@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/internal/passkey/flow.mjs

@@ -1,452 +0,0 @@
-import { CurrentPasskeyTransaction } from "./state.mjs";
-import { DateTime, Effect } from "effect";
-import { PasskeyClaim, snapshotPasskeySync } from "@yielded/auth/Passkey";
-//#region src/internal/passkey/flow.ts
-const makePasskeyFlowKernel = (operations, admission, credentials, registrationCustody, state, transactions) => {
-	const { sql } = operations;
-	const { admissionCondition, chargeScopes, guardAdmission, guardChargeSet, insertCharges, lockAdmission, readCharges } = admission;
-	const { readCredential, readModule, readPolicyGuards, readRevision, readSubject } = credentials;
-	const { releaseRegistrationCustody, scrubRegistrationIntent } = registrationCustody;
-	const { ceremonyStorage, col, credentialStorage, equal, existsExact, mappedColumns, policyStorage, profileStorage, sameCredential, sameRevision, semanticCredentialColumns, subjectScope, targetScope } = state;
-	const invariant = state.invariant;
-	const { both } = transactions;
-	const assertionPurposes = [
-		"sign-in",
-		"pending",
-		"step-up",
-		"action"
-	];
-	const contextPurpose = {
-		SignIn: "sign-in",
-		Pending: "pending",
-		StepUp: "step-up",
-		Action: "action",
-		Enrollment: "enrollment",
-		Registration: "registration"
-	};
-	const knownSubject = (ceremony) => "target" in ceremony.context ? ceremony.context.target.revision.subjectId : ceremony.context._tag === "Enrollment" ? ceremony.context.revision.subjectId : void 0;
-	const compatiblePolicy = (ceremony, original, current) => {
-		const selected = current.profiles.find((profile) => profile.profileId === ceremony.profile.profileId);
-		const issued = original.profiles.find((profile) => profile.profileId === ceremony.profile.profileId);
-		return ceremony.generation === current.generation && ceremony.generation === original.generation && selected !== void 0 && issued !== void 0 && profileStorage.encode(selected) === profileStorage.encode(ceremony.profile) && profileStorage.encode(issued) === profileStorage.encode(ceremony.profile) && ceremony.claimLifetimeMillis === original.claimLifetimeMillis && ceremony.expiresAtMillis > ceremony.issuedAtMillis && ceremony.expiresAtMillis <= ceremony.requestBindingExpiresAtMillis && ceremony.expiresAtMillis - ceremony.issuedAtMillis <= original.lifetimeMillis && ceremony.expiresAtMillis - ceremony.issuedAtMillis <= current.lifetimeMillis && ceremony.retentionUntilMillis === ceremony.issuedAtMillis + original.retentionMillis && contextPurpose[ceremony.context._tag] === ceremony.purpose && new Set(ceremony.allowedCredentials.map((item) => item.id)).size === ceremony.allowedCredentials.length;
-	};
-	const liveCondition = (mapping, ceremony, claim) => {
-		const now = mapping.clock.engineNowMillis;
-		return both(sql`${now} >= ${ceremony.issuedAtMillis}`, sql`${now} < ${ceremony.expiresAtMillis}`, sql`${now} < ${ceremony.requestBindingExpiresAtMillis}`, "target" in ceremony.context ? sql`${now} < ${ceremony.context.target.expiresAtMillis}` : void 0, claim === void 0 ? void 0 : both(sql`${now} >= ${claim.claimedAtMillis}`, sql`${now} < ${claim.claimExpiresAtMillis}`));
-	};
-	const matchesAccess = (ceremony, access) => ceremony.moduleId === access.moduleId && ceremony.generation === access.generation && ceremony.purpose === access.purpose && ceremony.flowId === access.flowId && ceremony.requestBindingVerifier === access.requestBindingVerifier && ceremony.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis;
-	const readFlow = Effect.fn("passkey.readFlow")(function* (mapping, flowId) {
-		const owner = yield* CurrentPasskeyTransaction;
-		const table = mapping.flow;
-		const row = (yield* owner.read(table.table, equal(table.table, {
-			[table.moduleId]: mapping.moduleId,
-			[table.flowId]: flowId
-		}), {
-			limit: 1,
-			columns: mappedColumns(table)
-		})).rows[0];
-		if (row === void 0) return void 0;
-		const ceremony = ceremonyStorage.decode(row[table.snapshot]);
-		const policy = policyStorage.decode(row[table.policySnapshot]);
-		const state = Object.keys(table.states).find((name) => table.states[name] === row[table.state]);
-		invariant(state !== void 0 && ceremony.moduleId === mapping.moduleId && ceremony.flowId === flowId);
-		invariant(row[table.moduleId] === ceremony.moduleId && row[table.flowId] === ceremony.flowId && row[table.commandId] === ceremony.commandId);
-		invariant(row[table.purpose] === ceremony.purpose && row[table.generation] === ceremony.generation);
-		invariant(row[table.requestBindingVerifier] === ceremony.requestBindingVerifier && mapping.clock.decodeInstant(row[table.requestBindingExpiresAt]) === ceremony.requestBindingExpiresAtMillis);
-		invariant(mapping.clock.decodeInstant(row[table.issuedAt]) === ceremony.issuedAtMillis && mapping.clock.decodeInstant(row[table.expiresAt]) === ceremony.expiresAtMillis && mapping.clock.decodeInstant(row[table.retentionUntil]) === ceremony.retentionUntilMillis);
-		invariant(compatiblePolicy(ceremony, policy, policy));
-		const credential = row[table.credentialSnapshot] === null ? void 0 : credentialStorage.decode(row[table.credentialSnapshot]);
-		const subject = credential?.revision.subjectId ?? knownSubject(ceremony);
-		invariant(row[table.subjectScope] === (subject === void 0 ? null : yield* subjectScope(subject)) && row[table.targetScope] === (yield* targetScope(ceremony)));
-		if (state === "Pending") {
-			invariant(row[table.claimId] === null && row[table.claimedAt] === null && row[table.claimExpiresAt] === null && credential === void 0);
-			return {
-				row,
-				ceremony,
-				policy,
-				state
-			};
-		}
-		const claim = row[table.claimId] === null ? void 0 : snapshotPasskeySync(PasskeyClaim, {
-			ceremony,
-			claimId: row[table.claimId],
-			claimedAtMillis: mapping.clock.decodeInstant(row[table.claimedAt]),
-			claimExpiresAtMillis: mapping.clock.decodeInstant(row[table.claimExpiresAt])
-		});
-		invariant(state !== "Claimed" || claim !== void 0);
-		if (claim !== void 0) invariant(claim.claimExpiresAtMillis === Math.min(claim.claimedAtMillis + ceremony.claimLifetimeMillis, ceremony.expiresAtMillis));
-		return {
-			row,
-			ceremony,
-			policy,
-			state,
-			...claim === void 0 ? {} : { claim },
-			...credential === void 0 ? {} : { credential }
-		};
-	});
-	const terminalFlow = Effect.fn("passkey.terminalFlow")(function* (mapping, read, state) {
-		const owner = yield* CurrentPasskeyTransaction;
-		const table = mapping.flow;
-		yield* owner.update(table.table, {
-			[table.moduleId]: mapping.moduleId,
-			[table.flowId]: read.ceremony.flowId
-		}, {
-			[table.state]: table.states[state],
-			[table.version]: owner.marker
-		});
-		owner.postconditions.push(yield* existsExact(table.table, {
-			[table.moduleId]: mapping.moduleId,
-			[table.flowId]: read.ceremony.flowId,
-			[table.state]: table.states[state],
-			[table.version]: owner.marker
-		}));
-		return state;
-	});
-	const targetRevision = (ceremony) => "target" in ceremony.context ? ceremony.context.target.revision : ceremony.context._tag === "Enrollment" ? ceremony.context.revision : void 0;
-	const currentTarget = Effect.fn("passkey.currentTarget")(function* (mapping, subject, ceremony) {
-		const target = targetRevision(ceremony);
-		if (target === void 0) return true;
-		if (subject === void 0 || subject.subjectId !== target.subjectId || subject.securityRevision !== target.securityRevision) return false;
-		const current = yield* readRevision(mapping.read, subject, target.credentials.map((item) => item.credentialId));
-		return current !== void 0 && sameRevision(current, target);
-	});
-	const issueAssertion = Effect.fn("passkey.issueAssertion")(function* (mapping, ceremony, suppliedPolicy) {
-		const owner = yield* CurrentPasskeyTransaction;
-		const current = yield* readModule(mapping);
-		if (current === void 0 || ceremony.moduleId !== mapping.moduleId || !compatiblePolicy(ceremony, suppliedPolicy, current) || policyStorage.encode(suppliedPolicy) !== policyStorage.encode(current)) return { _tag: "Rejected" };
-		yield* lockAdmission(mapping);
-		const subjectId = knownSubject(ceremony);
-		const subject = subjectId === void 0 ? void 0 : yield* readSubject(mapping.read, subjectId);
-		yield* readPolicyGuards(mapping);
-		if (!(yield* currentTarget(mapping, subject, ceremony))) return { _tag: "Rejected" };
-		if (ceremony.context._tag === "SignIn" && (!ceremony.profile.primarySignIn || ceremony.profile.userVerification !== "required" || ceremony.profile.residentKey !== "required")) return { _tag: "Rejected" };
-		const table = mapping.flow;
-		const sameCommand = yield* owner.read(table.table, equal(table.table, {
-			[table.moduleId]: mapping.moduleId,
-			[table.commandId]: ceremony.commandId
-		}), { limit: 1 });
-		const sameFlow = yield* readFlow(mapping, ceremony.flowId);
-		if (sameCommand.rows.length !== 0 || sameFlow !== void 0) return { _tag: "Rejected" };
-		const kinds = (yield* chargeScopes(ceremony, subjectId)).map((item) => item.kind);
-		if (!(yield* owner.check(liveCondition(mapping, ceremony))) || !(yield* owner.check(yield* admissionCondition(mapping, [current], ceremony, subjectId, kinds, true, false)))) return { _tag: "Rejected" };
-		const values = {
-			...table.encodeInsert({
-				ceremony,
-				policy: suppliedPolicy,
-				marker: owner.marker
-			}),
-			[table.moduleId]: ceremony.moduleId,
-			[table.flowId]: ceremony.flowId,
-			[table.commandId]: ceremony.commandId,
-			[table.purpose]: ceremony.purpose,
-			[table.state]: table.states.Pending,
-			[table.version]: owner.marker,
-			[table.generation]: ceremony.generation,
-			[table.snapshot]: ceremonyStorage.encode(ceremony),
-			[table.policySnapshot]: policyStorage.encode(suppliedPolicy),
-			[table.requestBindingVerifier]: ceremony.requestBindingVerifier,
-			[table.requestBindingExpiresAt]: mapping.clock.encodeInstant(ceremony.requestBindingExpiresAtMillis),
-			[table.issuedAt]: mapping.clock.encodeInstant(ceremony.issuedAtMillis),
-			[table.expiresAt]: mapping.clock.encodeInstant(ceremony.expiresAtMillis),
-			[table.retentionUntil]: mapping.clock.encodeInstant(ceremony.retentionUntilMillis),
-			[table.claimId]: null,
-			[table.claimedAt]: null,
-			[table.claimExpiresAt]: null,
-			[table.credentialSnapshot]: null,
-			[table.subjectScope]: subjectId === void 0 ? null : yield* subjectScope(subjectId),
-			[table.targetScope]: yield* targetScope(ceremony)
-		};
-		const inserted = yield* owner.insert(table.table, values, {
-			[table.moduleId]: mapping.moduleId,
-			[table.flowId]: ceremony.flowId
-		});
-		sameCommand.rows = inserted.rows;
-		for (const observation of owner.observations) if (observation.table === table.table && observation.rows.length === 0) observation.rows = inserted.rows;
-		yield* insertCharges(mapping, ceremony, suppliedPolicy, kinds, subjectId);
-		yield* guardChargeSet(mapping, ceremony, subjectId);
-		yield* guardAdmission(mapping, [current], ceremony, subjectId);
-		owner.postconditions.push(liveCondition(mapping, ceremony));
-		return {
-			_tag: "Issued",
-			ceremony
-		};
-	});
-	const contextAssertion = Effect.fn("passkey.contextAssertion")(function* (mapping, access) {
-		const owner = yield* CurrentPasskeyTransaction;
-		if (access.moduleId !== mapping.moduleId) return void 0;
-		const current = yield* readModule(mapping);
-		if (current === void 0) return void 0;
-		yield* readPolicyGuards(mapping);
-		const read = yield* readFlow(mapping, access.flowId);
-		if (read === void 0 || read.state !== "Pending" || !matchesAccess(read.ceremony, access) || !compatiblePolicy(read.ceremony, read.policy, current)) return void 0;
-		if (!(yield* owner.check(liveCondition(mapping, read.ceremony)))) return void 0;
-		owner.postconditions.push(liveCondition(mapping, read.ceremony));
-		return read.ceremony;
-	});
-	const claimAssertion = Effect.fn("passkey.claimAssertion")(function* (mapping, input) {
-		const owner = yield* CurrentPasskeyTransaction;
-		const current = yield* readModule(mapping);
-		if (current === void 0 || input.access.moduleId !== mapping.moduleId) return { _tag: "Rejected" };
-		yield* lockAdmission(mapping);
-		const expectedSubject = knownSubject(input.ceremony);
-		const subjectId = expectedSubject ?? input.credential?.revision.subjectId;
-		const subject = subjectId === void 0 ? void 0 : yield* readSubject(mapping.read, subjectId);
-		yield* readPolicyGuards(mapping);
-		const requested = targetRevision(input.ceremony)?.credentials.map((item) => item.credentialId) ?? input.credential?.revision.credentials.map((item) => item.credentialId);
-		const credential = input.credential === void 0 || subject === void 0 ? void 0 : yield* readCredential(mapping.read, subject, input.ceremony.profile.rpId, input.credential.protocolCredentialId, requested);
-		const read = yield* readFlow(mapping, input.access.flowId);
-		if (read === void 0 || read.state !== "Pending" || !matchesAccess(read.ceremony, input.access)) return { _tag: "Rejected" };
-		invariant(ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(input.ceremony));
-		const reject = Effect.gen(function* () {
-			yield* terminalFlow(mapping, read, "Rejected");
-			return { _tag: "Rejected" };
-		});
-		if (!compatiblePolicy(read.ceremony, read.policy, current) || policyStorage.encode(input.policy) !== policyStorage.encode(current) || !(yield* currentTarget(mapping, subject, read.ceremony))) return yield* reject;
-		if (input.credential !== void 0 && (credential === void 0 || !sameCredential(input.credential, credential.credential))) return yield* reject;
-		if (input.credential !== void 0 && credential !== void 0) {
-			const original = input.credential.revision;
-			const actual = credential.credential.revision;
-			const ids = [.../* @__PURE__ */ new Set([...requested ?? [], input.credential.credentialId])];
-			if (original.subjectId !== actual.subjectId || original.securityRevision !== actual.securityRevision || ids.some((id) => {
-				const before = original.credentials.find((item) => item.credentialId === id);
-				const after = actual.credentials.find((item) => item.credentialId === id);
-				return after === void 0 || (before === void 0 ? id === input.credential?.credentialId || targetRevision(read.ceremony) === void 0 : before.revision !== after.revision);
-			})) return yield* reject;
-		}
-		if (!(yield* owner.check(liveCondition(mapping, read.ceremony)))) return yield* reject;
-		yield* readCharges(mapping, read.ceremony, read.policy, expectedSubject);
-		const resolved = expectedSubject === void 0 && subjectId !== void 0;
-		if (!(yield* owner.check(yield* admissionCondition(mapping, [read.policy, current], read.ceremony, subjectId, resolved ? ["subject"] : [], false, resolved)))) return yield* reject;
-		const claimedAtMillis = yield* owner.now(mapping.clock);
-		const claim = snapshotPasskeySync(PasskeyClaim, {
-			ceremony: read.ceremony,
-			claimId: input.claimId,
-			claimedAtMillis,
-			claimExpiresAtMillis: Math.min(claimedAtMillis + read.ceremony.claimLifetimeMillis, read.ceremony.expiresAtMillis)
-		});
-		const table = mapping.flow;
-		yield* owner.update(table.table, {
-			[table.moduleId]: mapping.moduleId,
-			[table.flowId]: read.ceremony.flowId
-		}, {
-			[table.state]: table.states.Claimed,
-			[table.version]: owner.marker,
-			[table.claimId]: claim.claimId,
-			[table.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),
-			[table.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),
-			[table.credentialSnapshot]: input.credential === void 0 ? null : credentialStorage.encode(input.credential),
-			[table.subjectScope]: subjectId === void 0 ? null : yield* subjectScope(subjectId)
-		});
-		if (resolved) yield* insertCharges(mapping, read.ceremony, read.policy, ["subject"], subjectId);
-		yield* guardChargeSet(mapping, read.ceremony, subjectId);
-		yield* guardAdmission(mapping, [read.policy, current], read.ceremony, subjectId);
-		owner.postconditions.push(liveCondition(mapping, read.ceremony, claim));
-		return {
-			_tag: "Claimed",
-			claim
-		};
-	});
-	const exactClaim = (read, claim) => read.state === "Claimed" && read.claim !== void 0 && read.claim.claimId === claim.claimId && read.claim.claimedAtMillis === claim.claimedAtMillis && read.claim.claimExpiresAtMillis === claim.claimExpiresAtMillis && ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(claim.ceremony);
-	const evidenceMatches = (ceremony, captured, credential, assertion, evidence) => {
-		const proof = evidence.proofs[0];
-		const original = targetRevision(ceremony) ?? captured.revision;
-		const ids = [.../* @__PURE__ */ new Set([...original.credentials.map((item) => item.credentialId), credential.credentialId])];
-		const expected = {
-			...credential.revision,
-			credentials: credential.revision.credentials.filter((item) => ids.includes(item.credentialId))
-		};
-		const selected = captured.revision.credentials.find((item) => item.credentialId === credential.credentialId);
-		return evidence.proofs.length === 1 && proof !== void 0 && proof.method === "passkey" && proof.credentialId === credential.credentialId && proof.factors.length === 1 && proof.factors[0] === "possession" && proof.userVerified === assertion.userVerified && proof.phishingResistant && DateTime.toEpochMillis(proof.verifiedAt) === ceremony.issuedAtMillis && evidence.flowId === ("target" in ceremony.context ? ceremony.context.target.flowId : ceremony.flowId) && evidence.bindingDigest === ("target" in ceremony.context ? ceremony.context.target.bindingDigest : ceremony.requestBindingVerifier) && expected.credentials.length === ids.length && sameRevision(evidence.revision, expected) && original.subjectId === expected.subjectId && original.securityRevision === expected.securityRevision && original.credentials.every((item) => expected.credentials.some((current) => current.credentialId === item.credentialId && current.revision === item.revision)) && selected !== void 0 && expected.credentials.some((item) => item.credentialId === selected.credentialId && item.revision === selected.revision);
-	};
-	const updateTelemetry = Effect.fn("passkey.updateTelemetry")(function* (mapping, found, assertion, dialect) {
-		const owner = yield* CurrentPasskeyTransaction;
-		const table = mapping.read.credential;
-		const counter = sql`${col(table.table, table.counter)}`;
-		const maximum = sql`${col(table.table, table.maximumCounter)}`;
-		const max = (...values) => dialect === "sqlite" ? sql`max(${sql.join([...values], sql`, `)})` : sql`greatest(${sql.join([...values], sql`, `)})`;
-		const semantic = Object.fromEntries(semanticCredentialColumns(table).map((column) => [column, found.row[column]]));
-		const bs = mapping.telemetry.encodeBackupState(assertion.backupState);
-		const synced = found.credential.backupEligible;
-		const merged = max(counter, maximum, sql`${assertion.counter}`);
-		const currentCounter = synced ? sql`1 = 1` : sql`((${counter} = 0 and ${assertion.counter} = 0) or ${counter} < ${assertion.counter})`;
-		yield* owner.updateGuarded(table.table, both(owner.exact(table.table, semantic), table.activeCondition, currentCounter), {
-			[table.counter]: synced ? merged : assertion.counter,
-			[table.maximumCounter]: merged,
-			[table.backupState]: bs
-		}, {
-			rows: 1,
-			postcondition: yield* existsExact(table.table, {
-				...semantic,
-				[table.backupState]: bs
-			}, both(synced ? sql`${counter} = ${maximum}` : sql`${counter} = ${assertion.counter}`, sql`${maximum} >= ${assertion.counter}`))
-		});
-		const earliest = yield* owner.now(mapping.clock);
-		const lastUsed = sql`${col(table.table, mapping.telemetry.lastUsedAt)}`;
-		const millis = mapping.clock.toMillis(lastUsed);
-		yield* owner.finalUpdate(table.table, owner.exact(table.table, semantic), { [mapping.telemetry.lastUsedAt]: mapping.clock.fromMillis(max(sql`coalesce(${millis}, 0)`, mapping.clock.engineNowMillis)) }, {
-			rows: 1,
-			postcondition: yield* existsExact(table.table, semantic, both(sql`${millis} >= ${earliest}`, sql`${millis} <= ${mapping.clock.engineNowMillis}`))
-		});
-	});
-	const settleAssertion = Effect.fn("passkey.settleAssertion")(function* (mapping, claim, outcome, dialect) {
-		const owner = yield* CurrentPasskeyTransaction;
-		const assertedCredential = outcome._tag === "Assertion" ? outcome.credential : void 0;
-		const current = yield* readModule(mapping);
-		if (current === void 0 || claim.ceremony.moduleId !== mapping.moduleId) return "Rejected";
-		yield* lockAdmission(mapping);
-		const originalIds = targetRevision(claim.ceremony)?.credentials.map((item) => item.credentialId) ?? (outcome._tag === "Assertion" ? outcome.credential.revision.credentials.map((item) => item.credentialId) : void 0);
-		const subjectId = outcome._tag === "Assertion" ? outcome.credential.revision.subjectId : knownSubject(claim.ceremony);
-		const subject = subjectId === void 0 ? void 0 : yield* readSubject(mapping.read, subjectId);
-		yield* readPolicyGuards(mapping);
-		const found = outcome._tag !== "Assertion" || subject === void 0 ? void 0 : yield* readCredential(mapping.read, subject, claim.ceremony.profile.rpId, outcome.credential.protocolCredentialId, originalIds);
-		const read = yield* readFlow(mapping, claim.ceremony.flowId);
-		if (read === void 0 || !exactClaim(read, claim)) return "Rejected";
-		if (outcome._tag !== "Assertion") return yield* terminalFlow(mapping, read, outcome._tag);
-		invariant(assertedCredential !== void 0);
-		const captured = "credential" in read ? read.credential : void 0;
-		const assertion = outcome.assertion;
-		if (captured === void 0 || found === void 0 || !compatiblePolicy(read.ceremony, read.policy, current) || !sameCredential(captured, assertedCredential) || !sameCredential(captured, found.credential)) return yield* terminalFlow(mapping, read, "Rejected");
-		const credential = found.credential;
-		const profile = read.ceremony.profile;
-		if (assertion.protocolCredentialId !== credential.protocolCredentialId || assertion.userHandle !== void 0 && assertion.userHandle !== credential.userHandle || assertion.backupEligible !== credential.backupEligible || assertion.backupState && !assertion.backupEligible || profile.userVerification === "required" && !assertion.userVerified || !profile.algorithms.includes(credential.algorithm) || read.ceremony.allowedCredentials.length !== 0 && !read.ceremony.allowedCredentials.some((item) => item.id === credential.protocolCredentialId) || read.ceremony.purpose === "sign-in" && (assertion.userHandle !== credential.userHandle || !credential.primarySignIn || !credential.enrollmentUserVerified || !credential.profile.primarySignIn || credential.profile.userVerification !== "required" || !assertion.userVerified) || !evidenceMatches(read.ceremony, captured, credential, assertion, outcome.evidence) || !(yield* owner.check(liveCondition(mapping, read.ceremony, claim)))) return yield* terminalFlow(mapping, read, "Rejected");
-		yield* readCharges(mapping, read.ceremony, read.policy, credential.revision.subjectId);
-		yield* guardChargeSet(mapping, read.ceremony, credential.revision.subjectId);
-		yield* updateTelemetry(mapping, found, assertion, dialect);
-		yield* terminalFlow(mapping, read, "Verified");
-		owner.postconditions.push(liveCondition(mapping, read.ceremony, claim));
-		return "Verified";
-	});
-	const purposeCondition = (table, purposes) => sql`${col(table.table, table.purpose)} in (${sql.join(purposes.map((purpose) => sql`${purpose}`), sql`, `)})`;
-	const custodyFree = (mapping, flowExpression) => {
-		if (mapping.intent === void 0) return sql`1 = 1`;
-		const intent = mapping.intent;
-		return sql`not exists (select 1 from ${intent.table} where ${both(equal(intent.table, { [intent.moduleId]: mapping.moduleId }), sql`${col(intent.table, intent.flowId)} = ${flowExpression}`, intent.custodyCondition)})`;
-	};
-	const flowDue = (mapping, purposes) => {
-		const flow = mapping.flow, charge = mapping.charge, now = mapping.clock.engineNowMillis;
-		const state = sql`${col(flow.table, flow.state)}`;
-		const retained = sql`${mapping.clock.toMillis(sql`${col(flow.table, flow.retentionUntil)}`)} <= ${now}`;
-		const chargeLive = sql`exists (select 1 from ${charge.table} where ${both(equal(charge.table, { [charge.moduleId]: mapping.moduleId }), sql`${col(charge.table, charge.flowId)} = ${col(flow.table, flow.flowId)}`, sql`(${col(charge.table, charge.retainUntil)} is null or ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${now})`)})`;
-		return both(equal(flow.table, { [flow.moduleId]: mapping.moduleId }), purposeCondition(flow, purposes), sql`((${state} = ${flow.states.Pending} and ${mapping.clock.toMillis(sql`${col(flow.table, flow.expiresAt)}`)} <= ${now}) or
-        (${state} = ${flow.states.Claimed} and ${mapping.clock.toMillis(sql`${col(flow.table, flow.claimExpiresAt)}`)} <= ${now}) or
-        (${state} in (${flow.states.Verified}, ${flow.states.Rejected}, ${flow.states.Ambiguous}, ${flow.states.RegistrationAccepted}) and ${retained} and not (${chargeLive}) and ${custodyFree(mapping, sql`${col(flow.table, flow.flowId)}`)}))`);
-	};
-	const chargeDue = (mapping, purposes) => {
-		const charge = mapping.charge;
-		return both(equal(charge.table, { [charge.moduleId]: mapping.moduleId }), purposeCondition(charge, purposes), sql`${col(charge.table, charge.admittedAt)} is not null and ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} <= ${mapping.clock.engineNowMillis}`, custodyFree(mapping, sql`${col(charge.table, charge.flowId)}`));
-	};
-	return {
-		assertionPurposes,
-		contextPurpose,
-		knownSubject,
-		compatiblePolicy,
-		liveCondition,
-		matchesAccess,
-		readFlow,
-		terminalFlow,
-		issueAssertion,
-		contextAssertion,
-		claimAssertion,
-		exactClaim,
-		settleAssertion,
-		cleanupCeremonies: Effect.fn("passkey.cleanupCeremonies")(function* (mapping, input, purposes) {
-			const owner = yield* CurrentPasskeyTransaction;
-			invariant(input.moduleId === mapping.moduleId && Number.isSafeInteger(input.nowMillis) && input.nowMillis >= 0 && Number.isSafeInteger(input.limit) && input.limit >= 1 && input.limit <= 1e3);
-			yield* readModule(mapping);
-			yield* lockAdmission(mapping);
-			yield* readPolicyGuards(mapping);
-			const flow = mapping.flow, charge = mapping.charge;
-			const rows = (yield* owner.read(flow.table, flowDue(mapping, purposes), {
-				limit: input.limit,
-				takeOnly: true,
-				observe: false,
-				orderBy: sql`${col(flow.table, flow.flowId)}`
-			})).rows;
-			const touched = [];
-			const transitioned = [];
-			let terminalized = 0, removed = 0;
-			for (const candidate of rows) {
-				const read = yield* readFlow(mapping, candidate[flow.flowId]);
-				if (read === void 0) continue;
-				invariant(yield* owner.check(sql`exists (select 1 from ${flow.table} where ${both(equal(flow.table, {
-					[flow.moduleId]: mapping.moduleId,
-					[flow.flowId]: read.ceremony.flowId
-				}), flowDue(mapping, purposes))})`));
-				touched.push(read.ceremony.flowId);
-				if (read.state === "Pending" || read.state === "Claimed") {
-					const deadline = read.state === "Pending" ? read.ceremony.expiresAtMillis : read.claim.claimExpiresAtMillis;
-					if (read.state === "Pending") yield* releaseRegistrationCustody(mapping, read.ceremony);
-					yield* terminalFlow(mapping, read, read.state === "Pending" ? "Rejected" : "Ambiguous");
-					owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${deadline}`);
-					transitioned.push(read);
-					terminalized++;
-				} else {
-					yield* scrubRegistrationIntent(mapping, read.ceremony);
-					yield* owner.remove(flow.table, {
-						[flow.moduleId]: mapping.moduleId,
-						[flow.flowId]: read.ceremony.flowId
-					});
-					owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${read.ceremony.retentionUntilMillis}`, custodyFree(mapping, sql`${read.ceremony.flowId}`), sql`not exists (select 1 from ${charge.table} where ${both(equal(charge.table, {
-						[charge.moduleId]: mapping.moduleId,
-						[charge.flowId]: read.ceremony.flowId
-					}), sql`(${col(charge.table, charge.retainUntil)} is null or ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${mapping.clock.engineNowMillis})`)})`);
-					removed++;
-				}
-			}
-			const removedCharges = [];
-			const remaining = input.limit - terminalized - removed;
-			if (remaining > 0) {
-				const charges = (yield* owner.read(charge.table, chargeDue(mapping, purposes), {
-					limit: remaining,
-					takeOnly: true,
-					observe: false,
-					orderBy: sql`${col(charge.table, charge.flowId)}, ${col(charge.table, charge.kind)}`
-				})).rows;
-				for (const candidate of charges) {
-					const identity = {
-						[charge.moduleId]: mapping.moduleId,
-						[charge.flowId]: candidate[charge.flowId],
-						[charge.kind]: candidate[charge.kind]
-					};
-					const selected = (yield* owner.read(charge.table, equal(charge.table, identity), { limit: 1 })).rows[0];
-					invariant(selected !== void 0);
-					const horizon = mapping.clock.decodeInstant(selected[charge.retainUntil]);
-					invariant(Number.isSafeInteger(horizon));
-					yield* owner.remove(charge.table, identity);
-					owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${horizon}`, custodyFree(mapping, sql`${candidate[charge.flowId]}`));
-					removedCharges.push({
-						flowId: candidate[charge.flowId],
-						kind: candidate[charge.kind]
-					});
-					removed++;
-				}
-			}
-			const excludeFlows = touched.length === 0 ? void 0 : sql`${col(flow.table, flow.flowId)} not in (${sql.join(touched.map((id) => sql`${id}`), sql`, `)})`;
-			const excludeCharges = removedCharges.map((item) => sql`not (${equal(charge.table, {
-				[charge.flowId]: item.flowId,
-				[charge.kind]: item.kind
-			})})`);
-			const predicted = sql`exists (select 1 from ${flow.table} where ${both(flowDue(mapping, purposes), excludeFlows)}) or exists (select 1 from ${charge.table} where ${both(chargeDue(mapping, purposes), ...excludeCharges)})`;
-			let hasMore = yield* owner.check(predicted);
-			for (const read of transitioned) {
-				if (read.ceremony.retentionUntilMillis > (yield* owner.now(mapping.clock))) continue;
-				const liveCharges = sql`exists (select 1 from ${charge.table} where ${both(equal(charge.table, {
-					[charge.moduleId]: mapping.moduleId,
-					[charge.flowId]: read.ceremony.flowId
-				}), sql`${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${mapping.clock.engineNowMillis}`, ...excludeCharges)})`;
-				if (!(yield* owner.check(liveCharges)) && (yield* owner.check(custodyFree(mapping, sql`${read.ceremony.flowId}`)))) hasMore = true;
-			}
-			const actual = sql`exists (select 1 from ${flow.table} where ${flowDue(mapping, purposes)}) or exists (select 1 from ${charge.table} where ${chargeDue(mapping, purposes)})`;
-			owner.postconditions.push(hasMore ? actual : sql`not (${actual})`);
-			return {
-				terminalized,
-				removed,
-				hasMore
-			};
-		})
-	};
-};
-//#endregion
-export { makePasskeyFlowKernel };
-
-//# sourceMappingURL=flow.mjs.map

package/dist/internal/passkey/flow.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"flow.mjs","names":[],"sources":["../../../src/internal/passkey/flow.ts"],"sourcesContent":["/* oxlint-disable no-explicit-any -- existing mapped-row bridge; public adapters preserve table, ID, and Effect types. */\n\nimport {\n  PasskeyClaim,\n  type PasskeyAccess,\n  type PasskeyAssertionVerified,\n  type PasskeyCeremony,\n  type PasskeyCredential,\n  type PasskeyEvidence,\n  type PasskeyMethodPolicy,\n  snapshotPasskeySync,\n} from \"@yielded/auth/Passkey\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport { DateTime, Effect } from \"effect\";\n\nimport type { PasskeyFlowState } from \"../models/passkey-model\";\nimport type { QueryOperations } from \"../query-operations\";\nimport type { makeTransactionKernel } from \"../transaction-kernel\";\nimport type { makePasskeyAdmissionKernel } from \"./admission\";\nimport type { CredentialRead, SubjectRead, makePasskeyCredentialsKernel } from \"./credentials\";\nimport type { makePasskeyRegistrationCustodyKernel } from \"./registration-custody\";\nimport { CurrentPasskeyTransaction } from \"./state\";\nimport type { makePasskeyStateKernel } from \"./state\";\n\nexport interface FlowRead {\n  readonly row: Record<string, any>;\n  readonly ceremony: PasskeyCeremony;\n  readonly policy: PasskeyMethodPolicy;\n  readonly state: PasskeyFlowState;\n  readonly claim?: PasskeyClaim;\n  readonly credential?: PasskeyCredential;\n}\n\nexport const makePasskeyFlowKernel = (\n  operations: QueryOperations,\n  admission: Pick<\n    ReturnType<typeof makePasskeyAdmissionKernel>,\n    | \"admissionCondition\"\n    | \"chargeScopes\"\n    | \"guardAdmission\"\n    | \"guardChargeSet\"\n    | \"insertCharges\"\n    | \"lockAdmission\"\n    | \"readCharges\"\n  >,\n  credentials: Pick<\n    ReturnType<typeof makePasskeyCredentialsKernel>,\n    \"readCredential\" | \"readModule\" | \"readPolicyGuards\" | \"readRevision\" | \"readSubject\"\n  >,\n  registrationCustody: Pick<\n    ReturnType<typeof makePasskeyRegistrationCustodyKernel>,\n    \"releaseRegistrationCustody\" | \"scrubRegistrationIntent\"\n  >,\n  state: Pick<\n    ReturnType<typeof makePasskeyStateKernel>,\n    | \"ceremonyStorage\"\n    | \"col\"\n    | \"credentialStorage\"\n    | \"equal\"\n    | \"existsExact\"\n    | \"invariant\"\n    | \"mappedColumns\"\n    | \"policyStorage\"\n    | \"profileStorage\"\n    | \"sameCredential\"\n    | \"sameRevision\"\n    | \"semanticCredentialColumns\"\n    | \"subjectScope\"\n    | \"targetScope\"\n  >,\n  transactions: Pick<ReturnType<typeof makeTransactionKernel>, \"both\">,\n) => {\n  const { sql } = operations;\n\n  const {\n    admissionCondition,\n    chargeScopes,\n    guardAdmission,\n    guardChargeSet,\n    insertCharges,\n    lockAdmission,\n    readCharges,\n  } = admission;\n\n  const { readCredential, readModule, readPolicyGuards, readRevision, readSubject } = credentials;\n  const { releaseRegistrationCustody, scrubRegistrationIntent } = registrationCustody;\n\n  const {\n    ceremonyStorage,\n    col,\n    credentialStorage,\n    equal,\n    existsExact,\n    mappedColumns,\n    policyStorage,\n    profileStorage,\n    sameCredential,\n    sameRevision,\n    semanticCredentialColumns,\n    subjectScope,\n    targetScope,\n  } = state;\n\n  const invariant: (value: unknown) => asserts value = state.invariant;\n  const { both } = transactions;\n\n  const assertionPurposes = [\"sign-in\", \"pending\", \"step-up\", \"action\"] as const;\n\n  const contextPurpose = {\n    SignIn: \"sign-in\",\n    Pending: \"pending\",\n    StepUp: \"step-up\",\n    Action: \"action\",\n    Enrollment: \"enrollment\",\n    Registration: \"registration\",\n  } as const;\n\n  const knownSubject = (ceremony: PasskeyCeremony): SubjectId | undefined =>\n    \"target\" in ceremony.context\n      ? ceremony.context.target.revision.subjectId\n      : ceremony.context._tag === \"Enrollment\"\n        ? ceremony.context.revision.subjectId\n        : undefined;\n\n  const compatiblePolicy = (\n    ceremony: PasskeyCeremony,\n    original: PasskeyMethodPolicy,\n    current: PasskeyMethodPolicy,\n  ) => {\n    const selected = current.profiles.find(\n      (profile) => profile.profileId === ceremony.profile.profileId,\n    );\n\n    const issued = original.profiles.find(\n      (profile) => profile.profileId === ceremony.profile.profileId,\n    );\n\n    return (\n      ceremony.generation === current.generation &&\n      ceremony.generation === original.generation &&\n      selected !== undefined &&\n      issued !== undefined &&\n      profileStorage.encode(selected) === profileStorage.encode(ceremony.profile) &&\n      profileStorage.encode(issued) === profileStorage.encode(ceremony.profile) &&\n      ceremony.claimLifetimeMillis === original.claimLifetimeMillis &&\n      ceremony.expiresAtMillis > ceremony.issuedAtMillis &&\n      ceremony.expiresAtMillis <= ceremony.requestBindingExpiresAtMillis &&\n      ceremony.expiresAtMillis - ceremony.issuedAtMillis <= original.lifetimeMillis &&\n      ceremony.expiresAtMillis - ceremony.issuedAtMillis <= current.lifetimeMillis &&\n      ceremony.retentionUntilMillis === ceremony.issuedAtMillis + original.retentionMillis &&\n      contextPurpose[ceremony.context._tag] === ceremony.purpose &&\n      new Set(ceremony.allowedCredentials.map((item) => item.id)).size ===\n        ceremony.allowedCredentials.length\n    );\n  };\n\n  const liveCondition = (mapping: any, ceremony: PasskeyCeremony, claim?: PasskeyClaim) => {\n    const now = mapping.clock.engineNowMillis;\n\n    return both(\n      sql`${now} >= ${ceremony.issuedAtMillis}`,\n      sql`${now} < ${ceremony.expiresAtMillis}`,\n      sql`${now} < ${ceremony.requestBindingExpiresAtMillis}`,\n      \"target\" in ceremony.context\n        ? sql`${now} < ${ceremony.context.target.expiresAtMillis}`\n        : undefined,\n      claim === undefined\n        ? undefined\n        : both(\n            sql`${now} >= ${claim.claimedAtMillis}`,\n            sql`${now} < ${claim.claimExpiresAtMillis}`,\n          ),\n    );\n  };\n\n  const matchesAccess = (ceremony: PasskeyCeremony, access: PasskeyAccess) =>\n    ceremony.moduleId === access.moduleId &&\n    ceremony.generation === access.generation &&\n    ceremony.purpose === access.purpose &&\n    ceremony.flowId === access.flowId &&\n    ceremony.requestBindingVerifier === access.requestBindingVerifier &&\n    ceremony.requestBindingExpiresAtMillis === access.requestBindingExpiresAtMillis;\n\n  const readFlow = Effect.fn(\"passkey.readFlow\")(function* (mapping: any, flowId: string) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.flow;\n\n    const row = (yield* owner.read(\n      table.table,\n      equal(table.table, {\n        [table.moduleId]: mapping.moduleId,\n        [table.flowId]: flowId,\n      }),\n      { limit: 1, columns: mappedColumns(table) },\n    )).rows[0];\n\n    if (row === undefined) return undefined;\n    const ceremony = ceremonyStorage.decode(row[table.snapshot]);\n    const policy = policyStorage.decode(row[table.policySnapshot]);\n\n    const state = Object.keys(table.states).find(\n      (name) => table.states[name] === row[table.state],\n    ) as PasskeyFlowState | undefined;\n\n    invariant(\n      state !== undefined && ceremony.moduleId === mapping.moduleId && ceremony.flowId === flowId,\n    );\n    invariant(\n      row[table.moduleId] === ceremony.moduleId &&\n        row[table.flowId] === ceremony.flowId &&\n        row[table.commandId] === ceremony.commandId,\n    );\n    invariant(\n      row[table.purpose] === ceremony.purpose && row[table.generation] === ceremony.generation,\n    );\n    invariant(\n      row[table.requestBindingVerifier] === ceremony.requestBindingVerifier &&\n        mapping.clock.decodeInstant(row[table.requestBindingExpiresAt]) ===\n          ceremony.requestBindingExpiresAtMillis,\n    );\n    invariant(\n      mapping.clock.decodeInstant(row[table.issuedAt]) === ceremony.issuedAtMillis &&\n        mapping.clock.decodeInstant(row[table.expiresAt]) === ceremony.expiresAtMillis &&\n        mapping.clock.decodeInstant(row[table.retentionUntil]) === ceremony.retentionUntilMillis,\n    );\n    invariant(compatiblePolicy(ceremony, policy, policy));\n\n    const credential =\n      row[table.credentialSnapshot] === null\n        ? undefined\n        : credentialStorage.decode(row[table.credentialSnapshot]);\n\n    const subject = credential?.revision.subjectId ?? knownSubject(ceremony);\n\n    invariant(\n      row[table.subjectScope] === (subject === undefined ? null : yield* subjectScope(subject)) &&\n        row[table.targetScope] === (yield* targetScope(ceremony)),\n    );\n    if (state === \"Pending\") {\n      invariant(\n        row[table.claimId] === null &&\n          row[table.claimedAt] === null &&\n          row[table.claimExpiresAt] === null &&\n          credential === undefined,\n      );\n\n      return { row, ceremony, policy, state };\n    }\n\n    const claim =\n      row[table.claimId] === null\n        ? undefined\n        : snapshotPasskeySync(PasskeyClaim, {\n            ceremony,\n            claimId: row[table.claimId],\n            claimedAtMillis: mapping.clock.decodeInstant(row[table.claimedAt]),\n            claimExpiresAtMillis: mapping.clock.decodeInstant(row[table.claimExpiresAt]),\n          });\n\n    invariant(state !== \"Claimed\" || claim !== undefined);\n    if (claim !== undefined)\n      invariant(\n        claim.claimExpiresAtMillis ===\n          Math.min(claim.claimedAtMillis + ceremony.claimLifetimeMillis, ceremony.expiresAtMillis),\n      );\n\n    return {\n      row,\n      ceremony,\n      policy,\n      state,\n      ...(claim === undefined ? {} : { claim }),\n      ...(credential === undefined ? {} : { credential }),\n    };\n  });\n\n  const terminalFlow = Effect.fn(\"passkey.terminalFlow\")(function* (\n    mapping: any,\n    read: FlowRead,\n    state: \"Verified\" | \"Rejected\" | \"Ambiguous\",\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.flow;\n\n    yield* owner.update(\n      table.table,\n      { [table.moduleId]: mapping.moduleId, [table.flowId]: read.ceremony.flowId },\n      {\n        [table.state]: table.states[state],\n        [table.version]: owner.marker,\n      },\n    );\n    owner.postconditions.push(\n      yield* existsExact(table.table, {\n        [table.moduleId]: mapping.moduleId,\n        [table.flowId]: read.ceremony.flowId,\n        [table.state]: table.states[state],\n        [table.version]: owner.marker,\n      }),\n    );\n\n    return state;\n  });\n\n  const targetRevision = (ceremony: PasskeyCeremony) =>\n    \"target\" in ceremony.context\n      ? ceremony.context.target.revision\n      : ceremony.context._tag === \"Enrollment\"\n        ? ceremony.context.revision\n        : undefined;\n\n  const currentTarget = Effect.fn(\"passkey.currentTarget\")(function* (\n    mapping: any,\n    subject: SubjectRead | undefined,\n    ceremony: PasskeyCeremony,\n  ) {\n    const target = targetRevision(ceremony);\n\n    if (target === undefined) return true;\n    if (\n      subject === undefined ||\n      subject.subjectId !== target.subjectId ||\n      subject.securityRevision !== target.securityRevision\n    )\n      return false;\n\n    const current = yield* readRevision(\n      mapping.read,\n      subject,\n      target.credentials.map((item) => item.credentialId),\n    );\n\n    return current !== undefined && sameRevision(current, target);\n  });\n\n  const issueAssertion = Effect.fn(\"passkey.issueAssertion\")(function* (\n    mapping: any,\n    ceremony: PasskeyCeremony,\n    suppliedPolicy: PasskeyMethodPolicy,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const current = yield* readModule(mapping);\n\n    if (\n      current === undefined ||\n      ceremony.moduleId !== mapping.moduleId ||\n      !compatiblePolicy(ceremony, suppliedPolicy, current) ||\n      policyStorage.encode(suppliedPolicy) !== policyStorage.encode(current)\n    )\n      return { _tag: \"Rejected\" } as const;\n    yield* lockAdmission(mapping);\n    const subjectId = knownSubject(ceremony);\n\n    const subject =\n      subjectId === undefined ? undefined : yield* readSubject(mapping.read, subjectId);\n\n    yield* readPolicyGuards(mapping);\n    if (!(yield* currentTarget(mapping, subject, ceremony))) return { _tag: \"Rejected\" } as const;\n    if (\n      ceremony.context._tag === \"SignIn\" &&\n      (!ceremony.profile.primarySignIn ||\n        ceremony.profile.userVerification !== \"required\" ||\n        ceremony.profile.residentKey !== \"required\")\n    )\n      return { _tag: \"Rejected\" } as const;\n    const table = mapping.flow;\n\n    const sameCommand = yield* owner.read(\n      table.table,\n      equal(table.table, {\n        [table.moduleId]: mapping.moduleId,\n        [table.commandId]: ceremony.commandId,\n      }),\n      { limit: 1 },\n    );\n\n    const sameFlow = yield* readFlow(mapping, ceremony.flowId);\n\n    if (sameCommand.rows.length !== 0 || sameFlow !== undefined)\n      return { _tag: \"Rejected\" } as const;\n    const kinds = (yield* chargeScopes(ceremony, subjectId)).map((item) => item.kind);\n\n    if (\n      !(yield* owner.check(liveCondition(mapping, ceremony))) ||\n      !(yield* owner.check(\n        yield* admissionCondition(mapping, [current], ceremony, subjectId, kinds, true, false),\n      ))\n    )\n      return { _tag: \"Rejected\" } as const;\n\n    const values = {\n      ...table.encodeInsert({ ceremony, policy: suppliedPolicy, marker: owner.marker }),\n      [table.moduleId]: ceremony.moduleId,\n      [table.flowId]: ceremony.flowId,\n      [table.commandId]: ceremony.commandId,\n      [table.purpose]: ceremony.purpose,\n      [table.state]: table.states.Pending,\n      [table.version]: owner.marker,\n      [table.generation]: ceremony.generation,\n      [table.snapshot]: ceremonyStorage.encode(ceremony),\n      [table.policySnapshot]: policyStorage.encode(suppliedPolicy),\n      [table.requestBindingVerifier]: ceremony.requestBindingVerifier,\n      [table.requestBindingExpiresAt]: mapping.clock.encodeInstant(\n        ceremony.requestBindingExpiresAtMillis,\n      ),\n      [table.issuedAt]: mapping.clock.encodeInstant(ceremony.issuedAtMillis),\n      [table.expiresAt]: mapping.clock.encodeInstant(ceremony.expiresAtMillis),\n      [table.retentionUntil]: mapping.clock.encodeInstant(ceremony.retentionUntilMillis),\n      [table.claimId]: null,\n      [table.claimedAt]: null,\n      [table.claimExpiresAt]: null,\n      [table.credentialSnapshot]: null,\n      [table.subjectScope]: subjectId === undefined ? null : yield* subjectScope(subjectId),\n      [table.targetScope]: yield* targetScope(ceremony),\n    };\n\n    // Empty-key observations now expect this exact inserted row as well.\n    const inserted = yield* owner.insert(table.table, values, {\n      [table.moduleId]: mapping.moduleId,\n      [table.flowId]: ceremony.flowId,\n    });\n\n    sameCommand.rows = inserted.rows;\n    for (const observation of owner.observations)\n      if (observation.table === table.table && observation.rows.length === 0)\n        observation.rows = inserted.rows;\n    yield* insertCharges(mapping, ceremony, suppliedPolicy, kinds, subjectId);\n    yield* guardChargeSet(mapping, ceremony, subjectId);\n    yield* guardAdmission(mapping, [current], ceremony, subjectId);\n    owner.postconditions.push(liveCondition(mapping, ceremony));\n\n    return { _tag: \"Issued\", ceremony } as const;\n  });\n\n  const contextAssertion = Effect.fn(\"passkey.contextAssertion\")(function* (\n    mapping: any,\n    access: PasskeyAccess,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    if (access.moduleId !== mapping.moduleId) return undefined;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined) return undefined;\n    yield* readPolicyGuards(mapping);\n    const read = yield* readFlow(mapping, access.flowId);\n\n    if (\n      read === undefined ||\n      read.state !== \"Pending\" ||\n      !matchesAccess(read.ceremony, access) ||\n      !compatiblePolicy(read.ceremony, read.policy, current)\n    )\n      return undefined;\n    if (!(yield* owner.check(liveCondition(mapping, read.ceremony)))) return undefined;\n    owner.postconditions.push(liveCondition(mapping, read.ceremony));\n\n    return read.ceremony;\n  });\n\n  const claimAssertion = Effect.fn(\"passkey.claimAssertion\")(function* (\n    mapping: any,\n    input: {\n      readonly access: PasskeyAccess;\n      readonly policy: PasskeyMethodPolicy;\n      readonly ceremony: PasskeyCeremony;\n      readonly claimId: string;\n      readonly credential?: PasskeyCredential;\n    },\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined || input.access.moduleId !== mapping.moduleId)\n      return { _tag: \"Rejected\" } as const;\n    yield* lockAdmission(mapping);\n    const expectedSubject = knownSubject(input.ceremony);\n    const subjectId = expectedSubject ?? input.credential?.revision.subjectId;\n\n    const subject =\n      subjectId === undefined ? undefined : yield* readSubject(mapping.read, subjectId);\n\n    yield* readPolicyGuards(mapping);\n\n    const requested =\n      targetRevision(input.ceremony)?.credentials.map((item) => item.credentialId) ??\n      input.credential?.revision.credentials.map((item) => item.credentialId);\n\n    const credential =\n      input.credential === undefined || subject === undefined\n        ? undefined\n        : yield* readCredential(\n            mapping.read,\n            subject,\n            input.ceremony.profile.rpId,\n            input.credential.protocolCredentialId,\n            requested,\n          );\n\n    const read = yield* readFlow(mapping, input.access.flowId);\n\n    if (\n      read === undefined ||\n      read.state !== \"Pending\" ||\n      !matchesAccess(read.ceremony, input.access)\n    )\n      return { _tag: \"Rejected\" } as const;\n    invariant(ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(input.ceremony));\n\n    const reject = Effect.gen(function* () {\n      yield* terminalFlow(mapping, read, \"Rejected\");\n\n      return { _tag: \"Rejected\" } as const;\n    });\n\n    if (\n      !compatiblePolicy(read.ceremony, read.policy, current) ||\n      policyStorage.encode(input.policy) !== policyStorage.encode(current) ||\n      !(yield* currentTarget(mapping, subject, read.ceremony))\n    )\n      return yield* reject;\n    if (\n      input.credential !== undefined &&\n      (credential === undefined || !sameCredential(input.credential, credential.credential))\n    )\n      return yield* reject;\n    if (input.credential !== undefined && credential !== undefined) {\n      const original = input.credential.revision;\n      const actual = credential.credential.revision;\n      const ids = [...new Set([...(requested ?? []), input.credential.credentialId])];\n\n      if (\n        original.subjectId !== actual.subjectId ||\n        original.securityRevision !== actual.securityRevision ||\n        ids.some((id) => {\n          const before = original.credentials.find((item) => item.credentialId === id);\n          const after = actual.credentials.find((item) => item.credentialId === id);\n\n          // A target can include non-passkey factors absent from the minimum\n          // lookup snapshot; currentTarget independently checks those originals.\n          return (\n            after === undefined ||\n            (before === undefined\n              ? id === input.credential?.credentialId || targetRevision(read.ceremony) === undefined\n              : before.revision !== after.revision)\n          );\n        })\n      )\n        return yield* reject;\n    }\n    if (!(yield* owner.check(liveCondition(mapping, read.ceremony)))) return yield* reject;\n    yield* readCharges(mapping, read.ceremony, read.policy, expectedSubject);\n    const resolved = expectedSubject === undefined && subjectId !== undefined;\n\n    if (\n      !(yield* owner.check(\n        yield* admissionCondition(\n          mapping,\n          [read.policy, current],\n          read.ceremony,\n          subjectId,\n          resolved ? [\"subject\"] : [],\n          false,\n          resolved,\n        ),\n      ))\n    )\n      return yield* reject;\n    const claimedAtMillis = yield* owner.now(mapping.clock);\n\n    const claim = snapshotPasskeySync(PasskeyClaim, {\n      ceremony: read.ceremony,\n      claimId: input.claimId,\n      claimedAtMillis,\n      claimExpiresAtMillis: Math.min(\n        claimedAtMillis + read.ceremony.claimLifetimeMillis,\n        read.ceremony.expiresAtMillis,\n      ),\n    });\n\n    const table = mapping.flow;\n\n    yield* owner.update(\n      table.table,\n      { [table.moduleId]: mapping.moduleId, [table.flowId]: read.ceremony.flowId },\n      {\n        [table.state]: table.states.Claimed,\n        [table.version]: owner.marker,\n        [table.claimId]: claim.claimId,\n        [table.claimedAt]: mapping.clock.encodeInstant(claim.claimedAtMillis),\n        [table.claimExpiresAt]: mapping.clock.encodeInstant(claim.claimExpiresAtMillis),\n        [table.credentialSnapshot]:\n          input.credential === undefined ? null : credentialStorage.encode(input.credential),\n        [table.subjectScope]: subjectId === undefined ? null : yield* subjectScope(subjectId),\n      },\n    );\n    if (resolved) yield* insertCharges(mapping, read.ceremony, read.policy, [\"subject\"], subjectId);\n    yield* guardChargeSet(mapping, read.ceremony, subjectId);\n    yield* guardAdmission(mapping, [read.policy, current], read.ceremony, subjectId);\n    owner.postconditions.push(liveCondition(mapping, read.ceremony, claim));\n\n    return { _tag: \"Claimed\", claim } as const;\n  });\n\n  const exactClaim = (read: FlowRead, claim: PasskeyClaim) =>\n    read.state === \"Claimed\" &&\n    read.claim !== undefined &&\n    read.claim.claimId === claim.claimId &&\n    read.claim.claimedAtMillis === claim.claimedAtMillis &&\n    read.claim.claimExpiresAtMillis === claim.claimExpiresAtMillis &&\n    ceremonyStorage.encode(read.ceremony) === ceremonyStorage.encode(claim.ceremony);\n\n  const evidenceMatches = (\n    ceremony: PasskeyCeremony,\n    captured: PasskeyCredential,\n    credential: PasskeyCredential,\n    assertion: PasskeyAssertionVerified,\n    evidence: typeof PasskeyEvidence.Type,\n  ) => {\n    const proof = evidence.proofs[0];\n    const target = targetRevision(ceremony);\n    const original = target ?? captured.revision;\n\n    const ids = [\n      ...new Set([\n        ...original.credentials.map((item) => item.credentialId),\n        credential.credentialId,\n      ]),\n    ];\n\n    const expected = {\n      ...credential.revision,\n      credentials: credential.revision.credentials.filter((item) =>\n        ids.includes(item.credentialId),\n      ),\n    };\n\n    const selected = captured.revision.credentials.find(\n      (item) => item.credentialId === credential.credentialId,\n    );\n\n    return (\n      evidence.proofs.length === 1 &&\n      proof !== undefined &&\n      proof.method === \"passkey\" &&\n      proof.credentialId === credential.credentialId &&\n      proof.factors.length === 1 &&\n      proof.factors[0] === \"possession\" &&\n      proof.userVerified === assertion.userVerified &&\n      proof.phishingResistant &&\n      DateTime.toEpochMillis(proof.verifiedAt) === ceremony.issuedAtMillis &&\n      evidence.flowId ===\n        (\"target\" in ceremony.context ? ceremony.context.target.flowId : ceremony.flowId) &&\n      evidence.bindingDigest ===\n        (\"target\" in ceremony.context\n          ? ceremony.context.target.bindingDigest\n          : ceremony.requestBindingVerifier) &&\n      expected.credentials.length === ids.length &&\n      sameRevision(evidence.revision, expected) &&\n      original.subjectId === expected.subjectId &&\n      original.securityRevision === expected.securityRevision &&\n      original.credentials.every((item) =>\n        expected.credentials.some(\n          (current) =>\n            current.credentialId === item.credentialId && current.revision === item.revision,\n        ),\n      ) &&\n      selected !== undefined &&\n      expected.credentials.some(\n        (item) =>\n          item.credentialId === selected.credentialId && item.revision === selected.revision,\n      )\n    );\n  };\n\n  const updateTelemetry = Effect.fn(\"passkey.updateTelemetry\")(function* (\n    mapping: any,\n    found: CredentialRead,\n    assertion: PasskeyAssertionVerified,\n    dialect: \"pg\" | \"mysql\" | \"sqlite\",\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const table = mapping.read.credential;\n    const counter = sql`${col(table.table, table.counter)}`;\n    const maximum = sql`${col(table.table, table.maximumCounter)}`;\n\n    const max = (...values: ReadonlyArray<ReturnType<QueryOperations[\"sql\"]>>) =>\n      dialect === \"sqlite\"\n        ? sql`max(${sql.join([...values], sql`, `)})`\n        : sql`greatest(${sql.join([...values], sql`, `)})`;\n\n    const semantic = Object.fromEntries(\n      semanticCredentialColumns(table).map((column) => [column, found.row[column]]),\n    );\n\n    const bs = mapping.telemetry.encodeBackupState(assertion.backupState);\n    const synced = found.credential.backupEligible;\n    const merged = max(counter, maximum, sql`${assertion.counter}`);\n\n    const currentCounter = synced\n      ? sql`1 = 1`\n      : sql`((${counter} = 0 and ${assertion.counter} = 0) or ${counter} < ${assertion.counter})`;\n\n    yield* owner.updateGuarded(\n      table.table,\n      both(owner.exact(table.table, semantic), table.activeCondition, currentCounter),\n      {\n        [table.counter]: synced ? merged : assertion.counter,\n        [table.maximumCounter]: merged,\n        [table.backupState]: bs,\n      },\n      {\n        rows: 1,\n        postcondition: yield* existsExact(\n          table.table,\n          { ...semantic, [table.backupState]: bs },\n          both(\n            synced ? sql`${counter} = ${maximum}` : sql`${counter} = ${assertion.counter}`,\n            sql`${maximum} >= ${assertion.counter}`,\n          ),\n        ),\n      },\n    );\n    const earliest = yield* owner.now(mapping.clock);\n    const lastUsed = sql`${col(table.table, mapping.telemetry.lastUsedAt)}`;\n    const millis = mapping.clock.toMillis(lastUsed);\n\n    yield* owner.finalUpdate(\n      table.table,\n      owner.exact(table.table, semantic),\n      {\n        [mapping.telemetry.lastUsedAt]: mapping.clock.fromMillis(\n          max(sql`coalesce(${millis}, 0)`, mapping.clock.engineNowMillis),\n        ),\n      },\n      {\n        rows: 1,\n        postcondition: yield* existsExact(\n          table.table,\n          semantic,\n          both(sql`${millis} >= ${earliest}`, sql`${millis} <= ${mapping.clock.engineNowMillis}`),\n        ),\n      },\n    );\n  });\n\n  const settleAssertion = Effect.fn(\"passkey.settleAssertion\")(function* (\n    mapping: any,\n    claim: PasskeyClaim,\n    outcome:\n      | { readonly _tag: \"Rejected\" | \"Ambiguous\" }\n      | {\n          readonly _tag: \"Assertion\";\n          readonly credential: PasskeyCredential;\n          readonly assertion: PasskeyAssertionVerified;\n          readonly evidence: typeof PasskeyEvidence.Type;\n        },\n    dialect: \"pg\" | \"mysql\" | \"sqlite\",\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n    const assertedCredential = outcome._tag === \"Assertion\" ? outcome.credential : undefined;\n    const current = yield* readModule(mapping);\n\n    if (current === undefined || claim.ceremony.moduleId !== mapping.moduleId)\n      return \"Rejected\" as const;\n    yield* lockAdmission(mapping);\n\n    const originalIds =\n      targetRevision(claim.ceremony)?.credentials.map((item) => item.credentialId) ??\n      (outcome._tag === \"Assertion\"\n        ? outcome.credential.revision.credentials.map((item) => item.credentialId)\n        : undefined);\n\n    const subjectId =\n      outcome._tag === \"Assertion\"\n        ? outcome.credential.revision.subjectId\n        : knownSubject(claim.ceremony);\n\n    const subject =\n      subjectId === undefined ? undefined : yield* readSubject(mapping.read, subjectId);\n\n    yield* readPolicyGuards(mapping);\n\n    const found =\n      outcome._tag !== \"Assertion\" || subject === undefined\n        ? undefined\n        : yield* readCredential(\n            mapping.read,\n            subject,\n            claim.ceremony.profile.rpId,\n            outcome.credential.protocolCredentialId,\n            originalIds,\n          );\n\n    const read = yield* readFlow(mapping, claim.ceremony.flowId);\n\n    if (read === undefined || !exactClaim(read, claim)) return \"Rejected\" as const;\n    if (outcome._tag !== \"Assertion\") return yield* terminalFlow(mapping, read, outcome._tag);\n    invariant(assertedCredential !== undefined);\n    const captured = \"credential\" in read ? read.credential : undefined;\n    const assertion = outcome.assertion;\n\n    if (\n      captured === undefined ||\n      found === undefined ||\n      !compatiblePolicy(read.ceremony, read.policy, current) ||\n      !sameCredential(captured, assertedCredential) ||\n      !sameCredential(captured, found.credential)\n    )\n      return yield* terminalFlow(mapping, read, \"Rejected\");\n    const credential = found.credential;\n    const profile = read.ceremony.profile;\n\n    if (\n      assertion.protocolCredentialId !== credential.protocolCredentialId ||\n      (assertion.userHandle !== undefined && assertion.userHandle !== credential.userHandle) ||\n      assertion.backupEligible !== credential.backupEligible ||\n      (assertion.backupState && !assertion.backupEligible) ||\n      (profile.userVerification === \"required\" && !assertion.userVerified) ||\n      !profile.algorithms.includes(credential.algorithm) ||\n      (read.ceremony.allowedCredentials.length !== 0 &&\n        !read.ceremony.allowedCredentials.some(\n          (item) => item.id === credential.protocolCredentialId,\n        )) ||\n      (read.ceremony.purpose === \"sign-in\" &&\n        (assertion.userHandle !== credential.userHandle ||\n          !credential.primarySignIn ||\n          !credential.enrollmentUserVerified ||\n          !credential.profile.primarySignIn ||\n          credential.profile.userVerification !== \"required\" ||\n          !assertion.userVerified)) ||\n      !evidenceMatches(read.ceremony, captured, credential, assertion, outcome.evidence) ||\n      !(yield* owner.check(liveCondition(mapping, read.ceremony, claim)))\n    )\n      return yield* terminalFlow(mapping, read, \"Rejected\");\n    yield* readCharges(mapping, read.ceremony, read.policy, credential.revision.subjectId);\n    yield* guardChargeSet(mapping, read.ceremony, credential.revision.subjectId);\n    yield* updateTelemetry(mapping, found, assertion, dialect);\n    yield* terminalFlow(mapping, read, \"Verified\");\n    owner.postconditions.push(liveCondition(mapping, read.ceremony, claim));\n\n    return \"Verified\" as const;\n  });\n\n  const purposeCondition = (table: any, purposes: ReadonlyArray<string>) =>\n    sql`${col(table.table, table.purpose)} in (${sql.join(\n      purposes.map((purpose) => sql`${purpose}`),\n      sql`, `,\n    )})`;\n\n  const custodyFree = (mapping: any, flowExpression: ReturnType<QueryOperations[\"sql\"]>) => {\n    if (mapping.intent === undefined) return sql`1 = 1`;\n    const intent = mapping.intent;\n\n    return sql`not exists (select 1 from ${intent.table} where ${both(\n      equal(intent.table, { [intent.moduleId]: mapping.moduleId }),\n      sql`${col(intent.table, intent.flowId)} = ${flowExpression}`,\n      intent.custodyCondition,\n    )})`;\n  };\n\n  const flowDue = (mapping: any, purposes: ReadonlyArray<string>) => {\n    const flow = mapping.flow,\n      charge = mapping.charge,\n      now = mapping.clock.engineNowMillis;\n\n    const state = sql`${col(flow.table, flow.state)}`;\n    const retained = sql`${mapping.clock.toMillis(sql`${col(flow.table, flow.retentionUntil)}`)} <= ${now}`;\n\n    const chargeLive = sql`exists (select 1 from ${charge.table} where ${both(\n      equal(charge.table, { [charge.moduleId]: mapping.moduleId }),\n      sql`${col(charge.table, charge.flowId)} = ${col(flow.table, flow.flowId)}`,\n      sql`(${col(charge.table, charge.retainUntil)} is null or ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${now})`,\n    )})`;\n\n    return both(\n      equal(flow.table, { [flow.moduleId]: mapping.moduleId }),\n      purposeCondition(flow, purposes),\n      sql`((${state} = ${flow.states.Pending} and ${mapping.clock.toMillis(sql`${col(flow.table, flow.expiresAt)}`)} <= ${now}) or\n        (${state} = ${flow.states.Claimed} and ${mapping.clock.toMillis(sql`${col(flow.table, flow.claimExpiresAt)}`)} <= ${now}) or\n        (${state} in (${flow.states.Verified}, ${flow.states.Rejected}, ${flow.states.Ambiguous}, ${flow.states.RegistrationAccepted}) and ${retained} and not (${chargeLive}) and ${custodyFree(mapping, sql`${col(flow.table, flow.flowId)}`)}))`,\n    );\n  };\n\n  const chargeDue = (mapping: any, purposes: ReadonlyArray<string>) => {\n    const charge = mapping.charge;\n\n    return both(\n      equal(charge.table, { [charge.moduleId]: mapping.moduleId }),\n      purposeCondition(charge, purposes),\n      sql`${col(charge.table, charge.admittedAt)} is not null and ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} <= ${mapping.clock.engineNowMillis}`,\n      custodyFree(mapping, sql`${col(charge.table, charge.flowId)}`),\n    );\n  };\n\n  /** Flow transitions and row removals share one bound. Prepared hasMore is\n   * predicted from this owner's staged changes, then asserted after final writes. */\n  const cleanupCeremonies = Effect.fn(\"passkey.cleanupCeremonies\")(function* (\n    mapping: any,\n    input: { readonly moduleId: string; readonly nowMillis: number; readonly limit: number },\n    purposes: ReadonlyArray<string>,\n  ) {\n    const owner = yield* CurrentPasskeyTransaction;\n\n    invariant(\n      input.moduleId === mapping.moduleId &&\n        Number.isSafeInteger(input.nowMillis) &&\n        input.nowMillis >= 0 &&\n        Number.isSafeInteger(input.limit) &&\n        input.limit >= 1 &&\n        input.limit <= 1000,\n    );\n    yield* readModule(mapping);\n    yield* lockAdmission(mapping);\n    yield* readPolicyGuards(mapping);\n\n    const flow = mapping.flow,\n      charge = mapping.charge;\n\n    const rows = (yield* owner.read(flow.table, flowDue(mapping, purposes), {\n      limit: input.limit,\n      takeOnly: true,\n      observe: false,\n      orderBy: sql`${col(flow.table, flow.flowId)}`,\n    })).rows;\n\n    const touched: string[] = [];\n    const transitioned: FlowRead[] = [];\n\n    let terminalized = 0,\n      removed = 0;\n\n    for (const candidate of rows) {\n      const read = yield* readFlow(mapping, candidate[flow.flowId]);\n\n      if (read === undefined) continue;\n      invariant(\n        yield* owner.check(\n          sql`exists (select 1 from ${flow.table} where ${both(equal(flow.table, { [flow.moduleId]: mapping.moduleId, [flow.flowId]: read.ceremony.flowId }), flowDue(mapping, purposes))})`,\n        ),\n      );\n      touched.push(read.ceremony.flowId);\n      if (read.state === \"Pending\" || read.state === \"Claimed\") {\n        const deadline =\n          read.state === \"Pending\"\n            ? read.ceremony.expiresAtMillis\n            : read.claim!.claimExpiresAtMillis;\n\n        if (read.state === \"Pending\") yield* releaseRegistrationCustody(mapping, read.ceremony);\n        yield* terminalFlow(mapping, read, read.state === \"Pending\" ? \"Rejected\" : \"Ambiguous\");\n        owner.postconditions.push(sql`${mapping.clock.engineNowMillis} >= ${deadline}`);\n        transitioned.push(read);\n        terminalized++;\n      } else {\n        yield* scrubRegistrationIntent(mapping, read.ceremony);\n        yield* owner.remove(flow.table, {\n          [flow.moduleId]: mapping.moduleId,\n          [flow.flowId]: read.ceremony.flowId,\n        });\n        owner.postconditions.push(\n          sql`${mapping.clock.engineNowMillis} >= ${read.ceremony.retentionUntilMillis}`,\n          custodyFree(mapping, sql`${read.ceremony.flowId}`),\n          sql`not exists (select 1 from ${charge.table} where ${both(\n            equal(charge.table, {\n              [charge.moduleId]: mapping.moduleId,\n              [charge.flowId]: read.ceremony.flowId,\n            }),\n            sql`(${col(charge.table, charge.retainUntil)} is null or ${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${mapping.clock.engineNowMillis})`,\n          )})`,\n        );\n        removed++;\n      }\n    }\n    const removedCharges: Array<{ flowId: string; kind: string }> = [];\n    const remaining = input.limit - terminalized - removed;\n\n    if (remaining > 0) {\n      const charges = (yield* owner.read(charge.table, chargeDue(mapping, purposes), {\n        limit: remaining,\n        takeOnly: true,\n        observe: false,\n        orderBy: sql`${col(charge.table, charge.flowId)}, ${col(charge.table, charge.kind)}`,\n      })).rows;\n\n      for (const candidate of charges) {\n        const identity = {\n          [charge.moduleId]: mapping.moduleId,\n          [charge.flowId]: candidate[charge.flowId],\n          [charge.kind]: candidate[charge.kind],\n        };\n\n        const selected = (yield* owner.read(charge.table, equal(charge.table, identity), {\n          limit: 1,\n        })).rows[0];\n\n        invariant(selected !== undefined);\n        const horizon = mapping.clock.decodeInstant(selected[charge.retainUntil]);\n\n        invariant(Number.isSafeInteger(horizon));\n        yield* owner.remove(charge.table, identity);\n        owner.postconditions.push(\n          sql`${mapping.clock.engineNowMillis} >= ${horizon}`,\n          custodyFree(mapping, sql`${candidate[charge.flowId]}`),\n        );\n        removedCharges.push({ flowId: candidate[charge.flowId], kind: candidate[charge.kind] });\n        removed++;\n      }\n    }\n\n    const excludeFlows =\n      touched.length === 0\n        ? undefined\n        : sql`${col(flow.table, flow.flowId)} not in (${sql.join(\n            touched.map((id) => sql`${id}`),\n            sql`, `,\n          )})`;\n\n    const excludeCharges = removedCharges.map(\n      (item) =>\n        sql`not (${equal(charge.table, { [charge.flowId]: item.flowId, [charge.kind]: item.kind })})`,\n    );\n\n    const predicted = sql`exists (select 1 from ${flow.table} where ${both(flowDue(mapping, purposes), excludeFlows)}) or exists (select 1 from ${charge.table} where ${both(chargeDue(mapping, purposes), ...excludeCharges)})`;\n    // A transitioned row cannot also be removed by this call, but may be due now.\n    // Read through check only for unchanged rows; D1's prebatch assertion must use\n    // this predictive predicate, while the final assertion uses actual states.\n    let hasMore = yield* owner.check(predicted);\n\n    for (const read of transitioned) {\n      if (read.ceremony.retentionUntilMillis > (yield* owner.now(mapping.clock))) continue;\n      const liveCharges = sql`exists (select 1 from ${charge.table} where ${both(equal(charge.table, { [charge.moduleId]: mapping.moduleId, [charge.flowId]: read.ceremony.flowId }), sql`${mapping.clock.toMillis(sql`${col(charge.table, charge.retainUntil)}`)} > ${mapping.clock.engineNowMillis}`, ...excludeCharges)})`;\n\n      if (\n        !(yield* owner.check(liveCharges)) &&\n        (yield* owner.check(custodyFree(mapping, sql`${read.ceremony.flowId}`)))\n      )\n        hasMore = true;\n    }\n    const actual = sql`exists (select 1 from ${flow.table} where ${flowDue(mapping, purposes)}) or exists (select 1 from ${charge.table} where ${chargeDue(mapping, purposes)})`;\n\n    owner.postconditions.push(hasMore ? actual : sql`not (${actual})`);\n\n    return { terminalized, removed, hasMore };\n  });\n\n  return {\n    assertionPurposes,\n    contextPurpose,\n    knownSubject,\n    compatiblePolicy,\n    liveCondition,\n    matchesAccess,\n    readFlow,\n    terminalFlow,\n    issueAssertion,\n    contextAssertion,\n    claimAssertion,\n    exactClaim,\n    settleAssertion,\n    cleanupCeremonies,\n  };\n};\n"],"mappings":";;;;AAiCA,MAAa,yBACX,YACA,WAUA,aAIA,qBAIA,OAiBA,iBACG;CACH,MAAM,EAAE,QAAQ;CAEhB,MAAM,EACJ,oBACA,cACA,gBACA,gBACA,eACA,eACA,gBACE;CAEJ,MAAM,EAAE,gBAAgB,YAAY,kBAAkB,cAAc,gBAAgB;CACpF,MAAM,EAAE,4BAA4B,4BAA4B;CAEhE,MAAM,EACJ,iBACA,KACA,mBACA,OACA,aACA,eACA,eACA,gBACA,gBACA,cACA,2BACA,cACA,gBACE;CAEJ,MAAM,YAA+C,MAAM;CAC3D,MAAM,EAAE,SAAS;CAEjB,MAAM,oBAAoB;EAAC;EAAW;EAAW;EAAW;CAAQ;CAEpE,MAAM,iBAAiB;EACrB,QAAQ;EACR,SAAS;EACT,QAAQ;EACR,QAAQ;EACR,YAAY;EACZ,cAAc;CAChB;CAEA,MAAM,gBAAgB,aACpB,YAAY,SAAS,UACjB,SAAS,QAAQ,OAAO,SAAS,YACjC,SAAS,QAAQ,SAAS,eACxB,SAAS,QAAQ,SAAS,YAC1B,KAAA;CAER,MAAM,oBACJ,UACA,UACA,YACG;EACH,MAAM,WAAW,QAAQ,SAAS,MAC/B,YAAY,QAAQ,cAAc,SAAS,QAAQ,SACtD;EAEA,MAAM,SAAS,SAAS,SAAS,MAC9B,YAAY,QAAQ,cAAc,SAAS,QAAQ,SACtD;EAEA,OACE,SAAS,eAAe,QAAQ,cAChC,SAAS,eAAe,SAAS,cACjC,aAAa,KAAA,KACb,WAAW,KAAA,KACX,eAAe,OAAO,QAAQ,MAAM,eAAe,OAAO,SAAS,OAAO,KAC1E,eAAe,OAAO,MAAM,MAAM,eAAe,OAAO,SAAS,OAAO,KACxE,SAAS,wBAAwB,SAAS,uBAC1C,SAAS,kBAAkB,SAAS,kBACpC,SAAS,mBAAmB,SAAS,iCACrC,SAAS,kBAAkB,SAAS,kBAAkB,SAAS,kBAC/D,SAAS,kBAAkB,SAAS,kBAAkB,QAAQ,kBAC9D,SAAS,yBAAyB,SAAS,iBAAiB,SAAS,mBACrE,eAAe,SAAS,QAAQ,UAAU,SAAS,WACnD,IAAI,IAAI,SAAS,mBAAmB,KAAK,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,SAC1D,SAAS,mBAAmB;CAElC;CAEA,MAAM,iBAAiB,SAAc,UAA2B,UAAyB;EACvF,MAAM,MAAM,QAAQ,MAAM;EAE1B,OAAO,KACL,GAAG,GAAG,IAAI,MAAM,SAAS,kBACzB,GAAG,GAAG,IAAI,KAAK,SAAS,mBACxB,GAAG,GAAG,IAAI,KAAK,SAAS,iCACxB,YAAY,SAAS,UACjB,GAAG,GAAG,IAAI,KAAK,SAAS,QAAQ,OAAO,oBACvC,KAAA,GACJ,UAAU,KAAA,IACN,KAAA,IACA,KACE,GAAG,GAAG,IAAI,MAAM,MAAM,mBACtB,GAAG,GAAG,IAAI,KAAK,MAAM,sBACvB,CACN;CACF;CAEA,MAAM,iBAAiB,UAA2B,WAChD,SAAS,aAAa,OAAO,YAC7B,SAAS,eAAe,OAAO,cAC/B,SAAS,YAAY,OAAO,WAC5B,SAAS,WAAW,OAAO,UAC3B,SAAS,2BAA2B,OAAO,0BAC3C,SAAS,kCAAkC,OAAO;CAEpD,MAAM,WAAW,OAAO,GAAG,kBAAkB,CAAC,CAAC,WAAW,SAAc,QAAgB;EACtF,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAEtB,MAAM,OAAO,OAAO,MAAM,KACxB,MAAM,OACN,MAAM,MAAM,OAAO;IAChB,MAAM,WAAW,QAAQ;IACzB,MAAM,SAAS;EAClB,CAAC,GACD;GAAE,OAAO;GAAG,SAAS,cAAc,KAAK;EAAE,CAC5C,EAAA,CAAG,KAAK;EAER,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;EAC9B,MAAM,WAAW,gBAAgB,OAAO,IAAI,MAAM,SAAS;EAC3D,MAAM,SAAS,cAAc,OAAO,IAAI,MAAM,eAAe;EAE7D,MAAM,QAAQ,OAAO,KAAK,MAAM,MAAM,CAAC,CAAC,MACrC,SAAS,MAAM,OAAO,UAAU,IAAI,MAAM,MAC7C;EAEA,UACE,UAAU,KAAA,KAAa,SAAS,aAAa,QAAQ,YAAY,SAAS,WAAW,MACvF;EACA,UACE,IAAI,MAAM,cAAc,SAAS,YAC/B,IAAI,MAAM,YAAY,SAAS,UAC/B,IAAI,MAAM,eAAe,SAAS,SACtC;EACA,UACE,IAAI,MAAM,aAAa,SAAS,WAAW,IAAI,MAAM,gBAAgB,SAAS,UAChF;EACA,UACE,IAAI,MAAM,4BAA4B,SAAS,0BAC7C,QAAQ,MAAM,cAAc,IAAI,MAAM,wBAAwB,MAC5D,SAAS,6BACf;EACA,UACE,QAAQ,MAAM,cAAc,IAAI,MAAM,SAAS,MAAM,SAAS,kBAC5D,QAAQ,MAAM,cAAc,IAAI,MAAM,UAAU,MAAM,SAAS,mBAC/D,QAAQ,MAAM,cAAc,IAAI,MAAM,eAAe,MAAM,SAAS,oBACxE;EACA,UAAU,iBAAiB,UAAU,QAAQ,MAAM,CAAC;EAEpD,MAAM,aACJ,IAAI,MAAM,wBAAwB,OAC9B,KAAA,IACA,kBAAkB,OAAO,IAAI,MAAM,mBAAmB;EAE5D,MAAM,UAAU,YAAY,SAAS,aAAa,aAAa,QAAQ;EAEvE,UACE,IAAI,MAAM,mBAAmB,YAAY,KAAA,IAAY,OAAO,OAAO,aAAa,OAAO,MACrF,IAAI,MAAM,kBAAkB,OAAO,YAAY,QAAQ,EAC3D;EACA,IAAI,UAAU,WAAW;GACvB,UACE,IAAI,MAAM,aAAa,QACrB,IAAI,MAAM,eAAe,QACzB,IAAI,MAAM,oBAAoB,QAC9B,eAAe,KAAA,CACnB;GAEA,OAAO;IAAE;IAAK;IAAU;IAAQ;GAAM;EACxC;EAEA,MAAM,QACJ,IAAI,MAAM,aAAa,OACnB,KAAA,IACA,oBAAoB,cAAc;GAChC;GACA,SAAS,IAAI,MAAM;GACnB,iBAAiB,QAAQ,MAAM,cAAc,IAAI,MAAM,UAAU;GACjE,sBAAsB,QAAQ,MAAM,cAAc,IAAI,MAAM,eAAe;EAC7E,CAAC;EAEP,UAAU,UAAU,aAAa,UAAU,KAAA,CAAS;EACpD,IAAI,UAAU,KAAA,GACZ,UACE,MAAM,yBACJ,KAAK,IAAI,MAAM,kBAAkB,SAAS,qBAAqB,SAAS,eAAe,CAC3F;EAEF,OAAO;GACL;GACA;GACA;GACA;GACA,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;GACvC,GAAI,eAAe,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW;EACnD;CACF,CAAC;CAED,MAAM,eAAe,OAAO,GAAG,sBAAsB,CAAC,CAAC,WACrD,SACA,MACA,OACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ;EAEtB,OAAO,MAAM,OACX,MAAM,OACN;IAAG,MAAM,WAAW,QAAQ;IAAW,MAAM,SAAS,KAAK,SAAS;EAAO,GAC3E;IACG,MAAM,QAAQ,MAAM,OAAO;IAC3B,MAAM,UAAU,MAAM;EACzB,CACF;EACA,MAAM,eAAe,KACnB,OAAO,YAAY,MAAM,OAAO;IAC7B,MAAM,WAAW,QAAQ;IACzB,MAAM,SAAS,KAAK,SAAS;IAC7B,MAAM,QAAQ,MAAM,OAAO;IAC3B,MAAM,UAAU,MAAM;EACzB,CAAC,CACH;EAEA,OAAO;CACT,CAAC;CAED,MAAM,kBAAkB,aACtB,YAAY,SAAS,UACjB,SAAS,QAAQ,OAAO,WACxB,SAAS,QAAQ,SAAS,eACxB,SAAS,QAAQ,WACjB,KAAA;CAER,MAAM,gBAAgB,OAAO,GAAG,uBAAuB,CAAC,CAAC,WACvD,SACA,SACA,UACA;EACA,MAAM,SAAS,eAAe,QAAQ;EAEtC,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,IACE,YAAY,KAAA,KACZ,QAAQ,cAAc,OAAO,aAC7B,QAAQ,qBAAqB,OAAO,kBAEpC,OAAO;EAET,MAAM,UAAU,OAAO,aACrB,QAAQ,MACR,SACA,OAAO,YAAY,KAAK,SAAS,KAAK,YAAY,CACpD;EAEA,OAAO,YAAY,KAAA,KAAa,aAAa,SAAS,MAAM;CAC9D,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,UACA,gBACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,UAAU,OAAO,WAAW,OAAO;EAEzC,IACE,YAAY,KAAA,KACZ,SAAS,aAAa,QAAQ,YAC9B,CAAC,iBAAiB,UAAU,gBAAgB,OAAO,KACnD,cAAc,OAAO,cAAc,MAAM,cAAc,OAAO,OAAO,GAErE,OAAO,EAAE,MAAM,WAAW;EAC5B,OAAO,cAAc,OAAO;EAC5B,MAAM,YAAY,aAAa,QAAQ;EAEvC,MAAM,UACJ,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,YAAY,QAAQ,MAAM,SAAS;EAElF,OAAO,iBAAiB,OAAO;EAC/B,IAAI,EAAE,OAAO,cAAc,SAAS,SAAS,QAAQ,IAAI,OAAO,EAAE,MAAM,WAAW;EACnF,IACE,SAAS,QAAQ,SAAS,aACzB,CAAC,SAAS,QAAQ,iBACjB,SAAS,QAAQ,qBAAqB,cACtC,SAAS,QAAQ,gBAAgB,aAEnC,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,QAAQ,QAAQ;EAEtB,MAAM,cAAc,OAAO,MAAM,KAC/B,MAAM,OACN,MAAM,MAAM,OAAO;IAChB,MAAM,WAAW,QAAQ;IACzB,MAAM,YAAY,SAAS;EAC9B,CAAC,GACD,EAAE,OAAO,EAAE,CACb;EAEA,MAAM,WAAW,OAAO,SAAS,SAAS,SAAS,MAAM;EAEzD,IAAI,YAAY,KAAK,WAAW,KAAK,aAAa,KAAA,GAChD,OAAO,EAAE,MAAM,WAAW;EAC5B,MAAM,SAAS,OAAO,aAAa,UAAU,SAAS,EAAA,CAAG,KAAK,SAAS,KAAK,IAAI;EAEhF,IACE,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,QAAQ,CAAC,MACrD,EAAE,OAAO,MAAM,MACb,OAAO,mBAAmB,SAAS,CAAC,OAAO,GAAG,UAAU,WAAW,OAAO,MAAM,KAAK,CACvF,IAEA,OAAO,EAAE,MAAM,WAAW;EAE5B,MAAM,SAAS;GACb,GAAG,MAAM,aAAa;IAAE;IAAU,QAAQ;IAAgB,QAAQ,MAAM;GAAO,CAAC;IAC/E,MAAM,WAAW,SAAS;IAC1B,MAAM,SAAS,SAAS;IACxB,MAAM,YAAY,SAAS;IAC3B,MAAM,UAAU,SAAS;IACzB,MAAM,QAAQ,MAAM,OAAO;IAC3B,MAAM,UAAU,MAAM;IACtB,MAAM,aAAa,SAAS;IAC5B,MAAM,WAAW,gBAAgB,OAAO,QAAQ;IAChD,MAAM,iBAAiB,cAAc,OAAO,cAAc;IAC1D,MAAM,yBAAyB,SAAS;IACxC,MAAM,0BAA0B,QAAQ,MAAM,cAC7C,SAAS,6BACX;IACC,MAAM,WAAW,QAAQ,MAAM,cAAc,SAAS,cAAc;IACpE,MAAM,YAAY,QAAQ,MAAM,cAAc,SAAS,eAAe;IACtE,MAAM,iBAAiB,QAAQ,MAAM,cAAc,SAAS,oBAAoB;IAChF,MAAM,UAAU;IAChB,MAAM,YAAY;IAClB,MAAM,iBAAiB;IACvB,MAAM,qBAAqB;IAC3B,MAAM,eAAe,cAAc,KAAA,IAAY,OAAO,OAAO,aAAa,SAAS;IACnF,MAAM,cAAc,OAAO,YAAY,QAAQ;EAClD;EAGA,MAAM,WAAW,OAAO,MAAM,OAAO,MAAM,OAAO,QAAQ;IACvD,MAAM,WAAW,QAAQ;IACzB,MAAM,SAAS,SAAS;EAC3B,CAAC;EAED,YAAY,OAAO,SAAS;EAC5B,KAAK,MAAM,eAAe,MAAM,cAC9B,IAAI,YAAY,UAAU,MAAM,SAAS,YAAY,KAAK,WAAW,GACnE,YAAY,OAAO,SAAS;EAChC,OAAO,cAAc,SAAS,UAAU,gBAAgB,OAAO,SAAS;EACxE,OAAO,eAAe,SAAS,UAAU,SAAS;EAClD,OAAO,eAAe,SAAS,CAAC,OAAO,GAAG,UAAU,SAAS;EAC7D,MAAM,eAAe,KAAK,cAAc,SAAS,QAAQ,CAAC;EAE1D,OAAO;GAAE,MAAM;GAAU;EAAS;CACpC,CAAC;CAED,MAAM,mBAAmB,OAAO,GAAG,0BAA0B,CAAC,CAAC,WAC7D,SACA,QACA;EACA,MAAM,QAAQ,OAAO;EAErB,IAAI,OAAO,aAAa,QAAQ,UAAU,OAAO,KAAA;EACjD,MAAM,UAAU,OAAO,WAAW,OAAO;EAEzC,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;EAClC,OAAO,iBAAiB,OAAO;EAC/B,MAAM,OAAO,OAAO,SAAS,SAAS,OAAO,MAAM;EAEnD,IACE,SAAS,KAAA,KACT,KAAK,UAAU,aACf,CAAC,cAAc,KAAK,UAAU,MAAM,KACpC,CAAC,iBAAiB,KAAK,UAAU,KAAK,QAAQ,OAAO,GAErD,OAAO,KAAA;EACT,IAAI,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,KAAK,QAAQ,CAAC,IAAI,OAAO,KAAA;EACzE,MAAM,eAAe,KAAK,cAAc,SAAS,KAAK,QAAQ,CAAC;EAE/D,OAAO,KAAK;CACd,CAAC;CAED,MAAM,iBAAiB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WACzD,SACA,OAOA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,UAAU,OAAO,WAAW,OAAO;EAEzC,IAAI,YAAY,KAAA,KAAa,MAAM,OAAO,aAAa,QAAQ,UAC7D,OAAO,EAAE,MAAM,WAAW;EAC5B,OAAO,cAAc,OAAO;EAC5B,MAAM,kBAAkB,aAAa,MAAM,QAAQ;EACnD,MAAM,YAAY,mBAAmB,MAAM,YAAY,SAAS;EAEhE,MAAM,UACJ,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,YAAY,QAAQ,MAAM,SAAS;EAElF,OAAO,iBAAiB,OAAO;EAE/B,MAAM,YACJ,eAAe,MAAM,QAAQ,CAAC,EAAE,YAAY,KAAK,SAAS,KAAK,YAAY,KAC3E,MAAM,YAAY,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY;EAExE,MAAM,aACJ,MAAM,eAAe,KAAA,KAAa,YAAY,KAAA,IAC1C,KAAA,IACA,OAAO,eACL,QAAQ,MACR,SACA,MAAM,SAAS,QAAQ,MACvB,MAAM,WAAW,sBACjB,SACF;EAEN,MAAM,OAAO,OAAO,SAAS,SAAS,MAAM,OAAO,MAAM;EAEzD,IACE,SAAS,KAAA,KACT,KAAK,UAAU,aACf,CAAC,cAAc,KAAK,UAAU,MAAM,MAAM,GAE1C,OAAO,EAAE,MAAM,WAAW;EAC5B,UAAU,gBAAgB,OAAO,KAAK,QAAQ,MAAM,gBAAgB,OAAO,MAAM,QAAQ,CAAC;EAE1F,MAAM,SAAS,OAAO,IAAI,aAAa;GACrC,OAAO,aAAa,SAAS,MAAM,UAAU;GAE7C,OAAO,EAAE,MAAM,WAAW;EAC5B,CAAC;EAED,IACE,CAAC,iBAAiB,KAAK,UAAU,KAAK,QAAQ,OAAO,KACrD,cAAc,OAAO,MAAM,MAAM,MAAM,cAAc,OAAO,OAAO,KACnE,EAAE,OAAO,cAAc,SAAS,SAAS,KAAK,QAAQ,IAEtD,OAAO,OAAO;EAChB,IACE,MAAM,eAAe,KAAA,MACpB,eAAe,KAAA,KAAa,CAAC,eAAe,MAAM,YAAY,WAAW,UAAU,IAEpF,OAAO,OAAO;EAChB,IAAI,MAAM,eAAe,KAAA,KAAa,eAAe,KAAA,GAAW;GAC9D,MAAM,WAAW,MAAM,WAAW;GAClC,MAAM,SAAS,WAAW,WAAW;GACrC,MAAM,MAAM,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAI,aAAa,CAAC,GAAI,MAAM,WAAW,YAAY,CAAC,CAAC;GAE9E,IACE,SAAS,cAAc,OAAO,aAC9B,SAAS,qBAAqB,OAAO,oBACrC,IAAI,MAAM,OAAO;IACf,MAAM,SAAS,SAAS,YAAY,MAAM,SAAS,KAAK,iBAAiB,EAAE;IAC3E,MAAM,QAAQ,OAAO,YAAY,MAAM,SAAS,KAAK,iBAAiB,EAAE;IAIxE,OACE,UAAU,KAAA,MACT,WAAW,KAAA,IACR,OAAO,MAAM,YAAY,gBAAgB,eAAe,KAAK,QAAQ,MAAM,KAAA,IAC3E,OAAO,aAAa,MAAM;GAElC,CAAC,GAED,OAAO,OAAO;EAClB;EACA,IAAI,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,KAAK,QAAQ,CAAC,IAAI,OAAO,OAAO;EAChF,OAAO,YAAY,SAAS,KAAK,UAAU,KAAK,QAAQ,eAAe;EACvE,MAAM,WAAW,oBAAoB,KAAA,KAAa,cAAc,KAAA;EAEhE,IACE,EAAE,OAAO,MAAM,MACb,OAAO,mBACL,SACA,CAAC,KAAK,QAAQ,OAAO,GACrB,KAAK,UACL,WACA,WAAW,CAAC,SAAS,IAAI,CAAC,GAC1B,OACA,QACF,CACF,IAEA,OAAO,OAAO;EAChB,MAAM,kBAAkB,OAAO,MAAM,IAAI,QAAQ,KAAK;EAEtD,MAAM,QAAQ,oBAAoB,cAAc;GAC9C,UAAU,KAAK;GACf,SAAS,MAAM;GACf;GACA,sBAAsB,KAAK,IACzB,kBAAkB,KAAK,SAAS,qBAChC,KAAK,SAAS,eAChB;EACF,CAAC;EAED,MAAM,QAAQ,QAAQ;EAEtB,OAAO,MAAM,OACX,MAAM,OACN;IAAG,MAAM,WAAW,QAAQ;IAAW,MAAM,SAAS,KAAK,SAAS;EAAO,GAC3E;IACG,MAAM,QAAQ,MAAM,OAAO;IAC3B,MAAM,UAAU,MAAM;IACtB,MAAM,UAAU,MAAM;IACtB,MAAM,YAAY,QAAQ,MAAM,cAAc,MAAM,eAAe;IACnE,MAAM,iBAAiB,QAAQ,MAAM,cAAc,MAAM,oBAAoB;IAC7E,MAAM,qBACL,MAAM,eAAe,KAAA,IAAY,OAAO,kBAAkB,OAAO,MAAM,UAAU;IAClF,MAAM,eAAe,cAAc,KAAA,IAAY,OAAO,OAAO,aAAa,SAAS;EACtF,CACF;EACA,IAAI,UAAU,OAAO,cAAc,SAAS,KAAK,UAAU,KAAK,QAAQ,CAAC,SAAS,GAAG,SAAS;EAC9F,OAAO,eAAe,SAAS,KAAK,UAAU,SAAS;EACvD,OAAO,eAAe,SAAS,CAAC,KAAK,QAAQ,OAAO,GAAG,KAAK,UAAU,SAAS;EAC/E,MAAM,eAAe,KAAK,cAAc,SAAS,KAAK,UAAU,KAAK,CAAC;EAEtE,OAAO;GAAE,MAAM;GAAW;EAAM;CAClC,CAAC;CAED,MAAM,cAAc,MAAgB,UAClC,KAAK,UAAU,aACf,KAAK,UAAU,KAAA,KACf,KAAK,MAAM,YAAY,MAAM,WAC7B,KAAK,MAAM,oBAAoB,MAAM,mBACrC,KAAK,MAAM,yBAAyB,MAAM,wBAC1C,gBAAgB,OAAO,KAAK,QAAQ,MAAM,gBAAgB,OAAO,MAAM,QAAQ;CAEjF,MAAM,mBACJ,UACA,UACA,YACA,WACA,aACG;EACH,MAAM,QAAQ,SAAS,OAAO;EAE9B,MAAM,WADS,eAAe,QACR,KAAK,SAAS;EAEpC,MAAM,MAAM,CACV,mBAAG,IAAI,IAAI,CACT,GAAG,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,GACvD,WAAW,YACb,CAAC,CACH;EAEA,MAAM,WAAW;GACf,GAAG,WAAW;GACd,aAAa,WAAW,SAAS,YAAY,QAAQ,SACnD,IAAI,SAAS,KAAK,YAAY,CAChC;EACF;EAEA,MAAM,WAAW,SAAS,SAAS,YAAY,MAC5C,SAAS,KAAK,iBAAiB,WAAW,YAC7C;EAEA,OACE,SAAS,OAAO,WAAW,KAC3B,UAAU,KAAA,KACV,MAAM,WAAW,aACjB,MAAM,iBAAiB,WAAW,gBAClC,MAAM,QAAQ,WAAW,KACzB,MAAM,QAAQ,OAAO,gBACrB,MAAM,iBAAiB,UAAU,gBACjC,MAAM,qBACN,SAAS,cAAc,MAAM,UAAU,MAAM,SAAS,kBACtD,SAAS,YACN,YAAY,SAAS,UAAU,SAAS,QAAQ,OAAO,SAAS,SAAS,WAC5E,SAAS,mBACN,YAAY,SAAS,UAClB,SAAS,QAAQ,OAAO,gBACxB,SAAS,2BACf,SAAS,YAAY,WAAW,IAAI,UACpC,aAAa,SAAS,UAAU,QAAQ,KACxC,SAAS,cAAc,SAAS,aAChC,SAAS,qBAAqB,SAAS,oBACvC,SAAS,YAAY,OAAO,SAC1B,SAAS,YAAY,MAClB,YACC,QAAQ,iBAAiB,KAAK,gBAAgB,QAAQ,aAAa,KAAK,QAC5E,CACF,KACA,aAAa,KAAA,KACb,SAAS,YAAY,MAClB,SACC,KAAK,iBAAiB,SAAS,gBAAgB,KAAK,aAAa,SAAS,QAC9E;CAEJ;CAEA,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA,WACA,SACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,QAAQ,KAAK;EAC3B,MAAM,UAAU,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,OAAO;EACpD,MAAM,UAAU,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,cAAc;EAE3D,MAAM,OAAO,GAAG,WACd,YAAY,WACR,GAAG,OAAO,IAAI,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG,IAAI,EAAE,KACzC,GAAG,YAAY,IAAI,KAAK,CAAC,GAAG,MAAM,GAAG,GAAG,IAAI,EAAE;EAEpD,MAAM,WAAW,OAAO,YACtB,0BAA0B,KAAK,CAAC,CAAC,KAAK,WAAW,CAAC,QAAQ,MAAM,IAAI,OAAO,CAAC,CAC9E;EAEA,MAAM,KAAK,QAAQ,UAAU,kBAAkB,UAAU,WAAW;EACpE,MAAM,SAAS,MAAM,WAAW;EAChC,MAAM,SAAS,IAAI,SAAS,SAAS,GAAG,GAAG,UAAU,SAAS;EAE9D,MAAM,iBAAiB,SACnB,GAAG,UACH,GAAG,KAAK,QAAQ,WAAW,UAAU,QAAQ,WAAW,QAAQ,KAAK,UAAU,QAAQ;EAE3F,OAAO,MAAM,cACX,MAAM,OACN,KAAK,MAAM,MAAM,MAAM,OAAO,QAAQ,GAAG,MAAM,iBAAiB,cAAc,GAC9E;IACG,MAAM,UAAU,SAAS,SAAS,UAAU;IAC5C,MAAM,iBAAiB;IACvB,MAAM,cAAc;EACvB,GACA;GACE,MAAM;GACN,eAAe,OAAO,YACpB,MAAM,OACN;IAAE,GAAG;KAAW,MAAM,cAAc;GAAG,GACvC,KACE,SAAS,GAAG,GAAG,QAAQ,KAAK,YAAY,GAAG,GAAG,QAAQ,KAAK,UAAU,WACrE,GAAG,GAAG,QAAQ,MAAM,UAAU,SAChC,CACF;EACF,CACF;EACA,MAAM,WAAW,OAAO,MAAM,IAAI,QAAQ,KAAK;EAC/C,MAAM,WAAW,GAAG,GAAG,IAAI,MAAM,OAAO,QAAQ,UAAU,UAAU;EACpE,MAAM,SAAS,QAAQ,MAAM,SAAS,QAAQ;EAE9C,OAAO,MAAM,YACX,MAAM,OACN,MAAM,MAAM,MAAM,OAAO,QAAQ,GACjC,GACG,QAAQ,UAAU,aAAa,QAAQ,MAAM,WAC5C,IAAI,GAAG,YAAY,OAAO,OAAO,QAAQ,MAAM,eAAe,CAChE,EACF,GACA;GACE,MAAM;GACN,eAAe,OAAO,YACpB,MAAM,OACN,UACA,KAAK,GAAG,GAAG,OAAO,MAAM,YAAY,GAAG,GAAG,OAAO,MAAM,QAAQ,MAAM,iBAAiB,CACxF;EACF,CACF;CACF,CAAC;CAED,MAAM,kBAAkB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WAC3D,SACA,OACA,SAQA,SACA;EACA,MAAM,QAAQ,OAAO;EACrB,MAAM,qBAAqB,QAAQ,SAAS,cAAc,QAAQ,aAAa,KAAA;EAC/E,MAAM,UAAU,OAAO,WAAW,OAAO;EAEzC,IAAI,YAAY,KAAA,KAAa,MAAM,SAAS,aAAa,QAAQ,UAC/D,OAAO;EACT,OAAO,cAAc,OAAO;EAE5B,MAAM,cACJ,eAAe,MAAM,QAAQ,CAAC,EAAE,YAAY,KAAK,SAAS,KAAK,YAAY,MAC1E,QAAQ,SAAS,cACd,QAAQ,WAAW,SAAS,YAAY,KAAK,SAAS,KAAK,YAAY,IACvE,KAAA;EAEN,MAAM,YACJ,QAAQ,SAAS,cACb,QAAQ,WAAW,SAAS,YAC5B,aAAa,MAAM,QAAQ;EAEjC,MAAM,UACJ,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,YAAY,QAAQ,MAAM,SAAS;EAElF,OAAO,iBAAiB,OAAO;EAE/B,MAAM,QACJ,QAAQ,SAAS,eAAe,YAAY,KAAA,IACxC,KAAA,IACA,OAAO,eACL,QAAQ,MACR,SACA,MAAM,SAAS,QAAQ,MACvB,QAAQ,WAAW,sBACnB,WACF;EAEN,MAAM,OAAO,OAAO,SAAS,SAAS,MAAM,SAAS,MAAM;EAE3D,IAAI,SAAS,KAAA,KAAa,CAAC,WAAW,MAAM,KAAK,GAAG,OAAO;EAC3D,IAAI,QAAQ,SAAS,aAAa,OAAO,OAAO,aAAa,SAAS,MAAM,QAAQ,IAAI;EACxF,UAAU,uBAAuB,KAAA,CAAS;EAC1C,MAAM,WAAW,gBAAgB,OAAO,KAAK,aAAa,KAAA;EAC1D,MAAM,YAAY,QAAQ;EAE1B,IACE,aAAa,KAAA,KACb,UAAU,KAAA,KACV,CAAC,iBAAiB,KAAK,UAAU,KAAK,QAAQ,OAAO,KACrD,CAAC,eAAe,UAAU,kBAAkB,KAC5C,CAAC,eAAe,UAAU,MAAM,UAAU,GAE1C,OAAO,OAAO,aAAa,SAAS,MAAM,UAAU;EACtD,MAAM,aAAa,MAAM;EACzB,MAAM,UAAU,KAAK,SAAS;EAE9B,IACE,UAAU,yBAAyB,WAAW,wBAC7C,UAAU,eAAe,KAAA,KAAa,UAAU,eAAe,WAAW,cAC3E,UAAU,mBAAmB,WAAW,kBACvC,UAAU,eAAe,CAAC,UAAU,kBACpC,QAAQ,qBAAqB,cAAc,CAAC,UAAU,gBACvD,CAAC,QAAQ,WAAW,SAAS,WAAW,SAAS,KAChD,KAAK,SAAS,mBAAmB,WAAW,KAC3C,CAAC,KAAK,SAAS,mBAAmB,MAC/B,SAAS,KAAK,OAAO,WAAW,oBACnC,KACD,KAAK,SAAS,YAAY,cACxB,UAAU,eAAe,WAAW,cACnC,CAAC,WAAW,iBACZ,CAAC,WAAW,0BACZ,CAAC,WAAW,QAAQ,iBACpB,WAAW,QAAQ,qBAAqB,cACxC,CAAC,UAAU,iBACf,CAAC,gBAAgB,KAAK,UAAU,UAAU,YAAY,WAAW,QAAQ,QAAQ,KACjF,EAAE,OAAO,MAAM,MAAM,cAAc,SAAS,KAAK,UAAU,KAAK,CAAC,IAEjE,OAAO,OAAO,aAAa,SAAS,MAAM,UAAU;EACtD,OAAO,YAAY,SAAS,KAAK,UAAU,KAAK,QAAQ,WAAW,SAAS,SAAS;EACrF,OAAO,eAAe,SAAS,KAAK,UAAU,WAAW,SAAS,SAAS;EAC3E,OAAO,gBAAgB,SAAS,OAAO,WAAW,OAAO;EACzD,OAAO,aAAa,SAAS,MAAM,UAAU;EAC7C,MAAM,eAAe,KAAK,cAAc,SAAS,KAAK,UAAU,KAAK,CAAC;EAEtE,OAAO;CACT,CAAC;CAED,MAAM,oBAAoB,OAAY,aACpC,GAAG,GAAG,IAAI,MAAM,OAAO,MAAM,OAAO,EAAE,OAAO,IAAI,KAC/C,SAAS,KAAK,YAAY,GAAG,GAAG,SAAS,GACzC,GAAG,IACL,EAAE;CAEJ,MAAM,eAAe,SAAc,mBAAuD;EACxF,IAAI,QAAQ,WAAW,KAAA,GAAW,OAAO,GAAG;EAC5C,MAAM,SAAS,QAAQ;EAEvB,OAAO,GAAG,6BAA6B,OAAO,MAAM,SAAS,KAC3D,MAAM,OAAO,OAAO,GAAG,OAAO,WAAW,QAAQ,SAAS,CAAC,GAC3D,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,MAAM,EAAE,KAAK,kBAC5C,OAAO,gBACT,EAAE;CACJ;CAEA,MAAM,WAAW,SAAc,aAAoC;EACjE,MAAM,OAAO,QAAQ,MACnB,SAAS,QAAQ,QACjB,MAAM,QAAQ,MAAM;EAEtB,MAAM,QAAQ,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,KAAK;EAC9C,MAAM,WAAW,GAAG,GAAG,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,cAAc,GAAG,EAAE,MAAM;EAElG,MAAM,aAAa,GAAG,yBAAyB,OAAO,MAAM,SAAS,KACnE,MAAM,OAAO,OAAO,GAAG,OAAO,WAAW,QAAQ,SAAS,CAAC,GAC3D,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,MAAM,EAAE,KAAK,IAAI,KAAK,OAAO,KAAK,MAAM,KACvE,GAAG,IAAI,IAAI,OAAO,OAAO,OAAO,WAAW,EAAE,cAAc,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,WAAW,GAAG,EAAE,KAAK,IAAI,EAC5I,EAAE;EAEF,OAAO,KACL,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,QAAQ,SAAS,CAAC,GACvD,iBAAiB,MAAM,QAAQ,GAC/B,GAAG,KAAK,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,SAAS,GAAG,EAAE,MAAM,IAAI;WACnH,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,cAAc,GAAG,EAAE,MAAM,IAAI;WACrH,MAAM,OAAO,KAAK,OAAO,SAAS,IAAI,KAAK,OAAO,SAAS,IAAI,KAAK,OAAO,UAAU,IAAI,KAAK,OAAO,qBAAqB,QAAQ,SAAS,YAAY,WAAW,QAAQ,YAAY,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE,GAC5O;CACF;CAEA,MAAM,aAAa,SAAc,aAAoC;EACnE,MAAM,SAAS,QAAQ;EAEvB,OAAO,KACL,MAAM,OAAO,OAAO,GAAG,OAAO,WAAW,QAAQ,SAAS,CAAC,GAC3D,iBAAiB,QAAQ,QAAQ,GACjC,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,UAAU,EAAE,mBAAmB,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,WAAW,GAAG,EAAE,MAAM,QAAQ,MAAM,mBACxJ,YAAY,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,MAAM,GAAG,CAC/D;CACF;CAwJA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,mBAlKwB,OAAO,GAAG,2BAA2B,CAAC,CAAC,WAC/D,SACA,OACA,UACA;GACA,MAAM,QAAQ,OAAO;GAErB,UACE,MAAM,aAAa,QAAQ,YACzB,OAAO,cAAc,MAAM,SAAS,KACpC,MAAM,aAAa,KACnB,OAAO,cAAc,MAAM,KAAK,KAChC,MAAM,SAAS,KACf,MAAM,SAAS,GACnB;GACA,OAAO,WAAW,OAAO;GACzB,OAAO,cAAc,OAAO;GAC5B,OAAO,iBAAiB,OAAO;GAE/B,MAAM,OAAO,QAAQ,MACnB,SAAS,QAAQ;GAEnB,MAAM,QAAQ,OAAO,MAAM,KAAK,KAAK,OAAO,QAAQ,SAAS,QAAQ,GAAG;IACtE,OAAO,MAAM;IACb,UAAU;IACV,SAAS;IACT,SAAS,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,MAAM;GAC5C,CAAC,EAAA,CAAG;GAEJ,MAAM,UAAoB,CAAC;GAC3B,MAAM,eAA2B,CAAC;GAElC,IAAI,eAAe,GACjB,UAAU;GAEZ,KAAK,MAAM,aAAa,MAAM;IAC5B,MAAM,OAAO,OAAO,SAAS,SAAS,UAAU,KAAK,OAAO;IAE5D,IAAI,SAAS,KAAA,GAAW;IACxB,UACE,OAAO,MAAM,MACX,GAAG,yBAAyB,KAAK,MAAM,SAAS,KAAK,MAAM,KAAK,OAAO;MAAG,KAAK,WAAW,QAAQ;MAAW,KAAK,SAAS,KAAK,SAAS;IAAO,CAAC,GAAG,QAAQ,SAAS,QAAQ,CAAC,EAAE,EAClL,CACF;IACA,QAAQ,KAAK,KAAK,SAAS,MAAM;IACjC,IAAI,KAAK,UAAU,aAAa,KAAK,UAAU,WAAW;KACxD,MAAM,WACJ,KAAK,UAAU,YACX,KAAK,SAAS,kBACd,KAAK,MAAO;KAElB,IAAI,KAAK,UAAU,WAAW,OAAO,2BAA2B,SAAS,KAAK,QAAQ;KACtF,OAAO,aAAa,SAAS,MAAM,KAAK,UAAU,YAAY,aAAa,WAAW;KACtF,MAAM,eAAe,KAAK,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,UAAU;KAC9E,aAAa,KAAK,IAAI;KACtB;IACF,OAAO;KACL,OAAO,wBAAwB,SAAS,KAAK,QAAQ;KACrD,OAAO,MAAM,OAAO,KAAK,OAAO;OAC7B,KAAK,WAAW,QAAQ;OACxB,KAAK,SAAS,KAAK,SAAS;KAC/B,CAAC;KACD,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,KAAK,SAAS,wBACxD,YAAY,SAAS,GAAG,GAAG,KAAK,SAAS,QAAQ,GACjD,GAAG,6BAA6B,OAAO,MAAM,SAAS,KACpD,MAAM,OAAO,OAAO;OACjB,OAAO,WAAW,QAAQ;OAC1B,OAAO,SAAS,KAAK,SAAS;KACjC,CAAC,GACD,GAAG,IAAI,IAAI,OAAO,OAAO,OAAO,WAAW,EAAE,cAAc,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,WAAW,GAAG,EAAE,KAAK,QAAQ,MAAM,gBAAgB,EACtK,EAAE,EACJ;KACA;IACF;GACF;GACA,MAAM,iBAA0D,CAAC;GACjE,MAAM,YAAY,MAAM,QAAQ,eAAe;GAE/C,IAAI,YAAY,GAAG;IACjB,MAAM,WAAW,OAAO,MAAM,KAAK,OAAO,OAAO,UAAU,SAAS,QAAQ,GAAG;KAC7E,OAAO;KACP,UAAU;KACV,SAAS;KACT,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,MAAM,EAAE,IAAI,IAAI,OAAO,OAAO,OAAO,IAAI;IACnF,CAAC,EAAA,CAAG;IAEJ,KAAK,MAAM,aAAa,SAAS;KAC/B,MAAM,WAAW;OACd,OAAO,WAAW,QAAQ;OAC1B,OAAO,SAAS,UAAU,OAAO;OACjC,OAAO,OAAO,UAAU,OAAO;KAClC;KAEA,MAAM,YAAY,OAAO,MAAM,KAAK,OAAO,OAAO,MAAM,OAAO,OAAO,QAAQ,GAAG,EAC/E,OAAO,EACT,CAAC,EAAA,CAAG,KAAK;KAET,UAAU,aAAa,KAAA,CAAS;KAChC,MAAM,UAAU,QAAQ,MAAM,cAAc,SAAS,OAAO,YAAY;KAExE,UAAU,OAAO,cAAc,OAAO,CAAC;KACvC,OAAO,MAAM,OAAO,OAAO,OAAO,QAAQ;KAC1C,MAAM,eAAe,KACnB,GAAG,GAAG,QAAQ,MAAM,gBAAgB,MAAM,WAC1C,YAAY,SAAS,GAAG,GAAG,UAAU,OAAO,SAAS,CACvD;KACA,eAAe,KAAK;MAAE,QAAQ,UAAU,OAAO;MAAS,MAAM,UAAU,OAAO;KAAM,CAAC;KACtF;IACF;GACF;GAEA,MAAM,eACJ,QAAQ,WAAW,IACf,KAAA,IACA,GAAG,GAAG,IAAI,KAAK,OAAO,KAAK,MAAM,EAAE,WAAW,IAAI,KAChD,QAAQ,KAAK,OAAO,GAAG,GAAG,IAAI,GAC9B,GAAG,IACL,EAAE;GAER,MAAM,iBAAiB,eAAe,KACnC,SACC,GAAG,QAAQ,MAAM,OAAO,OAAO;KAAG,OAAO,SAAS,KAAK;KAAS,OAAO,OAAO,KAAK;GAAK,CAAC,EAAE,EAC/F;GAEA,MAAM,YAAY,GAAG,yBAAyB,KAAK,MAAM,SAAS,KAAK,QAAQ,SAAS,QAAQ,GAAG,YAAY,EAAE,6BAA6B,OAAO,MAAM,SAAS,KAAK,UAAU,SAAS,QAAQ,GAAG,GAAG,cAAc,EAAE;GAI1N,IAAI,UAAU,OAAO,MAAM,MAAM,SAAS;GAE1C,KAAK,MAAM,QAAQ,cAAc;IAC/B,IAAI,KAAK,SAAS,wBAAwB,OAAO,MAAM,IAAI,QAAQ,KAAK,IAAI;IAC5E,MAAM,cAAc,GAAG,yBAAyB,OAAO,MAAM,SAAS,KAAK,MAAM,OAAO,OAAO;MAAG,OAAO,WAAW,QAAQ;MAAW,OAAO,SAAS,KAAK,SAAS;IAAO,CAAC,GAAG,GAAG,GAAG,QAAQ,MAAM,SAAS,GAAG,GAAG,IAAI,OAAO,OAAO,OAAO,WAAW,GAAG,EAAE,KAAK,QAAQ,MAAM,mBAAmB,GAAG,cAAc,EAAE;IAErT,IACE,EAAE,OAAO,MAAM,MAAM,WAAW,OAC/B,OAAO,MAAM,MAAM,YAAY,SAAS,GAAG,GAAG,KAAK,SAAS,QAAQ,CAAC,IAEtE,UAAU;GACd;GACA,MAAM,SAAS,GAAG,yBAAyB,KAAK,MAAM,SAAS,QAAQ,SAAS,QAAQ,EAAE,6BAA6B,OAAO,MAAM,SAAS,UAAU,SAAS,QAAQ,EAAE;GAE1K,MAAM,eAAe,KAAK,UAAU,SAAS,GAAG,QAAQ,OAAO,EAAE;GAEjE,OAAO;IAAE;IAAc;IAAS;GAAQ;EAC1C,CAgBkB;CAClB;AACF"}