@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/internal/passkey-managed.mjs

@@ -0,0 +1,224 @@
+import { PersistenceConfigurationError } from "./configuration.mjs";
+import { PersistenceMappingError } from "./mapping-error.mjs";
+import { anySqlCondition } from "./sql-change.mjs";
+import { requiredPasskeyCredentialConstraints, requiredPasskeyPersistenceConstraints } from "./models/passkey-model.mjs";
+import { makeNativePasskeyServices } from "./passkey-native.mjs";
+import { makePasskeyNativeManagement } from "./passkey-native-write.mjs";
+import { storageTables } from "./storage-tables.mjs";
+import { Context, Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import * as M from "@yielded/auth/Passkey";
+//#region src/internal/passkey-managed.ts
+const profileJson = Schema.fromJsonString(M.PasskeyProfile);
+const credentialData = M.PasskeyCredential.mapFields(({ revision: _revision, active: _active, requirement: _requirement, ...fields }) => fields);
+const configurationError = (reason) => PersistenceConfigurationError.make({ reason });
+const mappings = Effect.fnUntraced(function* (storage, tables, passwordModules, signInProfiles) {
+	const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+	const table = (role) => {
+		const value = storage.tables[role];
+		if (value === void 0) throw configurationError(`Missing ${role} mapping`);
+		return value;
+	};
+	const mapped = (role) => ({
+		table: table(role),
+		...Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key]))
+	});
+	const t = (role) => tables(table(role));
+	const eq = (role, key, value) => sql`${t(role).column(key)} = ${t(role).value(key, value)}`;
+	const s = storage.subjects;
+	const subject = tables(s.table);
+	const active = (value) => value === true;
+	const read = {
+		subject: {
+			table: s.table,
+			id: s.id,
+			status: s.status,
+			securityRevision: s.securityRevision,
+			decodeId: (row) => row[s.id],
+			decodeRequirement: s.requirements,
+			isActiveStatus: (value) => Object.is(value, s.activeValue),
+			activeCondition: sql`${subject.column(s.status)} = ${subject.value(s.status, s.activeValue)}`
+		},
+		credential: {
+			...mapped("passkeyCredentials"),
+			status: "active",
+			decode: (row) => Schema.decodeUnknownSync(credentialData)({
+				...row,
+				profile: Schema.decodeUnknownSync(profileJson)(row.profile)
+			}),
+			decodeSubjectId: (row) => row.subjectId,
+			isActiveStatus: active,
+			activeCondition: eq("passkeyCredentials", "active", true)
+		},
+		authority: {
+			...mapped("credentials"),
+			status: "active",
+			isActiveStatus: active,
+			activeCondition: eq("credentials", "active", true)
+		},
+		subjectIds: {
+			toNative: s.toNativeSync,
+			toSubject: s.toSubjectSync,
+			equals: Object.is
+		},
+		constraints: requiredPasskeyCredentialConstraints
+	};
+	const base = (feature) => ({
+		moduleId: feature.moduleId,
+		read,
+		flow: {
+			...mapped("passkeyFlows"),
+			encodeInsert: () => ({})
+		},
+		clock: {
+			encodeInstant: storage.encodeInstant,
+			decodeInstant: storage.decodeInstantSync,
+			engineNowMillis: sql.onDialectOrElse({
+				pg: () => sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)`,
+				orElse: () => sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`
+			}),
+			toMillis: (expression) => expression,
+			fromMillis: (expression) => expression
+		},
+		telemetry: {
+			lastUsedAt: "lastUsedAt",
+			encodeBackupEligible: (value) => value,
+			encodeBackupState: (value) => value
+		},
+		constraints: requiredPasskeyPersistenceConstraints
+	});
+	const metadata = (nativeId) => sql`exists(select 1 from ${subject.name} where ${subject.column(s.id)} = ${subject.value(s.id, nativeId)} and ${subject.column(s.status)} = ${subject.value(s.status, s.activeValue)})`;
+	const management = (feature) => {
+		const policy = feature.managementPolicy;
+		if (policy === void 0) throw configurationError(`Missing passkey management policy for ${feature.moduleId}`);
+		const c = t("passkeyCredentials"), f = t("credentials");
+		return {
+			...base(feature),
+			write: {
+				credential: {
+					name: "name",
+					createdAt: "createdAt",
+					encodeInsert: ({ credential, subjectId, summary, marker }) => ({
+						credentialId: credential.credentialId,
+						subjectId,
+						rpId: credential.rpId,
+						protocolCredentialId: credential.protocolCredentialId,
+						userHandle: credential.userHandle,
+						credentialKey: "",
+						publicKey: credential.publicKey,
+						algorithm: credential.algorithm,
+						profile: Schema.encodeSync(profileJson)(credential.profile),
+						credentialRevision: marker,
+						active: true,
+						primarySignIn: credential.primarySignIn,
+						enrollmentUserVerified: credential.enrollmentUserVerified,
+						backupEligible: credential.backupEligible,
+						backupState: credential.backupState,
+						counter: credential.counter,
+						name: summary.name,
+						createdAt: storage.encodeInstant(summary.createdAtMillis)
+					}),
+					encodePrimarySignIn: (value) => value,
+					encodeEnrollmentUserVerified: (value) => value,
+					encodeBackupEligible: (value) => value,
+					activeStatus: true,
+					removedStatus: false
+				},
+				authority: {
+					encodeInsert: ({ subjectId, credential, marker }) => ({
+						subjectId,
+						credentialId: credential.credentialId,
+						revision: marker,
+						active: true
+					}),
+					activeStatus: true,
+					removedStatus: false
+				},
+				policy: {
+					subjectColumns: subject.keys,
+					management: () => policy,
+					requirement: s.actionRequirements,
+					metadata,
+					action: metadata,
+					remainingSignIn: (nativeId, excluded, row) => Effect.gen(function* () {
+						const requirement = yield* Schema.decodeEffect(M.PasskeyRequirement)(yield* s.requirements(row));
+						const alternatives = [];
+						if (requirement.alternatives.some((alternative) => alternative.minimumCredentials === 1 && alternative.factors.every((factor) => factor === "possession"))) alternatives.push(sql`exists(select 1 from ${c.name} join ${f.name} on ${f.column("credentialId")} = ${c.column("credentialId")} and ${f.column("subjectId")} = ${f.value("subjectId", nativeId)} and ${f.column("revision")} = ${c.column("credentialRevision")} and ${eq("credentials", "active", true)}
+                where ${eq("passkeyCredentials", "subjectId", nativeId)} and ${c.column("credentialId")} <> ${c.value("credentialId", excluded)} and ${eq("passkeyCredentials", "active", true)} and ${eq("passkeyCredentials", "primarySignIn", true)} and ${eq("passkeyCredentials", "enrollmentUserVerified", true)} and ${anySqlCondition(signInProfiles.map((profile) => eq("passkeyCredentials", "rpId", profile.rpId)))})`);
+						if (passwordModules.length > 0 && requirement.alternatives.some((alternative) => alternative.minimumCredentials === 1 && !alternative.userVerified && !alternative.phishingResistant && alternative.factors.every((factor) => factor === "knowledge"))) {
+							const p = t("passwords"), i = t("identifiers");
+							alternatives.push(sql`exists(select 1 from ${p.name} join ${f.name} on ${f.column("credentialId")} = ${p.column("credentialId")} and ${f.column("subjectId")} = ${f.value("subjectId", nativeId)} and ${f.column("revision")} = ${p.column("credentialRevision")} and ${eq("credentials", "active", true)}
+                join ${i.name} on ${eq("identifiers", "subjectId", nativeId)} and ${eq("identifiers", "active", true)} and ${eq("identifiers", "namespace", "email")}
+                where ${eq("passwords", "subjectId", nativeId)} and ${p.column("credentialId")} <> ${p.value("credentialId", excluded)} and ${anySqlCondition(passwordModules.map((module) => eq("passwords", "moduleId", module)))})`);
+						}
+						return anySqlCondition(alternatives);
+					}).pipe(Effect.mapError((cause) => PersistenceMappingError.make({
+						operation: "mapping",
+						cause
+					})))
+				}
+			},
+			invalidation: {
+				window: {
+					trigger: "credential-change",
+					existingSessions: "immediate",
+					maximumExposureMillis: 0,
+					oldAuthenticationEvidence: "rejected"
+				},
+				mutations: [],
+				postcondition: ({ subjectId, securityRevision }) => sql`exists(select 1 from ${subject.name} where ${subject.column(s.id)} = ${subject.value(s.id, subjectId)} and ${subject.column(s.securityRevision)} = ${subject.value(s.securityRevision, securityRevision)})`
+			}
+		};
+	};
+	return {
+		base,
+		management
+	};
+});
+/** Managed and mapped tables feed the same native passkey statements. */
+const makeManagedPasskeys = Effect.fnUntraced(function* (input, tables) {
+	const policies = yield* Effect.forEach(input.features, (feature) => Effect.map(feature.policy, (policy) => ({
+		feature,
+		policy
+	})));
+	const mapping = yield* mappings(input.storage, tables, input.passwordModules, policies.flatMap(({ feature, policy }) => feature.management ? [] : policy.profiles));
+	const services = /* @__PURE__ */ new Map();
+	const managers = /* @__PURE__ */ new Map();
+	for (const feature of input.features) {
+		const selected = feature.management ? mapping.management(feature) : mapping.base(feature);
+		const base = yield* makeNativePasskeyServices(tables, selected);
+		services.set(feature.moduleId, base);
+		if (feature.management) managers.set(feature.moduleId, makePasskeyNativeManagement(base, mapping.management(feature)).passkeyManagementPersistence);
+	}
+	const service = (moduleId) => {
+		const value = services.get(moduleId);
+		return value === void 0 ? Effect.fail(M.PasskeyUnavailable.make({})) : Effect.succeed(value);
+	};
+	const manager = (moduleId) => {
+		const value = managers.get(moduleId);
+		return value === void 0 ? Effect.fail(M.PasskeyUnavailable.make({})) : Effect.succeed(value);
+	};
+	const first = services.values().next().value;
+	if (first === void 0) return yield* configurationError("A passkey module is required");
+	let context = Context.make(M.PasskeyCredentials, {
+		lookup: (input) => first.passkeyCredentials.lookup(input),
+		listForSubject: (input) => Effect.flatMap(service(input.moduleId), (value) => value.passkeyCredentials.listForSubject(input))
+	}).pipe(Context.add(M.PasskeyPersistence, {
+		issue: (input, prepare) => Effect.flatMap(service(input.ceremony.moduleId), (value) => value.passkeyPersistence.issue(input, prepare)),
+		context: (input) => Effect.flatMap(service(input.moduleId), (value) => value.passkeyPersistence.context(input)),
+		consume: (input, prepare) => Effect.flatMap(service(input.access.moduleId), (value) => value.passkeyPersistence.consume(input, prepare)),
+		cleanup: (input, prepare) => Effect.flatMap(service(input.moduleId), (value) => value.passkeyPersistence.cleanup(input, prepare))
+	}));
+	if (managers.size > 0) context = context.pipe(Context.add(M.PasskeyManagementPersistence, {
+		completeEnrollment: (input, prepare) => Effect.flatMap(manager(input.ceremony.moduleId), (value) => value.completeEnrollment(input, prepare)),
+		list: (input) => Effect.flatMap(manager(input.moduleId), (value) => value.list(input)),
+		inspectRemove: (input) => Effect.flatMap(manager(input.moduleId), (value) => value.inspectRemove(input)),
+		rename: (input, prepare) => Effect.flatMap(manager(input.moduleId), (value) => value.rename(input, prepare)),
+		remove: (input, prepare) => Effect.flatMap(manager(input.moduleId), (value) => value.remove(input, prepare))
+	}));
+	return context;
+}, Effect.mapError((error) => Schema.is(PersistenceConfigurationError)(error) ? error : configurationError("Unable to configure passkey persistence")));
+//#endregion
+export { makeManagedPasskeys };
+
+//# sourceMappingURL=passkey-managed.mjs.map

package/dist/internal/passkey-managed.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-managed.mjs","names":[],"sources":["../../src/internal/passkey-managed.ts"],"sourcesContent":["import * as M from \"@yielded/auth/Passkey\";\nimport { Context, Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport {\n  PersistenceConfigurationError,\n  type MappingInput,\n  type PasskeyFeature,\n} from \"./configuration\";\nimport { PersistenceMappingError } from \"./mapping-error\";\nimport {\n  requiredPasskeyCredentialConstraints,\n  requiredPasskeyPersistenceConstraints,\n} from \"./models/passkey-model\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { makeNativePasskeyServices } from \"./passkey-native\";\nimport type { PasskeyNativeMapping, PasskeyNativeRead } from \"./passkey-native-state\";\nimport {\n  makePasskeyNativeManagement,\n  type NativePasskeyManagementMapping,\n} from \"./passkey-native-write\";\nimport { anySqlCondition } from \"./sql-change\";\nimport { storageTables, type StorageRole } from \"./storage-tables\";\n\nexport interface ComposedPasskeyInput {\n  readonly storage: MappingInput;\n  readonly namespace: string;\n  readonly dialect: \"pg\" | \"sqlite\";\n  readonly features: ReadonlyArray<PasskeyFeature>;\n  readonly passwordModules: ReadonlyArray<string>;\n}\n\nconst profileJson = Schema.fromJsonString(M.PasskeyProfile);\n\nconst credentialData = M.PasskeyCredential.mapFields(\n  ({ revision: _revision, active: _active, requirement: _requirement, ...fields }) => fields,\n);\n\nconst configurationError = (reason: string) => PersistenceConfigurationError.make({ reason });\n\nconst mappings = Effect.fnUntraced(function* (\n  storage: MappingInput,\n  tables: NativeSqlTables,\n  passwordModules: ReadonlyArray<string>,\n  signInProfiles: ReadonlyArray<M.PasskeyProfile>,\n) {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n\n  const table = (role: StorageRole) => {\n    const value = storage.tables[role];\n\n    if (value === undefined) throw configurationError(`Missing ${role} mapping`);\n\n    return value;\n  };\n\n  const mapped = <Role extends StorageRole>(role: Role) => ({\n    table: table(role),\n    // Managed storage validation owns these physical column keys.\n    ...(Object.fromEntries(Object.keys(storageTables[role].columns).map((key) => [key, key])) as {\n      readonly [Key in keyof (typeof storageTables)[Role][\"columns\"]]: Key;\n    }),\n  });\n\n  const t = (role: StorageRole) => tables(table(role));\n\n  const eq = (role: StorageRole, key: string, value: unknown) =>\n    sql`${t(role).column(key)} = ${t(role).value(key, value)}`;\n\n  const s = storage.subjects;\n  const subject = tables(s.table);\n  const active = (value: unknown) => value === true;\n\n  const read: PasskeyNativeRead = {\n    subject: {\n      table: s.table,\n      id: s.id,\n      status: s.status,\n      securityRevision: s.securityRevision,\n      decodeId: (row) => row[s.id],\n      decodeRequirement: s.requirements,\n      isActiveStatus: (value) => Object.is(value, s.activeValue),\n      activeCondition: sql`${subject.column(s.status)} = ${subject.value(s.status, s.activeValue)}`,\n    },\n    credential: {\n      ...mapped(\"passkeyCredentials\"),\n      status: \"active\",\n      decode: (row) =>\n        Schema.decodeUnknownSync(credentialData)({\n          ...row,\n          profile: Schema.decodeUnknownSync(profileJson)(row.profile),\n        }),\n      decodeSubjectId: (row) => row.subjectId,\n      isActiveStatus: active,\n      activeCondition: eq(\"passkeyCredentials\", \"active\", true),\n    },\n    authority: {\n      ...mapped(\"credentials\"),\n      status: \"active\",\n      isActiveStatus: active,\n      activeCondition: eq(\"credentials\", \"active\", true),\n    },\n    subjectIds: { toNative: s.toNativeSync, toSubject: s.toSubjectSync, equals: Object.is },\n    constraints: requiredPasskeyCredentialConstraints,\n  };\n\n  const base = (feature: PasskeyFeature): PasskeyNativeMapping => ({\n    moduleId: feature.moduleId,\n    read,\n    flow: { ...mapped(\"passkeyFlows\"), encodeInsert: () => ({}) },\n    clock: {\n      encodeInstant: storage.encodeInstant,\n      decodeInstant: storage.decodeInstantSync,\n      engineNowMillis: sql.onDialectOrElse({\n        pg: () => sql`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)`,\n        orElse: () => sql`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`,\n      }),\n      toMillis: (expression: Fragment) => expression,\n      fromMillis: (expression: Fragment) => expression,\n    },\n    telemetry: {\n      lastUsedAt: \"lastUsedAt\",\n      encodeBackupEligible: (value) => value,\n      encodeBackupState: (value) => value,\n    },\n    constraints: requiredPasskeyPersistenceConstraints,\n  });\n\n  const metadata = (nativeId: unknown) =>\n    sql`exists(select 1 from ${subject.name} where ${subject.column(s.id)} = ${subject.value(s.id, nativeId)} and ${subject.column(s.status)} = ${subject.value(s.status, s.activeValue)})`;\n\n  const management = (feature: PasskeyFeature): NativePasskeyManagementMapping => {\n    const policy = feature.managementPolicy;\n\n    if (policy === undefined)\n      throw configurationError(`Missing passkey management policy for ${feature.moduleId}`);\n\n    const c = t(\"passkeyCredentials\"),\n      f = t(\"credentials\");\n\n    return {\n      ...base(feature),\n      write: {\n        credential: {\n          name: \"name\",\n          createdAt: \"createdAt\",\n          encodeInsert: ({ credential, subjectId, summary, marker }) => ({\n            credentialId: credential.credentialId,\n            subjectId,\n            rpId: credential.rpId,\n            protocolCredentialId: credential.protocolCredentialId,\n            userHandle: credential.userHandle,\n            credentialKey: \"\",\n            publicKey: credential.publicKey,\n            algorithm: credential.algorithm,\n            profile: Schema.encodeSync(profileJson)(credential.profile),\n            credentialRevision: marker,\n            active: true,\n            primarySignIn: credential.primarySignIn,\n            enrollmentUserVerified: credential.enrollmentUserVerified,\n            backupEligible: credential.backupEligible,\n            backupState: credential.backupState,\n            counter: credential.counter,\n            name: summary.name,\n            createdAt: storage.encodeInstant(summary.createdAtMillis),\n          }),\n          encodePrimarySignIn: (value) => value,\n          encodeEnrollmentUserVerified: (value) => value,\n          encodeBackupEligible: (value) => value,\n          activeStatus: true,\n          removedStatus: false,\n        },\n        authority: {\n          encodeInsert: ({ subjectId, credential, marker }) => ({\n            subjectId,\n            credentialId: credential.credentialId,\n            revision: marker,\n            active: true,\n          }),\n          activeStatus: true,\n          removedStatus: false,\n        },\n        policy: {\n          subjectColumns: subject.keys,\n          management: () => policy,\n          requirement: s.actionRequirements,\n          metadata,\n          action: metadata,\n          remainingSignIn: (nativeId, excluded, row) =>\n            Effect.gen(function* () {\n              const requirement = yield* Schema.decodeEffect(M.PasskeyRequirement)(\n                yield* s.requirements(row),\n              );\n\n              const alternatives: Fragment[] = [];\n\n              if (\n                requirement.alternatives.some(\n                  (alternative) =>\n                    alternative.minimumCredentials === 1 &&\n                    alternative.factors.every((factor) => factor === \"possession\"),\n                )\n              ) {\n                alternatives.push(sql`exists(select 1 from ${c.name} join ${f.name} on ${f.column(\"credentialId\")} = ${c.column(\"credentialId\")} and ${f.column(\"subjectId\")} = ${f.value(\"subjectId\", nativeId)} and ${f.column(\"revision\")} = ${c.column(\"credentialRevision\")} and ${eq(\"credentials\", \"active\", true)}\n                where ${eq(\"passkeyCredentials\", \"subjectId\", nativeId)} and ${c.column(\"credentialId\")} <> ${c.value(\"credentialId\", excluded)} and ${eq(\"passkeyCredentials\", \"active\", true)} and ${eq(\"passkeyCredentials\", \"primarySignIn\", true)} and ${eq(\"passkeyCredentials\", \"enrollmentUserVerified\", true)} and ${anySqlCondition(\n                  signInProfiles.map((profile) => eq(\"passkeyCredentials\", \"rpId\", profile.rpId)),\n                )})`);\n              }\n              if (\n                passwordModules.length > 0 &&\n                requirement.alternatives.some(\n                  (alternative) =>\n                    alternative.minimumCredentials === 1 &&\n                    !alternative.userVerified &&\n                    !alternative.phishingResistant &&\n                    alternative.factors.every((factor) => factor === \"knowledge\"),\n                )\n              ) {\n                const p = t(\"passwords\"),\n                  i = t(\"identifiers\");\n\n                alternatives.push(sql`exists(select 1 from ${p.name} join ${f.name} on ${f.column(\"credentialId\")} = ${p.column(\"credentialId\")} and ${f.column(\"subjectId\")} = ${f.value(\"subjectId\", nativeId)} and ${f.column(\"revision\")} = ${p.column(\"credentialRevision\")} and ${eq(\"credentials\", \"active\", true)}\n                join ${i.name} on ${eq(\"identifiers\", \"subjectId\", nativeId)} and ${eq(\"identifiers\", \"active\", true)} and ${eq(\"identifiers\", \"namespace\", \"email\")}\n                where ${eq(\"passwords\", \"subjectId\", nativeId)} and ${p.column(\"credentialId\")} <> ${p.value(\"credentialId\", excluded)} and ${anySqlCondition(\n                  passwordModules.map((module) => eq(\"passwords\", \"moduleId\", module)),\n                )})`);\n              }\n\n              return anySqlCondition(alternatives);\n            }).pipe(\n              Effect.mapError((cause) =>\n                PersistenceMappingError.make({ operation: \"mapping\", cause }),\n              ),\n            ),\n        },\n      },\n      invalidation: {\n        window: {\n          trigger: \"credential-change\",\n          existingSessions: \"immediate\",\n          maximumExposureMillis: 0,\n          oldAuthenticationEvidence: \"rejected\",\n        },\n        mutations: [],\n        postcondition: ({ subjectId, securityRevision }) =>\n          sql`exists(select 1 from ${subject.name} where ${subject.column(s.id)} = ${subject.value(s.id, subjectId)} and ${subject.column(s.securityRevision)} = ${subject.value(s.securityRevision, securityRevision)})`,\n      },\n    };\n  };\n\n  return { base, management };\n});\n\n/** Managed and mapped tables feed the same native passkey statements. */\nexport const makeManagedPasskeys = Effect.fnUntraced(\n  function* (input: ComposedPasskeyInput, tables: NativeSqlTables) {\n    const policies = yield* Effect.forEach(input.features, (feature) =>\n      Effect.map(feature.policy, (policy) => ({ feature, policy })),\n    );\n\n    const mapping = yield* mappings(\n      input.storage,\n      tables,\n      input.passwordModules,\n      policies.flatMap(({ feature, policy }) => (feature.management ? [] : policy.profiles)),\n    );\n\n    const services = new Map<\n      string,\n      Effect.Success<ReturnType<typeof makeNativePasskeyServices>>\n    >();\n\n    const managers = new Map<string, M.PasskeyManagementPersistence[\"Service\"]>();\n\n    for (const feature of input.features) {\n      const selected = feature.management ? mapping.management(feature) : mapping.base(feature);\n      const base = yield* makeNativePasskeyServices(tables, selected);\n\n      services.set(feature.moduleId, base);\n      if (feature.management)\n        managers.set(\n          feature.moduleId,\n          makePasskeyNativeManagement(base, mapping.management(feature))\n            .passkeyManagementPersistence,\n        );\n    }\n\n    const service = (moduleId: string) => {\n      const value = services.get(moduleId);\n\n      return value === undefined\n        ? Effect.fail(M.PasskeyUnavailable.make({}))\n        : Effect.succeed(value);\n    };\n\n    const manager = (moduleId: string) => {\n      const value = managers.get(moduleId);\n\n      return value === undefined\n        ? Effect.fail(M.PasskeyUnavailable.make({}))\n        : Effect.succeed(value);\n    };\n\n    const first = services.values().next().value;\n\n    if (first === undefined) return yield* configurationError(\"A passkey module is required\");\n\n    let context: Context.Context<never> = Context.make(M.PasskeyCredentials, {\n      lookup: (input) => first.passkeyCredentials.lookup(input),\n      listForSubject: (input) =>\n        Effect.flatMap(service(input.moduleId), (value) =>\n          value.passkeyCredentials.listForSubject(input),\n        ),\n    }).pipe(\n      Context.add(M.PasskeyPersistence, {\n        issue: (input, prepare) =>\n          Effect.flatMap(service(input.ceremony.moduleId), (value) =>\n            value.passkeyPersistence.issue(input, prepare),\n          ),\n        context: (input) =>\n          Effect.flatMap(service(input.moduleId), (value) =>\n            value.passkeyPersistence.context(input),\n          ),\n        consume: (input, prepare) =>\n          Effect.flatMap(service(input.access.moduleId), (value) =>\n            value.passkeyPersistence.consume(input, prepare),\n          ),\n        cleanup: (input, prepare) =>\n          Effect.flatMap(service(input.moduleId), (value) =>\n            value.passkeyPersistence.cleanup(input, prepare),\n          ),\n      }),\n    );\n\n    if (managers.size > 0)\n      context = context.pipe(\n        Context.add(M.PasskeyManagementPersistence, {\n          completeEnrollment: (input, prepare) =>\n            Effect.flatMap(manager(input.ceremony.moduleId), (value) =>\n              value.completeEnrollment(input, prepare),\n            ),\n          list: (input) => Effect.flatMap(manager(input.moduleId), (value) => value.list(input)),\n          inspectRemove: (input) =>\n            Effect.flatMap(manager(input.moduleId), (value) => value.inspectRemove(input)),\n          rename: (input, prepare) =>\n            Effect.flatMap(manager(input.moduleId), (value) => value.rename(input, prepare)),\n          remove: (input, prepare) =>\n            Effect.flatMap(manager(input.moduleId), (value) => value.remove(input, prepare)),\n        }),\n      );\n\n    return context;\n  },\n  Effect.mapError((error) =>\n    Schema.is(PersistenceConfigurationError)(error)\n      ? error\n      : configurationError(\"Unable to configure passkey persistence\"),\n  ),\n);\n"],"mappings":";;;;;;;;;;;AAiCA,MAAM,cAAc,OAAO,eAAe,EAAE,cAAc;AAE1D,MAAM,iBAAiB,EAAE,kBAAkB,WACxC,EAAE,UAAU,WAAW,QAAQ,SAAS,aAAa,cAAc,GAAG,aAAa,MACtF;AAEA,MAAM,sBAAsB,WAAmB,8BAA8B,KAAK,EAAE,OAAO,CAAC;AAE5F,MAAM,WAAW,OAAO,WAAW,WACjC,SACA,QACA,iBACA,gBACA;CACA,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAE3D,MAAM,SAAS,SAAsB;EACnC,MAAM,QAAQ,QAAQ,OAAO;EAE7B,IAAI,UAAU,KAAA,GAAW,MAAM,mBAAmB,WAAW,KAAK,SAAS;EAE3E,OAAO;CACT;CAEA,MAAM,UAAoC,UAAgB;EACxD,OAAO,MAAM,IAAI;EAEjB,GAAI,OAAO,YAAY,OAAO,KAAK,cAAc,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;CAG1F;CAEA,MAAM,KAAK,SAAsB,OAAO,MAAM,IAAI,CAAC;CAEnD,MAAM,MAAM,MAAmB,KAAa,UAC1C,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK;CAEzD,MAAM,IAAI,QAAQ;CAClB,MAAM,UAAU,OAAO,EAAE,KAAK;CAC9B,MAAM,UAAU,UAAmB,UAAU;CAE7C,MAAM,OAA0B;EAC9B,SAAS;GACP,OAAO,EAAE;GACT,IAAI,EAAE;GACN,QAAQ,EAAE;GACV,kBAAkB,EAAE;GACpB,WAAW,QAAQ,IAAI,EAAE;GACzB,mBAAmB,EAAE;GACrB,iBAAiB,UAAU,OAAO,GAAG,OAAO,EAAE,WAAW;GACzD,iBAAiB,GAAG,GAAG,QAAQ,OAAO,EAAE,MAAM,EAAE,KAAK,QAAQ,MAAM,EAAE,QAAQ,EAAE,WAAW;EAC5F;EACA,YAAY;GACV,GAAG,OAAO,oBAAoB;GAC9B,QAAQ;GACR,SAAS,QACP,OAAO,kBAAkB,cAAc,CAAC,CAAC;IACvC,GAAG;IACH,SAAS,OAAO,kBAAkB,WAAW,CAAC,CAAC,IAAI,OAAO;GAC5D,CAAC;GACH,kBAAkB,QAAQ,IAAI;GAC9B,gBAAgB;GAChB,iBAAiB,GAAG,sBAAsB,UAAU,IAAI;EAC1D;EACA,WAAW;GACT,GAAG,OAAO,aAAa;GACvB,QAAQ;GACR,gBAAgB;GAChB,iBAAiB,GAAG,eAAe,UAAU,IAAI;EACnD;EACA,YAAY;GAAE,UAAU,EAAE;GAAc,WAAW,EAAE;GAAe,QAAQ,OAAO;EAAG;EACtF,aAAa;CACf;CAEA,MAAM,QAAQ,aAAmD;EAC/D,UAAU,QAAQ;EAClB;EACA,MAAM;GAAE,GAAG,OAAO,cAAc;GAAG,qBAAqB,CAAC;EAAG;EAC5D,OAAO;GACL,eAAe,QAAQ;GACvB,eAAe,QAAQ;GACvB,iBAAiB,IAAI,gBAAgB;IACnC,UAAU,GAAG;IACb,cAAc,GAAG;GACnB,CAAC;GACD,WAAW,eAAyB;GACpC,aAAa,eAAyB;EACxC;EACA,WAAW;GACT,YAAY;GACZ,uBAAuB,UAAU;GACjC,oBAAoB,UAAU;EAChC;EACA,aAAa;CACf;CAEA,MAAM,YAAY,aAChB,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,EAAE,EAAE,EAAE,KAAK,QAAQ,MAAM,EAAE,IAAI,QAAQ,EAAE,OAAO,QAAQ,OAAO,EAAE,MAAM,EAAE,KAAK,QAAQ,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE;CAEvL,MAAM,cAAc,YAA4D;EAC9E,MAAM,SAAS,QAAQ;EAEvB,IAAI,WAAW,KAAA,GACb,MAAM,mBAAmB,yCAAyC,QAAQ,UAAU;EAEtF,MAAM,IAAI,EAAE,oBAAoB,GAC9B,IAAI,EAAE,aAAa;EAErB,OAAO;GACL,GAAG,KAAK,OAAO;GACf,OAAO;IACL,YAAY;KACV,MAAM;KACN,WAAW;KACX,eAAe,EAAE,YAAY,WAAW,SAAS,cAAc;MAC7D,cAAc,WAAW;MACzB;MACA,MAAM,WAAW;MACjB,sBAAsB,WAAW;MACjC,YAAY,WAAW;MACvB,eAAe;MACf,WAAW,WAAW;MACtB,WAAW,WAAW;MACtB,SAAS,OAAO,WAAW,WAAW,CAAC,CAAC,WAAW,OAAO;MAC1D,oBAAoB;MACpB,QAAQ;MACR,eAAe,WAAW;MAC1B,wBAAwB,WAAW;MACnC,gBAAgB,WAAW;MAC3B,aAAa,WAAW;MACxB,SAAS,WAAW;MACpB,MAAM,QAAQ;MACd,WAAW,QAAQ,cAAc,QAAQ,eAAe;KAC1D;KACA,sBAAsB,UAAU;KAChC,+BAA+B,UAAU;KACzC,uBAAuB,UAAU;KACjC,cAAc;KACd,eAAe;IACjB;IACA,WAAW;KACT,eAAe,EAAE,WAAW,YAAY,cAAc;MACpD;MACA,cAAc,WAAW;MACzB,UAAU;MACV,QAAQ;KACV;KACA,cAAc;KACd,eAAe;IACjB;IACA,QAAQ;KACN,gBAAgB,QAAQ;KACxB,kBAAkB;KAClB,aAAa,EAAE;KACf;KACA,QAAQ;KACR,kBAAkB,UAAU,UAAU,QACpC,OAAO,IAAI,aAAa;MACtB,MAAM,cAAc,OAAO,OAAO,aAAa,EAAE,kBAAkB,CAAC,CAClE,OAAO,EAAE,aAAa,GAAG,CAC3B;MAEA,MAAM,eAA2B,CAAC;MAElC,IACE,YAAY,aAAa,MACtB,gBACC,YAAY,uBAAuB,KACnC,YAAY,QAAQ,OAAO,WAAW,WAAW,YAAY,CACjE,GAEA,aAAa,KAAK,GAAG,wBAAwB,EAAE,KAAK,QAAQ,EAAE,KAAK,MAAM,EAAE,OAAO,cAAc,EAAE,KAAK,EAAE,OAAO,cAAc,EAAE,OAAO,EAAE,OAAO,WAAW,EAAE,KAAK,EAAE,MAAM,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,UAAU,EAAE,KAAK,EAAE,OAAO,oBAAoB,EAAE,OAAO,GAAG,eAAe,UAAU,IAAI,EAAE;wBAClS,GAAG,sBAAsB,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,cAAc,EAAE,MAAM,EAAE,MAAM,gBAAgB,QAAQ,EAAE,OAAO,GAAG,sBAAsB,UAAU,IAAI,EAAE,OAAO,GAAG,sBAAsB,iBAAiB,IAAI,EAAE,OAAO,GAAG,sBAAsB,0BAA0B,IAAI,EAAE,OAAO,gBAC5S,eAAe,KAAK,YAAY,GAAG,sBAAsB,QAAQ,QAAQ,IAAI,CAAC,CAChF,EAAE,EAAE;MAEN,IACE,gBAAgB,SAAS,KACzB,YAAY,aAAa,MACtB,gBACC,YAAY,uBAAuB,KACnC,CAAC,YAAY,gBACb,CAAC,YAAY,qBACb,YAAY,QAAQ,OAAO,WAAW,WAAW,WAAW,CAChE,GACA;OACA,MAAM,IAAI,EAAE,WAAW,GACrB,IAAI,EAAE,aAAa;OAErB,aAAa,KAAK,GAAG,wBAAwB,EAAE,KAAK,QAAQ,EAAE,KAAK,MAAM,EAAE,OAAO,cAAc,EAAE,KAAK,EAAE,OAAO,cAAc,EAAE,OAAO,EAAE,OAAO,WAAW,EAAE,KAAK,EAAE,MAAM,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,UAAU,EAAE,KAAK,EAAE,OAAO,oBAAoB,EAAE,OAAO,GAAG,eAAe,UAAU,IAAI,EAAE;uBACnS,EAAE,KAAK,MAAM,GAAG,eAAe,aAAa,QAAQ,EAAE,OAAO,GAAG,eAAe,UAAU,IAAI,EAAE,OAAO,GAAG,eAAe,aAAa,OAAO,EAAE;wBAC7I,GAAG,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,cAAc,EAAE,MAAM,EAAE,MAAM,gBAAgB,QAAQ,EAAE,OAAO,gBAC5H,gBAAgB,KAAK,WAAW,GAAG,aAAa,YAAY,MAAM,CAAC,CACrE,EAAE,EAAE;MACN;MAEA,OAAO,gBAAgB,YAAY;KACrC,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,wBAAwB,KAAK;MAAE,WAAW;MAAW;KAAM,CAAC,CAC9D,CACF;IACJ;GACF;GACA,cAAc;IACZ,QAAQ;KACN,SAAS;KACT,kBAAkB;KAClB,uBAAuB;KACvB,2BAA2B;IAC7B;IACA,WAAW,CAAC;IACZ,gBAAgB,EAAE,WAAW,uBAC3B,GAAG,wBAAwB,QAAQ,KAAK,SAAS,QAAQ,OAAO,EAAE,EAAE,EAAE,KAAK,QAAQ,MAAM,EAAE,IAAI,SAAS,EAAE,OAAO,QAAQ,OAAO,EAAE,gBAAgB,EAAE,KAAK,QAAQ,MAAM,EAAE,kBAAkB,gBAAgB,EAAE;GACjN;EACF;CACF;CAEA,OAAO;EAAE;EAAM;CAAW;AAC5B,CAAC;;AAGD,MAAa,sBAAsB,OAAO,WACxC,WAAW,OAA6B,QAAyB;CAC/D,MAAM,WAAW,OAAO,OAAO,QAAQ,MAAM,WAAW,YACtD,OAAO,IAAI,QAAQ,SAAS,YAAY;EAAE;EAAS;CAAO,EAAE,CAC9D;CAEA,MAAM,UAAU,OAAO,SACrB,MAAM,SACN,QACA,MAAM,iBACN,SAAS,SAAS,EAAE,SAAS,aAAc,QAAQ,aAAa,CAAC,IAAI,OAAO,QAAS,CACvF;CAEA,MAAM,2BAAW,IAAI,IAGnB;CAEF,MAAM,2BAAW,IAAI,IAAuD;CAE5E,KAAK,MAAM,WAAW,MAAM,UAAU;EACpC,MAAM,WAAW,QAAQ,aAAa,QAAQ,WAAW,OAAO,IAAI,QAAQ,KAAK,OAAO;EACxF,MAAM,OAAO,OAAO,0BAA0B,QAAQ,QAAQ;EAE9D,SAAS,IAAI,QAAQ,UAAU,IAAI;EACnC,IAAI,QAAQ,YACV,SAAS,IACP,QAAQ,UACR,4BAA4B,MAAM,QAAQ,WAAW,OAAO,CAAC,CAAC,CAC3D,4BACL;CACJ;CAEA,MAAM,WAAW,aAAqB;EACpC,MAAM,QAAQ,SAAS,IAAI,QAAQ;EAEnC,OAAO,UAAU,KAAA,IACb,OAAO,KAAK,EAAE,mBAAmB,KAAK,CAAC,CAAC,CAAC,IACzC,OAAO,QAAQ,KAAK;CAC1B;CAEA,MAAM,WAAW,aAAqB;EACpC,MAAM,QAAQ,SAAS,IAAI,QAAQ;EAEnC,OAAO,UAAU,KAAA,IACb,OAAO,KAAK,EAAE,mBAAmB,KAAK,CAAC,CAAC,CAAC,IACzC,OAAO,QAAQ,KAAK;CAC1B;CAEA,MAAM,QAAQ,SAAS,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;CAEvC,IAAI,UAAU,KAAA,GAAW,OAAO,OAAO,mBAAmB,8BAA8B;CAExF,IAAI,UAAkC,QAAQ,KAAK,EAAE,oBAAoB;EACvE,SAAS,UAAU,MAAM,mBAAmB,OAAO,KAAK;EACxD,iBAAiB,UACf,OAAO,QAAQ,QAAQ,MAAM,QAAQ,IAAI,UACvC,MAAM,mBAAmB,eAAe,KAAK,CAC/C;CACJ,CAAC,CAAC,CAAC,KACD,QAAQ,IAAI,EAAE,oBAAoB;EAChC,QAAQ,OAAO,YACb,OAAO,QAAQ,QAAQ,MAAM,SAAS,QAAQ,IAAI,UAChD,MAAM,mBAAmB,MAAM,OAAO,OAAO,CAC/C;EACF,UAAU,UACR,OAAO,QAAQ,QAAQ,MAAM,QAAQ,IAAI,UACvC,MAAM,mBAAmB,QAAQ,KAAK,CACxC;EACF,UAAU,OAAO,YACf,OAAO,QAAQ,QAAQ,MAAM,OAAO,QAAQ,IAAI,UAC9C,MAAM,mBAAmB,QAAQ,OAAO,OAAO,CACjD;EACF,UAAU,OAAO,YACf,OAAO,QAAQ,QAAQ,MAAM,QAAQ,IAAI,UACvC,MAAM,mBAAmB,QAAQ,OAAO,OAAO,CACjD;CACJ,CAAC,CACH;CAEA,IAAI,SAAS,OAAO,GAClB,UAAU,QAAQ,KAChB,QAAQ,IAAI,EAAE,8BAA8B;EAC1C,qBAAqB,OAAO,YAC1B,OAAO,QAAQ,QAAQ,MAAM,SAAS,QAAQ,IAAI,UAChD,MAAM,mBAAmB,OAAO,OAAO,CACzC;EACF,OAAO,UAAU,OAAO,QAAQ,QAAQ,MAAM,QAAQ,IAAI,UAAU,MAAM,KAAK,KAAK,CAAC;EACrF,gBAAgB,UACd,OAAO,QAAQ,QAAQ,MAAM,QAAQ,IAAI,UAAU,MAAM,cAAc,KAAK,CAAC;EAC/E,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,MAAM,QAAQ,IAAI,UAAU,MAAM,OAAO,OAAO,OAAO,CAAC;EACjF,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,MAAM,QAAQ,IAAI,UAAU,MAAM,OAAO,OAAO,OAAO,CAAC;CACnF,CAAC,CACH;CAEF,OAAO;AACT,GACA,OAAO,UAAU,UACf,OAAO,GAAG,6BAA6B,CAAC,CAAC,KAAK,IAC1C,QACA,mBAAmB,yCAAyC,CAClE,CACF"}

package/dist/internal/passkey-native-ceremony.d.mts

@@ -0,0 +1,35 @@
+import { TableModel } from "./table-model.mjs";
+import { PasskeyCeremonyMapping } from "./models/passkey-model.mjs";
+import { NativeSqlTables } from "./native-sql-table.mjs";
+import { Effect } from "effect";
+import * as M from "@yielded/auth/Passkey";
+//#region src/internal/passkey-native-ceremony.d.ts
+export type NativePasskeyCeremonyMapping = PasskeyCeremonyMapping<TableModel, any>;
+export declare const makeNativePasskeyCeremonyServices: (tables: NativeSqlTables, mapping: NativePasskeyCeremonyMapping, batch?: {
+  readonly client: import("effect/sql/SqlClient").SqlClient;
+  readonly execute: (statements: ReadonlyArray<import("effect/sql/Statement").Statement<unknown>>) => Effect.Effect<void, import("effect/sql/SqlError").SqlError>;
+} | undefined) => Effect.Effect<{
+  passkeyPersistence: {
+    readonly issue: <A>(input: {
+      readonly ceremony: M.PasskeyCeremony;
+    }, prepare: M.PreparePasskeyCommit<M.PasskeyIssueDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.PasskeyUnavailable>;
+    readonly context: (input: M.PasskeyAccess) => Effect.Effect<M.PasskeyCeremony | undefined, M.PasskeyUnavailable>;
+    readonly consume: <A>(input: {
+      readonly access: M.PasskeyAccess;
+      readonly ceremony: M.PasskeyCeremony;
+      readonly credential: M.PasskeyCredential;
+      readonly assertion: M.PasskeyAssertionVerified;
+    }, prepare: M.PreparePasskeyCommit<M.PasskeyConsumeDecision, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.PasskeyUnavailable>;
+    readonly cleanup: <A>(input: {
+      readonly moduleId: string;
+      readonly limit: import("@yielded/auth/Persistence").CleanupLimit;
+    }, prepare: M.PreparePasskeyCommit<import("@yielded/auth/Persistence").CleanupResult, A>) => Effect.Effect<import("@yielded/auth/Hooks").PreparedCommit<A>, M.PasskeyUnavailable>;
+  };
+  capabilities: {
+    purposes: readonly ["registration"];
+    issue: "registration-authority";
+    assertionConsumption: false;
+  };
+}, never, import("@yielded/auth/Hooks").LifecycleHooks | import("effect/sql/SqlClient").SqlClient>;
+//#endregion
+//# sourceMappingURL=passkey-native-ceremony.d.mts.map

package/dist/internal/passkey-native-ceremony.mjs

@@ -0,0 +1,38 @@
+import { SqlBatchCommit, makeSqlCommitExecutor } from "./sql-commit.mjs";
+import { passkeyOperationInputs } from "./passkey-inputs.mjs";
+import { makePasskeyNativeFlow } from "./passkey-native-flow.mjs";
+import { passkeyNativeInvariant } from "./passkey-native-state.mjs";
+import { preparePasskeyNative } from "./passkey-native.mjs";
+import { Effect } from "effect";
+import * as M from "@yielded/auth/Passkey";
+//#region src/internal/passkey-native-ceremony.ts
+const makeNativePasskeyCeremonyServices = Effect.fnUntraced(function* (tables, mapping, batch) {
+	const flow = yield* makePasskeyNativeFlow(tables, mapping);
+	const executor = yield* makeSqlCommitExecutor(() => M.PasskeyUnavailable.make({}));
+	const run = (effect) => batch === void 0 ? executor.run(effect, "statement") : executor.batch(effect).pipe(Effect.provideService(SqlBatchCommit, batch));
+	return {
+		passkeyPersistence: {
+			issue: () => Effect.fail(M.PasskeyUnavailable.make({})),
+			consume: () => Effect.fail(M.PasskeyUnavailable.make({})),
+			context: (access) => executor.read(Effect.suspend(() => {
+				const input = M.snapshotPasskeySync(M.PasskeyAccess, access);
+				passkeyNativeInvariant(input.purpose === "registration");
+				return flow.context(input);
+			})),
+			cleanup: (original, prepare) => run(Effect.gen(function* () {
+				const input = M.snapshotPasskeySync(passkeyOperationInputs.cleanup, original);
+				passkeyNativeInvariant(flow.validModule(input.moduleId));
+				return yield* preparePasskeyNative(yield* flow.cleanup(input.moduleId, input.limit, batch !== void 0), prepare);
+			}))
+		},
+		capabilities: {
+			purposes: ["registration"],
+			issue: "registration-authority",
+			assertionConsumption: false
+		}
+	};
+});
+//#endregion
+export { makeNativePasskeyCeremonyServices };
+
+//# sourceMappingURL=passkey-native-ceremony.mjs.map

package/dist/internal/passkey-native-ceremony.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-native-ceremony.mjs","names":[],"sources":["../../src/internal/passkey-native-ceremony.ts"],"sourcesContent":["import * as M from \"@yielded/auth/Passkey\";\nimport { Effect } from \"effect\";\n\nimport type { PasskeyCeremonyMapping } from \"./models/passkey-model\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { passkeyOperationInputs } from \"./passkey-inputs\";\nimport { preparePasskeyNative } from \"./passkey-native\";\nimport { makePasskeyNativeFlow } from \"./passkey-native-flow\";\nimport { passkeyNativeInvariant } from \"./passkey-native-state\";\nimport { makeSqlCommitExecutor, SqlBatchCommit } from \"./sql-commit\";\nimport type { TableModel } from \"./table-model\";\n\n// Physical SQL expressions are validated by the table compiler.\n// oxlint-disable-next-line no-explicit-any\nexport type NativePasskeyCeremonyMapping = PasskeyCeremonyMapping<TableModel, any>;\n\nexport const makeNativePasskeyCeremonyServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: NativePasskeyCeremonyMapping,\n  batch?: SqlBatchCommit[\"Service\"],\n) {\n  const flow = yield* makePasskeyNativeFlow(tables, mapping);\n  const executor = yield* makeSqlCommitExecutor(() => M.PasskeyUnavailable.make({}));\n\n  const run = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n    batch === undefined\n      ? executor.run(effect, \"statement\")\n      : executor.batch(effect).pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const passkeyPersistence: M.PasskeyPersistence[\"Service\"] = {\n    issue: () => Effect.fail(M.PasskeyUnavailable.make({})),\n    consume: () => Effect.fail(M.PasskeyUnavailable.make({})),\n    context: (access) =>\n      executor.read(\n        Effect.suspend(() => {\n          const input = M.snapshotPasskeySync(M.PasskeyAccess, access);\n\n          passkeyNativeInvariant(input.purpose === \"registration\");\n\n          return flow.context(input);\n        }),\n      ),\n    cleanup: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotPasskeySync(passkeyOperationInputs.cleanup, original);\n\n          passkeyNativeInvariant(flow.validModule(input.moduleId));\n\n          return yield* preparePasskeyNative(\n            yield* flow.cleanup(input.moduleId, input.limit, batch !== undefined),\n            prepare,\n          );\n        }),\n      ),\n  };\n\n  return {\n    passkeyPersistence,\n    capabilities: {\n      purposes: [\"registration\"] as const,\n      issue: \"registration-authority\" as const,\n      assertionConsumption: false as const,\n    },\n  };\n});\n"],"mappings":";;;;;;;;AAgBA,MAAa,oCAAoC,OAAO,WAAW,WACjE,QACA,SACA,OACA;CACA,MAAM,OAAO,OAAO,sBAAsB,QAAQ,OAAO;CACzD,MAAM,WAAW,OAAO,4BAA4B,EAAE,mBAAmB,KAAK,CAAC,CAAC,CAAC;CAEjF,MAAM,OAAgB,WACpB,UAAU,KAAA,IACN,SAAS,IAAI,QAAQ,WAAW,IAChC,SAAS,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CA8B9E,OAAO;EACL,oBAAA;GA5BA,aAAa,OAAO,KAAK,EAAE,mBAAmB,KAAK,CAAC,CAAC,CAAC;GACtD,eAAe,OAAO,KAAK,EAAE,mBAAmB,KAAK,CAAC,CAAC,CAAC;GACxD,UAAU,WACR,SAAS,KACP,OAAO,cAAc;IACnB,MAAM,QAAQ,EAAE,oBAAoB,EAAE,eAAe,MAAM;IAE3D,uBAAuB,MAAM,YAAY,cAAc;IAEvD,OAAO,KAAK,QAAQ,KAAK;GAC3B,CAAC,CACH;GACF,UAAU,UAAU,YAClB,IACE,OAAO,IAAI,aAAa;IACtB,MAAM,QAAQ,EAAE,oBAAoB,uBAAuB,SAAS,QAAQ;IAE5E,uBAAuB,KAAK,YAAY,MAAM,QAAQ,CAAC;IAEvD,OAAO,OAAO,qBACZ,OAAO,KAAK,QAAQ,MAAM,UAAU,MAAM,OAAO,UAAU,KAAA,CAAS,GACpE,OACF;GACF,CAAC,CACH;EAIe;EACjB,cAAc;GACZ,UAAU,CAAC,cAAc;GACzB,OAAO;GACP,sBAAsB;EACxB;CACF;AACF,CAAC"}

package/dist/internal/passkey-native-flow.mjs

@@ -0,0 +1,91 @@
+import { sqlBatchAssertion } from "./d1-planning.mjs";
+import { exactSqlText, executeSqlChange } from "./sql-change.mjs";
+import { appendSqlBatchStatement } from "./sql-commit.mjs";
+import { cleanupSqlRows } from "./sql-cleanup.mjs";
+import { passkeyMatchesAccess, validPasskeyCeremony } from "./passkey-policy.mjs";
+import { Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import * as M from "@yielded/auth/Passkey";
+//#region src/internal/passkey-native-flow.ts
+const passkeyCeremonyJson = Schema.fromJsonString(M.PasskeyCeremony);
+/** One set of challenge statements serves native transactions and fixed D1 plans. */
+const makePasskeyNativeFlow = Effect.fnUntraced(function* (tables, mapping) {
+	const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+	const flow = tables(mapping.flow.table);
+	const now = tables.expression(mapping.clock.engineNowMillis);
+	const millis = (expression) => tables.expression(mapping.clock.toMillis(expression));
+	const exact = (key, value) => exactSqlText(sql, flow.column(key), flow.value(key, value));
+	const module = (moduleId) => exact(mapping.flow.moduleId, moduleId);
+	const validModule = (moduleId) => moduleId === mapping.moduleId;
+	const access = (input, ceremony) => sql.and([
+		module(input.moduleId),
+		exact(mapping.flow.purpose, input.purpose),
+		exact(mapping.flow.flowId, input.flowId),
+		exact(mapping.flow.requestBindingVerifier, input.requestBindingVerifier),
+		sql`${flow.column(mapping.flow.requestBindingExpiresAt)} = ${flow.value(mapping.flow.requestBindingExpiresAt, mapping.clock.encodeInstant(input.requestBindingExpiresAtMillis))}`,
+		sql`${millis(flow.column(mapping.flow.expiresAt))} > ${now}`,
+		sql`${millis(flow.column(mapping.flow.requestBindingExpiresAt))} > ${now}`,
+		...ceremony === void 0 ? [] : [
+			exact(mapping.flow.snapshot, Schema.encodeSync(passkeyCeremonyJson)(ceremony)),
+			sql`${flow.column(mapping.flow.issuedAt)} = ${flow.value(mapping.flow.issuedAt, mapping.clock.encodeInstant(ceremony.issuedAtMillis))}`,
+			sql`${flow.column(mapping.flow.expiresAt)} = ${flow.value(mapping.flow.expiresAt, mapping.clock.encodeInstant(ceremony.expiresAtMillis))}`
+		]
+	]);
+	const insert = (ceremony, extra = {}) => {
+		const values = {
+			...mapping.flow.encodeInsert({ ceremony }),
+			...extra,
+			[mapping.flow.moduleId]: ceremony.moduleId,
+			[mapping.flow.flowId]: ceremony.flowId,
+			[mapping.flow.purpose]: ceremony.purpose,
+			[mapping.flow.snapshot]: Schema.encodeSync(passkeyCeremonyJson)(ceremony),
+			[mapping.flow.requestBindingVerifier]: ceremony.requestBindingVerifier,
+			[mapping.flow.requestBindingExpiresAt]: mapping.clock.encodeInstant(ceremony.requestBindingExpiresAtMillis),
+			[mapping.flow.issuedAt]: mapping.clock.encodeInstant(ceremony.issuedAtMillis),
+			[mapping.flow.expiresAt]: mapping.clock.encodeInstant(ceremony.expiresAtMillis)
+		};
+		return sql`${flow.insert(values)} ${sql.onDialectOrElse({
+			mysql: () => sql``,
+			orElse: () => sql`on conflict do nothing`
+		})}`;
+	};
+	const consume = (input, ceremony, condition = sql`true`) => sql`delete from ${flow.name} where ${access(input, ceremony)} and ${condition}`;
+	const context = Effect.fnUntraced(function* (input) {
+		if (!validModule(input.moduleId)) return void 0;
+		const rows = yield* sql`select ${flow.fields("flow_")} from ${flow.name} where ${access(input)}`;
+		if (rows.length !== 1) return void 0;
+		const row = flow.decode(rows[0], "flow_");
+		const ceremony = yield* Schema.decodeUnknownEffect(passkeyCeremonyJson)(row[mapping.flow.snapshot]);
+		return validPasskeyCeremony(ceremony) && passkeyMatchesAccess(ceremony, input) && mapping.clock.decodeInstant(row[mapping.flow.issuedAt]) === ceremony.issuedAtMillis && mapping.clock.decodeInstant(row[mapping.flow.expiresAt]) === ceremony.expiresAtMillis ? ceremony : void 0;
+	});
+	const cleanup = (moduleId, limit, batch = false) => cleanupSqlRows([{
+		table: flow,
+		keys: [mapping.flow.moduleId, mapping.flow.flowId],
+		due: sql`${module(moduleId)} and ${millis(flow.column(mapping.flow.expiresAt))} <= ${now}`,
+		order: [flow.column(mapping.flow.expiresAt), flow.column(mapping.flow.flowId)]
+	}], limit, batch);
+	return {
+		sql,
+		flow,
+		now,
+		millis,
+		exact,
+		module,
+		validModule,
+		access,
+		insert,
+		consume,
+		absent: (input) => sql`not exists(select 1 from ${flow.name} where ${module(input.moduleId)} and ${exact(mapping.flow.flowId, input.flowId)})`,
+		context,
+		cleanup,
+		stage: Effect.fnUntraced(function* (statement, count) {
+			yield* appendSqlBatchStatement(sql`${statement}`);
+			yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${count}`));
+		}),
+		change: (statement) => executeSqlChange(sql, statement)
+	};
+});
+//#endregion
+export { makePasskeyNativeFlow, passkeyCeremonyJson };
+
+//# sourceMappingURL=passkey-native-flow.mjs.map

package/dist/internal/passkey-native-flow.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-native-flow.mjs","names":[],"sources":["../../src/internal/passkey-native-flow.ts"],"sourcesContent":["import * as M from \"@yielded/auth/Passkey\";\nimport { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport type { PasskeyCeremonyMapping } from \"./models/passkey-model\";\nimport type { NativeSqlTables } from \"./native-sql-table\";\nimport { passkeyMatchesAccess, validPasskeyCeremony } from \"./passkey-policy\";\nimport { exactSqlText, executeSqlChange } from \"./sql-change\";\nimport { cleanupSqlRows } from \"./sql-cleanup\";\nimport { appendSqlBatchStatement } from \"./sql-commit\";\nimport type { TableModel } from \"./table-model\";\n\nexport const passkeyCeremonyJson = Schema.fromJsonString(M.PasskeyCeremony);\n\n// The physical expression compiler validates this adapter boundary.\n// oxlint-disable-next-line no-explicit-any\nexport type PasskeyNativeCeremonyMapping = PasskeyCeremonyMapping<TableModel, any>;\n\n/** One set of challenge statements serves native transactions and fixed D1 plans. */\nexport const makePasskeyNativeFlow = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: PasskeyNativeCeremonyMapping,\n) {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const flow = tables(mapping.flow.table);\n  const now = tables.expression(mapping.clock.engineNowMillis);\n  const millis = (expression: Fragment) => tables.expression(mapping.clock.toMillis(expression));\n\n  const exact = (key: string, value: unknown) =>\n    exactSqlText(sql, flow.column(key), flow.value(key, value));\n\n  const module = (moduleId: string) => exact(mapping.flow.moduleId, moduleId);\n  const validModule = (moduleId: string) => moduleId === mapping.moduleId;\n\n  const access = (input: M.PasskeyAccess, ceremony?: M.PasskeyCeremony) =>\n    sql.and([\n      module(input.moduleId),\n      exact(mapping.flow.purpose, input.purpose),\n      exact(mapping.flow.flowId, input.flowId),\n      exact(mapping.flow.requestBindingVerifier, input.requestBindingVerifier),\n      sql`${flow.column(mapping.flow.requestBindingExpiresAt)} = ${flow.value(mapping.flow.requestBindingExpiresAt, mapping.clock.encodeInstant(input.requestBindingExpiresAtMillis))}`,\n      sql`${millis(flow.column(mapping.flow.expiresAt))} > ${now}`,\n      sql`${millis(flow.column(mapping.flow.requestBindingExpiresAt))} > ${now}`,\n      ...(ceremony === undefined\n        ? []\n        : [\n            exact(mapping.flow.snapshot, Schema.encodeSync(passkeyCeremonyJson)(ceremony)),\n            sql`${flow.column(mapping.flow.issuedAt)} = ${flow.value(mapping.flow.issuedAt, mapping.clock.encodeInstant(ceremony.issuedAtMillis))}`,\n            sql`${flow.column(mapping.flow.expiresAt)} = ${flow.value(mapping.flow.expiresAt, mapping.clock.encodeInstant(ceremony.expiresAtMillis))}`,\n          ]),\n    ]);\n\n  const insert = (ceremony: M.PasskeyCeremony, extra: Readonly<Record<string, unknown>> = {}) => {\n    const values = {\n      ...mapping.flow.encodeInsert({ ceremony }),\n      ...extra,\n      [mapping.flow.moduleId]: ceremony.moduleId,\n      [mapping.flow.flowId]: ceremony.flowId,\n      [mapping.flow.purpose]: ceremony.purpose,\n      [mapping.flow.snapshot]: Schema.encodeSync(passkeyCeremonyJson)(ceremony),\n      [mapping.flow.requestBindingVerifier]: ceremony.requestBindingVerifier,\n      [mapping.flow.requestBindingExpiresAt]: mapping.clock.encodeInstant(\n        ceremony.requestBindingExpiresAtMillis,\n      ),\n      [mapping.flow.issuedAt]: mapping.clock.encodeInstant(ceremony.issuedAtMillis),\n      [mapping.flow.expiresAt]: mapping.clock.encodeInstant(ceremony.expiresAtMillis),\n    };\n\n    return sql`${flow.insert(values)} ${sql.onDialectOrElse({ mysql: () => sql``, orElse: () => sql`on conflict do nothing` })}`;\n  };\n\n  const consume = (\n    input: M.PasskeyAccess,\n    ceremony: M.PasskeyCeremony,\n    condition: Fragment = sql`true`,\n  ) => sql`delete from ${flow.name} where ${access(input, ceremony)} and ${condition}`;\n\n  const context = Effect.fnUntraced(function* (input: M.PasskeyAccess) {\n    if (!validModule(input.moduleId)) return undefined;\n\n    const rows =\n      yield* sql`select ${flow.fields(\"flow_\")} from ${flow.name} where ${access(input)}`;\n\n    if (rows.length !== 1) return undefined;\n    const row = flow.decode(rows[0]!, \"flow_\");\n\n    const ceremony = yield* Schema.decodeUnknownEffect(passkeyCeremonyJson)(\n      row[mapping.flow.snapshot],\n    );\n\n    return validPasskeyCeremony(ceremony) &&\n      passkeyMatchesAccess(ceremony, input) &&\n      mapping.clock.decodeInstant(row[mapping.flow.issuedAt]) === ceremony.issuedAtMillis &&\n      mapping.clock.decodeInstant(row[mapping.flow.expiresAt]) === ceremony.expiresAtMillis\n      ? ceremony\n      : undefined;\n  });\n\n  const cleanup = (moduleId: string, limit: number, batch = false) =>\n    cleanupSqlRows(\n      [\n        {\n          table: flow,\n          keys: [mapping.flow.moduleId, mapping.flow.flowId],\n          due: sql`${module(moduleId)} and ${millis(flow.column(mapping.flow.expiresAt))} <= ${now}`,\n          order: [flow.column(mapping.flow.expiresAt), flow.column(mapping.flow.flowId)],\n        },\n      ],\n      limit,\n      batch,\n    );\n\n  const stage = Effect.fnUntraced(function* (statement: Fragment, count: number) {\n    yield* appendSqlBatchStatement(sql`${statement}`);\n    yield* appendSqlBatchStatement(sqlBatchAssertion(sql, sql`changes() = ${count}`));\n  });\n\n  return {\n    sql,\n    flow,\n    now,\n    millis,\n    exact,\n    module,\n    validModule,\n    access,\n    insert,\n    consume,\n    absent: (input: M.PasskeyAccess) =>\n      sql`not exists(select 1 from ${flow.name} where ${module(input.moduleId)} and ${exact(mapping.flow.flowId, input.flowId)})`,\n    context,\n    cleanup,\n    stage,\n    change: (statement: Fragment) => executeSqlChange(sql, statement),\n  };\n});\n\nexport type PasskeyNativeFlow = Effect.Success<ReturnType<typeof makePasskeyNativeFlow>>;\n"],"mappings":";;;;;;;;;AAcA,MAAa,sBAAsB,OAAO,eAAe,EAAE,eAAe;;AAO1E,MAAa,wBAAwB,OAAO,WAAW,WACrD,QACA,SACA;CACA,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,OAAO,OAAO,QAAQ,KAAK,KAAK;CACtC,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAC3D,MAAM,UAAU,eAAyB,OAAO,WAAW,QAAQ,MAAM,SAAS,UAAU,CAAC;CAE7F,MAAM,SAAS,KAAa,UAC1B,aAAa,KAAK,KAAK,OAAO,GAAG,GAAG,KAAK,MAAM,KAAK,KAAK,CAAC;CAE5D,MAAM,UAAU,aAAqB,MAAM,QAAQ,KAAK,UAAU,QAAQ;CAC1E,MAAM,eAAe,aAAqB,aAAa,QAAQ;CAE/D,MAAM,UAAU,OAAwB,aACtC,IAAI,IAAI;EACN,OAAO,MAAM,QAAQ;EACrB,MAAM,QAAQ,KAAK,SAAS,MAAM,OAAO;EACzC,MAAM,QAAQ,KAAK,QAAQ,MAAM,MAAM;EACvC,MAAM,QAAQ,KAAK,wBAAwB,MAAM,sBAAsB;EACvE,GAAG,GAAG,KAAK,OAAO,QAAQ,KAAK,uBAAuB,EAAE,KAAK,KAAK,MAAM,QAAQ,KAAK,yBAAyB,QAAQ,MAAM,cAAc,MAAM,6BAA6B,CAAC;EAC9K,GAAG,GAAG,OAAO,KAAK,OAAO,QAAQ,KAAK,SAAS,CAAC,EAAE,KAAK;EACvD,GAAG,GAAG,OAAO,KAAK,OAAO,QAAQ,KAAK,uBAAuB,CAAC,EAAE,KAAK;EACrE,GAAI,aAAa,KAAA,IACb,CAAC,IACD;GACE,MAAM,QAAQ,KAAK,UAAU,OAAO,WAAW,mBAAmB,CAAC,CAAC,QAAQ,CAAC;GAC7E,GAAG,GAAG,KAAK,OAAO,QAAQ,KAAK,QAAQ,EAAE,KAAK,KAAK,MAAM,QAAQ,KAAK,UAAU,QAAQ,MAAM,cAAc,SAAS,cAAc,CAAC;GACpI,GAAG,GAAG,KAAK,OAAO,QAAQ,KAAK,SAAS,EAAE,KAAK,KAAK,MAAM,QAAQ,KAAK,WAAW,QAAQ,MAAM,cAAc,SAAS,eAAe,CAAC;EACzI;CACN,CAAC;CAEH,MAAM,UAAU,UAA6B,QAA2C,CAAC,MAAM;EAC7F,MAAM,SAAS;GACb,GAAG,QAAQ,KAAK,aAAa,EAAE,SAAS,CAAC;GACzC,GAAG;IACF,QAAQ,KAAK,WAAW,SAAS;IACjC,QAAQ,KAAK,SAAS,SAAS;IAC/B,QAAQ,KAAK,UAAU,SAAS;IAChC,QAAQ,KAAK,WAAW,OAAO,WAAW,mBAAmB,CAAC,CAAC,QAAQ;IACvE,QAAQ,KAAK,yBAAyB,SAAS;IAC/C,QAAQ,KAAK,0BAA0B,QAAQ,MAAM,cACpD,SAAS,6BACX;IACC,QAAQ,KAAK,WAAW,QAAQ,MAAM,cAAc,SAAS,cAAc;IAC3E,QAAQ,KAAK,YAAY,QAAQ,MAAM,cAAc,SAAS,eAAe;EAChF;EAEA,OAAO,GAAG,GAAG,KAAK,OAAO,MAAM,EAAE,GAAG,IAAI,gBAAgB;GAAE,aAAa,GAAG;GAAI,cAAc,GAAG;EAAyB,CAAC;CAC3H;CAEA,MAAM,WACJ,OACA,UACA,YAAsB,GAAG,WACtB,GAAG,eAAe,KAAK,KAAK,SAAS,OAAO,OAAO,QAAQ,EAAE,OAAO;CAEzE,MAAM,UAAU,OAAO,WAAW,WAAW,OAAwB;EACnE,IAAI,CAAC,YAAY,MAAM,QAAQ,GAAG,OAAO,KAAA;EAEzC,MAAM,OACJ,OAAO,GAAG,UAAU,KAAK,OAAO,OAAO,EAAE,QAAQ,KAAK,KAAK,SAAS,OAAO,KAAK;EAElF,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAC9B,MAAM,MAAM,KAAK,OAAO,KAAK,IAAK,OAAO;EAEzC,MAAM,WAAW,OAAO,OAAO,oBAAoB,mBAAmB,CAAC,CACrE,IAAI,QAAQ,KAAK,SACnB;EAEA,OAAO,qBAAqB,QAAQ,KAClC,qBAAqB,UAAU,KAAK,KACpC,QAAQ,MAAM,cAAc,IAAI,QAAQ,KAAK,SAAS,MAAM,SAAS,kBACrE,QAAQ,MAAM,cAAc,IAAI,QAAQ,KAAK,UAAU,MAAM,SAAS,kBACpE,WACA,KAAA;CACN,CAAC;CAED,MAAM,WAAW,UAAkB,OAAe,QAAQ,UACxD,eACE,CACE;EACE,OAAO;EACP,MAAM,CAAC,QAAQ,KAAK,UAAU,QAAQ,KAAK,MAAM;EACjD,KAAK,GAAG,GAAG,OAAO,QAAQ,EAAE,OAAO,OAAO,KAAK,OAAO,QAAQ,KAAK,SAAS,CAAC,EAAE,MAAM;EACrF,OAAO,CAAC,KAAK,OAAO,QAAQ,KAAK,SAAS,GAAG,KAAK,OAAO,QAAQ,KAAK,MAAM,CAAC;CAC/E,CACF,GACA,OACA,KACF;CAOF,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,SAAS,UACP,GAAG,4BAA4B,KAAK,KAAK,SAAS,OAAO,MAAM,QAAQ,EAAE,OAAO,MAAM,QAAQ,KAAK,QAAQ,MAAM,MAAM,EAAE;EAC3H;EACA;EACA,OApBY,OAAO,WAAW,WAAW,WAAqB,OAAe;GAC7E,OAAO,wBAAwB,GAAG,GAAG,WAAW;GAChD,OAAO,wBAAwB,kBAAkB,KAAK,GAAG,eAAe,OAAO,CAAC;EAClF,CAiBM;EACJ,SAAS,cAAwB,iBAAiB,KAAK,SAAS;CAClE;AACF,CAAC"}

package/dist/internal/passkey-native-registration.d.mts

@@ -0,0 +1,10 @@
+import { TableModel } from "./table-model.mjs";
+import { PasskeyRegistrationMapping, PasskeyRegistrationWriter } from "./models/passkey-write-model.mjs";
+import { NativePasskeyServices } from "./passkey-native.mjs";
+//#region src/internal/passkey-native-registration.d.ts
+export type NativePasskeyRegistrationMapping<R> = PasskeyRegistrationMapping<TableModel, TableModel, TableModel, TableModel, unknown, R, any>;
+export declare const makePasskeyNativeRegistration: <R>(base: NativePasskeyServices, mapping: NativePasskeyRegistrationMapping<R>) => {
+  passkeyRegistrationAuthority: PasskeyRegistrationWriter<R>;
+};
+//#endregion
+//# sourceMappingURL=passkey-native-registration.d.mts.map

package/dist/internal/passkey-native-registration.mjs

@@ -0,0 +1,114 @@
+import { sqlBatchAssertion } from "./d1-planning.mjs";
+import { appendSqlBatchStatement } from "./sql-commit.mjs";
+import { passkeyMatchesAccess, validPasskeyCeremony } from "./passkey-policy.mjs";
+import { passkeyNativeInvariant } from "./passkey-native-state.mjs";
+import { preparePasskeyNative } from "./passkey-native.mjs";
+import { randomId } from "./crypto.mjs";
+import { passkeyCanonicalJson, passkeyDigest } from "./passkey-actions.mjs";
+import { makePasskeyNativeWrites } from "./passkey-native-write.mjs";
+import { Effect, Schema } from "effect";
+import * as M from "@yielded/auth/Passkey";
+//#region src/internal/passkey-native-registration.ts
+const makePasskeyNativeRegistration = (base, mapping) => {
+	const { state, run, advisory } = base;
+	const { sql, tables, subject, credential, ceremony: flow } = state;
+	const { write, postcondition, check, insertCredential, subjectCondition, owned } = makePasskeyNativeWrites(base, mapping);
+	const invariant = passkeyNativeInvariant;
+	const codec = passkeyCanonicalJson(mapping.registration.schema);
+	const describe = Effect.fnUntraced(function* (original) {
+		const encoded = codec.encode(original);
+		invariant(new TextEncoder().encode(encoded).length <= 1048576);
+		const registration = codec.decode(encoded);
+		return {
+			encoded,
+			registration,
+			...yield* Schema.decodeEffect(Schema.Struct({
+				name: M.PasskeyLabel,
+				displayName: M.PasskeyLabel
+			}))(mapping.registration.describe(registration)),
+			fingerprint: yield* passkeyDigest(mapping.registration.schema, registration)
+		};
+	});
+	return { passkeyRegistrationAuthority: {
+		inspect: (original) => advisory(Effect.gen(function* () {
+			const value = yield* describe(original);
+			const rows = yield* sql`select case when ${tables.expression(mapping.registration.eligible(value.registration))} then 1 else 0 end as eligible`;
+			return {
+				fingerprint: value.fingerprint,
+				name: value.name,
+				displayName: value.displayName,
+				eligible: rows.length === 1 && Number(rows[0].eligible) === 1
+			};
+		})),
+		issueRegistration: (input, prepare) => run(Effect.gen(function* () {
+			const ceremony = M.snapshotPasskeySync(M.PasskeyCeremony, input.ceremony);
+			const value = yield* describe(input.registration);
+			if (!flow.validModule(ceremony.moduleId) || !validPasskeyCeremony(ceremony) || ceremony.purpose !== "registration" || ceremony.context._tag !== "Registration" || !ceremony.profile.primarySignIn || ceremony.profile.residentKey !== "required" || ceremony.profile.userVerification !== "required" || ceremony.allowedCredentials.length !== 0 || ceremony.context.fingerprint !== value.fingerprint || ceremony.context.name !== value.name || ceremony.context.displayName !== value.displayName) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+			const statement = flow.insert(ceremony, { [mapping.applicationSnapshot]: value.encoded });
+			if (base.batch) yield* flow.stage(statement, 1);
+			else if ((yield* flow.change(statement)) !== 1) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+			return yield* preparePasskeyNative({
+				_tag: "Issued",
+				ceremony
+			}, prepare);
+		}), "statement"),
+		completeRegistration: (input, prepare) => run(Effect.gen(function* () {
+			const ceremony = M.snapshotPasskeySync(M.PasskeyCeremony, input.ceremony);
+			const access = M.snapshotPasskeySync(M.PasskeyAccess, input.access);
+			const verified = M.snapshotPasskeySync(M.PasskeyRegistrationVerified, input.verified);
+			if (!flow.validModule(ceremony.moduleId) || ceremony.context._tag !== "Registration" || ceremony.purpose !== "registration" || !passkeyMatchesAccess(ceremony, access) || !verified.userVerified) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+			const rows = yield* sql`select ${flow.flow.fields("flow_")}, ${flow.now} as "engineNow" from ${flow.flow.name} where ${flow.access(access, ceremony)}`;
+			if (rows.length !== 1) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+			const row = flow.flow.decode(rows[0], "flow_");
+			const encoded = yield* Schema.decodeUnknownEffect(Schema.String)(row[mapping.applicationSnapshot]);
+			const registration = codec.decode(encoded);
+			const value = yield* describe(registration);
+			if (value.fingerprint !== ceremony.context.fingerprint || value.name !== ceremony.context.name || value.displayName !== ceremony.context.displayName) return yield* preparePasskeyNative({ _tag: "Rejected" }, prepare);
+			const eligible = tables.expression(mapping.registration.eligible(registration));
+			const marker = yield* randomId;
+			const provision = mapping.registration.subject({
+				registration,
+				ceremony,
+				marker
+			});
+			const nativeId = provision.subjectId;
+			const subjectId = mapping.read.subjectIds.toSubject(nativeId);
+			invariant(mapping.read.subjectIds.equals(mapping.read.subjectIds.toNative(subjectId), nativeId));
+			if (base.batch) yield* appendSqlBatchStatement(sqlBatchAssertion(sql, eligible));
+			else yield* check(eligible);
+			yield* write(subject.insert(provision.values), 1);
+			let revision;
+			let nowMillis;
+			let subjectRow = provision.values;
+			if (base.batch) {
+				invariant(mapping.read.subject.isActiveStatus(provision.values[mapping.read.subject.status]));
+				revision = yield* Schema.decodeUnknownEffect(M.PasskeyRevision)({
+					subjectId,
+					securityRevision: provision.values[mapping.read.subject.securityRevision],
+					credentials: []
+				});
+				nowMillis = yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engineNow));
+			} else {
+				const current = yield* state.readAuthority(nativeId, true);
+				invariant(current !== void 0);
+				subjectRow = current.row;
+				revision = current.revision;
+				nowMillis = current.nowMillis;
+			}
+			const cap = M.snapshotPasskeySync(M.PasskeyManagementPolicy, mapping.write.policy.management(subjectRow)).maximumCredentials;
+			const count = sql`(select count(*) from ${credential.name} where ${owned(nativeId)})`;
+			const finalEligibility = tables.expression(mapping.registration.finalEligibility({
+				registration,
+				subjectId: nativeId
+			}));
+			yield* write(flow.consume(access, ceremony, sql`${flow.exact(mapping.applicationSnapshot, encoded)} and ${subjectCondition(revision)} and ${count} < ${cap} and ${finalEligibility}`), 1);
+			const inserted = yield* insertCredential(nativeId, ceremony, verified, revision, value.displayName, nowMillis, subjectRow);
+			yield* postcondition("passkey-registration-subject", sql`${inserted.condition} and ${flow.absent(access)} and ${subjectCondition(revision)} and ${count} <= ${cap} and ${finalEligibility} and ${state.now} < ${ceremony.expiresAtMillis}`);
+			return yield* preparePasskeyNative({ _tag: "RegistrationAccepted" }, prepare);
+		}))
+	} };
+};
+//#endregion
+export { makePasskeyNativeRegistration };
+
+//# sourceMappingURL=passkey-native-registration.mjs.map

package/dist/internal/passkey-native-registration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-native-registration.mjs","names":[],"sources":["../../src/internal/passkey-native-registration.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- physical mapping generics are erased only at this shared adapter boundary. */\nimport * as M from \"@yielded/auth/Passkey\";\nimport { Effect, Schema } from \"effect\";\n\nimport { randomId } from \"./crypto\";\nimport { sqlBatchAssertion } from \"./d1-planning\";\nimport type {\n  PasskeyRegistrationMapping,\n  PasskeyRegistrationWriter,\n} from \"./models/passkey-write-model\";\nimport { passkeyCanonicalJson, passkeyDigest } from \"./passkey-actions\";\nimport { preparePasskeyNative, type NativePasskeyServices } from \"./passkey-native\";\nimport { passkeyNativeInvariant } from \"./passkey-native-state\";\nimport { makePasskeyNativeWrites } from \"./passkey-native-write\";\nimport { passkeyMatchesAccess, validPasskeyCeremony } from \"./passkey-policy\";\nimport { appendSqlBatchStatement } from \"./sql-commit\";\nimport type { TableModel } from \"./table-model\";\n\n// Foreign mapping expressions are compiled at the NativeSqlTables boundary.\nexport type NativePasskeyRegistrationMapping<R> = PasskeyRegistrationMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  R,\n  any\n>;\n\nexport const makePasskeyNativeRegistration = <R>(\n  base: NativePasskeyServices,\n  mapping: NativePasskeyRegistrationMapping<R>,\n) => {\n  const { state, run, advisory } = base;\n  const { sql, tables, subject, credential, ceremony: flow } = state;\n\n  const { write, postcondition, check, insertCredential, subjectCondition, owned } =\n    makePasskeyNativeWrites(base, mapping);\n\n  const invariant: typeof passkeyNativeInvariant = passkeyNativeInvariant;\n  const codec = passkeyCanonicalJson(mapping.registration.schema);\n\n  const describe = Effect.fnUntraced(function* (original: R) {\n    const encoded = codec.encode(original);\n\n    invariant(new TextEncoder().encode(encoded).length <= 1048576);\n    const registration = codec.decode(encoded);\n\n    const labels = yield* Schema.decodeEffect(\n      Schema.Struct({ name: M.PasskeyLabel, displayName: M.PasskeyLabel }),\n    )(mapping.registration.describe(registration));\n\n    return {\n      encoded,\n      registration,\n      ...labels,\n      fingerprint: yield* passkeyDigest(mapping.registration.schema, registration),\n    };\n  });\n\n  const writer: PasskeyRegistrationWriter<R> = {\n    inspect: (original) =>\n      advisory(\n        Effect.gen(function* () {\n          const value = yield* describe(original);\n\n          const rows =\n            yield* sql`select case when ${tables.expression(mapping.registration.eligible(value.registration))} then 1 else 0 end as eligible`;\n\n          return {\n            fingerprint: value.fingerprint,\n            name: value.name,\n            displayName: value.displayName,\n            eligible: rows.length === 1 && Number(rows[0]!.eligible) === 1,\n          };\n        }),\n      ),\n    issueRegistration: (input, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const ceremony = M.snapshotPasskeySync(M.PasskeyCeremony, input.ceremony);\n          const value = yield* describe(input.registration);\n\n          if (\n            !flow.validModule(ceremony.moduleId) ||\n            !validPasskeyCeremony(ceremony) ||\n            ceremony.purpose !== \"registration\" ||\n            ceremony.context._tag !== \"Registration\" ||\n            !ceremony.profile.primarySignIn ||\n            ceremony.profile.residentKey !== \"required\" ||\n            ceremony.profile.userVerification !== \"required\" ||\n            ceremony.allowedCredentials.length !== 0 ||\n            ceremony.context.fingerprint !== value.fingerprint ||\n            ceremony.context.name !== value.name ||\n            ceremony.context.displayName !== value.displayName\n          )\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const statement = flow.insert(ceremony, { [mapping.applicationSnapshot]: value.encoded });\n\n          if (base.batch) yield* flow.stage(statement, 1);\n          else if ((yield* flow.change(statement)) !== 1)\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          return yield* preparePasskeyNative({ _tag: \"Issued\", ceremony }, prepare);\n        }),\n        \"statement\",\n      ),\n    completeRegistration: (input, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const ceremony = M.snapshotPasskeySync(M.PasskeyCeremony, input.ceremony);\n          const access = M.snapshotPasskeySync(M.PasskeyAccess, input.access);\n          const verified = M.snapshotPasskeySync(M.PasskeyRegistrationVerified, input.verified);\n\n          if (\n            !flow.validModule(ceremony.moduleId) ||\n            ceremony.context._tag !== \"Registration\" ||\n            ceremony.purpose !== \"registration\" ||\n            !passkeyMatchesAccess(ceremony, access) ||\n            !verified.userVerified\n          )\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n\n          const rows =\n            yield* sql`select ${flow.flow.fields(\"flow_\")}, ${flow.now} as \"engineNow\" from ${flow.flow.name} where ${flow.access(access, ceremony)}`;\n\n          if (rows.length !== 1) return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const row = flow.flow.decode(rows[0]!, \"flow_\");\n\n          const encoded = yield* Schema.decodeUnknownEffect(Schema.String)(\n            row[mapping.applicationSnapshot],\n          );\n\n          const registration = codec.decode(encoded);\n          const value = yield* describe(registration);\n\n          if (\n            value.fingerprint !== ceremony.context.fingerprint ||\n            value.name !== ceremony.context.name ||\n            value.displayName !== ceremony.context.displayName\n          )\n            return yield* preparePasskeyNative({ _tag: \"Rejected\" }, prepare);\n          const eligible = tables.expression(mapping.registration.eligible(registration));\n          const marker = yield* randomId;\n          const provision = mapping.registration.subject({ registration, ceremony, marker });\n          const nativeId = provision.subjectId;\n          const subjectId = mapping.read.subjectIds.toSubject(nativeId);\n\n          invariant(\n            mapping.read.subjectIds.equals(mapping.read.subjectIds.toNative(subjectId), nativeId),\n          );\n          if (base.batch) yield* appendSqlBatchStatement(sqlBatchAssertion(sql, eligible));\n          else yield* check(eligible);\n          // Inserting the new subject acquires its lock before the challenge or\n          // credential is mutated. A failed consume rolls this insertion back.\n          yield* write(subject.insert(provision.values), 1);\n          let revision: M.PasskeyCredential[\"revision\"];\n          let nowMillis: number;\n          let subjectRow: Readonly<Record<string, unknown>> = provision.values;\n\n          if (base.batch) {\n            invariant(\n              mapping.read.subject.isActiveStatus(provision.values[mapping.read.subject.status]),\n            );\n            revision = yield* Schema.decodeUnknownEffect(M.PasskeyRevision)({\n              subjectId,\n              securityRevision: provision.values[mapping.read.subject.securityRevision],\n              credentials: [],\n            });\n            nowMillis = yield* Schema.decodeEffect(Schema.Int)(Number(rows[0]!.engineNow));\n          } else {\n            const current = yield* state.readAuthority(nativeId, true);\n\n            invariant(current !== undefined);\n            subjectRow = current.row;\n            revision = current.revision;\n            nowMillis = current.nowMillis;\n          }\n\n          const cap = M.snapshotPasskeySync(\n            M.PasskeyManagementPolicy,\n            mapping.write.policy.management(subjectRow),\n          ).maximumCredentials;\n\n          const count = sql`(select count(*) from ${credential.name} where ${owned(nativeId)})`;\n\n          const finalEligibility = tables.expression(\n            mapping.registration.finalEligibility({ registration, subjectId: nativeId }),\n          );\n\n          yield* write(\n            flow.consume(\n              access,\n              ceremony,\n              sql`${flow.exact(mapping.applicationSnapshot, encoded)} and ${subjectCondition(revision)} and ${count} < ${cap} and ${finalEligibility}`,\n            ),\n            1,\n          );\n\n          const inserted = yield* insertCredential(\n            nativeId,\n            ceremony,\n            verified,\n            revision,\n            value.displayName,\n            nowMillis,\n            subjectRow,\n          );\n\n          yield* postcondition(\n            \"passkey-registration-subject\",\n            sql`${inserted.condition} and ${flow.absent(access)} and ${subjectCondition(revision)} and ${count} <= ${cap} and ${finalEligibility} and ${state.now} < ${ceremony.expiresAtMillis}`,\n          );\n\n          return yield* preparePasskeyNative({ _tag: \"RegistrationAccepted\" }, prepare);\n        }),\n      ),\n  };\n\n  return { passkeyRegistrationAuthority: writer };\n};\n"],"mappings":";;;;;;;;;;;AA6BA,MAAa,iCACX,MACA,YACG;CACH,MAAM,EAAE,OAAO,KAAK,aAAa;CACjC,MAAM,EAAE,KAAK,QAAQ,SAAS,YAAY,UAAU,SAAS;CAE7D,MAAM,EAAE,OAAO,eAAe,OAAO,kBAAkB,kBAAkB,UACvE,wBAAwB,MAAM,OAAO;CAEvC,MAAM,YAA2C;CACjD,MAAM,QAAQ,qBAAqB,QAAQ,aAAa,MAAM;CAE9D,MAAM,WAAW,OAAO,WAAW,WAAW,UAAa;EACzD,MAAM,UAAU,MAAM,OAAO,QAAQ;EAErC,UAAU,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,UAAU,OAAO;EAC7D,MAAM,eAAe,MAAM,OAAO,OAAO;EAMzC,OAAO;GACL;GACA;GACA,GAAG,OAPiB,OAAO,aAC3B,OAAO,OAAO;IAAE,MAAM,EAAE;IAAc,aAAa,EAAE;GAAa,CAAC,CACrE,CAAC,CAAC,QAAQ,aAAa,SAAS,YAAY,CAAC;GAM3C,aAAa,OAAO,cAAc,QAAQ,aAAa,QAAQ,YAAY;EAC7E;CACF,CAAC;CAiKD,OAAO,EAAE,8BAA8B;EA9JrC,UAAU,aACR,SACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,SAAS,QAAQ;GAEtC,MAAM,OACJ,OAAO,GAAG,oBAAoB,OAAO,WAAW,QAAQ,aAAa,SAAS,MAAM,YAAY,CAAC,EAAE;GAErG,OAAO;IACL,aAAa,MAAM;IACnB,MAAM,MAAM;IACZ,aAAa,MAAM;IACnB,UAAU,KAAK,WAAW,KAAK,OAAO,KAAK,EAAE,CAAE,QAAQ,MAAM;GAC/D;EACF,CAAC,CACH;EACF,oBAAoB,OAAO,YACzB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,EAAE,oBAAoB,EAAE,iBAAiB,MAAM,QAAQ;GACxE,MAAM,QAAQ,OAAO,SAAS,MAAM,YAAY;GAEhD,IACE,CAAC,KAAK,YAAY,SAAS,QAAQ,KACnC,CAAC,qBAAqB,QAAQ,KAC9B,SAAS,YAAY,kBACrB,SAAS,QAAQ,SAAS,kBAC1B,CAAC,SAAS,QAAQ,iBAClB,SAAS,QAAQ,gBAAgB,cACjC,SAAS,QAAQ,qBAAqB,cACtC,SAAS,mBAAmB,WAAW,KACvC,SAAS,QAAQ,gBAAgB,MAAM,eACvC,SAAS,QAAQ,SAAS,MAAM,QAChC,SAAS,QAAQ,gBAAgB,MAAM,aAEvC,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,YAAY,KAAK,OAAO,UAAU,GAAG,QAAQ,sBAAsB,MAAM,QAAQ,CAAC;GAExF,IAAI,KAAK,OAAO,OAAO,KAAK,MAAM,WAAW,CAAC;QACzC,KAAK,OAAO,KAAK,OAAO,SAAS,OAAO,GAC3C,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,OAAO,OAAO,qBAAqB;IAAE,MAAM;IAAU;GAAS,GAAG,OAAO;EAC1E,CAAC,GACD,WACF;EACF,uBAAuB,OAAO,YAC5B,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,EAAE,oBAAoB,EAAE,iBAAiB,MAAM,QAAQ;GACxE,MAAM,SAAS,EAAE,oBAAoB,EAAE,eAAe,MAAM,MAAM;GAClE,MAAM,WAAW,EAAE,oBAAoB,EAAE,6BAA6B,MAAM,QAAQ;GAEpF,IACE,CAAC,KAAK,YAAY,SAAS,QAAQ,KACnC,SAAS,QAAQ,SAAS,kBAC1B,SAAS,YAAY,kBACrB,CAAC,qBAAqB,UAAU,MAAM,KACtC,CAAC,SAAS,cAEV,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAElE,MAAM,OACJ,OAAO,GAAG,UAAU,KAAK,KAAK,OAAO,OAAO,EAAE,IAAI,KAAK,IAAI,uBAAuB,KAAK,KAAK,KAAK,SAAS,KAAK,OAAO,QAAQ,QAAQ;GAExI,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GACvF,MAAM,MAAM,KAAK,KAAK,OAAO,KAAK,IAAK,OAAO;GAE9C,MAAM,UAAU,OAAO,OAAO,oBAAoB,OAAO,MAAM,CAAC,CAC9D,IAAI,QAAQ,oBACd;GAEA,MAAM,eAAe,MAAM,OAAO,OAAO;GACzC,MAAM,QAAQ,OAAO,SAAS,YAAY;GAE1C,IACE,MAAM,gBAAgB,SAAS,QAAQ,eACvC,MAAM,SAAS,SAAS,QAAQ,QAChC,MAAM,gBAAgB,SAAS,QAAQ,aAEvC,OAAO,OAAO,qBAAqB,EAAE,MAAM,WAAW,GAAG,OAAO;GAClE,MAAM,WAAW,OAAO,WAAW,QAAQ,aAAa,SAAS,YAAY,CAAC;GAC9E,MAAM,SAAS,OAAO;GACtB,MAAM,YAAY,QAAQ,aAAa,QAAQ;IAAE;IAAc;IAAU;GAAO,CAAC;GACjF,MAAM,WAAW,UAAU;GAC3B,MAAM,YAAY,QAAQ,KAAK,WAAW,UAAU,QAAQ;GAE5D,UACE,QAAQ,KAAK,WAAW,OAAO,QAAQ,KAAK,WAAW,SAAS,SAAS,GAAG,QAAQ,CACtF;GACA,IAAI,KAAK,OAAO,OAAO,wBAAwB,kBAAkB,KAAK,QAAQ,CAAC;QAC1E,OAAO,MAAM,QAAQ;GAG1B,OAAO,MAAM,QAAQ,OAAO,UAAU,MAAM,GAAG,CAAC;GAChD,IAAI;GACJ,IAAI;GACJ,IAAI,aAAgD,UAAU;GAE9D,IAAI,KAAK,OAAO;IACd,UACE,QAAQ,KAAK,QAAQ,eAAe,UAAU,OAAO,QAAQ,KAAK,QAAQ,OAAO,CACnF;IACA,WAAW,OAAO,OAAO,oBAAoB,EAAE,eAAe,CAAC,CAAC;KAC9D;KACA,kBAAkB,UAAU,OAAO,QAAQ,KAAK,QAAQ;KACxD,aAAa,CAAC;IAChB,CAAC;IACD,YAAY,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAE,SAAS,CAAC;GAC/E,OAAO;IACL,MAAM,UAAU,OAAO,MAAM,cAAc,UAAU,IAAI;IAEzD,UAAU,YAAY,KAAA,CAAS;IAC/B,aAAa,QAAQ;IACrB,WAAW,QAAQ;IACnB,YAAY,QAAQ;GACtB;GAEA,MAAM,MAAM,EAAE,oBACZ,EAAE,yBACF,QAAQ,MAAM,OAAO,WAAW,UAAU,CAC5C,CAAC,CAAC;GAEF,MAAM,QAAQ,GAAG,yBAAyB,WAAW,KAAK,SAAS,MAAM,QAAQ,EAAE;GAEnF,MAAM,mBAAmB,OAAO,WAC9B,QAAQ,aAAa,iBAAiB;IAAE;IAAc,WAAW;GAAS,CAAC,CAC7E;GAEA,OAAO,MACL,KAAK,QACH,QACA,UACA,GAAG,GAAG,KAAK,MAAM,QAAQ,qBAAqB,OAAO,EAAE,OAAO,iBAAiB,QAAQ,EAAE,OAAO,MAAM,KAAK,IAAI,OAAO,kBACxH,GACA,CACF;GAEA,MAAM,WAAW,OAAO,iBACtB,UACA,UACA,UACA,UACA,MAAM,aACN,WACA,UACF;GAEA,OAAO,cACL,gCACA,GAAG,GAAG,SAAS,UAAU,OAAO,KAAK,OAAO,MAAM,EAAE,OAAO,iBAAiB,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,OAAO,iBAAiB,OAAO,MAAM,IAAI,KAAK,SAAS,iBACtK;GAEA,OAAO,OAAO,qBAAqB,EAAE,MAAM,uBAAuB,GAAG,OAAO;EAC9E,CAAC,CACH;CAGwC,EAAE;AAChD"}