(\n sql`exists(select 1 from ${cr.table} where ${both(\n eq(col(cr.table, cr.credentialId), allocated.credentialId),\n cr.activeCondition,\n )})`,\n sql`exists(select 1 from ${a.table} where ${both(\n eq(col(a.table, a.subjectId), current.nativeId),\n eq(col(a.table, a.credentialId), allocated.credentialId),\n a.activeCondition,\n )})`,\n );\n if (tuple.row[t.state] === \"Unowned\")\n yield* acquireTuple(mapping.ownership, identity, tuple.key, current.nativeId);\n const next = yield* advance(mapping, current);\n\n const revision = snapshotOAuthSync(OAuthAccountRevision, {\n ...current.revision,\n securityRevision: next,\n credentials: [\n ...current.revision.credentials,\n { credentialId: allocated.credentialId, revision: allocated.revision },\n ],\n });\n\n decision = {\n _tag: \"Linked\",\n changed: true,\n credential: snapshotOAuthSync(OAuthCredentialSnapshot, {\n moduleId: c.moduleId,\n identity,\n credentialId: allocated.credentialId,\n credentialRevision: allocated.revision as never,\n revision,\n }),\n };\n }\n }\n }\n yield* terminalFlow(mapping, flow, decision._tag);\n\n return decision;\n }),\n );\n\n const targetCredential = (mapping: any, moduleId: string, credentialId: string, current: any) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n Effect.gen(function* () {\n const cr = mapping.credential;\n\n const found = yield* owner.read(\n cr.table,\n eq(col(cr.table, cr.credentialId), credentialId),\n {\n limit: 1,\n },\n );\n\n const row = found.rows[0];\n\n if (\n row === undefined \|\|\n row[cr.moduleId] !== moduleId \|\|\n !mapping.subjectId.equals(row[cr.subjectId], current.nativeId) \|\|\n !cr.isActiveStatus(row[cr.status])\n )\n return undefined;\n const t = mapping.ownership.tuple;\n\n const tuple = yield* owner.read(\n t.table,\n eq(col(t.table, t.identityKey), row[cr.identityKey]),\n {\n limit: 1,\n },\n );\n\n const ownership = tuple.rows[0];\n\n if (\n ownership === undefined \|\|\n ownership[t.state] !== \"Owned\" \|\|\n !mapping.subjectId.equals(ownership[t.subjectId], current.nativeId)\n )\n return undefined;\n\n const identity = {\n provider: ownership[t.provider],\n issuer: ownership[t.issuer],\n subject: ownership[t.externalSubject],\n };\n\n invariant((yield* oauthIdentityKey(identity)) === row[cr.identityKey]);\n\n const shared = current.revision.credentials.find(\n (item: any) => item.credentialId === credentialId,\n );\n\n if (\n shared?.revision !== row[cr.credentialRevision] \|\|\n !(yield* owner.check(\n sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), credentialId), cr.activeCondition)})`,\n ))\n )\n return undefined;\n\n return snapshotOAuthSync(OAuthCredentialSnapshot, {\n moduleId: moduleId as never,\n identity,\n credentialId,\n credentialRevision: row[cr.credentialRevision],\n revision: current.revision,\n });\n }),\n );\n\n const unlinkCommand = (mapping: any, moduleId: string, commandId: string) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n owner.read(\n mapping.command.table,\n equal(mapping.command.table, {\n [mapping.command.moduleId]: moduleId,\n [mapping.command.commandId]: commandId,\n }),\n { limit: 1 },\n ),\n );\n\n const inspectUnlink = (mapping: any, input: any) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n Effect.gen(function* () {\n const current = yield* accountCurrent(mapping, input.subjectId);\n\n if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),\n r = mapping.command;\n\n const old = command.rows[0];\n\n if (old !== undefined) {\n const intent = credentialStorage.decode(old[r.intentSnapshot]);\n\n if (\n intent.moduleId !== input.moduleId \|\|\n intent.revision.subjectId !== input.subjectId \|\|\n intent.credentialId !== input.credentialId \|\|\n !mapping.subjectId.equals(old[r.subjectId], current.nativeId) \|\|\n old[r.credentialId] !== input.credentialId\n )\n return { _tag: \"Conflict\" } as const;\n const metadata = mapping.metadata.condition(current.nativeId);\n\n if (!(yield* owner.check(metadata))) return { _tag: \"Rejected\" } as const;\n owner.postconditions.push(metadata);\n\n return { _tag: \"Replay\", result: unlinkedStorage.decode(old[r.decision]) } as const;\n }\n\n const credential = yield* targetCredential(\n mapping,\n input.moduleId,\n input.credentialId,\n current,\n );\n\n return credential === undefined\n ? ({ _tag: \"Rejected\" } as const)\n : ({ _tag: \"Target\", credential } as const);\n }),\n );\n\n const remainingEligibility = (mapping: any, current: any, removed: string) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n Effect.gen(function* () {\n invariant(mapping.eligibility.length > 0 && mapping.eligibility.length <= 32);\n const facts = new Map<string, OAuthEligibilityFact>();\n\n const revisions = new Map(\n current.revision.credentials.map((item: any) => [item.credentialId, item.revision]),\n );\n\n for (const descriptor of mapping.eligibility) {\n const observed = yield* owner.read(\n descriptor.table,\n both(\n eq(col(descriptor.table, descriptor.subjectId), current.nativeId),\n descriptor.condition(current.nativeId),\n ),\n { orderBy: col(descriptor.table, descriptor.credentialId) },\n );\n\n for (const row of observed.rows) {\n const fact = descriptor.decode(copiedRow(row)) as OAuthEligibilityFact \| undefined;\n\n if (fact === undefined \|\| fact.credentialId === removed) continue;\n invariant(\n fact.credentialId === row[descriptor.credentialId] &&\n fact.revision === row[descriptor.revision] &&\n revisions.get(fact.credentialId) === fact.revision &&\n fact.factors.length <= 8 &&\n fact.factors.every((factor) =>\n [\"knowledge\", \"possession\", \"inherence\"].includes(factor),\n ),\n );\n invariant(\n typeof fact.usablePrimary === \"boolean\" &&\n typeof fact.userVerified === \"boolean\" &&\n typeof fact.phishingResistant === \"boolean\",\n );\n\n const normalized = {\n credentialId: fact.credentialId,\n revision: fact.revision,\n usablePrimary: fact.usablePrimary,\n factors: [...new Set(fact.factors)].sort(),\n userVerified: fact.userVerified,\n phishingResistant: fact.phishingResistant,\n };\n\n const prior = facts.get(fact.credentialId);\n\n // oxlint-disable-next-line no-restricted-properties -- Canonical bounded eligibility fact fingerprint rejects contradictory duplicate IDs.\n invariant(prior === undefined \|\| JSON.stringify(prior) === JSON.stringify(normalized));\n facts.set(fact.credentialId, normalized);\n }\n }\n const available = [...facts.values()];\n\n const requirement = snapshotOAuthSync(\n AuthenticationRequirement,\n mapping.subject.decodeAuthenticationRequirement(copiedRow(current.row)),\n );\n\n return available.some((fact) => fact.usablePrimary) && satisfies(available, requirement);\n }),\n );\n\n const unlink = (mapping: any, input: any) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n Effect.gen(function* () {\n const expected = snapshotOAuthSync(OAuthCredentialSnapshot, input.credential);\n\n invariant(expected.moduleId === input.moduleId);\n const current = yield* accountCurrent(mapping, expected.revision.subjectId);\n\n if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n const guards: ReadonlyArray<OAuthReferenceGuardDescriptor<unknown>> =\n mapping.connectedReferenceGuards ?? [];\n\n invariant(guards.length <= 32);\n let referencesGuarded = mapping.connectedReference !== undefined && guards.length > 0;\n\n if (mapping.connectedReference !== undefined)\n for (const guard of guards) {\n const condition = guard.condition({\n identity: snapshotOAuthSync(\n OAuthCredentialSnapshot.fields.identity,\n expected.identity,\n ),\n identityKey: yield* oauthIdentityKey(expected.identity),\n subjectId: copiedRow({ value: current.nativeId }).value,\n });\n\n const read = yield* owner.read(\n guard.table,\n Effect.isEffect(condition) ? yield* condition : condition,\n { orderBy: col(guard.table, guard.orderBy) },\n );\n\n if (read.rows.length === 0) referencesGuarded = false;\n }\n\n const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),\n r = mapping.command;\n\n const previous = command.rows[0];\n\n if (previous !== undefined) {\n if (\n previous[r.intentSnapshot] !== credentialStorage.encode(expected) \|\|\n previous[r.credentialId] !== expected.credentialId \|\|\n !mapping.subjectId.equals(previous[r.subjectId], current.nativeId)\n )\n return { _tag: \"Conflict\" } as const;\n const metadata = mapping.metadata.condition(current.nativeId);\n\n if (!(yield* owner.check(metadata))) return { _tag: \"Rejected\" } as const;\n owner.postconditions.push(metadata);\n\n return {\n _tag: \"Unlinked\",\n replayed: true,\n result: unlinkedStorage.decode(previous[r.decision]),\n } as const;\n }\n\n const actual = yield* targetCredential(\n mapping,\n input.moduleId,\n expected.credentialId,\n current,\n );\n\n if (\n actual === undefined \|\|\n credentialStorage.encode(actual) !== credentialStorage.encode(expected)\n )\n return { _tag: \"Rejected\" } as const;\n const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n if (\n auth.challenge.moduleId !== input.moduleId \|\|\n !(yield* authorization(\n mapping,\n current,\n auth,\n \"unlink\",\n input.commandId,\n input.commandId,\n credentialStorage.encode(expected),\n auth.requirement.maximumAgeMillis,\n ))\n )\n return { _tag: \"Rejected\" } as const;\n if (!(yield* remainingEligibility(mapping, current, expected.credentialId)))\n return { _tag: \"LastSignInMethod\" } as const;\n\n const invalidation = checkInvalidation(mapping, input.invalidation),\n cr = mapping.credential,\n a = mapping.authority;\n\n const key = yield* oauthIdentityKey(expected.identity),\n t = mapping.ownership.tuple;\n\n const connected = mapping.connectedReference?.({\n identityKey: key,\n subjectId: copiedRow({ value: current.nativeId }).value,\n });\n\n const retain =\n connected !== undefined && (!referencesGuarded \|\| (yield* owner.check(connected)));\n\n if (connected !== undefined && referencesGuarded)\n owner.postconditions.push(retain ? connected : sql`not (${connected})`);\n yield* owner.remove(cr.table, { [cr.credentialId]: expected.credentialId });\n yield* owner.remove(a.table, {\n [a.subjectId]: current.nativeId,\n [a.credentialId]: expected.credentialId,\n });\n if (!retain) {\n yield* owner.update(\n t.table,\n { [t.identityKey]: key },\n {\n [t.state]: \"Unowned\",\n [t.subjectId]: null,\n [t.reservation]: null,\n [t.version]: owner.marker,\n },\n );\n if (mapping.ownership.mode === \"separate\")\n yield* owner.remove(mapping.ownership.external.table, {\n [mapping.ownership.external.identityKey]: key,\n });\n }\n yield* advance(mapping, current, expected.credentialId);\n\n const result = snapshotOAuthSync(OAuthUnlinked, {\n _tag: \"Unlinked\",\n credentialId: expected.credentialId,\n invalidation,\n });\n\n const now = yield* owner.now(mapping.clock);\n\n invariant(\n Number.isSafeInteger(input.retentionUntilMillis) &&\n input.retentionUntilMillis > now &&\n input.retentionUntilMillis >= input.nowMillis + 120000,\n );\n const commandKey = { [r.moduleId]: input.moduleId, [r.commandId]: input.commandId };\n\n const values = {\n ...r.encodeInsert({\n moduleId: input.moduleId,\n commandId: input.commandId,\n credential: snapshotOAuthSync(OAuthCredentialSnapshot, expected),\n }),\n ...commandKey,\n [r.subjectId]: current.nativeId,\n [r.credentialId]: expected.credentialId,\n [r.intentSnapshot]: credentialStorage.encode(expected),\n [r.decision]: unlinkedStorage.encode(result),\n [r.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),\n };\n\n const inserted = yield* owner.insert(r.table, values, commandKey);\n\n command.rows = inserted.rows;\n\n return { _tag: \"Unlinked\", result, replayed: false } as const;\n }),\n );\n\n return { accountCurrent, issueLink, preflightLink, claimLink, settleLink, inspectUnlink, unlink };\n});\n\nexport class OAuthAccounts extends Context.Service<OAuthAccounts, Effect.Success<typeof make>>()(\n \"effect-auth/persistence/OAuthAccounts\",\n) {\n static readonly layer = Layer.effect(OAuthAccounts, make);\n}\n"],"mappings":";;;;;;;;;AAkCA,MAAMA,SAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,OAAO,OAAO;CACpB,MAAM,eAAe,OAAO;CAE5B,MAAM,EAAE,IAAI,QAAQ;CAEpB,MAAM,EACJ,WACA,mBACA,gBACA,YACA,WACA,aACA,eACA,UACA,iBACE;CAEJ,MAAM,EAAE,MAAM,KAAK,WAAW,UAAU;CACxC,MAAM,EAAE,cAAc,cAAc;CAEpC,MAAM,iBAAiB,QAAQ,2BAA2B;CAE1D,MAAM,kBAAkB,QAAQ,aAAa;CAE7C,MAAM,kBAAkB,SAAc,cACpC,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAQ,QAAQ,UAAsC,SAAS,SAAS;EAEvF,OAAO,OAAO,eAAe,SAAS,MAAM;CAC9C,CAAC;CAEH,MAAM,iBACJ,SACA,SACA,MACA,QACA,QACA,WACA,QACA,eAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,MAAM,qBAAqB,kBACzB,2BACA,QAAQ,QAAQ,wBAAwB,UAAU,QAAQ,GAAG,GAAG,MAAM,CACxE;EAiBA,IAAI,EAAC,OAfmB,YACtB,MACA;GACE,UAAU,KAAK,UAAU;GACzB;GACA;GACA;GACA,UAAU,QAAQ;GAClB;EACF,GACA,oBACA,KACA,UACF,IAEe,OAAO;EAEtB,MAAM,MAAM,KAAK,IACf,YACA,KAAK,YAAY,kBACjB,mBAAmB,gBACrB;EAEA,MAAM,QAAQ,KAAK,SAAS,OAAO,QAChC,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;EAEA,UAAU,MAAM,SAAS,CAAC;EAE1B,MAAM,WAAW,KAAK,IACpB,GAAG,MAAM,KAAK,UAAU,SAAS,cAAc,MAAM,UAAU,IAAI,GAAG,CACxE;EAEA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,UAC1F;EAEA,OAAO;CACT,CAAC,CACH;CAEF,MAAM,eAAe,SAAc,SACjC,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,eAAe,SAAS,KAAK,QAAQ,SAAS,SAAS;EAE9E,OAAO,YAAY,KAAA,KAAa,aAAa,QAAQ,UAAU,KAAK,QAAQ,QAAQ,IAChF,UACA,KAAA;CACN,CAAC;CAEH,MAAM,aAAa,SAAc,UAC/B,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAI,GAC7D,IAAI,KAAK;EAEX,MAAM,UAAU,OAAO,YAAY,SAAS,IAAI;EAChD,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;EAE5E,IACE,YAAY,KAAA,KACZ,KAAK,UAAU,aAAa,EAAE,YAC9B,EAAE,OAAO,cACP,SACA,SACA,MACA,cACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IAEA,OAAO,EAAE,MAAM,WAAW;EAE5B,OAAO,OAAO,UAAU,SAAS,MAAM,MAAM;CAC/C,CAAC;CAEH,MAAM,iBAAiB,SAAc,aACnC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,iBAAiB,QAAQ;EAEzD,MAAM,UAAU,OAAO,eAAe,SAAS,MAAM,SAAS;EAC9D,MAAM,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM;EACpD,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,IACE,YAAY,KAAA,KACZ,MAAM,SAAS,KAAA,KACf,MAAM,MAAM,QAAQ,KAAK,WAAW,aACpC,CAAC,cAAc,MAAM,MAAM,KAAK,GAEhC,OAAO,KAAA;EAET,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAa,GACtE,IAAI,KAAK;EAEX,IACE,EAAE,SAAS,cAAc,MAAM,aAC/B,CAAC,aAAa,QAAQ,UAAU,EAAE,QAAQ,KAC1C,MAAM,EAAE,kBACR,OAAO,EAAE,iBAET,OAAO,KAAA;EACT,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,EAAE,eAAe,OAAO,QAAQ,MAAM,gBAAgB,KAAK,EAAE,iBACzG;EAEA,OAAO;GAAE;GAAS;GAAM,KAAK,MAAM;EAAI;CACzC,CAAC,CACH;CAEF,MAAM,aAAa,SAAc,UAC/B,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,cAAc,SAAS,MAAM,MAAM;EACxD,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAI;EAE/D,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa,GAC1E,IAAI,KAAK;EAEX,IACE,UAAU,KAAA,KACV,YAAY,OAAO,MAAM,IAAI,MAAM,YAAY,OAAO,IAAI,KAC1D,KAAK,UAAU,aAAa,EAAE,YAC9B,EAAE,OAAO,cACP,SACA,MAAM,SACN,MACA,iBACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IAEA,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,QAAQ,OAAO,UAAU,SAAS;GAAE,KAAK,MAAM;GAAM;EAAK,GAAG,MAAM,OAAO;EAEhF,OAAO,UAAU,KAAA,IACZ,EAAE,MAAM,WAAW,IACnB;GAAE,MAAM;GAAW;EAAM;CAChC,CAAC;CAEH,MAAM,qBAAqB,SAAc,aAAwC;EAC/E,MAAM,QAAQ,kBAAkB,2BAA2B,QAAQ;EAEnE,UACE,MAAM,YAAY,uBAChB,MAAM,8BAA8B,eACnC,QAAQ,wBAAwB,6BAC7B,MAAM,qBAAqB,eAAe,MAAM,0BAA0B,IAC1E,MAAM,qBAAqB,2BACnC;EAEA,OAAO;CACT;CAEA,MAAM,WAAW,SAAc,SAAc,YAC3C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,QAAQ,QAAQ,qBAAqB,QAAQ,SAAS,gBAAgB;EAEvF,UACE,OAAO,aAAa,YAClB,SAAS,SAAS,KAClB,SAAS,UAAU,OACnB,aAAa,QAAQ,SAAS,gBAClC;EACA,MAAM,UAAU,QAAQ;EAExB,OAAO,MAAM,OACX,QAAQ,OACR,GAAG,QAAQ,KAAK,QAAQ,SAAS,GACjC,GAAG,QAAQ,mBAAmB,SAAS,CACzC;EACA,KAAK,MAAM,WAAW,QAAQ,SAAS;GACrC,MAAM,YAAY,KAChB,GAAG,IAAI,QAAQ,OAAO,QAAQ,SAAS,GAAG,QAAQ,QAAQ,GAC1D,QAAQ,UAAU;IAChB,WAAW,QAAQ;IACnB,UAAU,kBAAkB,sBAAsB,QAAQ,QAAQ;IAClE,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,qBAAqB,QAAQ;GAClE,CAAC,CACH;GAEA,OAAO,MAAM,MAAM,MAAM,SAAS,OAAO,QAAQ,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC;GACxE,MAAM,eAAe,KACnB,GAAG,4BAA4B,QAAQ,MAAM,SAAS,UAAU,EAClE;EACF;EAEA,OAAO,iBAAiB,KAAK,QAAQ;CACvC,CAAC,CACH;CAEF,MAAM,cACJ,SACA,OACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,gBAAgB,MAAM,KAAK,GACzD,OAAO,MAAM,MACb,IAAI,KAAK;EAEX,MAAM,UAAU,OAAO,YAAY,SAAS,IAAI;EAIhD,MAAM,WACJ,MAAM,QAAQ,SAAS,aAAa,MAAM,QAAQ,SAAS,WAAW,KAAA;EAExE,IAAI,aAAa,KAAA,GACf,UAAU,SAAS,aAAa,EAAE,YAAY,SAAS,WAAW,EAAE,MAAM;EAE5E,MAAM,QACJ,aAAa,KAAA,KAAa,YAAY,KAAA,IAClC,OAAO,UAAU,QAAQ,WAAW,QAAQ,IAC5C,KAAA;EAIN,KAAI,OAFiB,WAAW,SAAS,OAAO,MAAM,OAExC,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EACnD,IAAI,WAAgB,EAAE,MAAM,MAAM,QAAQ,KAAK;EAE/C,IAAI,MAAM,QAAQ,SAAS,YAAY;GACrC,WAAW,EAAE,MAAM,WAAW;GAC9B,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;GAE5E,IACE,YAAY,KAAA,KACZ,UAAU,KAAA,KACV,KAAK,UAAU,aAAa,EAAE,aAC7B,OAAO,cACN,SACA,SACA,MACA,iBACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IACA;IACA,MAAM,IAAI,QAAQ,UAAU,OAC1B,KAAK,QAAQ,YACb,IAAI,QAAQ;IAEd,MAAM,QAAQ,OAAO,MAAM,KACzB,GAAG,OACH,GAAG,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,GAAG,GAC3C,EACE,OAAO,EACT,CACF;IAEA,MAAM,WAAW,MAAM,KAAK;IAE5B,IACE,MAAM,IAAI,EAAE,WAAW,cACtB,MAAM,IAAI,EAAE,WAAW,WACtB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,QAAQ,QAAQ,KACnE,aAAa,KAAA,MACX,SAAS,GAAG,cAAc,EAAE,YAC3B,CAAC,QAAQ,UAAU,OAAO,SAAS,GAAG,YAAY,QAAQ,QAAQ,KAClE,CAAC,GAAG,eAAe,SAAS,GAAG,OAAO,IAE1C,WAAW,EAAE,MAAM,WAAW;SAC3B,IAAI,aAAa,KAAA,GAAW;KAC/B,MAAM,SAAS,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,SAAS,GAAG,aACnD;KAEA,IACE,MAAM,IAAI,EAAE,WAAW,WACvB,QAAQ,aAAa,SAAS,GAAG,uBACjC,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,GAAG,GAAG,GAAG,eAAe,EAAE,EACtH,IAEA,WAAW,EAAE,MAAM,WAAW;UAE9B,WAAW;MACT,MAAM;MACN,SAAS;MACT,YAAY,kBAAkB,yBAAyB;OACrD,UAAU,EAAE;OACZ;OACA,cAAc,SAAS,GAAG;OAC1B,oBAAoB,SAAS,GAAG;OAChC,UAAU,QAAQ;MACpB,CAAC;KACH;IACJ,OAAO;KACL,kBAAkB,SAAS,MAAM,YAAY;KAE7C,MAAM,SAAS;MACb,GAAG,GAAG,aAAa;OACjB,UAAU,EAAE;OACZ,WAAW,QAAQ;OACnB,aAAa,MAAM;OACnB,cAAc,UAAU;OACxB,oBAAoB,UAAU;MAChC,CAAC;OACA,GAAG,WAAW,EAAE;OAChB,GAAG,YAAY,QAAQ;OACvB,GAAG,cAAc,MAAM;OACvB,GAAG,eAAe,UAAU;OAC5B,GAAG,qBAAqB,UAAU;KACrC;KAEA,UAAU,GAAG,eAAe,OAAO,GAAG,OAAO,CAAC;KAM9C,MAAM,QAAO,OAJW,MAAM,OAAO,GAAG,OAAO,QAAQ,GACpD,GAAG,eAAe,UAAU,aAC/B,CAAC,EAAA,CAEqB;KAEtB,MAAM,eAAe;MACnB,GAAG,EAAE,aAAa;OAChB,WAAW,QAAQ;OACnB,cAAc,UAAU;OACxB,UAAU,UAAU;MACtB,CAAC;OACA,EAAE,YAAY,QAAQ;OACtB,EAAE,eAAe,UAAU;OAC3B,EAAE,WAAW,UAAU;KAC1B;KAEA,UAAU,EAAE,eAAe,aAAa,EAAE,OAAO,CAAC;KAElD,MAAM,SAAS,OAAO,MAAM,OAAO,EAAE,OAAO,cAAc;OACvD,EAAE,YAAY,QAAQ;OACtB,EAAE,eAAe,UAAU;KAC9B,CAAC;KAED,QAAQ,YAAY,OAAO,CAAC,GAAG,QAAQ,YAAY,MAAM,GAAG,OAAO,IAAI;KACvE,MAAM,eAAe,KACnB,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAC3C,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,YAAY,GACzD,GAAG,eACL,EAAE,IACF,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,QAAQ,GAC9C,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,UAAU,YAAY,GACvD,EAAE,eACJ,EAAE,EACJ;KACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAO,aAAa,QAAQ,WAAW,UAAU,MAAM,KAAK,QAAQ,QAAQ;KAC9E,MAAM,OAAO,OAAO,QAAQ,SAAS,OAAO;KAE5C,MAAM,WAAW,kBAAkB,sBAAsB;MACvD,GAAG,QAAQ;MACX,kBAAkB;MAClB,aAAa,CACX,GAAG,QAAQ,SAAS,aACpB;OAAE,cAAc,UAAU;OAAc,UAAU,UAAU;MAAS,CACvE;KACF,CAAC;KAED,WAAW;MACT,MAAM;MACN,SAAS;MACT,YAAY,kBAAkB,yBAAyB;OACrD,UAAU,EAAE;OACZ;OACA,cAAc,UAAU;OACxB,oBAAoB,UAAU;OAC9B;MACF,CAAC;KACH;IACF;GACF;EACF;EACA,OAAO,aAAa,SAAS,MAAM,SAAS,IAAI;EAEhD,OAAO;CACT,CAAC,CACH;CAEF,MAAM,oBAAoB,SAAc,UAAkB,cAAsB,YAC9E,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,KAAK,QAAQ;EAUnB,MAAM,OAAM,OARS,MAAM,KACzB,GAAG,OACH,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAC/C,EACE,OAAO,EACT,CACF,EAAA,CAEkB,KAAK;EAEvB,IACE,QAAQ,KAAA,KACR,IAAI,GAAG,cAAc,YACrB,CAAC,QAAQ,UAAU,OAAO,IAAI,GAAG,YAAY,QAAQ,QAAQ,KAC7D,CAAC,GAAG,eAAe,IAAI,GAAG,OAAO,GAEjC,OAAO,KAAA;EACT,MAAM,IAAI,QAAQ,UAAU;EAU5B,MAAM,aAAY,OARG,MAAM,KACzB,EAAE,OACF,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,GAAG,YAAY,GACnD,EACE,OAAO,EACT,CACF,EAAA,CAEwB,KAAK;EAE7B,IACE,cAAc,KAAA,KACd,UAAU,EAAE,WAAW,WACvB,CAAC,QAAQ,UAAU,OAAO,UAAU,EAAE,YAAY,QAAQ,QAAQ,GAElE,OAAO,KAAA;EAET,MAAM,WAAW;GACf,UAAU,UAAU,EAAE;GACtB,QAAQ,UAAU,EAAE;GACpB,SAAS,UAAU,EAAE;EACvB;EAEA,WAAW,OAAO,iBAAiB,QAAQ,OAAO,IAAI,GAAG,YAAY;EAMrE,IAJe,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,YAIhC,CAAC,EAAE,aAAa,IAAI,GAAG,uBAC5B,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,GAAG,eAAe,EAAE,EAC1H,IAEA,OAAO,KAAA;EAET,OAAO,kBAAkB,yBAAyB;GACtC;GACV;GACA;GACA,oBAAoB,IAAI,GAAG;GAC3B,UAAU,QAAQ;EACpB,CAAC;CACH,CAAC,CACH;CAEF,MAAM,iBAAiB,SAAc,UAAkB,cACrD,OAAO,QAAQ,0BAA0B,UACvC,MAAM,KACJ,QAAQ,QAAQ,OAChB,MAAM,QAAQ,QAAQ,OAAO;GAC1B,QAAQ,QAAQ,WAAW;GAC3B,QAAQ,QAAQ,YAAY;CAC/B,CAAC,GACD,EAAE,OAAO,EAAE,CACb,CACF;CAEF,MAAM,iBAAiB,SAAc,UACnC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,eAAe,SAAS,MAAM,SAAS;EAE9D,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAErD,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,SAAS,GAC3E,IAAI,QAAQ;EAEd,MAAM,MAAM,QAAQ,KAAK;EAEzB,IAAI,QAAQ,KAAA,GAAW;GACrB,MAAM,SAAS,kBAAkB,OAAO,IAAI,EAAE,eAAe;GAE7D,IACE,OAAO,aAAa,MAAM,YAC1B,OAAO,SAAS,cAAc,MAAM,aACpC,OAAO,iBAAiB,MAAM,gBAC9B,CAAC,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,QAAQ,QAAQ,KAC5D,IAAI,EAAE,kBAAkB,MAAM,cAE9B,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,WAAW,QAAQ,SAAS,UAAU,QAAQ,QAAQ;GAE5D,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;GAC/D,MAAM,eAAe,KAAK,QAAQ;GAElC,OAAO;IAAE,MAAM;IAAU,QAAQ,gBAAgB,OAAO,IAAI,EAAE,SAAS;GAAE;EAC3E;EAEA,MAAM,aAAa,OAAO,iBACxB,SACA,MAAM,UACN,MAAM,cACN,OACF;EAEA,OAAO,eAAe,KAAA,IACjB,EAAE,MAAM,WAAW,IACnB;GAAE,MAAM;GAAU;EAAW;CACpC,CAAC,CACH;CAEF,MAAM,wBAAwB,SAAc,SAAc,YACxD,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,UAAU,QAAQ,YAAY,SAAS,KAAK,QAAQ,YAAY,UAAU,EAAE;EAC5E,MAAM,wBAAQ,IAAI,IAAkC;EAEpD,MAAM,YAAY,IAAI,IACpB,QAAQ,SAAS,YAAY,KAAK,SAAc,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CACpF;EAEA,KAAK,MAAM,cAAc,QAAQ,aAAa;GAC5C,MAAM,WAAW,OAAO,MAAM,KAC5B,WAAW,OACX,KACE,GAAG,IAAI,WAAW,OAAO,WAAW,SAAS,GAAG,QAAQ,QAAQ,GAChE,WAAW,UAAU,QAAQ,QAAQ,CACvC,GACA,EAAE,SAAS,IAAI,WAAW,OAAO,WAAW,YAAY,EAAE,CAC5D;GAEA,KAAK,MAAM,OAAO,SAAS,MAAM;IAC/B,MAAM,OAAO,WAAW,OAAO,UAAU,GAAG,CAAC;IAE7C,IAAI,SAAS,KAAA,KAAa,KAAK,iBAAiB,SAAS;IACzD,UACE,KAAK,iBAAiB,IAAI,WAAW,iBACnC,KAAK,aAAa,IAAI,WAAW,aACjC,UAAU,IAAI,KAAK,YAAY,MAAM,KAAK,YAC1C,KAAK,QAAQ,UAAU,KACvB,KAAK,QAAQ,OAAO,WAClB;KAAC;KAAa;KAAc;IAAW,CAAC,CAAC,SAAS,MAAM,CAC1D,CACJ;IACA,UACE,OAAO,KAAK,kBAAkB,aAC5B,OAAO,KAAK,iBAAiB,aAC7B,OAAO,KAAK,sBAAsB,SACtC;IAEA,MAAM,aAAa;KACjB,cAAc,KAAK;KACnB,UAAU,KAAK;KACf,eAAe,KAAK;KACpB,SAAS,CAAC,GAAG,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK;KACzC,cAAc,KAAK;KACnB,mBAAmB,KAAK;IAC1B;IAEA,MAAM,QAAQ,MAAM,IAAI,KAAK,YAAY;IAGzC,UAAU,UAAU,KAAA,KAAa,KAAK,UAAU,KAAK,MAAM,KAAK,UAAU,UAAU,CAAC;IACrF,MAAM,IAAI,KAAK,cAAc,UAAU;GACzC;EACF;EACA,MAAM,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC;EAEpC,MAAM,cAAc,kBAClB,2BACA,QAAQ,QAAQ,gCAAgC,UAAU,QAAQ,GAAG,CAAC,CACxE;EAEA,OAAO,UAAU,MAAM,SAAS,KAAK,aAAa,KAAK,UAAU,WAAW,WAAW;CACzF,CAAC,CACH;CAEF,MAAM,UAAU,SAAc,UAC5B,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,kBAAkB,yBAAyB,MAAM,UAAU;EAE5E,UAAU,SAAS,aAAa,MAAM,QAAQ;EAC9C,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS,SAAS,SAAS;EAE1E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAErD,MAAM,SACJ,QAAQ,4BAA4B,CAAC;EAEvC,UAAU,OAAO,UAAU,EAAE;EAC7B,IAAI,oBAAoB,QAAQ,uBAAuB,KAAA,KAAa,OAAO,SAAS;EAEpF,IAAI,QAAQ,uBAAuB,KAAA,GACjC,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,YAAY,MAAM,UAAU;IAChC,UAAU,kBACR,wBAAwB,OAAO,UAC/B,SAAS,QACX;IACA,aAAa,OAAO,iBAAiB,SAAS,QAAQ;IACtD,WAAW,UAAU,EAAE,OAAO,QAAQ,SAAS,CAAC,CAAC,CAAC;GACpD,CAAC;GAQD,KAAI,OANgB,MAAM,KACxB,MAAM,OACN,OAAO,SAAS,SAAS,IAAI,OAAO,YAAY,WAChD,EAAE,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO,EAAE,CAC7C,EAAA,CAES,KAAK,WAAW,GAAG,oBAAoB;EAClD;EAEF,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,SAAS,GAC3E,IAAI,QAAQ;EAEd,MAAM,WAAW,QAAQ,KAAK;EAE9B,IAAI,aAAa,KAAA,GAAW;GAC1B,IACE,SAAS,EAAE,oBAAoB,kBAAkB,OAAO,QAAQ,KAChE,SAAS,EAAE,kBAAkB,SAAS,gBACtC,CAAC,QAAQ,UAAU,OAAO,SAAS,EAAE,YAAY,QAAQ,QAAQ,GAEjE,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,WAAW,QAAQ,SAAS,UAAU,QAAQ,QAAQ;GAE5D,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;GAC/D,MAAM,eAAe,KAAK,QAAQ;GAElC,OAAO;IACL,MAAM;IACN,UAAU;IACV,QAAQ,gBAAgB,OAAO,SAAS,EAAE,SAAS;GACrD;EACF;EAEA,MAAM,SAAS,OAAO,iBACpB,SACA,MAAM,UACN,SAAS,cACT,OACF;EAEA,IACE,WAAW,KAAA,KACX,kBAAkB,OAAO,MAAM,MAAM,kBAAkB,OAAO,QAAQ,GAEtE,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;EAE5E,IACE,KAAK,UAAU,aAAa,MAAM,YAClC,EAAE,OAAO,cACP,SACA,SACA,MACA,UACA,MAAM,WACN,MAAM,WACN,kBAAkB,OAAO,QAAQ,GACjC,KAAK,YAAY,gBACnB,IAEA,OAAO,EAAE,MAAM,WAAW;EAC5B,IAAI,EAAE,OAAO,qBAAqB,SAAS,SAAS,SAAS,YAAY,IACvE,OAAO,EAAE,MAAM,mBAAmB;EAEpC,MAAM,eAAe,kBAAkB,SAAS,MAAM,YAAY,GAChE,KAAK,QAAQ,YACb,IAAI,QAAQ;EAEd,MAAM,MAAM,OAAO,iBAAiB,SAAS,QAAQ,GACnD,IAAI,QAAQ,UAAU;EAExB,MAAM,YAAY,QAAQ,qBAAqB;GAC7C,aAAa;GACb,WAAW,UAAU,EAAE,OAAO,QAAQ,SAAS,CAAC,CAAC,CAAC;EACpD,CAAC;EAED,MAAM,SACJ,cAAc,KAAA,MAAc,CAAC,sBAAsB,OAAO,MAAM,MAAM,SAAS;EAEjF,IAAI,cAAc,KAAA,KAAa,mBAC7B,MAAM,eAAe,KAAK,SAAS,YAAY,GAAG,QAAQ,UAAU,EAAE;EACxE,OAAO,MAAM,OAAO,GAAG,OAAO,GAAG,GAAG,eAAe,SAAS,aAAa,CAAC;EAC1E,OAAO,MAAM,OAAO,EAAE,OAAO;IAC1B,EAAE,YAAY,QAAQ;IACtB,EAAE,eAAe,SAAS;EAC7B,CAAC;EACD,IAAI,CAAC,QAAQ;GACX,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,IAAI,GACvB;KACG,EAAE,QAAQ;KACV,EAAE,YAAY;KACd,EAAE,cAAc;KAChB,EAAE,UAAU,MAAM;GACrB,CACF;GACA,IAAI,QAAQ,UAAU,SAAS,YAC7B,OAAO,MAAM,OAAO,QAAQ,UAAU,SAAS,OAAO,GACnD,QAAQ,UAAU,SAAS,cAAc,IAC5C,CAAC;EACL;EACA,OAAO,QAAQ,SAAS,SAAS,SAAS,YAAY;EAEtD,MAAM,SAAS,kBAAkB,eAAe;GAC9C,MAAM;GACN,cAAc,SAAS;GACvB;EACF,CAAC;EAED,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,UACE,OAAO,cAAc,MAAM,oBAAoB,KAC7C,MAAM,uBAAuB,OAC7B,MAAM,wBAAwB,MAAM,YAAY,IACpD;EACA,MAAM,aAAa;IAAG,EAAE,WAAW,MAAM;IAAW,EAAE,YAAY,MAAM;EAAU;EAElF,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAChB,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,YAAY,kBAAkB,yBAAyB,QAAQ;GACjE,CAAC;GACD,GAAG;IACF,EAAE,YAAY,QAAQ;IACtB,EAAE,eAAe,SAAS;IAC1B,EAAE,iBAAiB,kBAAkB,OAAO,QAAQ;IACpD,EAAE,WAAW,gBAAgB,OAAO,MAAM;IAC1C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;EAC5E;EAIA,QAAQ,QAAO,OAFS,MAAM,OAAO,EAAE,OAAO,QAAQ,UAAU,EAAA,CAExC;EAExB,OAAO;GAAE,MAAM;GAAY;GAAQ,UAAU;EAAM;CACrD,CAAC,CACH;CAEF,OAAO;EAAE;EAAgB;EAAW;EAAe;EAAW;EAAY;EAAe;CAAO;AAClG,CAAC;AAED,IAAa,gBAAb,MAAa,sBAAsB,QAAQ,QAAoD,CAAC,CAC9F,uCACF,CAAC,CAAC;CACA,OAAgB,QAAQ,MAAM,OAAO,eAAeA,MAAI;AAC1D"}
1	+ {"version":3,"file":"accounts.mjs","names":["make"],"sources":["../../../src/internal/oauth/accounts.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- compiler table shapes are erased; domain codecs and error channels remain typed. /\nimport {\n OAuthAccountRevision,\n OAuthActionAuthorization,\n OAuthLinkAccess,\n OAuthLinkClaim,\n OAuthLinkPendingFlow,\n OAuthLinkTransactionContext,\n OAuthUnlinked,\n OAuthCredentialSnapshot,\n snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport {\n SessionInvalidationWindow,\n AuthenticationRequirement,\n SecurityRevision,\n} from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Context, Layer } from \"effect\";\n\nimport type { SubjectIdCodec } from \"../models/common\";\nimport type { OAuthReferenceGuardDescriptor, OAuthEligibilityFact } from \"../models/oauth-model\";\nimport { OAuthFlow } from \"./flow\";\nimport { CurrentOAuthTransaction } from \"./owner\";\nimport { OAuthQueryCompiler } from \"./query-compiler\";\nimport { OAuthRegistration } from \"./registration\";\nimport {\n invariant,\n oauthIdentityKey,\n sameRevision,\n satisfies,\n storage,\n validAction,\n} from \"./state\";\n\nconst make = Effect.gen(function () {\n const operations = yield* OAuthQueryCompiler;\n const flow = yield* OAuthFlow;\n const registration = yield* OAuthRegistration;\n\n const { eq, sql } = operations;\n\n const {\n claimFlow,\n credentialStorage,\n currentSubject,\n exactClaim,\n issueFlow,\n linkStorage,\n matchesAccess,\n readFlow,\n terminalFlow,\n } = flow;\n\n const { both, col, copiedRow, equal } = operations;\n const { acquireTuple, readTuple } = registration;\n\n const contextStorage = storage(OAuthLinkTransactionContext);\n\n const unlinkedStorage = storage(OAuthUnlinked);\n\n const accountCurrent = (mapping: any, subjectId: OAuthAccountRevision[\"subjectId\"]) =>\n Effect.gen(function* () {\n const native = yield* (mapping.subjectId as SubjectIdCodec<unknown>).toNative(subjectId);\n\n return yield* currentSubject(mapping, native);\n });\n\n const authorization = (\n mapping: any,\n current: any,\n auth: OAuthActionAuthorization,\n action: OAuthActionAuthorization[\"challenge\"][\"action\"],\n flowId: string,\n commandId: string,\n intent: string,\n maximumAge: number,\n ) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n Effect.gen(function* () {\n const now = yield* owner.now(mapping.clock);\n\n const currentRequirement = snapshotOAuthSync(\n AuthenticationRequirement,\n mapping.subject.decodeActionRequirement(copiedRow(current.row), action),\n );\n\n const accepted = yield* validAction(\n auth,\n {\n moduleId: auth.challenge.moduleId,\n action,\n flowId,\n commandId,\n revision: current.revision,\n intent,\n },\n currentRequirement,\n now,\n maximumAge,\n );\n\n if (!accepted) return false;\n\n const age = Math.min(\n maximumAge,\n auth.requirement.maximumAgeMillis,\n currentRequirement.maximumAgeMillis,\n );\n\n const fresh = auth.evidence.proofs.filter(\n (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n );\n\n invariant(fresh.length > 0);\n\n const deadline = Math.min(\n ...fresh.map((proof) => DateTime.toEpochMillis(proof.verifiedAt) + age),\n );\n\n owner.postconditions.push(\n sql`${mapping.clock.engineNowMillis} >= ${now} and ${mapping.clock.engineNowMillis} < ${deadline}`,\n );\n\n return true;\n }),\n );\n\n const currentLink = (mapping: any, flow: typeof OAuthLinkPendingFlow.Type) =>\n Effect.gen(function* () {\n const current = yield* accountCurrent(mapping, flow.context.revision.subjectId);\n\n return current !== undefined && sameRevision(current.revision, flow.context.revision)\n ? current\n : undefined;\n });\n\n const issueLink = (mapping: any, input: any) =>\n Effect.gen(function* () {\n const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow),\n c = flow.context;\n\n const current = yield* currentLink(mapping, flow);\n const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n if (\n current === undefined \|\|\n auth.challenge.moduleId !== c.moduleId \|\|\n !(yield* authorization(\n mapping,\n current,\n auth,\n \"link-begin\",\n c.flowId,\n c.commandId,\n contextStorage.encode(c),\n c.maximumEvidenceAgeMillis,\n ))\n )\n return { _tag: \"Rejected\" } as const;\n\n return yield* issueFlow(mapping, flow, \"link\");\n });\n\n const preflightLink = (mapping: any, original: typeof OAuthLinkAccess.Type) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n Effect.gen(function* () {\n const input = snapshotOAuthSync(OAuthLinkAccess, original);\n // The authenticated subject is known before discovering/locking any flow.\n const current = yield* accountCurrent(mapping, input.subjectId);\n const found = yield* readFlow(mapping, input, \"link\");\n const now = yield* owner.now(mapping.clock);\n\n if (\n current === undefined \|\|\n found.flow === undefined \|\|\n found.row?.[mapping.flow.state] !== \"Pending\" \|\|\n !matchesAccess(found.flow, input)\n )\n return undefined;\n\n const flow = snapshotOAuthSync(OAuthLinkPendingFlow, found.flow as never),\n c = flow.context;\n\n if (\n c.revision.subjectId !== input.subjectId \|\|\n !sameRevision(current.revision, c.revision) \|\|\n now < c.issuedAtMillis \|\|\n now >= c.expiresAtMillis\n )\n return undefined;\n owner.postconditions.push(\n sql`${mapping.clock.engineNowMillis} >= ${c.issuedAtMillis} and ${mapping.clock.engineNowMillis} < ${c.expiresAtMillis}`,\n );\n\n return { current, flow, row: found.row };\n }),\n );\n\n const claimLink = (mapping: any, input: any) =>\n Effect.gen(function* () {\n const found = yield* preflightLink(mapping, input.access);\n const flow = snapshotOAuthSync(OAuthLinkPendingFlow, input.flow);\n\n const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization),\n c = flow.context;\n\n if (\n found === undefined \|\|\n linkStorage.encode(found.flow) !== linkStorage.encode(flow) \|\|\n auth.challenge.moduleId !== c.moduleId \|\|\n !(yield* authorization(\n mapping,\n found.current,\n auth,\n \"link-complete\",\n c.flowId,\n c.commandId,\n contextStorage.encode(c),\n c.maximumEvidenceAgeMillis,\n ))\n )\n return { _tag: \"Rejected\" } as const;\n const claim = yield* claimFlow(mapping, { row: found.row!, flow }, input.claimId);\n\n return claim === undefined\n ? ({ _tag: \"Rejected\" } as const)\n : ({ _tag: \"Claimed\", claim } as const);\n });\n\n const checkInvalidation = (mapping: any, original: SessionInvalidationWindow) => {\n const value = snapshotOAuthSync(SessionInvalidationWindow, original);\n\n invariant(\n value.trigger === \"credential-change\" &&\n value.oldAuthenticationEvidence === \"rejected\" &&\n (mapping.sessionInvalidation === \"same-authority-immediate\"\n ? (value.existingSessions === \"immediate\" && value.maximumExposureMillis === 0) \|\|\n (value.existingSessions === \"cache-expiry\" && value.maximumExposureMillis > 0)\n : value.existingSessions === \"original-absolute-expiry\"),\n );\n\n return value;\n };\n\n const advance = (mapping: any, current: any, removed?: string) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n Effect.gen(function* () {\n const revision = mapping.subject.nextSecurityRevision(current.revision.securityRevision);\n\n invariant(\n typeof revision === \"string\" &&\n revision.length > 0 &&\n revision.length <= 256 &&\n revision !== current.revision.securityRevision,\n );\n const subject = mapping.subject;\n\n yield* owner.update(\n subject.table,\n { [subject.id]: current.nativeId },\n { [subject.securityRevision]: revision },\n );\n for (const cleanup of mapping.cleanup) {\n const condition = both(\n eq(col(cleanup.table, cleanup.subjectId), current.nativeId),\n cleanup.condition({\n subjectId: current.nativeId,\n revision: snapshotOAuthSync(OAuthAccountRevision, current.revision),\n ...(removed === undefined ? {} : { removedCredentialId: removed }),\n }),\n );\n\n yield* owner.write(owner.database.delete(cleanup.table).where(condition));\n owner.postconditions.push(\n sql`not exists(select 1 from ${cleanup.table} where ${condition})`,\n );\n }\n\n return SecurityRevision.make(revision);\n }),\n );\n\n const settleLink = (\n mapping: any,\n input: any,\n allocated: { readonly credentialId: string; readonly revision: SecurityRevision },\n ) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n Effect.gen(function* () {\n const claim = snapshotOAuthSync(OAuthLinkClaim, input.claim),\n flow = claim.flow,\n c = flow.context;\n\n const current = yield* currentLink(mapping, flow);\n\n // Known subject is always locked before tuple/flow; even a rejected outcome\n // settles its exact original claim without adopting a newer revision.\n const identity =\n input.outcome._tag === \"Verified\" ? input.outcome.identity.identity : undefined;\n\n if (identity !== undefined)\n invariant(identity.provider === c.provider && identity.issuer === c.issuer);\n\n const tuple =\n identity !== undefined && current !== undefined\n ? yield* readTuple(mapping.ownership, identity)\n : undefined;\n\n const exact = yield* exactClaim(mapping, claim, \"link\");\n\n if (exact === undefined) return { _tag: \"Rejected\" } as const;\n let decision: any = { _tag: input.outcome._tag };\n\n if (input.outcome._tag === \"Verified\") {\n decision = { _tag: \"Rejected\" };\n const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n if (\n current !== undefined &&\n tuple !== undefined &&\n auth.challenge.moduleId === c.moduleId &&\n (yield* authorization(\n mapping,\n current,\n auth,\n \"link-complete\",\n c.flowId,\n c.commandId,\n contextStorage.encode(c),\n c.maximumEvidenceAgeMillis,\n ))\n ) {\n const t = mapping.ownership.tuple,\n cr = mapping.credential,\n a = mapping.authority;\n\n const login = yield* owner.read(\n cr.table,\n eq(col(cr.table, cr.identityKey), tuple.key),\n {\n limit: 1,\n },\n );\n\n const previous = login.rows[0];\n\n if (\n tuple.row[t.state] === \"Reserved\" \|\|\n (tuple.row[t.state] === \"Owned\" &&\n !mapping.subjectId.equals(tuple.row[t.subjectId], current.nativeId)) \|\|\n (previous !== undefined &&\n (previous[cr.moduleId] !== c.moduleId \|\|\n !mapping.subjectId.equals(previous[cr.subjectId], current.nativeId) \|\|\n !cr.isActiveStatus(previous[cr.status])))\n )\n decision = { _tag: \"Conflict\" };\n else if (previous !== undefined) {\n const shared = current.revision.credentials.find(\n (item: any) => item.credentialId === previous[cr.credentialId],\n );\n\n if (\n tuple.row[t.state] !== \"Owned\" \|\|\n shared?.revision !== previous[cr.credentialRevision] \|\|\n !(yield* owner.check(\n sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.identityKey), tuple.key), cr.activeCondition)})`,\n ))\n )\n decision = { _tag: \"Conflict\" };\n else\n decision = {\n _tag: \"Linked\",\n changed: false,\n credential: snapshotOAuthSync(OAuthCredentialSnapshot, {\n moduleId: c.moduleId,\n identity,\n credentialId: previous[cr.credentialId],\n credentialRevision: previous[cr.credentialRevision],\n revision: current.revision,\n }),\n };\n } else {\n checkInvalidation(mapping, input.invalidation);\n\n const values = {\n ...cr.encodeInsert({\n moduleId: c.moduleId,\n subjectId: current.nativeId,\n identityKey: tuple.key,\n credentialId: allocated.credentialId,\n credentialRevision: allocated.revision,\n }),\n [cr.moduleId]: c.moduleId,\n [cr.subjectId]: current.nativeId,\n [cr.identityKey]: tuple.key,\n [cr.credentialId]: allocated.credentialId,\n [cr.credentialRevision]: allocated.revision,\n };\n\n invariant(cr.isActiveStatus(values[cr.status]));\n\n const inserted = yield* owner.insert(cr.table, values, {\n [cr.credentialId]: allocated.credentialId,\n });\n\n login.rows = inserted.rows;\n\n const sharedValues = {\n ...a.encodeInsert({\n subjectId: current.nativeId,\n credentialId: allocated.credentialId,\n revision: allocated.revision,\n }),\n [a.subjectId]: current.nativeId,\n [a.credentialId]: allocated.credentialId,\n [a.revision]: allocated.revision,\n };\n\n invariant(a.isActiveStatus(sharedValues[a.status]));\n\n const shared = yield* owner.insert(a.table, sharedValues, {\n [a.subjectId]: current.nativeId,\n [a.credentialId]: allocated.credentialId,\n });\n\n current.authorities.rows = [...current.authorities.rows, ...shared.rows];\n owner.postconditions.push(\n sql`exists(select 1 from ${cr.table} where ${both(\n eq(col(cr.table, cr.credentialId), allocated.credentialId),\n cr.activeCondition,\n )})`,\n sql`exists(select 1 from ${a.table} where ${both(\n eq(col(a.table, a.subjectId), current.nativeId),\n eq(col(a.table, a.credentialId), allocated.credentialId),\n a.activeCondition,\n )})`,\n );\n if (tuple.row[t.state] === \"Unowned\")\n yield* acquireTuple(mapping.ownership, identity, tuple.key, current.nativeId);\n const next = yield* advance(mapping, current);\n\n const revision = snapshotOAuthSync(OAuthAccountRevision, {\n ...current.revision,\n securityRevision: next,\n credentials: [\n ...current.revision.credentials,\n { credentialId: allocated.credentialId, revision: allocated.revision },\n ],\n });\n\n decision = {\n _tag: \"Linked\",\n changed: true,\n credential: snapshotOAuthSync(OAuthCredentialSnapshot, {\n moduleId: c.moduleId,\n identity,\n credentialId: allocated.credentialId,\n credentialRevision: allocated.revision as never,\n revision,\n }),\n };\n }\n }\n }\n yield* terminalFlow(mapping, flow, decision._tag);\n\n return decision;\n }),\n );\n\n const targetCredential = (mapping: any, moduleId: string, credentialId: string, current: any) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n Effect.gen(function* () {\n const cr = mapping.credential;\n\n const found = yield* owner.read(\n cr.table,\n eq(col(cr.table, cr.credentialId), credentialId),\n {\n limit: 1,\n },\n );\n\n const row = found.rows[0];\n\n if (\n row === undefined \|\|\n row[cr.moduleId] !== moduleId \|\|\n !mapping.subjectId.equals(row[cr.subjectId], current.nativeId) \|\|\n !cr.isActiveStatus(row[cr.status])\n )\n return undefined;\n const t = mapping.ownership.tuple;\n\n const tuple = yield* owner.read(\n t.table,\n eq(col(t.table, t.identityKey), row[cr.identityKey]),\n {\n limit: 1,\n },\n );\n\n const ownership = tuple.rows[0];\n\n if (\n ownership === undefined \|\|\n ownership[t.state] !== \"Owned\" \|\|\n !mapping.subjectId.equals(ownership[t.subjectId], current.nativeId)\n )\n return undefined;\n\n const identity = {\n provider: ownership[t.provider],\n issuer: ownership[t.issuer],\n subject: ownership[t.externalSubject],\n };\n\n invariant((yield* oauthIdentityKey(identity)) === row[cr.identityKey]);\n\n const shared = current.revision.credentials.find(\n (item: any) => item.credentialId === credentialId,\n );\n\n if (\n shared?.revision !== row[cr.credentialRevision] \|\|\n !(yield* owner.check(\n sql`exists(select 1 from ${cr.table} where ${both(eq(col(cr.table, cr.credentialId), credentialId), cr.activeCondition)})`,\n ))\n )\n return undefined;\n\n return snapshotOAuthSync(OAuthCredentialSnapshot, {\n moduleId: moduleId as never,\n identity,\n credentialId,\n credentialRevision: row[cr.credentialRevision],\n revision: current.revision,\n });\n }),\n );\n\n const unlinkCommand = (mapping: any, moduleId: string, commandId: string) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n owner.read(\n mapping.command.table,\n equal(mapping.command.table, {\n [mapping.command.moduleId]: moduleId,\n [mapping.command.commandId]: commandId,\n }),\n { limit: 1 },\n ),\n );\n\n const inspectUnlink = (mapping: any, input: any) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n Effect.gen(function* () {\n const current = yield* accountCurrent(mapping, input.subjectId);\n\n if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),\n r = mapping.command;\n\n const old = command.rows[0];\n\n if (old !== undefined) {\n const intent = credentialStorage.decode(old[r.intentSnapshot]);\n\n if (\n intent.moduleId !== input.moduleId \|\|\n intent.revision.subjectId !== input.subjectId \|\|\n intent.credentialId !== input.credentialId \|\|\n !mapping.subjectId.equals(old[r.subjectId], current.nativeId) \|\|\n old[r.credentialId] !== input.credentialId\n )\n return { _tag: \"Conflict\" } as const;\n const metadata = mapping.metadata.condition(current.nativeId);\n\n if (!(yield* owner.check(metadata))) return { _tag: \"Rejected\" } as const;\n owner.postconditions.push(metadata);\n\n return { _tag: \"Replay\", result: unlinkedStorage.decode(old[r.decision]) } as const;\n }\n\n const credential = yield* targetCredential(\n mapping,\n input.moduleId,\n input.credentialId,\n current,\n );\n\n return credential === undefined\n ? ({ _tag: \"Rejected\" } as const)\n : ({ _tag: \"Target\", credential } as const);\n }),\n );\n\n const remainingEligibility = (mapping: any, current: any, removed: string) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n Effect.gen(function* () {\n invariant(mapping.eligibility.length > 0 && mapping.eligibility.length <= 32);\n const facts = new Map<string, OAuthEligibilityFact>();\n\n const revisions = new Map(\n current.revision.credentials.map((item: any) => [item.credentialId, item.revision]),\n );\n\n for (const descriptor of mapping.eligibility) {\n const observed = yield* owner.read(\n descriptor.table,\n both(\n eq(col(descriptor.table, descriptor.subjectId), current.nativeId),\n descriptor.condition(current.nativeId),\n ),\n { orderBy: col(descriptor.table, descriptor.credentialId) },\n );\n\n for (const row of observed.rows) {\n const fact = descriptor.decode(copiedRow(row)) as OAuthEligibilityFact \| undefined;\n\n if (fact === undefined \|\| fact.credentialId === removed) continue;\n invariant(\n fact.credentialId === row[descriptor.credentialId] &&\n fact.revision === row[descriptor.revision] &&\n revisions.get(fact.credentialId) === fact.revision &&\n fact.factors.length <= 8 &&\n fact.factors.every((factor) =>\n [\"knowledge\", \"possession\", \"inherence\"].includes(factor),\n ),\n );\n invariant(\n typeof fact.usablePrimary === \"boolean\" &&\n typeof fact.userVerified === \"boolean\" &&\n typeof fact.phishingResistant === \"boolean\",\n );\n\n const normalized = {\n credentialId: fact.credentialId,\n revision: fact.revision,\n usablePrimary: fact.usablePrimary,\n factors: [...new Set(fact.factors)].sort(),\n userVerified: fact.userVerified,\n phishingResistant: fact.phishingResistant,\n };\n\n const prior = facts.get(fact.credentialId);\n\n // oxlint-disable-next-line no-restricted-properties -- Canonical bounded eligibility fact fingerprint rejects contradictory duplicate IDs.\n invariant(prior === undefined \|\| JSON.stringify(prior) === JSON.stringify(normalized));\n facts.set(fact.credentialId, normalized);\n }\n }\n const available = [...facts.values()];\n\n const requirement = snapshotOAuthSync(\n AuthenticationRequirement,\n mapping.subject.decodeAuthenticationRequirement(copiedRow(current.row)),\n );\n\n return available.some((fact) => fact.usablePrimary) && satisfies(available, requirement);\n }),\n );\n\n const unlink = (mapping: any, input: any) =>\n Effect.flatMap(CurrentOAuthTransaction, (owner) =>\n Effect.gen(function* () {\n const expected = snapshotOAuthSync(OAuthCredentialSnapshot, input.credential);\n\n invariant(expected.moduleId === input.moduleId);\n const current = yield* accountCurrent(mapping, expected.revision.subjectId);\n\n if (current === undefined) return { _tag: \"Rejected\" } as const;\n\n const guards: ReadonlyArray<OAuthReferenceGuardDescriptor<unknown>> =\n mapping.connectedReferenceGuards ?? [];\n\n invariant(guards.length <= 32);\n let referencesGuarded = mapping.connectedReference !== undefined && guards.length > 0;\n\n if (mapping.connectedReference !== undefined)\n for (const guard of guards) {\n const condition = guard.condition({\n identity: snapshotOAuthSync(\n OAuthCredentialSnapshot.fields.identity,\n expected.identity,\n ),\n identityKey: yield* oauthIdentityKey(expected.identity),\n subjectId: copiedRow({ value: current.nativeId }).value,\n });\n\n const read = yield* owner.read(\n guard.table,\n Effect.isEffect(condition) ? yield* condition : condition,\n { orderBy: col(guard.table, guard.orderBy) },\n );\n\n if (read.rows.length === 0) referencesGuarded = false;\n }\n\n const command = yield* unlinkCommand(mapping, input.moduleId, input.commandId),\n r = mapping.command;\n\n const previous = command.rows[0];\n\n if (previous !== undefined) {\n if (\n previous[r.intentSnapshot] !== credentialStorage.encode(expected) \|\|\n previous[r.credentialId] !== expected.credentialId \|\|\n !mapping.subjectId.equals(previous[r.subjectId], current.nativeId)\n )\n return { _tag: \"Conflict\" } as const;\n const metadata = mapping.metadata.condition(current.nativeId);\n\n if (!(yield* owner.check(metadata))) return { _tag: \"Rejected\" } as const;\n owner.postconditions.push(metadata);\n\n return {\n _tag: \"Unlinked\",\n replayed: true,\n result: unlinkedStorage.decode(previous[r.decision]),\n } as const;\n }\n\n const actual = yield* targetCredential(\n mapping,\n input.moduleId,\n expected.credentialId,\n current,\n );\n\n if (\n actual === undefined \|\|\n credentialStorage.encode(actual) !== credentialStorage.encode(expected)\n )\n return { _tag: \"Rejected\" } as const;\n const auth = snapshotOAuthSync(OAuthActionAuthorization, input.authorization);\n\n if (\n auth.challenge.moduleId !== input.moduleId \|\|\n !(yield* authorization(\n mapping,\n current,\n auth,\n \"unlink\",\n input.commandId,\n input.commandId,\n credentialStorage.encode(expected),\n auth.requirement.maximumAgeMillis,\n ))\n )\n return { _tag: \"Rejected\" } as const;\n if (!(yield* remainingEligibility(mapping, current, expected.credentialId)))\n return { _tag: \"LastSignInMethod\" } as const;\n\n const invalidation = checkInvalidation(mapping, input.invalidation),\n cr = mapping.credential,\n a = mapping.authority;\n\n const key = yield* oauthIdentityKey(expected.identity),\n t = mapping.ownership.tuple;\n\n const connected = mapping.connectedReference?.({\n identityKey: key,\n subjectId: copiedRow({ value: current.nativeId }).value,\n });\n\n const retain =\n connected !== undefined && (!referencesGuarded \|\| (yield* owner.check(connected)));\n\n if (connected !== undefined && referencesGuarded)\n owner.postconditions.push(retain ? connected : sql`not (${connected})`);\n yield* owner.remove(cr.table, { [cr.credentialId]: expected.credentialId });\n yield* owner.remove(a.table, {\n [a.subjectId]: current.nativeId,\n [a.credentialId]: expected.credentialId,\n });\n if (!retain) {\n yield* owner.update(\n t.table,\n { [t.identityKey]: key },\n {\n [t.state]: \"Unowned\",\n [t.subjectId]: null,\n [t.reservation]: null,\n [t.version]: owner.marker,\n },\n );\n if (mapping.ownership.mode === \"separate\")\n yield* owner.remove(mapping.ownership.external.table, {\n [mapping.ownership.external.identityKey]: key,\n });\n }\n yield* advance(mapping, current, expected.credentialId);\n\n const result = snapshotOAuthSync(OAuthUnlinked, {\n _tag: \"Unlinked\",\n credentialId: expected.credentialId,\n invalidation,\n });\n\n const now = yield* owner.now(mapping.clock);\n\n invariant(\n Number.isSafeInteger(input.retentionUntilMillis) &&\n input.retentionUntilMillis > now &&\n input.retentionUntilMillis >= input.nowMillis + 120000,\n );\n const commandKey = { [r.moduleId]: input.moduleId, [r.commandId]: input.commandId };\n\n const values = {\n ...r.encodeInsert({\n moduleId: input.moduleId,\n commandId: input.commandId,\n credential: snapshotOAuthSync(OAuthCredentialSnapshot, expected),\n }),\n ...commandKey,\n [r.subjectId]: current.nativeId,\n [r.credentialId]: expected.credentialId,\n [r.intentSnapshot]: credentialStorage.encode(expected),\n [r.decision]: unlinkedStorage.encode(result),\n [r.retentionUntil]: mapping.clock.encodeInstant(input.retentionUntilMillis),\n };\n\n const inserted = yield* owner.insert(r.table, values, commandKey);\n\n command.rows = inserted.rows;\n\n return { _tag: \"Unlinked\", result, replayed: false } as const;\n }),\n );\n\n return { accountCurrent, issueLink, preflightLink, claimLink, settleLink, inspectUnlink, unlink };\n});\n\nexport class OAuthAccounts extends Context.Service<OAuthAccounts, Effect.Success<typeof make>>()(\n \"effect-auth/persistence/OAuthAccounts\",\n) {\n static readonly layer = Layer.effect(OAuthAccounts, make);\n}\n"],"mappings":";;;;;;;;;AAkCA,MAAMA,SAAO,OAAO,IAAI,aAAa;CACnC,MAAM,aAAa,OAAO;CAC1B,MAAM,OAAO,OAAO;CACpB,MAAM,eAAe,OAAO;CAE5B,MAAM,EAAE,IAAI,QAAQ;CAEpB,MAAM,EACJ,WACA,mBACA,gBACA,YACA,WACA,aACA,eACA,UACA,iBACE;CAEJ,MAAM,EAAE,MAAM,KAAK,WAAW,UAAU;CACxC,MAAM,EAAE,cAAc,cAAc;CAEpC,MAAM,iBAAiB,QAAQ,2BAA2B;CAE1D,MAAM,kBAAkB,QAAQ,aAAa;CAE7C,MAAM,kBAAkB,SAAc,cACpC,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAQ,QAAQ,UAAsC,SAAS,SAAS;EAEvF,OAAO,OAAO,eAAe,SAAS,MAAM;CAC9C,CAAC;CAEH,MAAM,iBACJ,SACA,SACA,MACA,QACA,QACA,WACA,QACA,eAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,MAAM,qBAAqB,kBACzB,2BACA,QAAQ,QAAQ,wBAAwB,UAAU,QAAQ,GAAG,GAAG,MAAM,CACxE;EAiBA,IAAI,EAAC,OAfmB,YACtB,MACA;GACE,UAAU,KAAK,UAAU;GACzB;GACA;GACA;GACA,UAAU,QAAQ;GAClB;EACF,GACA,oBACA,KACA,UACF,IAEe,OAAO;EAEtB,MAAM,MAAM,KAAK,IACf,YACA,KAAK,YAAY,kBACjB,mBAAmB,gBACrB;EAEA,MAAM,QAAQ,KAAK,SAAS,OAAO,QAChC,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;EAEA,UAAU,MAAM,SAAS,CAAC;EAE1B,MAAM,WAAW,KAAK,IACpB,GAAG,MAAM,KAAK,UAAU,SAAS,cAAc,MAAM,UAAU,IAAI,GAAG,CACxE;EAEA,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,IAAI,OAAO,QAAQ,MAAM,gBAAgB,KAAK,UAC1F;EAEA,OAAO;CACT,CAAC,CACH;CAEF,MAAM,eAAe,SAAc,SACjC,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,eAAe,SAAS,KAAK,QAAQ,SAAS,SAAS;EAE9E,OAAO,YAAY,KAAA,KAAa,aAAa,QAAQ,UAAU,KAAK,QAAQ,QAAQ,IAChF,UACA,KAAA;CACN,CAAC;CAEH,MAAM,aAAa,SAAc,UAC/B,OAAO,IAAI,aAAa;EACtB,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAI,GAC7D,IAAI,KAAK;EAEX,MAAM,UAAU,OAAO,YAAY,SAAS,IAAI;EAChD,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;EAE5E,IACE,YAAY,KAAA,KACZ,KAAK,UAAU,aAAa,EAAE,YAC9B,EAAE,OAAO,cACP,SACA,SACA,MACA,cACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IAEA,OAAO,EAAE,MAAM,WAAW;EAE5B,OAAO,OAAO,UAAU,SAAS,MAAM,MAAM;CAC/C,CAAC;CAEH,MAAM,iBAAiB,SAAc,aACnC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,iBAAiB,QAAQ;EAEzD,MAAM,UAAU,OAAO,eAAe,SAAS,MAAM,SAAS;EAC9D,MAAM,QAAQ,OAAO,SAAS,SAAS,OAAO,MAAM;EACpD,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,IACE,YAAY,KAAA,KACZ,MAAM,SAAS,KAAA,KACf,MAAM,MAAM,QAAQ,KAAK,WAAW,aACpC,CAAC,cAAc,MAAM,MAAM,KAAK,GAEhC,OAAO,KAAA;EAET,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAa,GACtE,IAAI,KAAK;EAEX,IACE,EAAE,SAAS,cAAc,MAAM,aAC/B,CAAC,aAAa,QAAQ,UAAU,EAAE,QAAQ,KAC1C,MAAM,EAAE,kBACR,OAAO,EAAE,iBAET,OAAO,KAAA;EACT,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,EAAE,eAAe,OAAO,QAAQ,MAAM,gBAAgB,KAAK,EAAE,iBACzG;EAEA,OAAO;GAAE;GAAS;GAAM,KAAK,MAAM;EAAI;CACzC,CAAC,CACH;CAEF,MAAM,aAAa,SAAc,UAC/B,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,cAAc,SAAS,MAAM,MAAM;EACxD,MAAM,OAAO,kBAAkB,sBAAsB,MAAM,IAAI;EAE/D,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa,GAC1E,IAAI,KAAK;EAEX,IACE,UAAU,KAAA,KACV,YAAY,OAAO,MAAM,IAAI,MAAM,YAAY,OAAO,IAAI,KAC1D,KAAK,UAAU,aAAa,EAAE,YAC9B,EAAE,OAAO,cACP,SACA,MAAM,SACN,MACA,iBACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IAEA,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,QAAQ,OAAO,UAAU,SAAS;GAAE,KAAK,MAAM;GAAM;EAAK,GAAG,MAAM,OAAO;EAEhF,OAAO,UAAU,KAAA,IACZ,EAAE,MAAM,WAAW,IACnB;GAAE,MAAM;GAAW;EAAM;CAChC,CAAC;CAEH,MAAM,qBAAqB,SAAc,aAAwC;EAC/E,MAAM,QAAQ,kBAAkB,2BAA2B,QAAQ;EAEnE,UACE,MAAM,YAAY,uBAChB,MAAM,8BAA8B,eACnC,QAAQ,wBAAwB,6BAC5B,MAAM,qBAAqB,eAAe,MAAM,0BAA0B,KAC1E,MAAM,qBAAqB,kBAAkB,MAAM,wBAAwB,IAC5E,MAAM,qBAAqB,2BACnC;EAEA,OAAO;CACT;CAEA,MAAM,WAAW,SAAc,SAAc,YAC3C,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,QAAQ,QAAQ,qBAAqB,QAAQ,SAAS,gBAAgB;EAEvF,UACE,OAAO,aAAa,YAClB,SAAS,SAAS,KAClB,SAAS,UAAU,OACnB,aAAa,QAAQ,SAAS,gBAClC;EACA,MAAM,UAAU,QAAQ;EAExB,OAAO,MAAM,OACX,QAAQ,OACR,GAAG,QAAQ,KAAK,QAAQ,SAAS,GACjC,GAAG,QAAQ,mBAAmB,SAAS,CACzC;EACA,KAAK,MAAM,WAAW,QAAQ,SAAS;GACrC,MAAM,YAAY,KAChB,GAAG,IAAI,QAAQ,OAAO,QAAQ,SAAS,GAAG,QAAQ,QAAQ,GAC1D,QAAQ,UAAU;IAChB,WAAW,QAAQ;IACnB,UAAU,kBAAkB,sBAAsB,QAAQ,QAAQ;IAClE,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,qBAAqB,QAAQ;GAClE,CAAC,CACH;GAEA,OAAO,MAAM,MAAM,MAAM,SAAS,OAAO,QAAQ,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC;GACxE,MAAM,eAAe,KACnB,GAAG,4BAA4B,QAAQ,MAAM,SAAS,UAAU,EAClE;EACF;EAEA,OAAO,iBAAiB,KAAK,QAAQ;CACvC,CAAC,CACH;CAEF,MAAM,cACJ,SACA,OACA,cAEA,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,kBAAkB,gBAAgB,MAAM,KAAK,GACzD,OAAO,MAAM,MACb,IAAI,KAAK;EAEX,MAAM,UAAU,OAAO,YAAY,SAAS,IAAI;EAIhD,MAAM,WACJ,MAAM,QAAQ,SAAS,aAAa,MAAM,QAAQ,SAAS,WAAW,KAAA;EAExE,IAAI,aAAa,KAAA,GACf,UAAU,SAAS,aAAa,EAAE,YAAY,SAAS,WAAW,EAAE,MAAM;EAE5E,MAAM,QACJ,aAAa,KAAA,KAAa,YAAY,KAAA,IAClC,OAAO,UAAU,QAAQ,WAAW,QAAQ,IAC5C,KAAA;EAIN,KAAI,OAFiB,WAAW,SAAS,OAAO,MAAM,OAExC,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EACnD,IAAI,WAAgB,EAAE,MAAM,MAAM,QAAQ,KAAK;EAE/C,IAAI,MAAM,QAAQ,SAAS,YAAY;GACrC,WAAW,EAAE,MAAM,WAAW;GAC9B,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;GAE5E,IACE,YAAY,KAAA,KACZ,UAAU,KAAA,KACV,KAAK,UAAU,aAAa,EAAE,aAC7B,OAAO,cACN,SACA,SACA,MACA,iBACA,EAAE,QACF,EAAE,WACF,eAAe,OAAO,CAAC,GACvB,EAAE,wBACJ,IACA;IACA,MAAM,IAAI,QAAQ,UAAU,OAC1B,KAAK,QAAQ,YACb,IAAI,QAAQ;IAEd,MAAM,QAAQ,OAAO,MAAM,KACzB,GAAG,OACH,GAAG,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,GAAG,GAC3C,EACE,OAAO,EACT,CACF;IAEA,MAAM,WAAW,MAAM,KAAK;IAE5B,IACE,MAAM,IAAI,EAAE,WAAW,cACtB,MAAM,IAAI,EAAE,WAAW,WACtB,CAAC,QAAQ,UAAU,OAAO,MAAM,IAAI,EAAE,YAAY,QAAQ,QAAQ,KACnE,aAAa,KAAA,MACX,SAAS,GAAG,cAAc,EAAE,YAC3B,CAAC,QAAQ,UAAU,OAAO,SAAS,GAAG,YAAY,QAAQ,QAAQ,KAClE,CAAC,GAAG,eAAe,SAAS,GAAG,OAAO,IAE1C,WAAW,EAAE,MAAM,WAAW;SAC3B,IAAI,aAAa,KAAA,GAAW;KAC/B,MAAM,SAAS,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,SAAS,GAAG,aACnD;KAEA,IACE,MAAM,IAAI,EAAE,WAAW,WACvB,QAAQ,aAAa,SAAS,GAAG,uBACjC,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,GAAG,GAAG,GAAG,eAAe,EAAE,EACtH,IAEA,WAAW,EAAE,MAAM,WAAW;UAE9B,WAAW;MACT,MAAM;MACN,SAAS;MACT,YAAY,kBAAkB,yBAAyB;OACrD,UAAU,EAAE;OACZ;OACA,cAAc,SAAS,GAAG;OAC1B,oBAAoB,SAAS,GAAG;OAChC,UAAU,QAAQ;MACpB,CAAC;KACH;IACJ,OAAO;KACL,kBAAkB,SAAS,MAAM,YAAY;KAE7C,MAAM,SAAS;MACb,GAAG,GAAG,aAAa;OACjB,UAAU,EAAE;OACZ,WAAW,QAAQ;OACnB,aAAa,MAAM;OACnB,cAAc,UAAU;OACxB,oBAAoB,UAAU;MAChC,CAAC;OACA,GAAG,WAAW,EAAE;OAChB,GAAG,YAAY,QAAQ;OACvB,GAAG,cAAc,MAAM;OACvB,GAAG,eAAe,UAAU;OAC5B,GAAG,qBAAqB,UAAU;KACrC;KAEA,UAAU,GAAG,eAAe,OAAO,GAAG,OAAO,CAAC;KAM9C,MAAM,QAAO,OAJW,MAAM,OAAO,GAAG,OAAO,QAAQ,GACpD,GAAG,eAAe,UAAU,aAC/B,CAAC,EAAA,CAEqB;KAEtB,MAAM,eAAe;MACnB,GAAG,EAAE,aAAa;OAChB,WAAW,QAAQ;OACnB,cAAc,UAAU;OACxB,UAAU,UAAU;MACtB,CAAC;OACA,EAAE,YAAY,QAAQ;OACtB,EAAE,eAAe,UAAU;OAC3B,EAAE,WAAW,UAAU;KAC1B;KAEA,UAAU,EAAE,eAAe,aAAa,EAAE,OAAO,CAAC;KAElD,MAAM,SAAS,OAAO,MAAM,OAAO,EAAE,OAAO,cAAc;OACvD,EAAE,YAAY,QAAQ;OACtB,EAAE,eAAe,UAAU;KAC9B,CAAC;KAED,QAAQ,YAAY,OAAO,CAAC,GAAG,QAAQ,YAAY,MAAM,GAAG,OAAO,IAAI;KACvE,MAAM,eAAe,KACnB,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAC3C,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,YAAY,GACzD,GAAG,eACL,EAAE,IACF,GAAG,wBAAwB,EAAE,MAAM,SAAS,KAC1C,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,GAAG,QAAQ,QAAQ,GAC9C,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,UAAU,YAAY,GACvD,EAAE,eACJ,EAAE,EACJ;KACA,IAAI,MAAM,IAAI,EAAE,WAAW,WACzB,OAAO,aAAa,QAAQ,WAAW,UAAU,MAAM,KAAK,QAAQ,QAAQ;KAC9E,MAAM,OAAO,OAAO,QAAQ,SAAS,OAAO;KAE5C,MAAM,WAAW,kBAAkB,sBAAsB;MACvD,GAAG,QAAQ;MACX,kBAAkB;MAClB,aAAa,CACX,GAAG,QAAQ,SAAS,aACpB;OAAE,cAAc,UAAU;OAAc,UAAU,UAAU;MAAS,CACvE;KACF,CAAC;KAED,WAAW;MACT,MAAM;MACN,SAAS;MACT,YAAY,kBAAkB,yBAAyB;OACrD,UAAU,EAAE;OACZ;OACA,cAAc,UAAU;OACxB,oBAAoB,UAAU;OAC9B;MACF,CAAC;KACH;IACF;GACF;EACF;EACA,OAAO,aAAa,SAAS,MAAM,SAAS,IAAI;EAEhD,OAAO;CACT,CAAC,CACH;CAEF,MAAM,oBAAoB,SAAc,UAAkB,cAAsB,YAC9E,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,KAAK,QAAQ;EAUnB,MAAM,OAAM,OARS,MAAM,KACzB,GAAG,OACH,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAC/C,EACE,OAAO,EACT,CACF,EAAA,CAEkB,KAAK;EAEvB,IACE,QAAQ,KAAA,KACR,IAAI,GAAG,cAAc,YACrB,CAAC,QAAQ,UAAU,OAAO,IAAI,GAAG,YAAY,QAAQ,QAAQ,KAC7D,CAAC,GAAG,eAAe,IAAI,GAAG,OAAO,GAEjC,OAAO,KAAA;EACT,MAAM,IAAI,QAAQ,UAAU;EAU5B,MAAM,aAAY,OARG,MAAM,KACzB,EAAE,OACF,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,GAAG,YAAY,GACnD,EACE,OAAO,EACT,CACF,EAAA,CAEwB,KAAK;EAE7B,IACE,cAAc,KAAA,KACd,UAAU,EAAE,WAAW,WACvB,CAAC,QAAQ,UAAU,OAAO,UAAU,EAAE,YAAY,QAAQ,QAAQ,GAElE,OAAO,KAAA;EAET,MAAM,WAAW;GACf,UAAU,UAAU,EAAE;GACtB,QAAQ,UAAU,EAAE;GACpB,SAAS,UAAU,EAAE;EACvB;EAEA,WAAW,OAAO,iBAAiB,QAAQ,OAAO,IAAI,GAAG,YAAY;EAMrE,IAJe,QAAQ,SAAS,YAAY,MACzC,SAAc,KAAK,iBAAiB,YAIhC,CAAC,EAAE,aAAa,IAAI,GAAG,uBAC5B,EAAE,OAAO,MAAM,MACb,GAAG,wBAAwB,GAAG,MAAM,SAAS,KAAK,GAAG,IAAI,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,GAAG,eAAe,EAAE,EAC1H,IAEA,OAAO,KAAA;EAET,OAAO,kBAAkB,yBAAyB;GACtC;GACV;GACA;GACA,oBAAoB,IAAI,GAAG;GAC3B,UAAU,QAAQ;EACpB,CAAC;CACH,CAAC,CACH;CAEF,MAAM,iBAAiB,SAAc,UAAkB,cACrD,OAAO,QAAQ,0BAA0B,UACvC,MAAM,KACJ,QAAQ,QAAQ,OAChB,MAAM,QAAQ,QAAQ,OAAO;GAC1B,QAAQ,QAAQ,WAAW;GAC3B,QAAQ,QAAQ,YAAY;CAC/B,CAAC,GACD,EAAE,OAAO,EAAE,CACb,CACF;CAEF,MAAM,iBAAiB,SAAc,UACnC,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,eAAe,SAAS,MAAM,SAAS;EAE9D,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAErD,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,SAAS,GAC3E,IAAI,QAAQ;EAEd,MAAM,MAAM,QAAQ,KAAK;EAEzB,IAAI,QAAQ,KAAA,GAAW;GACrB,MAAM,SAAS,kBAAkB,OAAO,IAAI,EAAE,eAAe;GAE7D,IACE,OAAO,aAAa,MAAM,YAC1B,OAAO,SAAS,cAAc,MAAM,aACpC,OAAO,iBAAiB,MAAM,gBAC9B,CAAC,QAAQ,UAAU,OAAO,IAAI,EAAE,YAAY,QAAQ,QAAQ,KAC5D,IAAI,EAAE,kBAAkB,MAAM,cAE9B,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,WAAW,QAAQ,SAAS,UAAU,QAAQ,QAAQ;GAE5D,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;GAC/D,MAAM,eAAe,KAAK,QAAQ;GAElC,OAAO;IAAE,MAAM;IAAU,QAAQ,gBAAgB,OAAO,IAAI,EAAE,SAAS;GAAE;EAC3E;EAEA,MAAM,aAAa,OAAO,iBACxB,SACA,MAAM,UACN,MAAM,cACN,OACF;EAEA,OAAO,eAAe,KAAA,IACjB,EAAE,MAAM,WAAW,IACnB;GAAE,MAAM;GAAU;EAAW;CACpC,CAAC,CACH;CAEF,MAAM,wBAAwB,SAAc,SAAc,YACxD,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,UAAU,QAAQ,YAAY,SAAS,KAAK,QAAQ,YAAY,UAAU,EAAE;EAC5E,MAAM,wBAAQ,IAAI,IAAkC;EAEpD,MAAM,YAAY,IAAI,IACpB,QAAQ,SAAS,YAAY,KAAK,SAAc,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CACpF;EAEA,KAAK,MAAM,cAAc,QAAQ,aAAa;GAC5C,MAAM,WAAW,OAAO,MAAM,KAC5B,WAAW,OACX,KACE,GAAG,IAAI,WAAW,OAAO,WAAW,SAAS,GAAG,QAAQ,QAAQ,GAChE,WAAW,UAAU,QAAQ,QAAQ,CACvC,GACA,EAAE,SAAS,IAAI,WAAW,OAAO,WAAW,YAAY,EAAE,CAC5D;GAEA,KAAK,MAAM,OAAO,SAAS,MAAM;IAC/B,MAAM,OAAO,WAAW,OAAO,UAAU,GAAG,CAAC;IAE7C,IAAI,SAAS,KAAA,KAAa,KAAK,iBAAiB,SAAS;IACzD,UACE,KAAK,iBAAiB,IAAI,WAAW,iBACnC,KAAK,aAAa,IAAI,WAAW,aACjC,UAAU,IAAI,KAAK,YAAY,MAAM,KAAK,YAC1C,KAAK,QAAQ,UAAU,KACvB,KAAK,QAAQ,OAAO,WAClB;KAAC;KAAa;KAAc;IAAW,CAAC,CAAC,SAAS,MAAM,CAC1D,CACJ;IACA,UACE,OAAO,KAAK,kBAAkB,aAC5B,OAAO,KAAK,iBAAiB,aAC7B,OAAO,KAAK,sBAAsB,SACtC;IAEA,MAAM,aAAa;KACjB,cAAc,KAAK;KACnB,UAAU,KAAK;KACf,eAAe,KAAK;KACpB,SAAS,CAAC,GAAG,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK;KACzC,cAAc,KAAK;KACnB,mBAAmB,KAAK;IAC1B;IAEA,MAAM,QAAQ,MAAM,IAAI,KAAK,YAAY;IAGzC,UAAU,UAAU,KAAA,KAAa,KAAK,UAAU,KAAK,MAAM,KAAK,UAAU,UAAU,CAAC;IACrF,MAAM,IAAI,KAAK,cAAc,UAAU;GACzC;EACF;EACA,MAAM,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC;EAEpC,MAAM,cAAc,kBAClB,2BACA,QAAQ,QAAQ,gCAAgC,UAAU,QAAQ,GAAG,CAAC,CACxE;EAEA,OAAO,UAAU,MAAM,SAAS,KAAK,aAAa,KAAK,UAAU,WAAW,WAAW;CACzF,CAAC,CACH;CAEF,MAAM,UAAU,SAAc,UAC5B,OAAO,QAAQ,0BAA0B,UACvC,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,kBAAkB,yBAAyB,MAAM,UAAU;EAE5E,UAAU,SAAS,aAAa,MAAM,QAAQ;EAC9C,MAAM,UAAU,OAAO,eAAe,SAAS,SAAS,SAAS,SAAS;EAE1E,IAAI,YAAY,KAAA,GAAW,OAAO,EAAE,MAAM,WAAW;EAErD,MAAM,SACJ,QAAQ,4BAA4B,CAAC;EAEvC,UAAU,OAAO,UAAU,EAAE;EAC7B,IAAI,oBAAoB,QAAQ,uBAAuB,KAAA,KAAa,OAAO,SAAS;EAEpF,IAAI,QAAQ,uBAAuB,KAAA,GACjC,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,YAAY,MAAM,UAAU;IAChC,UAAU,kBACR,wBAAwB,OAAO,UAC/B,SAAS,QACX;IACA,aAAa,OAAO,iBAAiB,SAAS,QAAQ;IACtD,WAAW,UAAU,EAAE,OAAO,QAAQ,SAAS,CAAC,CAAC,CAAC;GACpD,CAAC;GAQD,KAAI,OANgB,MAAM,KACxB,MAAM,OACN,OAAO,SAAS,SAAS,IAAI,OAAO,YAAY,WAChD,EAAE,SAAS,IAAI,MAAM,OAAO,MAAM,OAAO,EAAE,CAC7C,EAAA,CAES,KAAK,WAAW,GAAG,oBAAoB;EAClD;EAEF,MAAM,UAAU,OAAO,cAAc,SAAS,MAAM,UAAU,MAAM,SAAS,GAC3E,IAAI,QAAQ;EAEd,MAAM,WAAW,QAAQ,KAAK;EAE9B,IAAI,aAAa,KAAA,GAAW;GAC1B,IACE,SAAS,EAAE,oBAAoB,kBAAkB,OAAO,QAAQ,KAChE,SAAS,EAAE,kBAAkB,SAAS,gBACtC,CAAC,QAAQ,UAAU,OAAO,SAAS,EAAE,YAAY,QAAQ,QAAQ,GAEjE,OAAO,EAAE,MAAM,WAAW;GAC5B,MAAM,WAAW,QAAQ,SAAS,UAAU,QAAQ,QAAQ;GAE5D,IAAI,EAAE,OAAO,MAAM,MAAM,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;GAC/D,MAAM,eAAe,KAAK,QAAQ;GAElC,OAAO;IACL,MAAM;IACN,UAAU;IACV,QAAQ,gBAAgB,OAAO,SAAS,EAAE,SAAS;GACrD;EACF;EAEA,MAAM,SAAS,OAAO,iBACpB,SACA,MAAM,UACN,SAAS,cACT,OACF;EAEA,IACE,WAAW,KAAA,KACX,kBAAkB,OAAO,MAAM,MAAM,kBAAkB,OAAO,QAAQ,GAEtE,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,OAAO,kBAAkB,0BAA0B,MAAM,aAAa;EAE5E,IACE,KAAK,UAAU,aAAa,MAAM,YAClC,EAAE,OAAO,cACP,SACA,SACA,MACA,UACA,MAAM,WACN,MAAM,WACN,kBAAkB,OAAO,QAAQ,GACjC,KAAK,YAAY,gBACnB,IAEA,OAAO,EAAE,MAAM,WAAW;EAC5B,IAAI,EAAE,OAAO,qBAAqB,SAAS,SAAS,SAAS,YAAY,IACvE,OAAO,EAAE,MAAM,mBAAmB;EAEpC,MAAM,eAAe,kBAAkB,SAAS,MAAM,YAAY,GAChE,KAAK,QAAQ,YACb,IAAI,QAAQ;EAEd,MAAM,MAAM,OAAO,iBAAiB,SAAS,QAAQ,GACnD,IAAI,QAAQ,UAAU;EAExB,MAAM,YAAY,QAAQ,qBAAqB;GAC7C,aAAa;GACb,WAAW,UAAU,EAAE,OAAO,QAAQ,SAAS,CAAC,CAAC,CAAC;EACpD,CAAC;EAED,MAAM,SACJ,cAAc,KAAA,MAAc,CAAC,sBAAsB,OAAO,MAAM,MAAM,SAAS;EAEjF,IAAI,cAAc,KAAA,KAAa,mBAC7B,MAAM,eAAe,KAAK,SAAS,YAAY,GAAG,QAAQ,UAAU,EAAE;EACxE,OAAO,MAAM,OAAO,GAAG,OAAO,GAAG,GAAG,eAAe,SAAS,aAAa,CAAC;EAC1E,OAAO,MAAM,OAAO,EAAE,OAAO;IAC1B,EAAE,YAAY,QAAQ;IACtB,EAAE,eAAe,SAAS;EAC7B,CAAC;EACD,IAAI,CAAC,QAAQ;GACX,OAAO,MAAM,OACX,EAAE,OACF,GAAG,EAAE,cAAc,IAAI,GACvB;KACG,EAAE,QAAQ;KACV,EAAE,YAAY;KACd,EAAE,cAAc;KAChB,EAAE,UAAU,MAAM;GACrB,CACF;GACA,IAAI,QAAQ,UAAU,SAAS,YAC7B,OAAO,MAAM,OAAO,QAAQ,UAAU,SAAS,OAAO,GACnD,QAAQ,UAAU,SAAS,cAAc,IAC5C,CAAC;EACL;EACA,OAAO,QAAQ,SAAS,SAAS,SAAS,YAAY;EAEtD,MAAM,SAAS,kBAAkB,eAAe;GAC9C,MAAM;GACN,cAAc,SAAS;GACvB;EACF,CAAC;EAED,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,UACE,OAAO,cAAc,MAAM,oBAAoB,KAC7C,MAAM,uBAAuB,OAC7B,MAAM,wBAAwB,MAAM,YAAY,IACpD;EACA,MAAM,aAAa;IAAG,EAAE,WAAW,MAAM;IAAW,EAAE,YAAY,MAAM;EAAU;EAElF,MAAM,SAAS;GACb,GAAG,EAAE,aAAa;IAChB,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,YAAY,kBAAkB,yBAAyB,QAAQ;GACjE,CAAC;GACD,GAAG;IACF,EAAE,YAAY,QAAQ;IACtB,EAAE,eAAe,SAAS;IAC1B,EAAE,iBAAiB,kBAAkB,OAAO,QAAQ;IACpD,EAAE,WAAW,gBAAgB,OAAO,MAAM;IAC1C,EAAE,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;EAC5E;EAIA,QAAQ,QAAO,OAFS,MAAM,OAAO,EAAE,OAAO,QAAQ,UAAU,EAAA,CAExC;EAExB,OAAO;GAAE,MAAM;GAAY;GAAQ,UAAU;EAAM;CACrD,CAAC,CACH;CAEF,OAAO;EAAE;EAAgB;EAAW;EAAe;EAAW;EAAY;EAAe;CAAO;AAClG,CAAC;AAED,IAAa,gBAAb,MAAa,sBAAsB,QAAQ,QAAoD,CAAC,CAC9F,uCACF,CAAC,CAAC;CACA,OAAgB,QAAQ,MAAM,OAAO,eAAeA,MAAI;AAC1D"}

package/dist/internal/oauth-kernel.d.mts CHANGED Viewed

@@ -206,10 +206,10 @@ export declare const makeOAuthKernel: (operations: QueryOperations, dialect: (ta
           readonly nowMillis: number;
         }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
           readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Ambiguous";
         } | {
           readonly _tag: "Cancelled";
+        } | {
+          readonly _tag: "Ambiguous";
         } | {
           readonly _tag: "Conflict";
         } | {
@@ -270,7 +270,7 @@ export declare const makeOAuthKernel: (operations: QueryOperations, dialect: (ta
             readonly credentialId: string;
             readonly invalidation: {
               readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-              readonly existingSessions: "immediate" | "original-absolute-expiry";
+              readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
               readonly maximumExposureMillis: number;
               readonly oldAuthenticationEvidence: "rejected";
             };
@@ -295,7 +295,7 @@ export declare const makeOAuthKernel: (operations: QueryOperations, dialect: (ta
             readonly credentialId: string;
             readonly invalidation: {
               readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-              readonly existingSessions: "immediate" | "original-absolute-expiry";
+              readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
               readonly maximumExposureMillis: number;
               readonly oldAuthenticationEvidence: "rejected";
             };
@@ -346,10 +346,10 @@ export declare const makeOAuthKernel: (operations: QueryOperations, dialect: (ta
           readonly outcome: import("@yielded/auth/OAuth").OAuthSignInAccessOutcome;
         }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
           readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Ambiguous";
         } | {
           readonly _tag: "Cancelled";
+        } | {
+          readonly _tag: "Ambiguous";
         } | {
           readonly _tag: "Connected";
           readonly grant: {
@@ -806,10 +806,10 @@ export declare const makeOAuthKernel: (operations: QueryOperations, dialect: (ta
           readonly nowMillis: number;
         }, prepare: import("@yielded/auth/OAuth").PrepareOAuthCommit<{
           readonly _tag: "Rejected";
-        } | {
-          readonly _tag: "Ambiguous";
         } | {
           readonly _tag: "Cancelled";
+        } | {
+          readonly _tag: "Ambiguous";
         } | {
           readonly _tag: "Connected";
           readonly grant: {

package/dist/internal/passkey/write-state.mjs CHANGED Viewed

@@ -184,7 +184,15 @@ const makePasskeyWriteStateKernel = (operations, state, transactions) => {
 		owner.postconditions.push(condition);
 		return true;
 	});
-	const invalidationMatches = (mapping, supplied, policy) => jsonStorage(SessionInvalidationWindow).encode(supplied) === jsonStorage(SessionInvalidationWindow).encode(mapping.invalidation.window) && (!policy.requireImmediateInvalidation || supplied.existingSessions === "immediate");
+	const invalidationMatches = (mapping, supplied, policy) => {
+		if (supplied.existingSessions === "cache-expiry" && supplied.maximumExposureMillis === 0) return false;
+		const authoritative = supplied.existingSessions === "cache-expiry" && mapping.invalidation.window.existingSessions === "immediate" ? {
+			...supplied,
+			existingSessions: "immediate",
+			maximumExposureMillis: 0
+		} : supplied;
+		return jsonStorage(SessionInvalidationWindow).encode(authoritative) === jsonStorage(SessionInvalidationWindow).encode(mapping.invalidation.window) && (!policy.requireImmediateInvalidation || supplied.existingSessions === "immediate");
+	};
 	const invalidate = Effect.fn("passkey.invalidateCredentialChange")(function* (mapping, subject, invalidation) {
 		const owner = yield* CurrentPasskeyTransaction;
 		const table = mapping.read.subject;

package/dist/internal/passkey/write-state.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"write-state.mjs","names":["digest","digestText"],"sources":["../../../src/internal/passkey/write-state.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. /\n\nimport {\n type PasskeyActionAuthorization,\n type PasskeyCeremony,\n PasskeyBegin,\n PasskeyCredential,\n PasskeyCredentialSummary,\n PasskeyDescriptor,\n PasskeyLabel,\n PasskeyModuleId,\n PasskeyProfile,\n PasskeyRequirement,\n PasskeyRevision,\n PasskeyUserHandle,\n PasskeyManagementPolicy,\n snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport { type SubjectId } from \"@yielded/auth/Schema\";\nimport { SessionInvalidationWindow } from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Schema } from \"effect\";\n\nimport { digest as digestText } from \"../crypto\";\nimport type { PersistenceMappingError } from \"../mapping-error\";\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport interface WriteSubject {\n readonly subjectId: SubjectId;\n readonly nativeId: any;\n readonly row: Record<string, any>;\n readonly revision: typeof PasskeyRevision.Type;\n}\n\nexport const makePasskeyWriteStateKernel = (\n operations: QueryOperations,\n state: Pick<\n ReturnType<typeof makePasskeyStateKernel>,\n \| \"col\"\n \| \"copiedRow\"\n \| \"credentialKey\"\n \| \"equal\"\n \| \"handleKey\"\n \| \"invariant\"\n \| \"mappedColumns\"\n \| \"sameCredential\"\n \| \"sameRevision\"\n \| \"subjectScope\"\n >,\n transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n const { sql } = operations;\n\n const {\n col,\n copiedRow,\n credentialKey,\n equal,\n handleKey,\n mappedColumns,\n sameCredential,\n sameRevision,\n subjectScope,\n } = state;\n\n const invariant: (value: unknown) => asserts value = state.invariant;\n const { both } = transactions;\n\n const jsonStorage = <S extends Schema.Codec<unknown, unknown, never, never>>(schema: S) => {\n const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n\n return {\n encode: (value: S[\"Type\"]) => Schema.encodeSync(codec)(snapshotPasskeySync(schema, value)),\n decode: (text: unknown): S[\"Type\"] => {\n // oxlint-disable-next-line no-restricted-properties -- persisted private JSON enters through its schema.\n return Schema.decodeUnknownSync(codec)(text);\n },\n };\n };\n\n const digest = <S extends Schema.Codec<unknown, unknown, never, never>>(\n schema: S,\n value: S[\"Type\"],\n ) => digestText(jsonStorage(schema).encode(value));\n\n const currentSubject = Effect.fn(\"passkey.currentWriteSubject\")(function (\n mapping: any,\n subjectId: SubjectId,\n ) {\n const owner = yield* CurrentPasskeyTransaction;\n const read = mapping.read;\n const table = read.subject;\n const nativeId = read.subjectIds.toNative(subjectId);\n\n invariant(read.subjectIds.toSubject(nativeId) === subjectId);\n\n const row = (yield* owner.read(table.table, equal(table.table, { [table.id]: nativeId }), {\n limit: 1,\n columns: [\n ...new Set<string>([\n table.id,\n table.status,\n table.securityRevision,\n ...mapping.write.policy.subjectColumns,\n ]),\n ],\n })).rows[0];\n\n if (row === undefined \|\| !table.isActiveStatus(row[table.status])) return undefined;\n invariant(read.subjectIds.equals(table.decodeId(copiedRow(row)), nativeId));\n const active = sql`exists(select 1 from ${table.table} where ${both(equal(table.table, { [table.id]: nativeId }), table.activeCondition)})`;\n\n if (!(yield* owner.check(active))) return undefined;\n owner.postconditions.push(active);\n const factor = read.authority;\n\n const factors = (yield* owner.read(\n factor.table,\n both(equal(factor.table, { [factor.subjectId]: nativeId }), factor.activeCondition),\n {\n limit: 64,\n columns: mappedColumns(factor),\n orderBy: col(factor.table, factor.credentialId),\n },\n )).rows;\n\n const revision = snapshotPasskeySync(PasskeyRevision, {\n subjectId,\n securityRevision: row[table.securityRevision],\n credentials: factors.map((value) => ({\n credentialId: value[factor.credentialId],\n revision: value[factor.revision],\n })),\n });\n\n invariant(\n new Set(revision.credentials.map((item) => item.credentialId)).size ===\n revision.credentials.length,\n );\n\n return { subjectId, nativeId, row, revision };\n });\n\n const credentialRows = Effect.fn(\"passkey.writeCredentialRows\")(function* (\n mapping: any,\n subject: WriteSubject,\n rpId?: string,\n ) {\n const owner = yield* CurrentPasskeyTransaction;\n const table = mapping.read.credential;\n\n return (yield* owner.read(\n table.table,\n both(\n equal(table.table, { [table.subjectId]: subject.nativeId }),\n table.activeCondition,\n rpId === undefined ? undefined : equal(table.table, { [table.rpId]: rpId }),\n ),\n { limit: 64, orderBy: col(table.table, table.credentialId) },\n )).rows;\n });\n\n const summary = (mapping: any, row: any) => {\n const table = mapping.read.credential;\n const write = mapping.write.credential;\n const decoded = table.decode(copiedRow(row));\n\n return snapshotPasskeySync(PasskeyCredentialSummary, {\n credentialId: decoded.credentialId,\n name: row[write.name],\n primarySignIn: decoded.primarySignIn,\n createdAtMillis: mapping.clock.decodeInstant(row[write.createdAt]),\n ...(row[mapping.telemetry.lastUsedAt] === null \|\|\n row[mapping.telemetry.lastUsedAt] === undefined\n ? {}\n : { lastUsedAtMillis: mapping.clock.decodeInstant(row[mapping.telemetry.lastUsedAt]) }),\n });\n };\n\n const ownedCredential = Effect.fn(\"passkey.ownedWriteCredential\")(function* (\n mapping: any,\n subject: WriteSubject,\n row: any,\n ) {\n const owner = yield* CurrentPasskeyTransaction;\n const read = mapping.read;\n const table = read.credential;\n\n const decoded = snapshotPasskeySync(PasskeyCredential, {\n ...table.decode(copiedRow(row)),\n revision: subject.revision,\n active: true,\n });\n\n invariant(\n decoded.credentialId === row[table.credentialId] &&\n decoded.profile.rpId === decoded.rpId &&\n read.subjectIds.equals(table.decodeSubjectId(copiedRow(row)), subject.nativeId),\n );\n const ownership = read.credentialOwnership;\n const key = yield* credentialKey(decoded.rpId, decoded.protocolCredentialId);\n\n const tuple = (yield* owner.read(\n ownership.table,\n equal(ownership.table, { [ownership.credentialKey]: key }),\n { limit: 1, columns: mappedColumns(ownership) },\n )).rows[0];\n\n if (\n tuple === undefined \|\|\n !ownership.isOwnedState(tuple[ownership.state]) \|\|\n !read.subjectIds.equals(ownership.decodeSubjectId(copiedRow(tuple)), subject.nativeId)\n )\n return undefined;\n invariant(\n tuple[ownership.rpId] === decoded.rpId &&\n tuple[ownership.protocolCredentialId] === decoded.protocolCredentialId &&\n tuple[ownership.credentialId] === decoded.credentialId &&\n row[table.credentialKey] === key,\n );\n const handle = read.handleOwnership;\n const hashedHandle = yield* handleKey(decoded.rpId, decoded.userHandle);\n\n const held = (yield* owner.read(\n handle.table,\n equal(handle.table, { [handle.handleKey]: hashedHandle }),\n { limit: 1, columns: mappedColumns(handle) },\n )).rows[0];\n\n if (\n held === undefined \|\|\n !handle.isOwnedState(held[handle.state]) \|\|\n !read.subjectIds.equals(handle.decodeSubjectId(copiedRow(held)), subject.nativeId)\n )\n return undefined;\n invariant(\n held[handle.rpId] === decoded.rpId &&\n held[handle.userHandle] === decoded.userHandle &&\n row[table.handleKey] === hashedHandle,\n );\n invariant(\n subject.revision.credentials.some(\n (item) =>\n item.credentialId === decoded.credentialId &&\n item.revision === row[table.credentialRevision],\n ),\n );\n\n return decoded;\n });\n\n const managementPolicy = (mapping: any, subject: WriteSubject) =>\n snapshotPasskeySync(\n PasskeyManagementPolicy,\n mapping.write.policy.management(copiedRow(subject.row)),\n );\n\n const metadataAllowed = Effect.fn(\"passkey.metadataAllowed\")(function* (\n mapping: any,\n subject: WriteSubject,\n ) {\n const owner = yield* CurrentPasskeyTransaction;\n const condition = mapping.write.policy.metadata(subject.nativeId);\n const allowed = yield* owner.check(condition);\n\n if (allowed) owner.postconditions.push(condition);\n\n return allowed;\n });\n\n const enrollmentDigest = (ceremony: PasskeyCeremony) => {\n invariant(ceremony.context._tag === \"Enrollment\");\n const context = ceremony.context;\n\n return digest(\n Schema.Tuple([\n PasskeyModuleId,\n Schema.Literal(\"enrollment\"),\n Schema.Struct({ ...PasskeyBegin.fields, name: PasskeyLabel }),\n PasskeyProfile,\n PasskeyRevision,\n PasskeyUserHandle,\n Schema.Array(PasskeyDescriptor),\n ]),\n [\n ceremony.moduleId,\n \"enrollment\",\n {\n flowId: ceremony.flowId,\n commandId: ceremony.commandId,\n profileId: ceremony.profile.profileId,\n name: context.name,\n },\n ceremony.profile,\n context.revision,\n context.userHandle,\n ceremony.allowedCredentials,\n ],\n );\n };\n\n const removeDigest = (moduleId: string, commandId: string, credential: PasskeyCredential) =>\n digest(\n Schema.Tuple([\n PasskeyModuleId,\n Schema.Literal(\"remove\"),\n PasskeyBegin.fields.commandId,\n PasskeyCredential,\n ]),\n [\n PasskeyModuleId.make(moduleId),\n \"remove\",\n PasskeyBegin.fields.commandId.make(commandId),\n credential,\n ],\n );\n\n const authorizeAction = Effect.fn(\"passkey.authorizeWriteAction\")(function* (\n mapping: any,\n subject: WriteSubject,\n authorization: PasskeyActionAuthorization,\n expected: {\n readonly action: PasskeyActionAuthorization[\"challenge\"][\"action\"];\n readonly commandId: string;\n readonly flowId: string;\n readonly bindingDigest: string;\n readonly revision: typeof PasskeyRevision.Type;\n },\n policy: PasskeyManagementPolicy,\n original?: typeof PasskeyRequirement.Type,\n ) {\n const owner = yield* CurrentPasskeyTransaction;\n const { challenge, evidence } = authorization;\n\n if (\n challenge.moduleId !== mapping.moduleId \|\|\n challenge.action !== expected.action \|\|\n challenge.commandId !== expected.commandId \|\|\n challenge.flowId !== expected.flowId \|\|\n challenge.bindingDigest !== expected.bindingDigest \|\|\n evidence.flowId !== expected.flowId \|\|\n evidence.bindingDigest !== expected.bindingDigest \|\|\n !sameRevision(challenge.revision, expected.revision) \|\|\n subject.revision.subjectId !== expected.revision.subjectId \|\|\n subject.revision.securityRevision !== expected.revision.securityRevision \|\|\n evidence.revision.subjectId !== subject.subjectId \|\|\n evidence.revision.securityRevision !== subject.revision.securityRevision\n )\n return false;\n for (const revision of [expected.revision, evidence.revision])\n if (\n revision.credentials.some(\n (item) =>\n !subject.revision.credentials.some(\n (current) =>\n current.credentialId === item.credentialId && current.revision === item.revision,\n ),\n )\n )\n return false;\n const now = yield* owner.now(mapping.clock);\n\n if (\n evidence.proofs.some(\n (proof) =>\n DateTime.toEpochMillis(proof.verifiedAt) > now \|\|\n !evidence.revision.credentials.some((item) => item.credentialId === proof.credentialId),\n )\n )\n return false;\n\n const currentRequirement: Effect.Effect<\n typeof PasskeyRequirement.Type,\n PersistenceMappingError\n > = mapping.write.policy.requirement(copiedRow(subject.row), expected.action);\n\n const current = snapshotPasskeySync(PasskeyRequirement, yield* currentRequirement);\n\n for (const requirement of [\n authorization.requirement,\n current,\n ...(original === undefined ? [] : [original]),\n ]) {\n const age = Math.min(policy.maximumEvidenceAgeMillis, requirement.maximumAgeMillis);\n\n const fresh = evidence.proofs.filter(\n (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n );\n\n const factors = new Set(fresh.flatMap((proof) => proof.factors));\n\n if (\n !requirement.alternatives.some(\n (alternative) =>\n alternative.factors.every((factor) => factors.has(factor)) &&\n new Set(fresh.map((proof) => proof.credentialId)).size >=\n alternative.minimumCredentials &&\n fresh.some(\n (proof) =>\n (!alternative.userVerified \|\| proof.userVerified) &&\n (!alternative.phishingResistant \|\| proof.phishingResistant),\n ),\n )\n )\n return false;\n owner.postconditions.push(\n both(\n sql`${mapping.clock.engineNowMillis} >= ${now}`,\n ...fresh.map(\n (proof) =>\n sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`,\n ),\n ),\n );\n }\n const condition = mapping.write.policy.action(subject.nativeId, authorization);\n\n if (!(yield* owner.check(condition))) return false;\n owner.postconditions.push(condition);\n\n return true;\n });\n\n const invalidationMatches = (\n mapping: any,\n supplied: SessionInvalidationWindow,\n policy: PasskeyManagementPolicy,\n ) =>\n jsonStorage(SessionInvalidationWindow).encode(supplied) ===\n jsonStorage(SessionInvalidationWindow).encode(mapping.invalidation.window) &&\n (!policy.requireImmediateInvalidation \|\| supplied.existingSessions === \"immediate\");\n\n const invalidate = Effect.fn(\"passkey.invalidateCredentialChange\")(function* (\n mapping: any,\n subject: WriteSubject,\n invalidation: SessionInvalidationWindow,\n ) {\n const owner = yield* CurrentPasskeyTransaction;\n const table = mapping.read.subject;\n const revision = PasskeyRevision.fields.securityRevision.make(owner.marker);\n\n yield* owner.update(\n table.table,\n { [table.id]: subject.nativeId },\n { [table.securityRevision]: revision },\n );\n\n const input = {\n subjectId: subject.nativeId,\n previousRevision: subject.revision.securityRevision,\n securityRevision: revision,\n invalidation,\n };\n\n for (const mutation of mapping.invalidation.mutations) {\n yield* owner.write(\n owner.database\n .update(mutation.table)\n .set(mutation.values(input))\n .where(mutation.where(input)),\n );\n owner.postconditions.push(mutation.postcondition(input));\n }\n owner.postconditions.push(mapping.invalidation.postcondition(input));\n const flow = mapping.flow;\n const scope = yield* subjectScope(subject.subjectId);\n\n const where = both(\n equal(flow.table, { [flow.subjectScope]: scope }),\n sql`${col(flow.table, flow.state)} in (${flow.states.Pending}, ${flow.states.Claimed})`,\n );\n\n yield* owner.write(\n owner.database\n .update(flow.table)\n .set({ [flow.state]: flow.states.Rejected, [flow.version]: owner.marker })\n .where(where),\n );\n for (const observation of owner.observations)\n if (observation.table === flow.table)\n observation.rows = observation.rows.map((row) =>\n row[flow.subjectScope] === scope &&\n [flow.states.Pending, flow.states.Claimed].includes(row[flow.state])\n ? { ...row, [flow.state]: flow.states.Rejected, [flow.version]: owner.marker }\n : row,\n );\n owner.postconditions.push(sql`not exists(select 1 from ${flow.table} where ${where})`);\n\n return revision;\n });\n\n const validRegistration = (\n ceremony: PasskeyCeremony,\n verified: {\n readonly algorithm: number;\n readonly userVerified: boolean;\n readonly backupEligible: boolean;\n readonly backupState: boolean;\n readonly protocolCredentialId: string;\n },\n ) =>\n ceremony.profile.algorithms.some((algorithm) => algorithm === verified.algorithm) &&\n (ceremony.profile.userVerification !== \"required\" \|\| verified.userVerified) &&\n (!verified.backupState \|\| verified.backupEligible) &&\n !ceremony.allowedCredentials.some((item) => item.id === verified.protocolCredentialId);\n\n const insertCredential = Effect.fn(\"passkey.insertCredential\")(function* (\n mapping: any,\n subject: WriteSubject,\n ceremony: PasskeyCeremony,\n verified: any,\n now: number,\n ) {\n const owner = yield* CurrentPasskeyTransaction;\n\n invariant(ceremony.context._tag === \"Enrollment\" \|\| ceremony.context._tag === \"Registration\");\n const read = mapping.read;\n const write = mapping.write;\n const id = PasskeyCredential.fields.credentialId.make(owner.marker);\n\n const credential = snapshotPasskeySync(PasskeyCredential, {\n credentialId: id,\n rpId: ceremony.profile.rpId,\n protocolCredentialId: verified.protocolCredentialId,\n userHandle: ceremony.context.userHandle,\n publicKey: verified.publicKey,\n algorithm: verified.algorithm,\n profile: ceremony.profile,\n revision: {\n ...subject.revision,\n credentials: [\n ...subject.revision.credentials,\n {\n credentialId: id,\n revision: PasskeyRevision.fields.securityRevision.make(owner.marker),\n },\n ],\n },\n active: true,\n primarySignIn: ceremony.profile.primarySignIn && verified.userVerified,\n enrollmentUserVerified: verified.userVerified,\n backupEligible: verified.backupEligible,\n backupState: verified.backupState,\n counter: verified.counter,\n maximumCounter: verified.counter,\n });\n\n const safe = snapshotPasskeySync(PasskeyCredentialSummary, {\n credentialId: id,\n name: ceremony.context.name,\n primarySignIn: credential.primarySignIn,\n createdAtMillis: now,\n });\n\n const input = { subjectId: subject.nativeId, credential, summary: safe, marker: owner.marker };\n const tupleKey = yield* credentialKey(credential.rpId, credential.protocolCredentialId);\n const hashedHandle = yield* handleKey(credential.rpId, credential.userHandle);\n const tuple = read.credentialOwnership;\n\n const absent = yield* owner.read(\n tuple.table,\n equal(tuple.table, { [tuple.credentialKey]: tupleKey }),\n { limit: 1 },\n );\n\n invariant(absent.rows.length === 0);\n\n const inserted = yield* owner.insert(\n tuple.table,\n {\n ...write.credentialOwnership.encodeInsert(input),\n [tuple.credentialKey]: tupleKey,\n [tuple.rpId]: credential.rpId,\n [tuple.protocolCredentialId]: credential.protocolCredentialId,\n [tuple.subjectId]: subject.nativeId,\n [tuple.credentialId]: id,\n [tuple.state]: write.credentialOwnership.ownedState,\n [tuple.version]: owner.marker,\n [tuple.reservationId]: null,\n },\n { [tuple.credentialKey]: tupleKey },\n );\n\n absent.rows = inserted.rows;\n const table = read.credential;\n\n const values = {\n ...write.credential.encodeInsert(input),\n [table.credentialId]: id,\n [table.subjectId]: subject.nativeId,\n [table.rpId]: credential.rpId,\n [table.protocolCredentialId]: credential.protocolCredentialId,\n [table.credentialKey]: tupleKey,\n [table.handleKey]: hashedHandle,\n [table.userHandle]: credential.userHandle,\n [table.algorithm]: credential.algorithm,\n [table.credentialRevision]: owner.marker,\n [table.status]: write.credential.activeStatus,\n [table.primarySignIn]: write.credential.encodePrimarySignIn(credential.primarySignIn),\n [table.enrollmentUserVerified]: write.credential.encodeEnrollmentUserVerified(\n credential.enrollmentUserVerified,\n ),\n [table.backupEligible]: write.credential.encodeBackupEligible(credential.backupEligible),\n [table.backupState]: mapping.telemetry.encodeBackupState(credential.backupState),\n [table.counter]: credential.counter,\n [table.maximumCounter]: credential.maximumCounter,\n [write.credential.name]: safe.name,\n [write.credential.createdAt]: mapping.clock.encodeInstant(now),\n [mapping.telemetry.lastUsedAt]: null,\n };\n\n yield* owner.insert(table.table, values, { [table.credentialId]: id });\n for (const observation of owner.observations)\n if (\n observation.table === table.table &&\n observation.rows !== inserted.rows &&\n !observation.rows.some((row) => row[table.credentialId] === id)\n )\n observation.rows = [...observation.rows, values];\n const factor = read.authority;\n\n const factorValues = {\n ...write.authority.encodeInsert(input),\n [factor.subjectId]: subject.nativeId,\n [factor.credentialId]: id,\n [factor.revision]: owner.marker,\n [factor.status]: write.authority.activeStatus,\n };\n\n yield* owner.insert(factor.table, factorValues, {\n [factor.subjectId]: subject.nativeId,\n [factor.credentialId]: id,\n });\n for (const observation of owner.observations)\n if (\n observation.table === factor.table &&\n !observation.rows.some((row) => row[factor.credentialId] === id)\n )\n observation.rows = [...observation.rows, factorValues];\n\n const decoded = snapshotPasskeySync(PasskeyCredential, {\n ...table.decode(copiedRow(values)),\n revision: credential.revision,\n active: true,\n });\n\n invariant(\n sameCredential(decoded, credential) &&\n decoded.counter === credential.counter &&\n decoded.maximumCounter === credential.maximumCounter &&\n decoded.backupState === credential.backupState,\n );\n invariant(summary(mapping, values).credentialId === id);\n owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now}`);\n\n return safe;\n });\n\n return {\n jsonStorage,\n digest,\n currentSubject,\n credentialRows,\n summary,\n ownedCredential,\n managementPolicy,\n metadataAllowed,\n enrollmentDigest,\n removeDigest,\n authorizeAction,\n invalidationMatches,\n invalidate,\n validRegistration,\n insertCredential,\n };\n};\n"],"mappings":";;;;;;;AAoCA,MAAa,+BACX,YACA,OAaA,iBACG;CACH,MAAM,EAAE,QAAQ;CAEhB,MAAM,EACJ,KACA,WACA,eACA,OACA,WACA,eACA,gBACA,cACA,iBACE;CAEJ,MAAM,YAA+C,MAAM;CAC3D,MAAM,EAAE,SAAS;CAEjB,MAAM,eAAuE,WAAc;EACzF,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;EAE7E,OAAO;GACL,SAAS,UAAqB,OAAO,WAAW,KAAK,CAAC,CAAC,oBAAoB,QAAQ,KAAK,CAAC;GACzF,SAAS,SAA6B;IAEpC,OAAO,OAAO,kBAAkB,KAAK,CAAC,CAAC,IAAI;GAC7C;EACF;CACF;CAEA,MAAMA,YACJ,QACA,UACGC,OAAW,YAAY,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC;CAEjD,MAAM,iBAAiB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC9D,SACA,WACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,OAAO,QAAQ;EACrB,MAAM,QAAQ,KAAK;EACnB,MAAM,WAAW,KAAK,WAAW,SAAS,SAAS;EAEnD,UAAU,KAAK,WAAW,UAAU,QAAQ,MAAM,SAAS;EAE3D,MAAM,OAAO,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,GAAG;GACxF,OAAO;GACP,SAAS,CACP,mBAAG,IAAI,IAAY;IACjB,MAAM;IACN,MAAM;IACN,MAAM;IACN,GAAG,QAAQ,MAAM,OAAO;GAC1B,CAAC,CACH;EACF,CAAC,EAAA,CAAG,KAAK;EAET,IAAI,QAAQ,KAAA,KAAa,CAAC,MAAM,eAAe,IAAI,MAAM,OAAO,GAAG,OAAO,KAAA;EAC1E,UAAU,KAAK,WAAW,OAAO,MAAM,SAAS,UAAU,GAAG,CAAC,GAAG,QAAQ,CAAC;EAC1E,MAAM,SAAS,GAAG,wBAAwB,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,GAAG,MAAM,eAAe,EAAE;EAEzI,IAAI,EAAE,OAAO,MAAM,MAAM,MAAM,IAAI,OAAO,KAAA;EAC1C,MAAM,eAAe,KAAK,MAAM;EAChC,MAAM,SAAS,KAAK;EAEpB,MAAM,WAAW,OAAO,MAAM,KAC5B,OAAO,OACP,KAAK,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,SAAS,CAAC,GAAG,OAAO,eAAe,GAClF;GACE,OAAO;GACP,SAAS,cAAc,MAAM;GAC7B,SAAS,IAAI,OAAO,OAAO,OAAO,YAAY;EAChD,CACF,EAAA,CAAG;EAEH,MAAM,WAAW,oBAAoB,iBAAiB;GACpD;GACA,kBAAkB,IAAI,MAAM;GAC5B,aAAa,QAAQ,KAAK,WAAW;IACnC,cAAc,MAAM,OAAO;IAC3B,UAAU,MAAM,OAAO;GACzB,EAAE;EACJ,CAAC;EAED,UACE,IAAI,IAAI,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAC7D,SAAS,YAAY,MACzB;EAEA,OAAO;GAAE;GAAW;GAAU;GAAK;EAAS;CAC9C,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC9D,SACA,SACA,MACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,KAAK;EAE3B,QAAQ,OAAO,MAAM,KACnB,MAAM,OACN,KACE,MAAM,MAAM,OAAO,GAAG,MAAM,YAAY,QAAQ,SAAS,CAAC,GAC1D,MAAM,iBACN,SAAS,KAAA,IAAY,KAAA,IAAY,MAAM,MAAM,OAAO,GAAG,MAAM,OAAO,KAAK,CAAC,CAC5E,GACA;GAAE,OAAO;GAAI,SAAS,IAAI,MAAM,OAAO,MAAM,YAAY;EAAE,CAC7D,EAAA,CAAG;CACL,CAAC;CAED,MAAM,WAAW,SAAc,QAAa;EAC1C,MAAM,QAAQ,QAAQ,KAAK;EAC3B,MAAM,QAAQ,QAAQ,MAAM;EAC5B,MAAM,UAAU,MAAM,OAAO,UAAU,GAAG,CAAC;EAE3C,OAAO,oBAAoB,0BAA0B;GACnD,cAAc,QAAQ;GACtB,MAAM,IAAI,MAAM;GAChB,eAAe,QAAQ;GACvB,iBAAiB,QAAQ,MAAM,cAAc,IAAI,MAAM,UAAU;GACjE,GAAI,IAAI,QAAQ,UAAU,gBAAgB,QAC1C,IAAI,QAAQ,UAAU,gBAAgB,KAAA,IAClC,CAAC,IACD,EAAE,kBAAkB,QAAQ,MAAM,cAAc,IAAI,QAAQ,UAAU,WAAW,EAAE;EACzF,CAAC;CACH;CAEA,MAAM,kBAAkB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAChE,SACA,SACA,KACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,OAAO,QAAQ;EACrB,MAAM,QAAQ,KAAK;EAEnB,MAAM,UAAU,oBAAoB,mBAAmB;GACrD,GAAG,MAAM,OAAO,UAAU,GAAG,CAAC;GAC9B,UAAU,QAAQ;GAClB,QAAQ;EACV,CAAC;EAED,UACE,QAAQ,iBAAiB,IAAI,MAAM,iBACjC,QAAQ,QAAQ,SAAS,QAAQ,QACjC,KAAK,WAAW,OAAO,MAAM,gBAAgB,UAAU,GAAG,CAAC,GAAG,QAAQ,QAAQ,CAClF;EACA,MAAM,YAAY,KAAK;EACvB,MAAM,MAAM,OAAO,cAAc,QAAQ,MAAM,QAAQ,oBAAoB;EAE3E,MAAM,SAAS,OAAO,MAAM,KAC1B,UAAU,OACV,MAAM,UAAU,OAAO,GAAG,UAAU,gBAAgB,IAAI,CAAC,GACzD;GAAE,OAAO;GAAG,SAAS,cAAc,SAAS;EAAE,CAChD,EAAA,CAAG,KAAK;EAER,IACE,UAAU,KAAA,KACV,CAAC,UAAU,aAAa,MAAM,UAAU,MAAM,KAC9C,CAAC,KAAK,WAAW,OAAO,UAAU,gBAAgB,UAAU,KAAK,CAAC,GAAG,QAAQ,QAAQ,GAErF,OAAO,KAAA;EACT,UACE,MAAM,UAAU,UAAU,QAAQ,QAChC,MAAM,UAAU,0BAA0B,QAAQ,wBAClD,MAAM,UAAU,kBAAkB,QAAQ,gBAC1C,IAAI,MAAM,mBAAmB,GACjC;EACA,MAAM,SAAS,KAAK;EACpB,MAAM,eAAe,OAAO,UAAU,QAAQ,MAAM,QAAQ,UAAU;EAEtE,MAAM,QAAQ,OAAO,MAAM,KACzB,OAAO,OACP,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,aAAa,CAAC,GACxD;GAAE,OAAO;GAAG,SAAS,cAAc,MAAM;EAAE,CAC7C,EAAA,CAAG,KAAK;EAER,IACE,SAAS,KAAA,KACT,CAAC,OAAO,aAAa,KAAK,OAAO,MAAM,KACvC,CAAC,KAAK,WAAW,OAAO,OAAO,gBAAgB,UAAU,IAAI,CAAC,GAAG,QAAQ,QAAQ,GAEjF,OAAO,KAAA;EACT,UACE,KAAK,OAAO,UAAU,QAAQ,QAC5B,KAAK,OAAO,gBAAgB,QAAQ,cACpC,IAAI,MAAM,eAAe,YAC7B;EACA,UACE,QAAQ,SAAS,YAAY,MAC1B,SACC,KAAK,iBAAiB,QAAQ,gBAC9B,KAAK,aAAa,IAAI,MAAM,mBAChC,CACF;EAEA,OAAO;CACT,CAAC;CAED,MAAM,oBAAoB,SAAc,YACtC,oBACE,yBACA,QAAQ,MAAM,OAAO,WAAW,UAAU,QAAQ,GAAG,CAAC,CACxD;CAEF,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,SACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,YAAY,QAAQ,MAAM,OAAO,SAAS,QAAQ,QAAQ;EAChE,MAAM,UAAU,OAAO,MAAM,MAAM,SAAS;EAE5C,IAAI,SAAS,MAAM,eAAe,KAAK,SAAS;EAEhD,OAAO;CACT,CAAC;CAED,MAAM,oBAAoB,aAA8B;EACtD,UAAU,SAAS,QAAQ,SAAS,YAAY;EAChD,MAAM,UAAU,SAAS;EAEzB,OAAOD,SACL,OAAO,MAAM;GACX;GACA,OAAO,QAAQ,YAAY;GAC3B,OAAO,OAAO;IAAE,GAAG,aAAa;IAAQ,MAAM;GAAa,CAAC;GAC5D;GACA;GACA;GACA,OAAO,MAAM,iBAAiB;EAChC,CAAC,GACD;GACE,SAAS;GACT;GACA;IACE,QAAQ,SAAS;IACjB,WAAW,SAAS;IACpB,WAAW,SAAS,QAAQ;IAC5B,MAAM,QAAQ;GAChB;GACA,SAAS;GACT,QAAQ;GACR,QAAQ;GACR,SAAS;EACX,CACF;CACF;CAEA,MAAM,gBAAgB,UAAkB,WAAmB,eACzDA,SACE,OAAO,MAAM;EACX;EACA,OAAO,QAAQ,QAAQ;EACvB,aAAa,OAAO;EACpB;CACF,CAAC,GACD;EACE,gBAAgB,KAAK,QAAQ;EAC7B;EACA,aAAa,OAAO,UAAU,KAAK,SAAS;EAC5C;CACF,CACF;CAEF,MAAM,kBAAkB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAChE,SACA,SACA,eACA,UAOA,QACA,UACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,EAAE,WAAW,aAAa;EAEhC,IACE,UAAU,aAAa,QAAQ,YAC/B,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,WAAW,SAAS,UAC9B,UAAU,kBAAkB,SAAS,iBACrC,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,SAAS,iBACpC,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,QAAQ,SAAS,cAAc,SAAS,SAAS,aACjD,QAAQ,SAAS,qBAAqB,SAAS,SAAS,oBACxD,SAAS,SAAS,cAAc,QAAQ,aACxC,SAAS,SAAS,qBAAqB,QAAQ,SAAS,kBAExD,OAAO;EACT,KAAK,MAAM,YAAY,CAAC,SAAS,UAAU,SAAS,QAAQ,GAC1D,IACE,SAAS,YAAY,MAClB,SACC,CAAC,QAAQ,SAAS,YAAY,MAC3B,YACC,QAAQ,iBAAiB,KAAK,gBAAgB,QAAQ,aAAa,KAAK,QAC5E,CACJ,GAEA,OAAO;EACX,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,IACE,SAAS,OAAO,MACb,UACC,SAAS,cAAc,MAAM,UAAU,IAAI,OAC3C,CAAC,SAAS,SAAS,YAAY,MAAM,SAAS,KAAK,iBAAiB,MAAM,YAAY,CAC1F,GAEA,OAAO;EAET,MAAM,qBAGF,QAAQ,MAAM,OAAO,YAAY,UAAU,QAAQ,GAAG,GAAG,SAAS,MAAM;EAE5E,MAAM,UAAU,oBAAoB,oBAAoB,OAAO,kBAAkB;EAEjF,KAAK,MAAM,eAAe;GACxB,cAAc;GACd;GACA,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,CAAC,QAAQ;EAC7C,GAAG;GACD,MAAM,MAAM,KAAK,IAAI,OAAO,0BAA0B,YAAY,gBAAgB;GAElF,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;GAEA,MAAM,UAAU,IAAI,IAAI,MAAM,SAAS,UAAU,MAAM,OAAO,CAAC;GAE/D,IACE,CAAC,YAAY,aAAa,MACvB,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,IAAI,IAAI,MAAM,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,QAChD,YAAY,sBACd,MAAM,MACH,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ,GAEA,OAAO;GACT,MAAM,eAAe,KACnB,KACE,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAC1C,GAAG,MAAM,KACN,UACC,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KACxF,CACF,CACF;EACF;EACA,MAAM,YAAY,QAAQ,MAAM,OAAO,OAAO,QAAQ,UAAU,aAAa;EAE7E,IAAI,EAAE,OAAO,MAAM,MAAM,SAAS,IAAI,OAAO;EAC7C,MAAM,eAAe,KAAK,SAAS;EAEnC,OAAO;CACT,CAAC;CAED,MAAM,uBACJ,SACA,UACA,WAEA,YAAY,yBAAyB,CAAC,CAAC,OAAO,QAAQ,MACpD,YAAY,yBAAyB,CAAC,CAAC,OAAO,QAAQ,aAAa,MAAM,MAC1E,CAAC,OAAO,gCAAgC,SAAS,qBAAqB;CAEzE,MAAM,aAAa,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACjE,SACA,SACA,cACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,KAAK;EAC3B,MAAM,WAAW,gBAAgB,OAAO,iBAAiB,KAAK,MAAM,MAAM;EAE1E,OAAO,MAAM,OACX,MAAM,OACN,GAAG,MAAM,KAAK,QAAQ,SAAS,GAC/B,GAAG,MAAM,mBAAmB,SAAS,CACvC;EAEA,MAAM,QAAQ;GACZ,WAAW,QAAQ;GACnB,kBAAkB,QAAQ,SAAS;GACnC,kBAAkB;GAClB;EACF;EAEA,KAAK,MAAM,YAAY,QAAQ,aAAa,WAAW;GACrD,OAAO,MAAM,MACX,MAAM,SACH,OAAO,SAAS,KAAK,CAAC,CACtB,IAAI,SAAS,OAAO,KAAK,CAAC,CAAC,CAC3B,MAAM,SAAS,MAAM,KAAK,CAAC,CAChC;GACA,MAAM,eAAe,KAAK,SAAS,cAAc,KAAK,CAAC;EACzD;EACA,MAAM,eAAe,KAAK,QAAQ,aAAa,cAAc,KAAK,CAAC;EACnE,MAAM,OAAO,QAAQ;EACrB,MAAM,QAAQ,OAAO,aAAa,QAAQ,SAAS;EAEnD,MAAM,QAAQ,KACZ,MAAM,KAAK,OAAO,GAAG,KAAK,eAAe,MAAM,CAAC,GAChD,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,QAAQ,IAAI,KAAK,OAAO,QAAQ,EACvF;EAEA,OAAO,MAAM,MACX,MAAM,SACH,OAAO,KAAK,KAAK,CAAC,CAClB,IAAI;IAAG,KAAK,QAAQ,KAAK,OAAO;IAAW,KAAK,UAAU,MAAM;EAAO,CAAC,CAAC,CACzE,MAAM,KAAK,CAChB;EACA,KAAK,MAAM,eAAe,MAAM,cAC9B,IAAI,YAAY,UAAU,KAAK,OAC7B,YAAY,OAAO,YAAY,KAAK,KAAK,QACvC,IAAI,KAAK,kBAAkB,SAC3B,CAAC,KAAK,OAAO,SAAS,KAAK,OAAO,OAAO,CAAC,CAAC,SAAS,IAAI,KAAK,MAAM,IAC/D;GAAE,GAAG;IAAM,KAAK,QAAQ,KAAK,OAAO;IAAW,KAAK,UAAU,MAAM;EAAO,IAC3E,GACN;EACJ,MAAM,eAAe,KAAK,GAAG,4BAA4B,KAAK,MAAM,SAAS,MAAM,EAAE;EAErF,OAAO;CACT,CAAC;CAED,MAAM,qBACJ,UACA,aAQA,SAAS,QAAQ,WAAW,MAAM,cAAc,cAAc,SAAS,SAAS,MAC/E,SAAS,QAAQ,qBAAqB,cAAc,SAAS,kBAC7D,CAAC,SAAS,eAAe,SAAS,mBACnC,CAAC,SAAS,mBAAmB,MAAM,SAAS,KAAK,OAAO,SAAS,oBAAoB;CA0JvF,OAAO;EACL;EACA,QAAA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,kBAvKuB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,SACA,UACA,UACA,KACA;GACA,MAAM,QAAQ,OAAO;GAErB,UAAU,SAAS,QAAQ,SAAS,gBAAgB,SAAS,QAAQ,SAAS,cAAc;GAC5F,MAAM,OAAO,QAAQ;GACrB,MAAM,QAAQ,QAAQ;GACtB,MAAM,KAAK,kBAAkB,OAAO,aAAa,KAAK,MAAM,MAAM;GAElE,MAAM,aAAa,oBAAoB,mBAAmB;IACxD,cAAc;IACd,MAAM,SAAS,QAAQ;IACvB,sBAAsB,SAAS;IAC/B,YAAY,SAAS,QAAQ;IAC7B,WAAW,SAAS;IACpB,WAAW,SAAS;IACpB,SAAS,SAAS;IAClB,UAAU;KACR,GAAG,QAAQ;KACX,aAAa,CACX,GAAG,QAAQ,SAAS,aACpB;MACE,cAAc;MACd,UAAU,gBAAgB,OAAO,iBAAiB,KAAK,MAAM,MAAM;KACrE,CACF;IACF;IACA,QAAQ;IACR,eAAe,SAAS,QAAQ,iBAAiB,SAAS;IAC1D,wBAAwB,SAAS;IACjC,gBAAgB,SAAS;IACzB,aAAa,SAAS;IACtB,SAAS,SAAS;IAClB,gBAAgB,SAAS;GAC3B,CAAC;GAED,MAAM,OAAO,oBAAoB,0BAA0B;IACzD,cAAc;IACd,MAAM,SAAS,QAAQ;IACvB,eAAe,WAAW;IAC1B,iBAAiB;GACnB,CAAC;GAED,MAAM,QAAQ;IAAE,WAAW,QAAQ;IAAU;IAAY,SAAS;IAAM,QAAQ,MAAM;GAAO;GAC7F,MAAM,WAAW,OAAO,cAAc,WAAW,MAAM,WAAW,oBAAoB;GACtF,MAAM,eAAe,OAAO,UAAU,WAAW,MAAM,WAAW,UAAU;GAC5E,MAAM,QAAQ,KAAK;GAEnB,MAAM,SAAS,OAAO,MAAM,KAC1B,MAAM,OACN,MAAM,MAAM,OAAO,GAAG,MAAM,gBAAgB,SAAS,CAAC,GACtD,EAAE,OAAO,EAAE,CACb;GAEA,UAAU,OAAO,KAAK,WAAW,CAAC;GAElC,MAAM,WAAW,OAAO,MAAM,OAC5B,MAAM,OACN;IACE,GAAG,MAAM,oBAAoB,aAAa,KAAK;KAC9C,MAAM,gBAAgB;KACtB,MAAM,OAAO,WAAW;KACxB,MAAM,uBAAuB,WAAW;KACxC,MAAM,YAAY,QAAQ;KAC1B,MAAM,eAAe;KACrB,MAAM,QAAQ,MAAM,oBAAoB;KACxC,MAAM,UAAU,MAAM;KACtB,MAAM,gBAAgB;GACzB,GACA,GAAG,MAAM,gBAAgB,SAAS,CACpC;GAEA,OAAO,OAAO,SAAS;GACvB,MAAM,QAAQ,KAAK;GAEnB,MAAM,SAAS;IACb,GAAG,MAAM,WAAW,aAAa,KAAK;KACrC,MAAM,eAAe;KACrB,MAAM,YAAY,QAAQ;KAC1B,MAAM,OAAO,WAAW;KACxB,MAAM,uBAAuB,WAAW;KACxC,MAAM,gBAAgB;KACtB,MAAM,YAAY;KAClB,MAAM,aAAa,WAAW;KAC9B,MAAM,YAAY,WAAW;KAC7B,MAAM,qBAAqB,MAAM;KACjC,MAAM,SAAS,MAAM,WAAW;KAChC,MAAM,gBAAgB,MAAM,WAAW,oBAAoB,WAAW,aAAa;KACnF,MAAM,yBAAyB,MAAM,WAAW,6BAC/C,WAAW,sBACb;KACC,MAAM,iBAAiB,MAAM,WAAW,qBAAqB,WAAW,cAAc;KACtF,MAAM,cAAc,QAAQ,UAAU,kBAAkB,WAAW,WAAW;KAC9E,MAAM,UAAU,WAAW;KAC3B,MAAM,iBAAiB,WAAW;KAClC,MAAM,WAAW,OAAO,KAAK;KAC7B,MAAM,WAAW,YAAY,QAAQ,MAAM,cAAc,GAAG;KAC5D,QAAQ,UAAU,aAAa;GAClC;GAEA,OAAO,MAAM,OAAO,MAAM,OAAO,QAAQ,GAAG,MAAM,eAAe,GAAG,CAAC;GACrE,KAAK,MAAM,eAAe,MAAM,cAC9B,IACE,YAAY,UAAU,MAAM,SAC5B,YAAY,SAAS,SAAS,QAC9B,CAAC,YAAY,KAAK,MAAM,QAAQ,IAAI,MAAM,kBAAkB,EAAE,GAE9D,YAAY,OAAO,CAAC,GAAG,YAAY,MAAM,MAAM;GACnD,MAAM,SAAS,KAAK;GAEpB,MAAM,eAAe;IACnB,GAAG,MAAM,UAAU,aAAa,KAAK;KACpC,OAAO,YAAY,QAAQ;KAC3B,OAAO,eAAe;KACtB,OAAO,WAAW,MAAM;KACxB,OAAO,SAAS,MAAM,UAAU;GACnC;GAEA,OAAO,MAAM,OAAO,OAAO,OAAO,cAAc;KAC7C,OAAO,YAAY,QAAQ;KAC3B,OAAO,eAAe;GACzB,CAAC;GACD,KAAK,MAAM,eAAe,MAAM,cAC9B,IACE,YAAY,UAAU,OAAO,SAC7B,CAAC,YAAY,KAAK,MAAM,QAAQ,IAAI,OAAO,kBAAkB,EAAE,GAE/D,YAAY,OAAO,CAAC,GAAG,YAAY,MAAM,YAAY;GAEzD,MAAM,UAAU,oBAAoB,mBAAmB;IACrD,GAAG,MAAM,OAAO,UAAU,MAAM,CAAC;IACjC,UAAU,WAAW;IACrB,QAAQ;GACV,CAAC;GAED,UACE,eAAe,SAAS,UAAU,KAChC,QAAQ,YAAY,WAAW,WAC/B,QAAQ,mBAAmB,WAAW,kBACtC,QAAQ,gBAAgB,WAAW,WACvC;GACA,UAAU,QAAQ,SAAS,MAAM,CAAC,CAAC,iBAAiB,EAAE;GACtD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK;GAEzE,OAAO;EACT,CAiBiB;CACjB;AACF"}
1	+ {"version":3,"file":"write-state.mjs","names":["digest","digestText"],"sources":["../../../src/internal/passkey/write-state.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. /\n\nimport {\n type PasskeyActionAuthorization,\n type PasskeyCeremony,\n PasskeyBegin,\n PasskeyCredential,\n PasskeyCredentialSummary,\n PasskeyDescriptor,\n PasskeyLabel,\n PasskeyModuleId,\n PasskeyProfile,\n PasskeyRequirement,\n PasskeyRevision,\n PasskeyUserHandle,\n PasskeyManagementPolicy,\n snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport { type SubjectId } from \"@yielded/auth/Schema\";\nimport { SessionInvalidationWindow } from \"@yielded/auth/Sessions\";\nimport { DateTime, Effect, Schema } from \"effect\";\n\nimport { digest as digestText } from \"../crypto\";\nimport type { PersistenceMappingError } from \"../mapping-error\";\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport interface WriteSubject {\n readonly subjectId: SubjectId;\n readonly nativeId: any;\n readonly row: Record<string, any>;\n readonly revision: typeof PasskeyRevision.Type;\n}\n\nexport const makePasskeyWriteStateKernel = (\n operations: QueryOperations,\n state: Pick<\n ReturnType<typeof makePasskeyStateKernel>,\n \| \"col\"\n \| \"copiedRow\"\n \| \"credentialKey\"\n \| \"equal\"\n \| \"handleKey\"\n \| \"invariant\"\n \| \"mappedColumns\"\n \| \"sameCredential\"\n \| \"sameRevision\"\n \| \"subjectScope\"\n >,\n transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n const { sql } = operations;\n\n const {\n col,\n copiedRow,\n credentialKey,\n equal,\n handleKey,\n mappedColumns,\n sameCredential,\n sameRevision,\n subjectScope,\n } = state;\n\n const invariant: (value: unknown) => asserts value = state.invariant;\n const { both } = transactions;\n\n const jsonStorage = <S extends Schema.Codec<unknown, unknown, never, never>>(schema: S) => {\n const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n\n return {\n encode: (value: S[\"Type\"]) => Schema.encodeSync(codec)(snapshotPasskeySync(schema, value)),\n decode: (text: unknown): S[\"Type\"] => {\n // oxlint-disable-next-line no-restricted-properties -- persisted private JSON enters through its schema.\n return Schema.decodeUnknownSync(codec)(text);\n },\n };\n };\n\n const digest = <S extends Schema.Codec<unknown, unknown, never, never>>(\n schema: S,\n value: S[\"Type\"],\n ) => digestText(jsonStorage(schema).encode(value));\n\n const currentSubject = Effect.fn(\"passkey.currentWriteSubject\")(function (\n mapping: any,\n subjectId: SubjectId,\n ) {\n const owner = yield* CurrentPasskeyTransaction;\n const read = mapping.read;\n const table = read.subject;\n const nativeId = read.subjectIds.toNative(subjectId);\n\n invariant(read.subjectIds.toSubject(nativeId) === subjectId);\n\n const row = (yield* owner.read(table.table, equal(table.table, { [table.id]: nativeId }), {\n limit: 1,\n columns: [\n ...new Set<string>([\n table.id,\n table.status,\n table.securityRevision,\n ...mapping.write.policy.subjectColumns,\n ]),\n ],\n })).rows[0];\n\n if (row === undefined \|\| !table.isActiveStatus(row[table.status])) return undefined;\n invariant(read.subjectIds.equals(table.decodeId(copiedRow(row)), nativeId));\n const active = sql`exists(select 1 from ${table.table} where ${both(equal(table.table, { [table.id]: nativeId }), table.activeCondition)})`;\n\n if (!(yield* owner.check(active))) return undefined;\n owner.postconditions.push(active);\n const factor = read.authority;\n\n const factors = (yield* owner.read(\n factor.table,\n both(equal(factor.table, { [factor.subjectId]: nativeId }), factor.activeCondition),\n {\n limit: 64,\n columns: mappedColumns(factor),\n orderBy: col(factor.table, factor.credentialId),\n },\n )).rows;\n\n const revision = snapshotPasskeySync(PasskeyRevision, {\n subjectId,\n securityRevision: row[table.securityRevision],\n credentials: factors.map((value) => ({\n credentialId: value[factor.credentialId],\n revision: value[factor.revision],\n })),\n });\n\n invariant(\n new Set(revision.credentials.map((item) => item.credentialId)).size ===\n revision.credentials.length,\n );\n\n return { subjectId, nativeId, row, revision };\n });\n\n const credentialRows = Effect.fn(\"passkey.writeCredentialRows\")(function* (\n mapping: any,\n subject: WriteSubject,\n rpId?: string,\n ) {\n const owner = yield* CurrentPasskeyTransaction;\n const table = mapping.read.credential;\n\n return (yield* owner.read(\n table.table,\n both(\n equal(table.table, { [table.subjectId]: subject.nativeId }),\n table.activeCondition,\n rpId === undefined ? undefined : equal(table.table, { [table.rpId]: rpId }),\n ),\n { limit: 64, orderBy: col(table.table, table.credentialId) },\n )).rows;\n });\n\n const summary = (mapping: any, row: any) => {\n const table = mapping.read.credential;\n const write = mapping.write.credential;\n const decoded = table.decode(copiedRow(row));\n\n return snapshotPasskeySync(PasskeyCredentialSummary, {\n credentialId: decoded.credentialId,\n name: row[write.name],\n primarySignIn: decoded.primarySignIn,\n createdAtMillis: mapping.clock.decodeInstant(row[write.createdAt]),\n ...(row[mapping.telemetry.lastUsedAt] === null \|\|\n row[mapping.telemetry.lastUsedAt] === undefined\n ? {}\n : { lastUsedAtMillis: mapping.clock.decodeInstant(row[mapping.telemetry.lastUsedAt]) }),\n });\n };\n\n const ownedCredential = Effect.fn(\"passkey.ownedWriteCredential\")(function* (\n mapping: any,\n subject: WriteSubject,\n row: any,\n ) {\n const owner = yield* CurrentPasskeyTransaction;\n const read = mapping.read;\n const table = read.credential;\n\n const decoded = snapshotPasskeySync(PasskeyCredential, {\n ...table.decode(copiedRow(row)),\n revision: subject.revision,\n active: true,\n });\n\n invariant(\n decoded.credentialId === row[table.credentialId] &&\n decoded.profile.rpId === decoded.rpId &&\n read.subjectIds.equals(table.decodeSubjectId(copiedRow(row)), subject.nativeId),\n );\n const ownership = read.credentialOwnership;\n const key = yield* credentialKey(decoded.rpId, decoded.protocolCredentialId);\n\n const tuple = (yield* owner.read(\n ownership.table,\n equal(ownership.table, { [ownership.credentialKey]: key }),\n { limit: 1, columns: mappedColumns(ownership) },\n )).rows[0];\n\n if (\n tuple === undefined \|\|\n !ownership.isOwnedState(tuple[ownership.state]) \|\|\n !read.subjectIds.equals(ownership.decodeSubjectId(copiedRow(tuple)), subject.nativeId)\n )\n return undefined;\n invariant(\n tuple[ownership.rpId] === decoded.rpId &&\n tuple[ownership.protocolCredentialId] === decoded.protocolCredentialId &&\n tuple[ownership.credentialId] === decoded.credentialId &&\n row[table.credentialKey] === key,\n );\n const handle = read.handleOwnership;\n const hashedHandle = yield* handleKey(decoded.rpId, decoded.userHandle);\n\n const held = (yield* owner.read(\n handle.table,\n equal(handle.table, { [handle.handleKey]: hashedHandle }),\n { limit: 1, columns: mappedColumns(handle) },\n )).rows[0];\n\n if (\n held === undefined \|\|\n !handle.isOwnedState(held[handle.state]) \|\|\n !read.subjectIds.equals(handle.decodeSubjectId(copiedRow(held)), subject.nativeId)\n )\n return undefined;\n invariant(\n held[handle.rpId] === decoded.rpId &&\n held[handle.userHandle] === decoded.userHandle &&\n row[table.handleKey] === hashedHandle,\n );\n invariant(\n subject.revision.credentials.some(\n (item) =>\n item.credentialId === decoded.credentialId &&\n item.revision === row[table.credentialRevision],\n ),\n );\n\n return decoded;\n });\n\n const managementPolicy = (mapping: any, subject: WriteSubject) =>\n snapshotPasskeySync(\n PasskeyManagementPolicy,\n mapping.write.policy.management(copiedRow(subject.row)),\n );\n\n const metadataAllowed = Effect.fn(\"passkey.metadataAllowed\")(function* (\n mapping: any,\n subject: WriteSubject,\n ) {\n const owner = yield* CurrentPasskeyTransaction;\n const condition = mapping.write.policy.metadata(subject.nativeId);\n const allowed = yield* owner.check(condition);\n\n if (allowed) owner.postconditions.push(condition);\n\n return allowed;\n });\n\n const enrollmentDigest = (ceremony: PasskeyCeremony) => {\n invariant(ceremony.context._tag === \"Enrollment\");\n const context = ceremony.context;\n\n return digest(\n Schema.Tuple([\n PasskeyModuleId,\n Schema.Literal(\"enrollment\"),\n Schema.Struct({ ...PasskeyBegin.fields, name: PasskeyLabel }),\n PasskeyProfile,\n PasskeyRevision,\n PasskeyUserHandle,\n Schema.Array(PasskeyDescriptor),\n ]),\n [\n ceremony.moduleId,\n \"enrollment\",\n {\n flowId: ceremony.flowId,\n commandId: ceremony.commandId,\n profileId: ceremony.profile.profileId,\n name: context.name,\n },\n ceremony.profile,\n context.revision,\n context.userHandle,\n ceremony.allowedCredentials,\n ],\n );\n };\n\n const removeDigest = (moduleId: string, commandId: string, credential: PasskeyCredential) =>\n digest(\n Schema.Tuple([\n PasskeyModuleId,\n Schema.Literal(\"remove\"),\n PasskeyBegin.fields.commandId,\n PasskeyCredential,\n ]),\n [\n PasskeyModuleId.make(moduleId),\n \"remove\",\n PasskeyBegin.fields.commandId.make(commandId),\n credential,\n ],\n );\n\n const authorizeAction = Effect.fn(\"passkey.authorizeWriteAction\")(function* (\n mapping: any,\n subject: WriteSubject,\n authorization: PasskeyActionAuthorization,\n expected: {\n readonly action: PasskeyActionAuthorization[\"challenge\"][\"action\"];\n readonly commandId: string;\n readonly flowId: string;\n readonly bindingDigest: string;\n readonly revision: typeof PasskeyRevision.Type;\n },\n policy: PasskeyManagementPolicy,\n original?: typeof PasskeyRequirement.Type,\n ) {\n const owner = yield* CurrentPasskeyTransaction;\n const { challenge, evidence } = authorization;\n\n if (\n challenge.moduleId !== mapping.moduleId \|\|\n challenge.action !== expected.action \|\|\n challenge.commandId !== expected.commandId \|\|\n challenge.flowId !== expected.flowId \|\|\n challenge.bindingDigest !== expected.bindingDigest \|\|\n evidence.flowId !== expected.flowId \|\|\n evidence.bindingDigest !== expected.bindingDigest \|\|\n !sameRevision(challenge.revision, expected.revision) \|\|\n subject.revision.subjectId !== expected.revision.subjectId \|\|\n subject.revision.securityRevision !== expected.revision.securityRevision \|\|\n evidence.revision.subjectId !== subject.subjectId \|\|\n evidence.revision.securityRevision !== subject.revision.securityRevision\n )\n return false;\n for (const revision of [expected.revision, evidence.revision])\n if (\n revision.credentials.some(\n (item) =>\n !subject.revision.credentials.some(\n (current) =>\n current.credentialId === item.credentialId && current.revision === item.revision,\n ),\n )\n )\n return false;\n const now = yield* owner.now(mapping.clock);\n\n if (\n evidence.proofs.some(\n (proof) =>\n DateTime.toEpochMillis(proof.verifiedAt) > now \|\|\n !evidence.revision.credentials.some((item) => item.credentialId === proof.credentialId),\n )\n )\n return false;\n\n const currentRequirement: Effect.Effect<\n typeof PasskeyRequirement.Type,\n PersistenceMappingError\n > = mapping.write.policy.requirement(copiedRow(subject.row), expected.action);\n\n const current = snapshotPasskeySync(PasskeyRequirement, yield* currentRequirement);\n\n for (const requirement of [\n authorization.requirement,\n current,\n ...(original === undefined ? [] : [original]),\n ]) {\n const age = Math.min(policy.maximumEvidenceAgeMillis, requirement.maximumAgeMillis);\n\n const fresh = evidence.proofs.filter(\n (proof) => now - DateTime.toEpochMillis(proof.verifiedAt) < age,\n );\n\n const factors = new Set(fresh.flatMap((proof) => proof.factors));\n\n if (\n !requirement.alternatives.some(\n (alternative) =>\n alternative.factors.every((factor) => factors.has(factor)) &&\n new Set(fresh.map((proof) => proof.credentialId)).size >=\n alternative.minimumCredentials &&\n fresh.some(\n (proof) =>\n (!alternative.userVerified \|\| proof.userVerified) &&\n (!alternative.phishingResistant \|\| proof.phishingResistant),\n ),\n )\n )\n return false;\n owner.postconditions.push(\n both(\n sql`${mapping.clock.engineNowMillis} >= ${now}`,\n ...fresh.map(\n (proof) =>\n sql`${mapping.clock.engineNowMillis} < ${DateTime.toEpochMillis(proof.verifiedAt) + age}`,\n ),\n ),\n );\n }\n const condition = mapping.write.policy.action(subject.nativeId, authorization);\n\n if (!(yield* owner.check(condition))) return false;\n owner.postconditions.push(condition);\n\n return true;\n });\n\n const invalidationMatches = (\n mapping: any,\n supplied: SessionInvalidationWindow,\n policy: PasskeyManagementPolicy,\n ) => {\n if (supplied.existingSessions === \"cache-expiry\" && supplied.maximumExposureMillis === 0)\n return false;\n\n // Cookie-cache exposure does not weaken the mapping's authoritative\n // revision bump. Compare that immediate guarantee independently of the TTL.\n const authoritative: SessionInvalidationWindow =\n supplied.existingSessions === \"cache-expiry\" &&\n mapping.invalidation.window.existingSessions === \"immediate\"\n ? { ...supplied, existingSessions: \"immediate\", maximumExposureMillis: 0 }\n : supplied;\n\n return (\n jsonStorage(SessionInvalidationWindow).encode(authoritative) ===\n jsonStorage(SessionInvalidationWindow).encode(mapping.invalidation.window) &&\n (!policy.requireImmediateInvalidation \|\| supplied.existingSessions === \"immediate\")\n );\n };\n\n const invalidate = Effect.fn(\"passkey.invalidateCredentialChange\")(function* (\n mapping: any,\n subject: WriteSubject,\n invalidation: SessionInvalidationWindow,\n ) {\n const owner = yield* CurrentPasskeyTransaction;\n const table = mapping.read.subject;\n const revision = PasskeyRevision.fields.securityRevision.make(owner.marker);\n\n yield* owner.update(\n table.table,\n { [table.id]: subject.nativeId },\n { [table.securityRevision]: revision },\n );\n\n const input = {\n subjectId: subject.nativeId,\n previousRevision: subject.revision.securityRevision,\n securityRevision: revision,\n invalidation,\n };\n\n for (const mutation of mapping.invalidation.mutations) {\n yield* owner.write(\n owner.database\n .update(mutation.table)\n .set(mutation.values(input))\n .where(mutation.where(input)),\n );\n owner.postconditions.push(mutation.postcondition(input));\n }\n owner.postconditions.push(mapping.invalidation.postcondition(input));\n const flow = mapping.flow;\n const scope = yield* subjectScope(subject.subjectId);\n\n const where = both(\n equal(flow.table, { [flow.subjectScope]: scope }),\n sql`${col(flow.table, flow.state)} in (${flow.states.Pending}, ${flow.states.Claimed})`,\n );\n\n yield* owner.write(\n owner.database\n .update(flow.table)\n .set({ [flow.state]: flow.states.Rejected, [flow.version]: owner.marker })\n .where(where),\n );\n for (const observation of owner.observations)\n if (observation.table === flow.table)\n observation.rows = observation.rows.map((row) =>\n row[flow.subjectScope] === scope &&\n [flow.states.Pending, flow.states.Claimed].includes(row[flow.state])\n ? { ...row, [flow.state]: flow.states.Rejected, [flow.version]: owner.marker }\n : row,\n );\n owner.postconditions.push(sql`not exists(select 1 from ${flow.table} where ${where})`);\n\n return revision;\n });\n\n const validRegistration = (\n ceremony: PasskeyCeremony,\n verified: {\n readonly algorithm: number;\n readonly userVerified: boolean;\n readonly backupEligible: boolean;\n readonly backupState: boolean;\n readonly protocolCredentialId: string;\n },\n ) =>\n ceremony.profile.algorithms.some((algorithm) => algorithm === verified.algorithm) &&\n (ceremony.profile.userVerification !== \"required\" \|\| verified.userVerified) &&\n (!verified.backupState \|\| verified.backupEligible) &&\n !ceremony.allowedCredentials.some((item) => item.id === verified.protocolCredentialId);\n\n const insertCredential = Effect.fn(\"passkey.insertCredential\")(function* (\n mapping: any,\n subject: WriteSubject,\n ceremony: PasskeyCeremony,\n verified: any,\n now: number,\n ) {\n const owner = yield* CurrentPasskeyTransaction;\n\n invariant(ceremony.context._tag === \"Enrollment\" \|\| ceremony.context._tag === \"Registration\");\n const read = mapping.read;\n const write = mapping.write;\n const id = PasskeyCredential.fields.credentialId.make(owner.marker);\n\n const credential = snapshotPasskeySync(PasskeyCredential, {\n credentialId: id,\n rpId: ceremony.profile.rpId,\n protocolCredentialId: verified.protocolCredentialId,\n userHandle: ceremony.context.userHandle,\n publicKey: verified.publicKey,\n algorithm: verified.algorithm,\n profile: ceremony.profile,\n revision: {\n ...subject.revision,\n credentials: [\n ...subject.revision.credentials,\n {\n credentialId: id,\n revision: PasskeyRevision.fields.securityRevision.make(owner.marker),\n },\n ],\n },\n active: true,\n primarySignIn: ceremony.profile.primarySignIn && verified.userVerified,\n enrollmentUserVerified: verified.userVerified,\n backupEligible: verified.backupEligible,\n backupState: verified.backupState,\n counter: verified.counter,\n maximumCounter: verified.counter,\n });\n\n const safe = snapshotPasskeySync(PasskeyCredentialSummary, {\n credentialId: id,\n name: ceremony.context.name,\n primarySignIn: credential.primarySignIn,\n createdAtMillis: now,\n });\n\n const input = { subjectId: subject.nativeId, credential, summary: safe, marker: owner.marker };\n const tupleKey = yield* credentialKey(credential.rpId, credential.protocolCredentialId);\n const hashedHandle = yield* handleKey(credential.rpId, credential.userHandle);\n const tuple = read.credentialOwnership;\n\n const absent = yield* owner.read(\n tuple.table,\n equal(tuple.table, { [tuple.credentialKey]: tupleKey }),\n { limit: 1 },\n );\n\n invariant(absent.rows.length === 0);\n\n const inserted = yield* owner.insert(\n tuple.table,\n {\n ...write.credentialOwnership.encodeInsert(input),\n [tuple.credentialKey]: tupleKey,\n [tuple.rpId]: credential.rpId,\n [tuple.protocolCredentialId]: credential.protocolCredentialId,\n [tuple.subjectId]: subject.nativeId,\n [tuple.credentialId]: id,\n [tuple.state]: write.credentialOwnership.ownedState,\n [tuple.version]: owner.marker,\n [tuple.reservationId]: null,\n },\n { [tuple.credentialKey]: tupleKey },\n );\n\n absent.rows = inserted.rows;\n const table = read.credential;\n\n const values = {\n ...write.credential.encodeInsert(input),\n [table.credentialId]: id,\n [table.subjectId]: subject.nativeId,\n [table.rpId]: credential.rpId,\n [table.protocolCredentialId]: credential.protocolCredentialId,\n [table.credentialKey]: tupleKey,\n [table.handleKey]: hashedHandle,\n [table.userHandle]: credential.userHandle,\n [table.algorithm]: credential.algorithm,\n [table.credentialRevision]: owner.marker,\n [table.status]: write.credential.activeStatus,\n [table.primarySignIn]: write.credential.encodePrimarySignIn(credential.primarySignIn),\n [table.enrollmentUserVerified]: write.credential.encodeEnrollmentUserVerified(\n credential.enrollmentUserVerified,\n ),\n [table.backupEligible]: write.credential.encodeBackupEligible(credential.backupEligible),\n [table.backupState]: mapping.telemetry.encodeBackupState(credential.backupState),\n [table.counter]: credential.counter,\n [table.maximumCounter]: credential.maximumCounter,\n [write.credential.name]: safe.name,\n [write.credential.createdAt]: mapping.clock.encodeInstant(now),\n [mapping.telemetry.lastUsedAt]: null,\n };\n\n yield* owner.insert(table.table, values, { [table.credentialId]: id });\n for (const observation of owner.observations)\n if (\n observation.table === table.table &&\n observation.rows !== inserted.rows &&\n !observation.rows.some((row) => row[table.credentialId] === id)\n )\n observation.rows = [...observation.rows, values];\n const factor = read.authority;\n\n const factorValues = {\n ...write.authority.encodeInsert(input),\n [factor.subjectId]: subject.nativeId,\n [factor.credentialId]: id,\n [factor.revision]: owner.marker,\n [factor.status]: write.authority.activeStatus,\n };\n\n yield* owner.insert(factor.table, factorValues, {\n [factor.subjectId]: subject.nativeId,\n [factor.credentialId]: id,\n });\n for (const observation of owner.observations)\n if (\n observation.table === factor.table &&\n !observation.rows.some((row) => row[factor.credentialId] === id)\n )\n observation.rows = [...observation.rows, factorValues];\n\n const decoded = snapshotPasskeySync(PasskeyCredential, {\n ...table.decode(copiedRow(values)),\n revision: credential.revision,\n active: true,\n });\n\n invariant(\n sameCredential(decoded, credential) &&\n decoded.counter === credential.counter &&\n decoded.maximumCounter === credential.maximumCounter &&\n decoded.backupState === credential.backupState,\n );\n invariant(summary(mapping, values).credentialId === id);\n owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${now}`);\n\n return safe;\n });\n\n return {\n jsonStorage,\n digest,\n currentSubject,\n credentialRows,\n summary,\n ownedCredential,\n managementPolicy,\n metadataAllowed,\n enrollmentDigest,\n removeDigest,\n authorizeAction,\n invalidationMatches,\n invalidate,\n validRegistration,\n insertCredential,\n };\n};\n"],"mappings":";;;;;;;AAoCA,MAAa,+BACX,YACA,OAaA,iBACG;CACH,MAAM,EAAE,QAAQ;CAEhB,MAAM,EACJ,KACA,WACA,eACA,OACA,WACA,eACA,gBACA,cACA,iBACE;CAEJ,MAAM,YAA+C,MAAM;CAC3D,MAAM,EAAE,SAAS;CAEjB,MAAM,eAAuE,WAAc;EACzF,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;EAE7E,OAAO;GACL,SAAS,UAAqB,OAAO,WAAW,KAAK,CAAC,CAAC,oBAAoB,QAAQ,KAAK,CAAC;GACzF,SAAS,SAA6B;IAEpC,OAAO,OAAO,kBAAkB,KAAK,CAAC,CAAC,IAAI;GAC7C;EACF;CACF;CAEA,MAAMA,YACJ,QACA,UACGC,OAAW,YAAY,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC;CAEjD,MAAM,iBAAiB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC9D,SACA,WACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,OAAO,QAAQ;EACrB,MAAM,QAAQ,KAAK;EACnB,MAAM,WAAW,KAAK,WAAW,SAAS,SAAS;EAEnD,UAAU,KAAK,WAAW,UAAU,QAAQ,MAAM,SAAS;EAE3D,MAAM,OAAO,OAAO,MAAM,KAAK,MAAM,OAAO,MAAM,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,GAAG;GACxF,OAAO;GACP,SAAS,CACP,mBAAG,IAAI,IAAY;IACjB,MAAM;IACN,MAAM;IACN,MAAM;IACN,GAAG,QAAQ,MAAM,OAAO;GAC1B,CAAC,CACH;EACF,CAAC,EAAA,CAAG,KAAK;EAET,IAAI,QAAQ,KAAA,KAAa,CAAC,MAAM,eAAe,IAAI,MAAM,OAAO,GAAG,OAAO,KAAA;EAC1E,UAAU,KAAK,WAAW,OAAO,MAAM,SAAS,UAAU,GAAG,CAAC,GAAG,QAAQ,CAAC;EAC1E,MAAM,SAAS,GAAG,wBAAwB,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,GAAG,MAAM,eAAe,EAAE;EAEzI,IAAI,EAAE,OAAO,MAAM,MAAM,MAAM,IAAI,OAAO,KAAA;EAC1C,MAAM,eAAe,KAAK,MAAM;EAChC,MAAM,SAAS,KAAK;EAEpB,MAAM,WAAW,OAAO,MAAM,KAC5B,OAAO,OACP,KAAK,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,SAAS,CAAC,GAAG,OAAO,eAAe,GAClF;GACE,OAAO;GACP,SAAS,cAAc,MAAM;GAC7B,SAAS,IAAI,OAAO,OAAO,OAAO,YAAY;EAChD,CACF,EAAA,CAAG;EAEH,MAAM,WAAW,oBAAoB,iBAAiB;GACpD;GACA,kBAAkB,IAAI,MAAM;GAC5B,aAAa,QAAQ,KAAK,WAAW;IACnC,cAAc,MAAM,OAAO;IAC3B,UAAU,MAAM,OAAO;GACzB,EAAE;EACJ,CAAC;EAED,UACE,IAAI,IAAI,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAC7D,SAAS,YAAY,MACzB;EAEA,OAAO;GAAE;GAAW;GAAU;GAAK;EAAS;CAC9C,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAC9D,SACA,SACA,MACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,KAAK;EAE3B,QAAQ,OAAO,MAAM,KACnB,MAAM,OACN,KACE,MAAM,MAAM,OAAO,GAAG,MAAM,YAAY,QAAQ,SAAS,CAAC,GAC1D,MAAM,iBACN,SAAS,KAAA,IAAY,KAAA,IAAY,MAAM,MAAM,OAAO,GAAG,MAAM,OAAO,KAAK,CAAC,CAC5E,GACA;GAAE,OAAO;GAAI,SAAS,IAAI,MAAM,OAAO,MAAM,YAAY;EAAE,CAC7D,EAAA,CAAG;CACL,CAAC;CAED,MAAM,WAAW,SAAc,QAAa;EAC1C,MAAM,QAAQ,QAAQ,KAAK;EAC3B,MAAM,QAAQ,QAAQ,MAAM;EAC5B,MAAM,UAAU,MAAM,OAAO,UAAU,GAAG,CAAC;EAE3C,OAAO,oBAAoB,0BAA0B;GACnD,cAAc,QAAQ;GACtB,MAAM,IAAI,MAAM;GAChB,eAAe,QAAQ;GACvB,iBAAiB,QAAQ,MAAM,cAAc,IAAI,MAAM,UAAU;GACjE,GAAI,IAAI,QAAQ,UAAU,gBAAgB,QAC1C,IAAI,QAAQ,UAAU,gBAAgB,KAAA,IAClC,CAAC,IACD,EAAE,kBAAkB,QAAQ,MAAM,cAAc,IAAI,QAAQ,UAAU,WAAW,EAAE;EACzF,CAAC;CACH;CAEA,MAAM,kBAAkB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAChE,SACA,SACA,KACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,OAAO,QAAQ;EACrB,MAAM,QAAQ,KAAK;EAEnB,MAAM,UAAU,oBAAoB,mBAAmB;GACrD,GAAG,MAAM,OAAO,UAAU,GAAG,CAAC;GAC9B,UAAU,QAAQ;GAClB,QAAQ;EACV,CAAC;EAED,UACE,QAAQ,iBAAiB,IAAI,MAAM,iBACjC,QAAQ,QAAQ,SAAS,QAAQ,QACjC,KAAK,WAAW,OAAO,MAAM,gBAAgB,UAAU,GAAG,CAAC,GAAG,QAAQ,QAAQ,CAClF;EACA,MAAM,YAAY,KAAK;EACvB,MAAM,MAAM,OAAO,cAAc,QAAQ,MAAM,QAAQ,oBAAoB;EAE3E,MAAM,SAAS,OAAO,MAAM,KAC1B,UAAU,OACV,MAAM,UAAU,OAAO,GAAG,UAAU,gBAAgB,IAAI,CAAC,GACzD;GAAE,OAAO;GAAG,SAAS,cAAc,SAAS;EAAE,CAChD,EAAA,CAAG,KAAK;EAER,IACE,UAAU,KAAA,KACV,CAAC,UAAU,aAAa,MAAM,UAAU,MAAM,KAC9C,CAAC,KAAK,WAAW,OAAO,UAAU,gBAAgB,UAAU,KAAK,CAAC,GAAG,QAAQ,QAAQ,GAErF,OAAO,KAAA;EACT,UACE,MAAM,UAAU,UAAU,QAAQ,QAChC,MAAM,UAAU,0BAA0B,QAAQ,wBAClD,MAAM,UAAU,kBAAkB,QAAQ,gBAC1C,IAAI,MAAM,mBAAmB,GACjC;EACA,MAAM,SAAS,KAAK;EACpB,MAAM,eAAe,OAAO,UAAU,QAAQ,MAAM,QAAQ,UAAU;EAEtE,MAAM,QAAQ,OAAO,MAAM,KACzB,OAAO,OACP,MAAM,OAAO,OAAO,GAAG,OAAO,YAAY,aAAa,CAAC,GACxD;GAAE,OAAO;GAAG,SAAS,cAAc,MAAM;EAAE,CAC7C,EAAA,CAAG,KAAK;EAER,IACE,SAAS,KAAA,KACT,CAAC,OAAO,aAAa,KAAK,OAAO,MAAM,KACvC,CAAC,KAAK,WAAW,OAAO,OAAO,gBAAgB,UAAU,IAAI,CAAC,GAAG,QAAQ,QAAQ,GAEjF,OAAO,KAAA;EACT,UACE,KAAK,OAAO,UAAU,QAAQ,QAC5B,KAAK,OAAO,gBAAgB,QAAQ,cACpC,IAAI,MAAM,eAAe,YAC7B;EACA,UACE,QAAQ,SAAS,YAAY,MAC1B,SACC,KAAK,iBAAiB,QAAQ,gBAC9B,KAAK,aAAa,IAAI,MAAM,mBAChC,CACF;EAEA,OAAO;CACT,CAAC;CAED,MAAM,oBAAoB,SAAc,YACtC,oBACE,yBACA,QAAQ,MAAM,OAAO,WAAW,UAAU,QAAQ,GAAG,CAAC,CACxD;CAEF,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,SACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,YAAY,QAAQ,MAAM,OAAO,SAAS,QAAQ,QAAQ;EAChE,MAAM,UAAU,OAAO,MAAM,MAAM,SAAS;EAE5C,IAAI,SAAS,MAAM,eAAe,KAAK,SAAS;EAEhD,OAAO;CACT,CAAC;CAED,MAAM,oBAAoB,aAA8B;EACtD,UAAU,SAAS,QAAQ,SAAS,YAAY;EAChD,MAAM,UAAU,SAAS;EAEzB,OAAOD,SACL,OAAO,MAAM;GACX;GACA,OAAO,QAAQ,YAAY;GAC3B,OAAO,OAAO;IAAE,GAAG,aAAa;IAAQ,MAAM;GAAa,CAAC;GAC5D;GACA;GACA;GACA,OAAO,MAAM,iBAAiB;EAChC,CAAC,GACD;GACE,SAAS;GACT;GACA;IACE,QAAQ,SAAS;IACjB,WAAW,SAAS;IACpB,WAAW,SAAS,QAAQ;IAC5B,MAAM,QAAQ;GAChB;GACA,SAAS;GACT,QAAQ;GACR,QAAQ;GACR,SAAS;EACX,CACF;CACF;CAEA,MAAM,gBAAgB,UAAkB,WAAmB,eACzDA,SACE,OAAO,MAAM;EACX;EACA,OAAO,QAAQ,QAAQ;EACvB,aAAa,OAAO;EACpB;CACF,CAAC,GACD;EACE,gBAAgB,KAAK,QAAQ;EAC7B;EACA,aAAa,OAAO,UAAU,KAAK,SAAS;EAC5C;CACF,CACF;CAEF,MAAM,kBAAkB,OAAO,GAAG,8BAA8B,CAAC,CAAC,WAChE,SACA,SACA,eACA,UAOA,QACA,UACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,EAAE,WAAW,aAAa;EAEhC,IACE,UAAU,aAAa,QAAQ,YAC/B,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,WAAW,SAAS,UAC9B,UAAU,kBAAkB,SAAS,iBACrC,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,SAAS,iBACpC,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,QAAQ,SAAS,cAAc,SAAS,SAAS,aACjD,QAAQ,SAAS,qBAAqB,SAAS,SAAS,oBACxD,SAAS,SAAS,cAAc,QAAQ,aACxC,SAAS,SAAS,qBAAqB,QAAQ,SAAS,kBAExD,OAAO;EACT,KAAK,MAAM,YAAY,CAAC,SAAS,UAAU,SAAS,QAAQ,GAC1D,IACE,SAAS,YAAY,MAClB,SACC,CAAC,QAAQ,SAAS,YAAY,MAC3B,YACC,QAAQ,iBAAiB,KAAK,gBAAgB,QAAQ,aAAa,KAAK,QAC5E,CACJ,GAEA,OAAO;EACX,MAAM,MAAM,OAAO,MAAM,IAAI,QAAQ,KAAK;EAE1C,IACE,SAAS,OAAO,MACb,UACC,SAAS,cAAc,MAAM,UAAU,IAAI,OAC3C,CAAC,SAAS,SAAS,YAAY,MAAM,SAAS,KAAK,iBAAiB,MAAM,YAAY,CAC1F,GAEA,OAAO;EAET,MAAM,qBAGF,QAAQ,MAAM,OAAO,YAAY,UAAU,QAAQ,GAAG,GAAG,SAAS,MAAM;EAE5E,MAAM,UAAU,oBAAoB,oBAAoB,OAAO,kBAAkB;EAEjF,KAAK,MAAM,eAAe;GACxB,cAAc;GACd;GACA,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,CAAC,QAAQ;EAC7C,GAAG;GACD,MAAM,MAAM,KAAK,IAAI,OAAO,0BAA0B,YAAY,gBAAgB;GAElF,MAAM,QAAQ,SAAS,OAAO,QAC3B,UAAU,MAAM,SAAS,cAAc,MAAM,UAAU,IAAI,GAC9D;GAEA,MAAM,UAAU,IAAI,IAAI,MAAM,SAAS,UAAU,MAAM,OAAO,CAAC;GAE/D,IACE,CAAC,YAAY,aAAa,MACvB,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,IAAI,IAAI,MAAM,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC,QAChD,YAAY,sBACd,MAAM,MACH,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ,GAEA,OAAO;GACT,MAAM,eAAe,KACnB,KACE,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,OAC1C,GAAG,MAAM,KACN,UACC,GAAG,GAAG,QAAQ,MAAM,gBAAgB,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,KACxF,CACF,CACF;EACF;EACA,MAAM,YAAY,QAAQ,MAAM,OAAO,OAAO,QAAQ,UAAU,aAAa;EAE7E,IAAI,EAAE,OAAO,MAAM,MAAM,SAAS,IAAI,OAAO;EAC7C,MAAM,eAAe,KAAK,SAAS;EAEnC,OAAO;CACT,CAAC;CAED,MAAM,uBACJ,SACA,UACA,WACG;EACH,IAAI,SAAS,qBAAqB,kBAAkB,SAAS,0BAA0B,GACrF,OAAO;EAIT,MAAM,gBACJ,SAAS,qBAAqB,kBAC9B,QAAQ,aAAa,OAAO,qBAAqB,cAC7C;GAAE,GAAG;GAAU,kBAAkB;GAAa,uBAAuB;EAAE,IACvE;EAEN,OACE,YAAY,yBAAyB,CAAC,CAAC,OAAO,aAAa,MACzD,YAAY,yBAAyB,CAAC,CAAC,OAAO,QAAQ,aAAa,MAAM,MAC1E,CAAC,OAAO,gCAAgC,SAAS,qBAAqB;CAE3E;CAEA,MAAM,aAAa,OAAO,GAAG,oCAAoC,CAAC,CAAC,WACjE,SACA,SACA,cACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,KAAK;EAC3B,MAAM,WAAW,gBAAgB,OAAO,iBAAiB,KAAK,MAAM,MAAM;EAE1E,OAAO,MAAM,OACX,MAAM,OACN,GAAG,MAAM,KAAK,QAAQ,SAAS,GAC/B,GAAG,MAAM,mBAAmB,SAAS,CACvC;EAEA,MAAM,QAAQ;GACZ,WAAW,QAAQ;GACnB,kBAAkB,QAAQ,SAAS;GACnC,kBAAkB;GAClB;EACF;EAEA,KAAK,MAAM,YAAY,QAAQ,aAAa,WAAW;GACrD,OAAO,MAAM,MACX,MAAM,SACH,OAAO,SAAS,KAAK,CAAC,CACtB,IAAI,SAAS,OAAO,KAAK,CAAC,CAAC,CAC3B,MAAM,SAAS,MAAM,KAAK,CAAC,CAChC;GACA,MAAM,eAAe,KAAK,SAAS,cAAc,KAAK,CAAC;EACzD;EACA,MAAM,eAAe,KAAK,QAAQ,aAAa,cAAc,KAAK,CAAC;EACnE,MAAM,OAAO,QAAQ;EACrB,MAAM,QAAQ,OAAO,aAAa,QAAQ,SAAS;EAEnD,MAAM,QAAQ,KACZ,MAAM,KAAK,OAAO,GAAG,KAAK,eAAe,MAAM,CAAC,GAChD,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,QAAQ,IAAI,KAAK,OAAO,QAAQ,EACvF;EAEA,OAAO,MAAM,MACX,MAAM,SACH,OAAO,KAAK,KAAK,CAAC,CAClB,IAAI;IAAG,KAAK,QAAQ,KAAK,OAAO;IAAW,KAAK,UAAU,MAAM;EAAO,CAAC,CAAC,CACzE,MAAM,KAAK,CAChB;EACA,KAAK,MAAM,eAAe,MAAM,cAC9B,IAAI,YAAY,UAAU,KAAK,OAC7B,YAAY,OAAO,YAAY,KAAK,KAAK,QACvC,IAAI,KAAK,kBAAkB,SAC3B,CAAC,KAAK,OAAO,SAAS,KAAK,OAAO,OAAO,CAAC,CAAC,SAAS,IAAI,KAAK,MAAM,IAC/D;GAAE,GAAG;IAAM,KAAK,QAAQ,KAAK,OAAO;IAAW,KAAK,UAAU,MAAM;EAAO,IAC3E,GACN;EACJ,MAAM,eAAe,KAAK,GAAG,4BAA4B,KAAK,MAAM,SAAS,MAAM,EAAE;EAErF,OAAO;CACT,CAAC;CAED,MAAM,qBACJ,UACA,aAQA,SAAS,QAAQ,WAAW,MAAM,cAAc,cAAc,SAAS,SAAS,MAC/E,SAAS,QAAQ,qBAAqB,cAAc,SAAS,kBAC7D,CAAC,SAAS,eAAe,SAAS,mBACnC,CAAC,SAAS,mBAAmB,MAAM,SAAS,KAAK,OAAO,SAAS,oBAAoB;CA0JvF,OAAO;EACL;EACA,QAAA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,kBAvKuB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,SACA,UACA,UACA,KACA;GACA,MAAM,QAAQ,OAAO;GAErB,UAAU,SAAS,QAAQ,SAAS,gBAAgB,SAAS,QAAQ,SAAS,cAAc;GAC5F,MAAM,OAAO,QAAQ;GACrB,MAAM,QAAQ,QAAQ;GACtB,MAAM,KAAK,kBAAkB,OAAO,aAAa,KAAK,MAAM,MAAM;GAElE,MAAM,aAAa,oBAAoB,mBAAmB;IACxD,cAAc;IACd,MAAM,SAAS,QAAQ;IACvB,sBAAsB,SAAS;IAC/B,YAAY,SAAS,QAAQ;IAC7B,WAAW,SAAS;IACpB,WAAW,SAAS;IACpB,SAAS,SAAS;IAClB,UAAU;KACR,GAAG,QAAQ;KACX,aAAa,CACX,GAAG,QAAQ,SAAS,aACpB;MACE,cAAc;MACd,UAAU,gBAAgB,OAAO,iBAAiB,KAAK,MAAM,MAAM;KACrE,CACF;IACF;IACA,QAAQ;IACR,eAAe,SAAS,QAAQ,iBAAiB,SAAS;IAC1D,wBAAwB,SAAS;IACjC,gBAAgB,SAAS;IACzB,aAAa,SAAS;IACtB,SAAS,SAAS;IAClB,gBAAgB,SAAS;GAC3B,CAAC;GAED,MAAM,OAAO,oBAAoB,0BAA0B;IACzD,cAAc;IACd,MAAM,SAAS,QAAQ;IACvB,eAAe,WAAW;IAC1B,iBAAiB;GACnB,CAAC;GAED,MAAM,QAAQ;IAAE,WAAW,QAAQ;IAAU;IAAY,SAAS;IAAM,QAAQ,MAAM;GAAO;GAC7F,MAAM,WAAW,OAAO,cAAc,WAAW,MAAM,WAAW,oBAAoB;GACtF,MAAM,eAAe,OAAO,UAAU,WAAW,MAAM,WAAW,UAAU;GAC5E,MAAM,QAAQ,KAAK;GAEnB,MAAM,SAAS,OAAO,MAAM,KAC1B,MAAM,OACN,MAAM,MAAM,OAAO,GAAG,MAAM,gBAAgB,SAAS,CAAC,GACtD,EAAE,OAAO,EAAE,CACb;GAEA,UAAU,OAAO,KAAK,WAAW,CAAC;GAElC,MAAM,WAAW,OAAO,MAAM,OAC5B,MAAM,OACN;IACE,GAAG,MAAM,oBAAoB,aAAa,KAAK;KAC9C,MAAM,gBAAgB;KACtB,MAAM,OAAO,WAAW;KACxB,MAAM,uBAAuB,WAAW;KACxC,MAAM,YAAY,QAAQ;KAC1B,MAAM,eAAe;KACrB,MAAM,QAAQ,MAAM,oBAAoB;KACxC,MAAM,UAAU,MAAM;KACtB,MAAM,gBAAgB;GACzB,GACA,GAAG,MAAM,gBAAgB,SAAS,CACpC;GAEA,OAAO,OAAO,SAAS;GACvB,MAAM,QAAQ,KAAK;GAEnB,MAAM,SAAS;IACb,GAAG,MAAM,WAAW,aAAa,KAAK;KACrC,MAAM,eAAe;KACrB,MAAM,YAAY,QAAQ;KAC1B,MAAM,OAAO,WAAW;KACxB,MAAM,uBAAuB,WAAW;KACxC,MAAM,gBAAgB;KACtB,MAAM,YAAY;KAClB,MAAM,aAAa,WAAW;KAC9B,MAAM,YAAY,WAAW;KAC7B,MAAM,qBAAqB,MAAM;KACjC,MAAM,SAAS,MAAM,WAAW;KAChC,MAAM,gBAAgB,MAAM,WAAW,oBAAoB,WAAW,aAAa;KACnF,MAAM,yBAAyB,MAAM,WAAW,6BAC/C,WAAW,sBACb;KACC,MAAM,iBAAiB,MAAM,WAAW,qBAAqB,WAAW,cAAc;KACtF,MAAM,cAAc,QAAQ,UAAU,kBAAkB,WAAW,WAAW;KAC9E,MAAM,UAAU,WAAW;KAC3B,MAAM,iBAAiB,WAAW;KAClC,MAAM,WAAW,OAAO,KAAK;KAC7B,MAAM,WAAW,YAAY,QAAQ,MAAM,cAAc,GAAG;KAC5D,QAAQ,UAAU,aAAa;GAClC;GAEA,OAAO,MAAM,OAAO,MAAM,OAAO,QAAQ,GAAG,MAAM,eAAe,GAAG,CAAC;GACrE,KAAK,MAAM,eAAe,MAAM,cAC9B,IACE,YAAY,UAAU,MAAM,SAC5B,YAAY,SAAS,SAAS,QAC9B,CAAC,YAAY,KAAK,MAAM,QAAQ,IAAI,MAAM,kBAAkB,EAAE,GAE9D,YAAY,OAAO,CAAC,GAAG,YAAY,MAAM,MAAM;GACnD,MAAM,SAAS,KAAK;GAEpB,MAAM,eAAe;IACnB,GAAG,MAAM,UAAU,aAAa,KAAK;KACpC,OAAO,YAAY,QAAQ;KAC3B,OAAO,eAAe;KACtB,OAAO,WAAW,MAAM;KACxB,OAAO,SAAS,MAAM,UAAU;GACnC;GAEA,OAAO,MAAM,OAAO,OAAO,OAAO,cAAc;KAC7C,OAAO,YAAY,QAAQ;KAC3B,OAAO,eAAe;GACzB,CAAC;GACD,KAAK,MAAM,eAAe,MAAM,cAC9B,IACE,YAAY,UAAU,OAAO,SAC7B,CAAC,YAAY,KAAK,MAAM,QAAQ,IAAI,OAAO,kBAAkB,EAAE,GAE/D,YAAY,OAAO,CAAC,GAAG,YAAY,MAAM,YAAY;GAEzD,MAAM,UAAU,oBAAoB,mBAAmB;IACrD,GAAG,MAAM,OAAO,UAAU,MAAM,CAAC;IACjC,UAAU,WAAW;IACrB,QAAQ;GACV,CAAC;GAED,UACE,eAAe,SAAS,UAAU,KAChC,QAAQ,YAAY,WAAW,WAC/B,QAAQ,mBAAmB,WAAW,kBACtC,QAAQ,gBAAgB,WAAW,WACvC;GACA,UAAU,QAAQ,SAAS,MAAM,CAAC,CAAC,iBAAiB,EAAE;GACtD,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK;GAEzE,OAAO;EACT,CAiBiB;CACjB;AACF"}

package/dist/internal/passkey-kernel.d.mts CHANGED Viewed

@@ -4979,7 +4979,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
     invalidationMatches: (mapping: any, supplied: import("@yielded/auth/Sessions").SessionInvalidationWindow, policy: import("@yielded/auth/Passkey").PasskeyManagementPolicy) => boolean;
     invalidate: (mapping: any, subject: WriteSubject, invalidation: {
       readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-      readonly existingSessions: "immediate" | "original-absolute-expiry";
+      readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
       readonly maximumExposureMillis: number;
       readonly oldAuthenticationEvidence: "rejected";
     }) => import("effect/Effect").Effect<string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">, import("@yielded/auth/Passkey").PasskeyUnavailable | import("effect/PlatformError").PlatformError, import("effect/Crypto").Crypto | CurrentPasskeyTransaction>;
@@ -5711,7 +5711,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly credentialId: string;
         readonly invalidation: {
           readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
           readonly maximumExposureMillis: number;
           readonly oldAuthenticationEvidence: "rejected";
         };
@@ -5777,7 +5777,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         readonly credentialId: string;
         readonly invalidation: {
           readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
           readonly maximumExposureMillis: number;
           readonly oldAuthenticationEvidence: "rejected";
         };
@@ -5793,7 +5793,7 @@ export declare const makePasskeyKernel: (operations: QueryOperations) => {
         replayed: boolean;
         invalidation: {
           readonly trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-          readonly existingSessions: "immediate" | "original-absolute-expiry";
+          readonly existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
           readonly maximumExposureMillis: number;
           readonly oldAuthenticationEvidence: "rejected";
         };

package/dist/internal/password-kernel.d.mts CHANGED Viewed

@@ -117,7 +117,7 @@ export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFrag
       }>;
       invalidation: Readonly<{
         trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-        existingSessions: "immediate" | "original-absolute-expiry";
+        existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
         maximumExposureMillis: number;
         oldAuthenticationEvidence: "rejected";
       }>;
@@ -190,8 +190,8 @@ export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFrag
       nativeSubjectId: any;
       subject: any;
       identifier: any;
-      credential?: never;
       snapshot?: never;
+      readonly credential?: never;
     } | {
       nativeSubjectId: any;
       subject: any;

package/dist/internal/password-kernel.mjs CHANGED Viewed

@@ -254,7 +254,7 @@ const makePasswordKernel = (operations, proofs, nativeTables = (client) => makeN
 		const currentRequirement = yield* mapping.subject.decodeActionRequirement(row, action);
 		const now = yield* nowMillis;
 		if (!evidenceSatisfiedAt(input.authorization.evidence, input.authorization.requirement, now) || !evidenceSatisfiedAt(input.authorization.evidence, currentRequirement, now)) return void 0;
-		if (input.invalidation.existingSessions === "immediate" && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
+		if ((input.invalidation.existingSessions === "immediate" || input.invalidation.existingSessions === "cache-expiry") && mapping.sessionInvalidation !== "same-authority-immediate") return void 0;
 		return {
 			...locked,
 			now