@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/internal/oauth/native-sign-in.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-sign-in.mjs","names":[],"sources":["../../../src/internal/oauth/native-sign-in.ts"],"sourcesContent":["import { CurrentCommitJournal, type LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport * as M from \"@yielded/auth/OAuth\";\nimport { Crypto, Effect } from \"effect\";\nimport type { SqlClient } from \"effect/sql/SqlClient\";\n\nimport type { NativeSqlTables } from \"../native-sql-table\";\nimport { makeSqlCommitExecutor, registerSqlCommitReceipt, SqlBatchCommit } from \"../sql-commit\";\nimport { makeOAuthNativeFlow } from \"./native-flow\";\nimport { makeOAuthNativeState, type OAuthNativeReadMapping } from \"./native-state\";\nimport { invariant, unavailable } from \"./state\";\n\nexport const prepareOAuthNative = <Value, A>(\n  value: Value,\n  prepare: M.PrepareOAuthCommit<Value, A>,\n) =>\n  Effect.gen(function* () {\n    const journal = yield* CurrentCommitJournal;\n\n    const receipt = prepare(value, journal);\n\n    invariant(receipt?._tag === \"PreparedCommit\" && Effect.isEffect(receipt.read));\n    yield* registerSqlCommitReceipt(receipt);\n\n    return receipt;\n  });\n\n/** Both physical adapters bind the same native SQL operations. */\nexport const makeNativeOAuthSignInServices = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: OAuthNativeReadMapping,\n  batch?: SqlBatchCommit[\"Service\"],\n): Effect.fn.Return<\n  { readonly oauthSignInPersistence: M.OAuthSignInPersistence[\"Service\"] },\n  M.OAuthUnavailable,\n  SqlClient | LifecycleHooks | Crypto.Crypto\n> {\n  const executor = yield* makeSqlCommitExecutor(unavailable);\n  const crypto = yield* Crypto.Crypto;\n  const state = yield* makeOAuthNativeState(tables, mapping);\n\n  const flow = yield* makeOAuthNativeFlow(\n    tables,\n    mapping,\n    M.OAuthSignInFlow,\n    \"sign-in\",\n    () => undefined,\n    batch !== undefined,\n  );\n\n  const mode = flow.mysql ? \"transaction\" : \"statement\";\n\n  const run = <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n    selected: \"transaction\" | \"statement\" = mode,\n  ) =>\n    batch === undefined\n      ? executor.run(effect, selected)\n      : executor.batch(effect).pipe(Effect.provideService(SqlBatchCommit, batch));\n\n  const service: M.OAuthSignInPersistence[\"Service\"] = {\n    issue: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotOAuthSync(M.OAuthSignInFlow, original);\n          const issued = yield* flow.issue(input);\n\n          return yield* prepareOAuthNative(\n            issued ? { _tag: \"Issued\", flow: input } : { _tag: \"Rejected\" },\n            prepare,\n          );\n        }),\n        mode,\n      ),\n    consume: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotOAuthSync(M.OAuthSignInAccess, original);\n          const consumed = yield* flow.consume(input);\n\n          return yield* prepareOAuthNative(\n            consumed === undefined ? { _tag: \"Rejected\" } : { _tag: \"Consumed\", flow: consumed },\n            prepare,\n          );\n        }),\n        mode,\n      ),\n    resolve: (input) =>\n      executor.read(\n        Effect.suspend(() =>\n          state.resolve(\n            input.moduleId,\n            M.snapshotOAuthSync(M.OAuthExternalIdentity, input.identity),\n          ),\n        ).pipe(Effect.provideService(Crypto.Crypto, crypto)),\n      ),\n    cleanup: (original, prepare) =>\n      run(\n        Effect.gen(function* () {\n          const input = M.snapshotOAuthSync(M.OAuthCleanupInput, original);\n\n          return yield* prepareOAuthNative(\n            yield* flow.cleanup(input.moduleId, input.limit),\n            prepare,\n          );\n        }),\n        \"statement\",\n      ),\n  };\n\n  return { oauthSignInPersistence: service };\n});\n"],"mappings":";;;;;;;;AAWA,MAAa,sBACX,OACA,YAEA,OAAO,IAAI,aAAa;CAGtB,MAAM,UAAU,QAAQ,OAAO,OAFR,oBAEe;CAEtC,UAAU,SAAS,SAAS,oBAAoB,OAAO,SAAS,QAAQ,IAAI,CAAC;CAC7E,OAAO,yBAAyB,OAAO;CAEvC,OAAO;AACT,CAAC;;AAGH,MAAa,gCAAgC,OAAO,WAAW,WAC7D,QACA,SACA,OAKA;CACA,MAAM,WAAW,OAAO,sBAAsB,WAAW;CACzD,MAAM,SAAS,OAAO,OAAO;CAC7B,MAAM,QAAQ,OAAO,qBAAqB,QAAQ,OAAO;CAEzD,MAAM,OAAO,OAAO,oBAClB,QACA,SACA,EAAE,iBACF,iBACM,KAAA,GACN,UAAU,KAAA,CACZ;CAEA,MAAM,OAAO,KAAK,QAAQ,gBAAgB;CAE1C,MAAM,OACJ,QACA,WAAwC,SAExC,UAAU,KAAA,IACN,SAAS,IAAI,QAAQ,QAAQ,IAC7B,SAAS,MAAM,MAAM,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,KAAK,CAAC;CAoD9E,OAAO,EAAE,wBAAwB;EAjD/B,QAAQ,UAAU,YAChB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,iBAAiB,QAAQ;GAC7D,MAAM,SAAS,OAAO,KAAK,MAAM,KAAK;GAEtC,OAAO,OAAO,mBACZ,SAAS;IAAE,MAAM;IAAU,MAAM;GAAM,IAAI,EAAE,MAAM,WAAW,GAC9D,OACF;EACF,CAAC,GACD,IACF;EACF,UAAU,UAAU,YAClB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,mBAAmB,QAAQ;GAC/D,MAAM,WAAW,OAAO,KAAK,QAAQ,KAAK;GAE1C,OAAO,OAAO,mBACZ,aAAa,KAAA,IAAY,EAAE,MAAM,WAAW,IAAI;IAAE,MAAM;IAAY,MAAM;GAAS,GACnF,OACF;EACF,CAAC,GACD,IACF;EACF,UAAU,UACR,SAAS,KACP,OAAO,cACL,MAAM,QACJ,MAAM,UACN,EAAE,kBAAkB,EAAE,uBAAuB,MAAM,QAAQ,CAC7D,CACF,CAAC,CAAC,KAAK,OAAO,eAAe,OAAO,QAAQ,MAAM,CAAC,CACrD;EACF,UAAU,UAAU,YAClB,IACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,EAAE,kBAAkB,EAAE,mBAAmB,QAAQ;GAE/D,OAAO,OAAO,mBACZ,OAAO,KAAK,QAAQ,MAAM,UAAU,MAAM,KAAK,GAC/C,OACF;EACF,CAAC,GACD,WACF;CAGmC,EAAE;AAC3C,CAAC"}

package/dist/internal/oauth/native-state.d.mts

@@ -0,0 +1,10 @@
+import { SqlExpression, TableModel } from "../table-model.mjs";
+import "../mapping-error.mjs";
+import "../native-sql-table.mjs";
+import { OAuthSignInMapping } from "../models/oauth-model.mjs";
+import { Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+//#region src/internal/oauth/native-state.d.ts
+export type OAuthNativeReadMapping = OAuthSignInMapping<TableModel, TableModel, TableModel, TableModel, TableModel, unknown, SqlExpression>;
+//#endregion
+//# sourceMappingURL=native-state.d.mts.map

package/dist/internal/oauth/native-state.mjs

@@ -0,0 +1,214 @@
+import { exactSqlText } from "../sql-change.mjs";
+import { invariant, oauthIdentityKey } from "./state.mjs";
+import { Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+import { OAuthAccountRevision, OAuthCredentialSnapshot, OAuthExternalIdentity } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/native-state.ts
+/** Unlocked snapshots and explicit subject-first reads share decoding rules.
+* No observation registry or discovered-identity placeholder is retained. */
+const makeOAuthNativeAuthority = Effect.fnUntraced(function* (tables, mapping) {
+	const sql = (yield* SqlClient.SqlClient).withoutTransforms();
+	const subject = tables(mapping.subject.table);
+	const authority = tables(mapping.authority.table);
+	const s = subject.as("oauth_subject");
+	const a = authority.as("oauth_authority");
+	const now = tables.expression(mapping.clock.engineNowMillis);
+	const lock = sql.onDialectOrElse({
+		pg: () => sql`for update`,
+		mysql: () => sql`for update`,
+		orElse: () => sql``
+	});
+	const active = (kind, alias) => {
+		const descriptor = mapping[kind];
+		const physical = tables(descriptor.table);
+		return sql`(select * from ${physical.name} where ${tables.expression(descriptor.activeCondition)}) as ${sql(alias)}`;
+	};
+	const revision = Effect.fnUntraced(function* (subjectRow, factors, nativeId) {
+		invariant(mapping.subject.isActiveStatus(subjectRow[mapping.subject.status]));
+		invariant(mapping.subjectId.equals(subjectRow[mapping.subject.id], nativeId));
+		invariant(factors.length > 0 && factors.length <= 64);
+		invariant(factors.every((row) => mapping.subjectId.equals(row[mapping.authority.subjectId], nativeId) && mapping.authority.isActiveStatus(row[mapping.authority.status])));
+		const credentials = factors.map((row) => ({
+			credentialId: row[mapping.authority.credentialId],
+			revision: row[mapping.authority.revision]
+		}));
+		invariant(new Set(credentials.map((item) => item.credentialId)).size === credentials.length);
+		const value = yield* Schema.decodeUnknownEffect(Schema.toType(OAuthAccountRevision))({
+			subjectId: yield* mapping.subjectId.toSubject(nativeId),
+			securityRevision: subjectRow[mapping.subject.securityRevision],
+			credentials
+		});
+		return {
+			...value,
+			credentials: [...value.credentials].sort((left, right) => left.credentialId.localeCompare(right.credentialId))
+		};
+	});
+	const captureSubject = Effect.fnUntraced(function* (subjectId, locking) {
+		const nativeId = yield* mapping.subjectId.toNative(subjectId);
+		const rows = yield* sql`select ${subject.fields("s_")}, ${now} as engine_now from ${subject.name} where ${subject.column(mapping.subject.id)} = ${subject.value(mapping.subject.id, nativeId)} and ${tables.expression(mapping.subject.activeCondition)} limit 2 ${locking ? lock : sql``}`;
+		invariant(rows.length <= 1);
+		if (rows[0] === void 0) return void 0;
+		const row = subject.decode(rows[0], "s_");
+		invariant(mapping.subjectId.equals(row[mapping.subject.id], nativeId));
+		return {
+			nativeId,
+			subject: row,
+			securityRevision: yield* Schema.decodeUnknownEffect(OAuthAccountRevision.fields.securityRevision)(row[mapping.subject.securityRevision]),
+			now: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now))
+		};
+	});
+	return {
+		sql,
+		now,
+		lock,
+		subject,
+		authority,
+		capture: Effect.fnUntraced(function* (subjectId, locking) {
+			const nativeId = yield* mapping.subjectId.toNative(subjectId);
+			if (locking) {
+				const subjects = yield* sql`select ${subject.fields("s_")}, ${now} as engine_now from ${subject.name}
+        where ${subject.column(mapping.subject.id)} = ${subject.value(mapping.subject.id, nativeId)}
+          and ${tables.expression(mapping.subject.activeCondition)} ${lock}`;
+				if (subjects.length === 0) return void 0;
+				invariant(subjects.length === 1);
+				const subjectRow = subject.decode(subjects[0], "s_");
+				const factors = yield* sql`select ${authority.fields("a_")} from ${authority.name}
+        where ${authority.column(mapping.authority.subjectId)} = ${authority.value(mapping.authority.subjectId, nativeId)}
+          and ${tables.expression(mapping.authority.activeCondition)}
+        order by ${authority.column(mapping.authority.credentialId)} limit 65 ${lock}`;
+				if (factors.length === 0) return void 0;
+				return {
+					nativeId,
+					subject: subjectRow,
+					revision: yield* revision(subjectRow, factors.map((row) => authority.decode(row, "a_")), nativeId),
+					now: yield* Schema.decodeEffect(Schema.Int)(Number(subjects[0].engine_now))
+				};
+			}
+			const rows = yield* sql`select ${s.fields("s_")}, ${a.fields("a_")}, ${now} as engine_now
+      from ${active("subject", "oauth_subject")}
+      join ${active("authority", "oauth_authority")} on
+        ${a.column(mapping.authority.subjectId)} = ${a.value(mapping.authority.subjectId, nativeId)}
+      where ${s.column(mapping.subject.id)} = ${s.value(mapping.subject.id, nativeId)}
+      order by ${a.column(mapping.authority.credentialId)} limit 65`;
+			if (rows.length === 0) return void 0;
+			const subjectRow = s.decode(rows[0], "s_");
+			return {
+				nativeId,
+				subject: subjectRow,
+				revision: yield* revision(subjectRow, rows.map((row) => a.decode(row, "a_")), nativeId),
+				now: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now))
+			};
+		}),
+		captureSubject,
+		revision
+	};
+});
+const makeOAuthNativeState = Effect.fnUntraced(function* (tables, mapping) {
+	const state = yield* makeOAuthNativeAuthority(tables, mapping);
+	const { sql, subject, authority, revision } = state;
+	const ownership = tables(mapping.ownership.table);
+	const credential = tables(mapping.credential.table);
+	const s = subject.as("oauth_subject");
+	const o = ownership.as("oauth_identity");
+	const c = credential.as("oauth_credential");
+	const a = authority.as("oauth_authority");
+	const exact = (left, right) => exactSqlText(sql, left, right);
+	const active = (kind, alias) => {
+		const descriptor = mapping[kind];
+		const physical = tables(descriptor.table);
+		return sql`(select * from ${physical.name} where ${tables.expression(descriptor.activeCondition)}) as ${sql(alias)}`;
+	};
+	const joinedIds = ownership.unencodedTextColumn?.(mapping.ownership.subjectId) !== void 0 && subject.unencodedTextColumn?.(mapping.subject.id) !== void 0 && credential.unencodedTextColumn?.(mapping.credential.subjectId) !== void 0 && authority.unencodedTextColumn?.(mapping.authority.subjectId) !== void 0;
+	const decodeSnapshot = Effect.fnUntraced(function* (rows, moduleId, nativeId) {
+		if (rows.length === 0) return void 0;
+		const owned = o.decode(rows[0], "o_");
+		const identity = yield* Schema.decodeUnknownEffect(OAuthExternalIdentity)({
+			provider: owned[mapping.ownership.provider],
+			issuer: owned[mapping.ownership.issuer],
+			subject: owned[mapping.ownership.externalSubject]
+		});
+		const identityKey = yield* oauthIdentityKey(identity);
+		invariant(owned[mapping.ownership.identityKey] === identityKey);
+		const ownerId = mapping.ownership.decodeSubjectId(owned);
+		if (nativeId !== void 0) invariant(mapping.subjectId.equals(ownerId, nativeId));
+		const login = c.decode(rows[0], "c_");
+		invariant(mapping.subjectId.equals(login[mapping.credential.subjectId], ownerId));
+		invariant(login[mapping.credential.identityKey] === identityKey);
+		invariant(mapping.credential.isActiveStatus(login[mapping.credential.status]));
+		const current = yield* revision(s.decode(rows[0], "s_"), rows.map((row) => a.decode(row, "a_")), ownerId);
+		const credentialId = login[mapping.credential.credentialId];
+		const credentialRevision = login[mapping.credential.credentialRevision];
+		if (!current.credentials.some((item) => item.credentialId === credentialId && item.revision === credentialRevision)) return void 0;
+		return yield* Schema.decodeUnknownEffect(Schema.toType(OAuthCredentialSnapshot))({
+			moduleId,
+			identity,
+			credentialId,
+			credentialRevision,
+			revision: current,
+			requirement: mapping.subject.decodeAuthenticationRequirement(s.decode(rows[0], "s_"))
+		});
+	});
+	const resolve = Effect.fnUntraced(function* (moduleId, identity) {
+		const identityKey = yield* oauthIdentityKey(identity);
+		let nativeId;
+		if (!joinedIds) {
+			const found = yield* sql`select ${ownership.fields("o_")} from ${ownership.name}
+        where ${exact(ownership.column(mapping.ownership.identityKey), ownership.value(mapping.ownership.identityKey, identityKey))}`;
+			if (found.length === 0) return void 0;
+			invariant(found.length === 1);
+			const row = ownership.decode(found[0], "o_");
+			invariant(row[mapping.ownership.provider] === identity.provider && row[mapping.ownership.issuer] === identity.issuer && row[mapping.ownership.externalSubject] === identity.subject);
+			nativeId = mapping.ownership.decodeSubjectId(row);
+		}
+		const bindOwner = (table, key) => joinedIds ? exact(table.column(key), o.column(mapping.ownership.subjectId)) : sql`${table.column(key)} = ${table.value(key, nativeId)}`;
+		const rows = yield* sql`select ${o.fields("o_")}, ${s.fields("s_")}, ${c.fields("c_")}, ${a.fields("a_")}
+      from ${o.name}
+      join ${active("subject", "oauth_subject")} on ${bindOwner(s, mapping.subject.id)}
+      join ${active("credential", "oauth_credential")} on ${bindOwner(c, mapping.credential.subjectId)}
+        and ${exact(c.column(mapping.credential.moduleId), c.value(mapping.credential.moduleId, moduleId))}
+        and ${exact(c.column(mapping.credential.identityKey), c.value(mapping.credential.identityKey, identityKey))}
+      join ${active("authority", "oauth_authority")} on ${bindOwner(a, mapping.authority.subjectId)}
+      where ${exact(o.column(mapping.ownership.identityKey), o.value(mapping.ownership.identityKey, identityKey))}
+      order by ${a.column(mapping.authority.credentialId)} limit 65`;
+		const result = yield* decodeSnapshot(rows, moduleId, joinedIds ? void 0 : nativeId);
+		if (result !== void 0) invariant(result.identity.provider === identity.provider && result.identity.issuer === identity.issuer && result.identity.subject === identity.subject);
+		return result;
+	});
+	const readCredential = Effect.fnUntraced(function* (input) {
+		const nativeId = yield* mapping.subjectId.toNative(input.subjectId);
+		let identityKey;
+		const direct = credential.unencodedTextColumn?.(mapping.credential.identityKey) !== void 0 && ownership.unencodedTextColumn?.(mapping.ownership.identityKey) !== void 0;
+		if (!direct) {
+			const selected = yield* sql`select ${credential.fields("c_")} from ${credential.name}
+        where ${exact(credential.column(mapping.credential.moduleId), credential.value(mapping.credential.moduleId, input.moduleId))}
+          and ${exact(credential.column(mapping.credential.credentialId), credential.value(mapping.credential.credentialId, input.credentialId))}
+          and ${credential.column(mapping.credential.subjectId)} = ${credential.value(mapping.credential.subjectId, nativeId)}`;
+			if (selected.length === 0) return void 0;
+			invariant(selected.length === 1);
+			identityKey = credential.decode(selected[0], "c_")[mapping.credential.identityKey];
+		}
+		const owner = (table, key) => sql`${table.column(key)} = ${table.value(key, nativeId)}`;
+		const rows = yield* sql`select ${o.fields("o_")}, ${s.fields("s_")}, ${c.fields("c_")}, ${a.fields("a_")}
+      from ${active("credential", "oauth_credential")}
+      join ${o.name} on ${direct ? exact(o.column(mapping.ownership.identityKey), c.column(mapping.credential.identityKey)) : exact(o.column(mapping.ownership.identityKey), o.value(mapping.ownership.identityKey, identityKey))}
+        and ${owner(o, mapping.ownership.subjectId)}
+      join ${active("subject", "oauth_subject")} on ${owner(s, mapping.subject.id)}
+      join ${active("authority", "oauth_authority")} on ${owner(a, mapping.authority.subjectId)}
+      where ${owner(c, mapping.credential.subjectId)}
+        and ${exact(c.column(mapping.credential.moduleId), c.value(mapping.credential.moduleId, input.moduleId))}
+        and ${exact(c.column(mapping.credential.credentialId), c.value(mapping.credential.credentialId, input.credentialId))}
+      order by ${a.column(mapping.authority.credentialId)} limit 65`;
+		return yield* decodeSnapshot(rows, input.moduleId, nativeId);
+	});
+	return {
+		...state,
+		ownership,
+		credential,
+		resolve,
+		readCredential
+	};
+});
+//#endregion
+export { makeOAuthNativeAuthority, makeOAuthNativeState };
+
+//# sourceMappingURL=native-state.mjs.map

package/dist/internal/oauth/native-state.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-state.mjs","names":[],"sources":["../../../src/internal/oauth/native-state.ts"],"sourcesContent":["import {\n  OAuthAccountRevision,\n  OAuthCredentialSnapshot,\n  OAuthExternalIdentity,\n  type OAuthCredentialKey,\n} from \"@yielded/auth/OAuth\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport { Effect, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport type { OAuthSignInMapping } from \"../models/oauth-model\";\nimport type { NativeSqlTables } from \"../native-sql-table\";\nimport { exactSqlText } from \"../sql-change\";\nimport type { SqlExpression, TableModel } from \"../table-model\";\nimport { invariant, oauthIdentityKey } from \"./state\";\n\n// Expression handles are checked by the physical compiler, not domain codecs.\nexport type OAuthNativeReadMapping = OAuthSignInMapping<\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  TableModel,\n  unknown,\n  SqlExpression\n>;\n\ntype Row = Readonly<Record<string, unknown>>;\n\n/** Unlocked snapshots and explicit subject-first reads share decoding rules.\n * No observation registry or discovered-identity placeholder is retained. */\nexport const makeOAuthNativeAuthority = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: Pick<OAuthNativeReadMapping, \"subject\" | \"authority\" | \"subjectId\" | \"clock\">,\n) {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n  const subject = tables(mapping.subject.table);\n  const authority = tables(mapping.authority.table);\n  const s = subject.as(\"oauth_subject\");\n  const a = authority.as(\"oauth_authority\");\n  const now = tables.expression(mapping.clock.engineNowMillis);\n\n  const lock = sql.onDialectOrElse({\n    pg: () => sql`for update`,\n    mysql: () => sql`for update`,\n    orElse: () => sql``,\n  });\n\n  const active = (kind: \"subject\" | \"authority\", alias: string) => {\n    const descriptor = mapping[kind];\n    const physical = tables(descriptor.table);\n\n    return sql`(select * from ${physical.name} where ${tables.expression(descriptor.activeCondition)}) as ${sql(alias)}`;\n  };\n\n  const revision = Effect.fnUntraced(function* (\n    subjectRow: Row,\n    factors: ReadonlyArray<Row>,\n    nativeId: unknown,\n  ) {\n    invariant(mapping.subject.isActiveStatus(subjectRow[mapping.subject.status]));\n    invariant(mapping.subjectId.equals(subjectRow[mapping.subject.id], nativeId));\n    invariant(factors.length > 0 && factors.length <= 64);\n    invariant(\n      factors.every(\n        (row) =>\n          mapping.subjectId.equals(row[mapping.authority.subjectId], nativeId) &&\n          mapping.authority.isActiveStatus(row[mapping.authority.status]),\n      ),\n    );\n\n    const credentials = factors.map((row) => ({\n      credentialId: row[mapping.authority.credentialId],\n      revision: row[mapping.authority.revision],\n    }));\n\n    invariant(new Set(credentials.map((item) => item.credentialId)).size === credentials.length);\n\n    const value = yield* Schema.decodeUnknownEffect(Schema.toType(OAuthAccountRevision))({\n      subjectId: yield* mapping.subjectId.toSubject(nativeId),\n      securityRevision: subjectRow[mapping.subject.securityRevision],\n      credentials,\n    });\n\n    return {\n      ...value,\n      credentials: [...value.credentials].sort((left, right) =>\n        left.credentialId.localeCompare(right.credentialId),\n      ),\n    };\n  });\n\n  const captureSubject = Effect.fnUntraced(function* (subjectId: SubjectId, locking: boolean) {\n    const nativeId = yield* mapping.subjectId.toNative(subjectId);\n\n    const rows =\n      yield* sql`select ${subject.fields(\"s_\")}, ${now} as engine_now from ${subject.name} where ${subject.column(mapping.subject.id)} = ${subject.value(mapping.subject.id, nativeId)} and ${tables.expression(mapping.subject.activeCondition)} limit 2 ${locking ? lock : sql``}`;\n\n    invariant(rows.length <= 1);\n    if (rows[0] === undefined) return undefined;\n    const row = subject.decode(rows[0], \"s_\");\n\n    invariant(mapping.subjectId.equals(row[mapping.subject.id], nativeId));\n\n    return {\n      nativeId,\n      subject: row,\n      securityRevision: yield* Schema.decodeUnknownEffect(\n        OAuthAccountRevision.fields.securityRevision,\n      )(row[mapping.subject.securityRevision]),\n      now: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0].engine_now)),\n    };\n  });\n\n  const capture = Effect.fnUntraced(function* (subjectId: SubjectId, locking: boolean) {\n    const nativeId = yield* mapping.subjectId.toNative(subjectId);\n\n    if (locking) {\n      // Never acquire a credential, identity, flow or policy lock before this.\n      const subjects =\n        yield* sql`select ${subject.fields(\"s_\")}, ${now} as engine_now from ${subject.name}\n        where ${subject.column(mapping.subject.id)} = ${subject.value(mapping.subject.id, nativeId)}\n          and ${tables.expression(mapping.subject.activeCondition)} ${lock}`;\n\n      if (subjects.length === 0) return undefined;\n      invariant(subjects.length === 1);\n      const subjectRow = subject.decode(subjects[0]!, \"s_\");\n\n      const factors = yield* sql`select ${authority.fields(\"a_\")} from ${authority.name}\n        where ${authority.column(mapping.authority.subjectId)} = ${authority.value(mapping.authority.subjectId, nativeId)}\n          and ${tables.expression(mapping.authority.activeCondition)}\n        order by ${authority.column(mapping.authority.credentialId)} limit 65 ${lock}`;\n\n      if (factors.length === 0) return undefined;\n\n      return {\n        nativeId,\n        subject: subjectRow,\n        revision: yield* revision(\n          subjectRow,\n          factors.map((row) => authority.decode(row, \"a_\")),\n          nativeId,\n        ),\n        now: yield* Schema.decodeEffect(Schema.Int)(Number(subjects[0]!.engine_now)),\n      };\n    }\n\n    // Bind each column's own native codec; the columns need not share an encoding.\n    const rows = yield* sql`select ${s.fields(\"s_\")}, ${a.fields(\"a_\")}, ${now} as engine_now\n      from ${active(\"subject\", \"oauth_subject\")}\n      join ${active(\"authority\", \"oauth_authority\")} on\n        ${a.column(mapping.authority.subjectId)} = ${a.value(mapping.authority.subjectId, nativeId)}\n      where ${s.column(mapping.subject.id)} = ${s.value(mapping.subject.id, nativeId)}\n      order by ${a.column(mapping.authority.credentialId)} limit 65`;\n\n    if (rows.length === 0) return undefined;\n    const subjectRow = s.decode(rows[0]!, \"s_\");\n\n    return {\n      nativeId,\n      subject: subjectRow,\n      revision: yield* revision(\n        subjectRow,\n        rows.map((row) => a.decode(row, \"a_\")),\n        nativeId,\n      ),\n      now: yield* Schema.decodeEffect(Schema.Int)(Number(rows[0]!.engine_now)),\n    };\n  });\n\n  return { sql, now, lock, subject, authority, capture, captureSubject, revision };\n});\n\nexport const makeOAuthNativeState = Effect.fnUntraced(function* (\n  tables: NativeSqlTables,\n  mapping: OAuthNativeReadMapping,\n) {\n  const state = yield* makeOAuthNativeAuthority(tables, mapping);\n  const { sql, subject, authority, revision } = state;\n  const ownership = tables(mapping.ownership.table);\n  const credential = tables(mapping.credential.table);\n  const s = subject.as(\"oauth_subject\");\n  const o = ownership.as(\"oauth_identity\");\n  const c = credential.as(\"oauth_credential\");\n  const a = authority.as(\"oauth_authority\");\n\n  const exact = (\n    left: Parameters<typeof exactSqlText>[1],\n    right: Parameters<typeof exactSqlText>[2],\n  ) => exactSqlText(sql, left, right);\n\n  const active = (kind: \"subject\" | \"credential\" | \"authority\", alias: string) => {\n    const descriptor = mapping[kind];\n    const physical = tables(descriptor.table);\n\n    return sql`(select * from ${physical.name} where ${tables.expression(descriptor.activeCondition)}) as ${sql(alias)}`;\n  };\n\n  const joinedIds =\n    ownership.unencodedTextColumn?.(mapping.ownership.subjectId) !== undefined &&\n    subject.unencodedTextColumn?.(mapping.subject.id) !== undefined &&\n    credential.unencodedTextColumn?.(mapping.credential.subjectId) !== undefined &&\n    authority.unencodedTextColumn?.(mapping.authority.subjectId) !== undefined;\n\n  const decodeSnapshot = Effect.fnUntraced(function* (\n    rows: ReadonlyArray<Row>,\n    moduleId: string,\n    nativeId?: unknown,\n  ) {\n    if (rows.length === 0) return undefined;\n    const owned = o.decode(rows[0]!, \"o_\");\n\n    const identity = yield* Schema.decodeUnknownEffect(OAuthExternalIdentity)({\n      provider: owned[mapping.ownership.provider],\n      issuer: owned[mapping.ownership.issuer],\n      subject: owned[mapping.ownership.externalSubject],\n    });\n\n    const identityKey = yield* oauthIdentityKey(identity);\n\n    invariant(owned[mapping.ownership.identityKey] === identityKey);\n    const ownerId = mapping.ownership.decodeSubjectId(owned);\n\n    if (nativeId !== undefined) invariant(mapping.subjectId.equals(ownerId, nativeId));\n    const login = c.decode(rows[0]!, \"c_\");\n\n    invariant(mapping.subjectId.equals(login[mapping.credential.subjectId], ownerId));\n    invariant(login[mapping.credential.identityKey] === identityKey);\n    invariant(mapping.credential.isActiveStatus(login[mapping.credential.status]));\n\n    const current = yield* revision(\n      s.decode(rows[0]!, \"s_\"),\n      rows.map((row) => a.decode(row, \"a_\")),\n      ownerId,\n    );\n\n    const credentialId = login[mapping.credential.credentialId];\n    const credentialRevision = login[mapping.credential.credentialRevision];\n\n    if (\n      !current.credentials.some(\n        (item) => item.credentialId === credentialId && item.revision === credentialRevision,\n      )\n    )\n      return undefined;\n\n    return yield* Schema.decodeUnknownEffect(Schema.toType(OAuthCredentialSnapshot))({\n      moduleId,\n      identity,\n      credentialId,\n      credentialRevision,\n      revision: current,\n      requirement: mapping.subject.decodeAuthenticationRequirement(s.decode(rows[0]!, \"s_\")),\n    });\n  });\n\n  const resolve = Effect.fnUntraced(function* (\n    moduleId: string,\n    identity: typeof OAuthExternalIdentity.Type,\n  ) {\n    const identityKey = yield* oauthIdentityKey(identity);\n    let nativeId: unknown;\n\n    if (!joinedIds) {\n      const found = yield* sql`select ${ownership.fields(\"o_\")} from ${ownership.name}\n        where ${exact(ownership.column(mapping.ownership.identityKey), ownership.value(mapping.ownership.identityKey, identityKey))}`;\n\n      if (found.length === 0) return undefined;\n      invariant(found.length === 1);\n      const row = ownership.decode(found[0]!, \"o_\");\n\n      invariant(\n        row[mapping.ownership.provider] === identity.provider &&\n          row[mapping.ownership.issuer] === identity.issuer &&\n          row[mapping.ownership.externalSubject] === identity.subject,\n      );\n      nativeId = mapping.ownership.decodeSubjectId(row);\n    }\n\n    const bindOwner = (table: typeof s, key: string) =>\n      joinedIds\n        ? exact(table.column(key), o.column(mapping.ownership.subjectId))\n        : sql`${table.column(key)} = ${table.value(key, nativeId)}`;\n\n    const rows =\n      yield* sql`select ${o.fields(\"o_\")}, ${s.fields(\"s_\")}, ${c.fields(\"c_\")}, ${a.fields(\"a_\")}\n      from ${o.name}\n      join ${active(\"subject\", \"oauth_subject\")} on ${bindOwner(s, mapping.subject.id)}\n      join ${active(\"credential\", \"oauth_credential\")} on ${bindOwner(c, mapping.credential.subjectId)}\n        and ${exact(c.column(mapping.credential.moduleId), c.value(mapping.credential.moduleId, moduleId))}\n        and ${exact(c.column(mapping.credential.identityKey), c.value(mapping.credential.identityKey, identityKey))}\n      join ${active(\"authority\", \"oauth_authority\")} on ${bindOwner(a, mapping.authority.subjectId)}\n      where ${exact(o.column(mapping.ownership.identityKey), o.value(mapping.ownership.identityKey, identityKey))}\n      order by ${a.column(mapping.authority.credentialId)} limit 65`;\n\n    const result = yield* decodeSnapshot(rows, moduleId, joinedIds ? undefined : nativeId);\n\n    if (result !== undefined)\n      invariant(\n        result.identity.provider === identity.provider &&\n          result.identity.issuer === identity.issuer &&\n          result.identity.subject === identity.subject,\n      );\n\n    return result;\n  });\n\n  const readCredential = Effect.fnUntraced(function* (input: typeof OAuthCredentialKey.Type) {\n    const nativeId = yield* mapping.subjectId.toNative(input.subjectId);\n    let identityKey: unknown;\n\n    const direct =\n      credential.unencodedTextColumn?.(mapping.credential.identityKey) !== undefined &&\n      ownership.unencodedTextColumn?.(mapping.ownership.identityKey) !== undefined;\n\n    if (!direct) {\n      const selected = yield* sql`select ${credential.fields(\"c_\")} from ${credential.name}\n        where ${exact(credential.column(mapping.credential.moduleId), credential.value(mapping.credential.moduleId, input.moduleId))}\n          and ${exact(credential.column(mapping.credential.credentialId), credential.value(mapping.credential.credentialId, input.credentialId))}\n          and ${credential.column(mapping.credential.subjectId)} = ${credential.value(mapping.credential.subjectId, nativeId)}`;\n\n      if (selected.length === 0) return undefined;\n      invariant(selected.length === 1);\n      identityKey = credential.decode(selected[0]!, \"c_\")[mapping.credential.identityKey];\n    }\n\n    const owner = (table: typeof s, key: string) =>\n      sql`${table.column(key)} = ${table.value(key, nativeId)}`;\n\n    const rows =\n      yield* sql`select ${o.fields(\"o_\")}, ${s.fields(\"s_\")}, ${c.fields(\"c_\")}, ${a.fields(\"a_\")}\n      from ${active(\"credential\", \"oauth_credential\")}\n      join ${o.name} on ${direct ? exact(o.column(mapping.ownership.identityKey), c.column(mapping.credential.identityKey)) : exact(o.column(mapping.ownership.identityKey), o.value(mapping.ownership.identityKey, identityKey))}\n        and ${owner(o, mapping.ownership.subjectId)}\n      join ${active(\"subject\", \"oauth_subject\")} on ${owner(s, mapping.subject.id)}\n      join ${active(\"authority\", \"oauth_authority\")} on ${owner(a, mapping.authority.subjectId)}\n      where ${owner(c, mapping.credential.subjectId)}\n        and ${exact(c.column(mapping.credential.moduleId), c.value(mapping.credential.moduleId, input.moduleId))}\n        and ${exact(c.column(mapping.credential.credentialId), c.value(mapping.credential.credentialId, input.credentialId))}\n      order by ${a.column(mapping.authority.credentialId)} limit 65`;\n\n    return yield* decodeSnapshot(rows, input.moduleId, nativeId);\n  });\n\n  return { ...state, ownership, credential, resolve, readCredential };\n});\n"],"mappings":";;;;;;;;AA+BA,MAAa,2BAA2B,OAAO,WAAW,WACxD,QACA,SACA;CACA,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAC3D,MAAM,UAAU,OAAO,QAAQ,QAAQ,KAAK;CAC5C,MAAM,YAAY,OAAO,QAAQ,UAAU,KAAK;CAChD,MAAM,IAAI,QAAQ,GAAG,eAAe;CACpC,MAAM,IAAI,UAAU,GAAG,iBAAiB;CACxC,MAAM,MAAM,OAAO,WAAW,QAAQ,MAAM,eAAe;CAE3D,MAAM,OAAO,IAAI,gBAAgB;EAC/B,UAAU,GAAG;EACb,aAAa,GAAG;EAChB,cAAc,GAAG;CACnB,CAAC;CAED,MAAM,UAAU,MAA+B,UAAkB;EAC/D,MAAM,aAAa,QAAQ;EAC3B,MAAM,WAAW,OAAO,WAAW,KAAK;EAExC,OAAO,GAAG,kBAAkB,SAAS,KAAK,SAAS,OAAO,WAAW,WAAW,eAAe,EAAE,OAAO,IAAI,KAAK;CACnH;CAEA,MAAM,WAAW,OAAO,WAAW,WACjC,YACA,SACA,UACA;EACA,UAAU,QAAQ,QAAQ,eAAe,WAAW,QAAQ,QAAQ,OAAO,CAAC;EAC5E,UAAU,QAAQ,UAAU,OAAO,WAAW,QAAQ,QAAQ,KAAK,QAAQ,CAAC;EAC5E,UAAU,QAAQ,SAAS,KAAK,QAAQ,UAAU,EAAE;EACpD,UACE,QAAQ,OACL,QACC,QAAQ,UAAU,OAAO,IAAI,QAAQ,UAAU,YAAY,QAAQ,KACnE,QAAQ,UAAU,eAAe,IAAI,QAAQ,UAAU,OAAO,CAClE,CACF;EAEA,MAAM,cAAc,QAAQ,KAAK,SAAS;GACxC,cAAc,IAAI,QAAQ,UAAU;GACpC,UAAU,IAAI,QAAQ,UAAU;EAClC,EAAE;EAEF,UAAU,IAAI,IAAI,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,YAAY,MAAM;EAE3F,MAAM,QAAQ,OAAO,OAAO,oBAAoB,OAAO,OAAO,oBAAoB,CAAC,CAAC,CAAC;GACnF,WAAW,OAAO,QAAQ,UAAU,UAAU,QAAQ;GACtD,kBAAkB,WAAW,QAAQ,QAAQ;GAC7C;EACF,CAAC;EAED,OAAO;GACL,GAAG;GACH,aAAa,CAAC,GAAG,MAAM,WAAW,CAAC,CAAC,MAAM,MAAM,UAC9C,KAAK,aAAa,cAAc,MAAM,YAAY,CACpD;EACF;CACF,CAAC;CAED,MAAM,iBAAiB,OAAO,WAAW,WAAW,WAAsB,SAAkB;EAC1F,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,SAAS;EAE5D,MAAM,OACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,IAAI,sBAAsB,QAAQ,KAAK,SAAS,QAAQ,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE,OAAO,OAAO,WAAW,QAAQ,QAAQ,eAAe,EAAE,WAAW,UAAU,OAAO,GAAG;EAE5Q,UAAU,KAAK,UAAU,CAAC;EAC1B,IAAI,KAAK,OAAO,KAAA,GAAW,OAAO,KAAA;EAClC,MAAM,MAAM,QAAQ,OAAO,KAAK,IAAI,IAAI;EAExC,UAAU,QAAQ,UAAU,OAAO,IAAI,QAAQ,QAAQ,KAAK,QAAQ,CAAC;EAErE,OAAO;GACL;GACA,SAAS;GACT,kBAAkB,OAAO,OAAO,oBAC9B,qBAAqB,OAAO,gBAC9B,CAAC,CAAC,IAAI,QAAQ,QAAQ,iBAAiB;GACvC,KAAK,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,UAAU,CAAC;EACxE;CACF,CAAC;CA0DD,OAAO;EAAE;EAAK;EAAK;EAAM;EAAS;EAAW,SAxD7B,OAAO,WAAW,WAAW,WAAsB,SAAkB;GACnF,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,SAAS;GAE5D,IAAI,SAAS;IAEX,MAAM,WACJ,OAAO,GAAG,UAAU,QAAQ,OAAO,IAAI,EAAE,IAAI,IAAI,sBAAsB,QAAQ,KAAK;gBAC5E,QAAQ,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,QAAQ,MAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE;gBACpF,OAAO,WAAW,QAAQ,QAAQ,eAAe,EAAE,GAAG;IAEhE,IAAI,SAAS,WAAW,GAAG,OAAO,KAAA;IAClC,UAAU,SAAS,WAAW,CAAC;IAC/B,MAAM,aAAa,QAAQ,OAAO,SAAS,IAAK,IAAI;IAEpD,MAAM,UAAU,OAAO,GAAG,UAAU,UAAU,OAAO,IAAI,EAAE,QAAQ,UAAU,KAAK;gBACxE,UAAU,OAAO,QAAQ,UAAU,SAAS,EAAE,KAAK,UAAU,MAAM,QAAQ,UAAU,WAAW,QAAQ,EAAE;gBAC1G,OAAO,WAAW,QAAQ,UAAU,eAAe,EAAE;mBAClD,UAAU,OAAO,QAAQ,UAAU,YAAY,EAAE,YAAY;IAE1E,IAAI,QAAQ,WAAW,GAAG,OAAO,KAAA;IAEjC,OAAO;KACL;KACA,SAAS;KACT,UAAU,OAAO,SACf,YACA,QAAQ,KAAK,QAAQ,UAAU,OAAO,KAAK,IAAI,CAAC,GAChD,QACF;KACA,KAAK,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,SAAS,EAAE,CAAE,UAAU,CAAC;IAC7E;GACF;GAGA,MAAM,OAAO,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,IAAI;aAClE,OAAO,WAAW,eAAe,EAAE;aACnC,OAAO,aAAa,iBAAiB,EAAE;UAC1C,EAAE,OAAO,QAAQ,UAAU,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,UAAU,WAAW,QAAQ,EAAE;cACtF,EAAE,OAAO,QAAQ,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,QAAQ,QAAQ,IAAI,QAAQ,EAAE;iBACrE,EAAE,OAAO,QAAQ,UAAU,YAAY,EAAE;GAEtD,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;GAC9B,MAAM,aAAa,EAAE,OAAO,KAAK,IAAK,IAAI;GAE1C,OAAO;IACL;IACA,SAAS;IACT,UAAU,OAAO,SACf,YACA,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,GACrC,QACF;IACA,KAAK,OAAO,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,EAAE,CAAE,UAAU,CAAC;GACzE;EACF,CAEmD;EAAG;EAAgB;CAAS;AACjF,CAAC;AAED,MAAa,uBAAuB,OAAO,WAAW,WACpD,QACA,SACA;CACA,MAAM,QAAQ,OAAO,yBAAyB,QAAQ,OAAO;CAC7D,MAAM,EAAE,KAAK,SAAS,WAAW,aAAa;CAC9C,MAAM,YAAY,OAAO,QAAQ,UAAU,KAAK;CAChD,MAAM,aAAa,OAAO,QAAQ,WAAW,KAAK;CAClD,MAAM,IAAI,QAAQ,GAAG,eAAe;CACpC,MAAM,IAAI,UAAU,GAAG,gBAAgB;CACvC,MAAM,IAAI,WAAW,GAAG,kBAAkB;CAC1C,MAAM,IAAI,UAAU,GAAG,iBAAiB;CAExC,MAAM,SACJ,MACA,UACG,aAAa,KAAK,MAAM,KAAK;CAElC,MAAM,UAAU,MAA8C,UAAkB;EAC9E,MAAM,aAAa,QAAQ;EAC3B,MAAM,WAAW,OAAO,WAAW,KAAK;EAExC,OAAO,GAAG,kBAAkB,SAAS,KAAK,SAAS,OAAO,WAAW,WAAW,eAAe,EAAE,OAAO,IAAI,KAAK;CACnH;CAEA,MAAM,YACJ,UAAU,sBAAsB,QAAQ,UAAU,SAAS,MAAM,KAAA,KACjE,QAAQ,sBAAsB,QAAQ,QAAQ,EAAE,MAAM,KAAA,KACtD,WAAW,sBAAsB,QAAQ,WAAW,SAAS,MAAM,KAAA,KACnE,UAAU,sBAAsB,QAAQ,UAAU,SAAS,MAAM,KAAA;CAEnE,MAAM,iBAAiB,OAAO,WAAW,WACvC,MACA,UACA,UACA;EACA,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAC9B,MAAM,QAAQ,EAAE,OAAO,KAAK,IAAK,IAAI;EAErC,MAAM,WAAW,OAAO,OAAO,oBAAoB,qBAAqB,CAAC,CAAC;GACxE,UAAU,MAAM,QAAQ,UAAU;GAClC,QAAQ,MAAM,QAAQ,UAAU;GAChC,SAAS,MAAM,QAAQ,UAAU;EACnC,CAAC;EAED,MAAM,cAAc,OAAO,iBAAiB,QAAQ;EAEpD,UAAU,MAAM,QAAQ,UAAU,iBAAiB,WAAW;EAC9D,MAAM,UAAU,QAAQ,UAAU,gBAAgB,KAAK;EAEvD,IAAI,aAAa,KAAA,GAAW,UAAU,QAAQ,UAAU,OAAO,SAAS,QAAQ,CAAC;EACjF,MAAM,QAAQ,EAAE,OAAO,KAAK,IAAK,IAAI;EAErC,UAAU,QAAQ,UAAU,OAAO,MAAM,QAAQ,WAAW,YAAY,OAAO,CAAC;EAChF,UAAU,MAAM,QAAQ,WAAW,iBAAiB,WAAW;EAC/D,UAAU,QAAQ,WAAW,eAAe,MAAM,QAAQ,WAAW,OAAO,CAAC;EAE7E,MAAM,UAAU,OAAO,SACrB,EAAE,OAAO,KAAK,IAAK,IAAI,GACvB,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,GACrC,OACF;EAEA,MAAM,eAAe,MAAM,QAAQ,WAAW;EAC9C,MAAM,qBAAqB,MAAM,QAAQ,WAAW;EAEpD,IACE,CAAC,QAAQ,YAAY,MAClB,SAAS,KAAK,iBAAiB,gBAAgB,KAAK,aAAa,kBACpE,GAEA,OAAO,KAAA;EAET,OAAO,OAAO,OAAO,oBAAoB,OAAO,OAAO,uBAAuB,CAAC,CAAC,CAAC;GAC/E;GACA;GACA;GACA;GACA,UAAU;GACV,aAAa,QAAQ,QAAQ,gCAAgC,EAAE,OAAO,KAAK,IAAK,IAAI,CAAC;EACvF,CAAC;CACH,CAAC;CAED,MAAM,UAAU,OAAO,WAAW,WAChC,UACA,UACA;EACA,MAAM,cAAc,OAAO,iBAAiB,QAAQ;EACpD,IAAI;EAEJ,IAAI,CAAC,WAAW;GACd,MAAM,QAAQ,OAAO,GAAG,UAAU,UAAU,OAAO,IAAI,EAAE,QAAQ,UAAU,KAAK;gBACtE,MAAM,UAAU,OAAO,QAAQ,UAAU,WAAW,GAAG,UAAU,MAAM,QAAQ,UAAU,aAAa,WAAW,CAAC;GAE5H,IAAI,MAAM,WAAW,GAAG,OAAO,KAAA;GAC/B,UAAU,MAAM,WAAW,CAAC;GAC5B,MAAM,MAAM,UAAU,OAAO,MAAM,IAAK,IAAI;GAE5C,UACE,IAAI,QAAQ,UAAU,cAAc,SAAS,YAC3C,IAAI,QAAQ,UAAU,YAAY,SAAS,UAC3C,IAAI,QAAQ,UAAU,qBAAqB,SAAS,OACxD;GACA,WAAW,QAAQ,UAAU,gBAAgB,GAAG;EAClD;EAEA,MAAM,aAAa,OAAiB,QAClC,YACI,MAAM,MAAM,OAAO,GAAG,GAAG,EAAE,OAAO,QAAQ,UAAU,SAAS,CAAC,IAC9D,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,QAAQ;EAE5D,MAAM,OACJ,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE;aACrF,EAAE,KAAK;aACP,OAAO,WAAW,eAAe,EAAE,MAAM,UAAU,GAAG,QAAQ,QAAQ,EAAE,EAAE;aAC1E,OAAO,cAAc,kBAAkB,EAAE,MAAM,UAAU,GAAG,QAAQ,WAAW,SAAS,EAAE;cACzF,MAAM,EAAE,OAAO,QAAQ,WAAW,QAAQ,GAAG,EAAE,MAAM,QAAQ,WAAW,UAAU,QAAQ,CAAC,EAAE;cAC7F,MAAM,EAAE,OAAO,QAAQ,WAAW,WAAW,GAAG,EAAE,MAAM,QAAQ,WAAW,aAAa,WAAW,CAAC,EAAE;aACvG,OAAO,aAAa,iBAAiB,EAAE,MAAM,UAAU,GAAG,QAAQ,UAAU,SAAS,EAAE;cACtF,MAAM,EAAE,OAAO,QAAQ,UAAU,WAAW,GAAG,EAAE,MAAM,QAAQ,UAAU,aAAa,WAAW,CAAC,EAAE;iBACjG,EAAE,OAAO,QAAQ,UAAU,YAAY,EAAE;EAEtD,MAAM,SAAS,OAAO,eAAe,MAAM,UAAU,YAAY,KAAA,IAAY,QAAQ;EAErF,IAAI,WAAW,KAAA,GACb,UACE,OAAO,SAAS,aAAa,SAAS,YACpC,OAAO,SAAS,WAAW,SAAS,UACpC,OAAO,SAAS,YAAY,SAAS,OACzC;EAEF,OAAO;CACT,CAAC;CAED,MAAM,iBAAiB,OAAO,WAAW,WAAW,OAAuC;EACzF,MAAM,WAAW,OAAO,QAAQ,UAAU,SAAS,MAAM,SAAS;EAClE,IAAI;EAEJ,MAAM,SACJ,WAAW,sBAAsB,QAAQ,WAAW,WAAW,MAAM,KAAA,KACrE,UAAU,sBAAsB,QAAQ,UAAU,WAAW,MAAM,KAAA;EAErE,IAAI,CAAC,QAAQ;GACX,MAAM,WAAW,OAAO,GAAG,UAAU,WAAW,OAAO,IAAI,EAAE,QAAQ,WAAW,KAAK;gBAC3E,MAAM,WAAW,OAAO,QAAQ,WAAW,QAAQ,GAAG,WAAW,MAAM,QAAQ,WAAW,UAAU,MAAM,QAAQ,CAAC,EAAE;gBACrH,MAAM,WAAW,OAAO,QAAQ,WAAW,YAAY,GAAG,WAAW,MAAM,QAAQ,WAAW,cAAc,MAAM,YAAY,CAAC,EAAE;gBACjI,WAAW,OAAO,QAAQ,WAAW,SAAS,EAAE,KAAK,WAAW,MAAM,QAAQ,WAAW,WAAW,QAAQ;GAEtH,IAAI,SAAS,WAAW,GAAG,OAAO,KAAA;GAClC,UAAU,SAAS,WAAW,CAAC;GAC/B,cAAc,WAAW,OAAO,SAAS,IAAK,IAAI,CAAC,CAAC,QAAQ,WAAW;EACzE;EAEA,MAAM,SAAS,OAAiB,QAC9B,GAAG,GAAG,MAAM,OAAO,GAAG,EAAE,KAAK,MAAM,MAAM,KAAK,QAAQ;EAExD,MAAM,OACJ,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE;aACrF,OAAO,cAAc,kBAAkB,EAAE;aACzC,EAAE,KAAK,MAAM,SAAS,MAAM,EAAE,OAAO,QAAQ,UAAU,WAAW,GAAG,EAAE,OAAO,QAAQ,WAAW,WAAW,CAAC,IAAI,MAAM,EAAE,OAAO,QAAQ,UAAU,WAAW,GAAG,EAAE,MAAM,QAAQ,UAAU,aAAa,WAAW,CAAC,EAAE;cACpN,MAAM,GAAG,QAAQ,UAAU,SAAS,EAAE;aACvC,OAAO,WAAW,eAAe,EAAE,MAAM,MAAM,GAAG,QAAQ,QAAQ,EAAE,EAAE;aACtE,OAAO,aAAa,iBAAiB,EAAE,MAAM,MAAM,GAAG,QAAQ,UAAU,SAAS,EAAE;cAClF,MAAM,GAAG,QAAQ,WAAW,SAAS,EAAE;cACvC,MAAM,EAAE,OAAO,QAAQ,WAAW,QAAQ,GAAG,EAAE,MAAM,QAAQ,WAAW,UAAU,MAAM,QAAQ,CAAC,EAAE;cACnG,MAAM,EAAE,OAAO,QAAQ,WAAW,YAAY,GAAG,EAAE,MAAM,QAAQ,WAAW,cAAc,MAAM,YAAY,CAAC,EAAE;iBAC5G,EAAE,OAAO,QAAQ,UAAU,YAAY,EAAE;EAEtD,OAAO,OAAO,eAAe,MAAM,MAAM,UAAU,QAAQ;CAC7D,CAAC;CAED,OAAO;EAAE,GAAG;EAAO;EAAW;EAAY;EAAS;CAAe;AACpE,CAAC"}

package/dist/internal/oauth/state.d.mts

@@ -0,0 +1,10 @@
+import "../crypto.mjs";
+import { Crypto, Effect, Schema } from "effect";
+import { AuthenticationRequirement } from "@yielded/auth/Sessions";
+import { OAuthAccountRevision, OAuthExternalIdentity, OAuthUnavailable } from "@yielded/auth/OAuth";
+//#region src/internal/oauth/state.d.ts
+/** Capture configuration/callback references while preserving adapter table, SQL
+ * and Effect objects. Never freeze or mutate the consumer's original graph. */
+export declare const captureOAuthMapping: <A>(input: A) => A;
+//#endregion
+//# sourceMappingURL=state.d.mts.map

package/dist/internal/oauth/state.mjs

@@ -1,5 +1,5 @@
-import { digest, randomId } from "../crypto.mjs";
-import { Crypto, DateTime, Effect, Schema } from "effect";
+import "../crypto.mjs";
+import { Crypto, Effect, Schema } from "effect";
 import { Base64Url } from "effect/encoding";
 import { OAuthExternalIdentity, OAuthUnavailable, snapshotOAuthSync } from "@yielded/auth/OAuth";
 //#region src/internal/oauth/state.ts
@@ -9,7 +9,6 @@ const unavailable = () => OAuthUnavailable.make({});
 const invariant = (value) => {
 	if (!value) throw unavailable();
 };
-const nonce = randomId;
 /** Capture configuration/callback references while preserving adapter table, SQL
 * and Effect objects. Never freeze or mutate the consumer's original graph. */
 const captureOAuthMapping = (input) => {
@@ -78,30 +77,7 @@ const satisfies = (proofs, requirement) => {
 	const count = new Set(proofs.map((proof) => proof.credentialId)).size;
 	return requirement.alternatives.some((alternative) => alternative.factors.every((factor) => factors.has(factor)) && count >= alternative.minimumCredentials && proofs.some((proof) => (!alternative.userVerified || proof.userVerified) && (!alternative.phishingResistant || proof.phishingResistant)));
 };
-const validAction = Effect.fnUntraced(function* (authorization, expected, currentRequirement, now, maximumAgeMillis) {
-	const challenge = authorization.challenge;
-	const evidence = authorization.evidence;
-	const intentDigest = yield* digest(expected.intent);
-	const binding = yield* digest(JSON.stringify([
-		"effect-auth/oauth-action/v1",
-		expected.moduleId,
-		expected.action,
-		expected.flowId,
-		expected.commandId,
-		intentDigest
-	]));
-	if (challenge.moduleId !== expected.moduleId || challenge.action !== expected.action || challenge.flowId !== expected.flowId || challenge.commandId !== expected.commandId || challenge.intentDigest !== intentDigest || challenge.bindingDigest !== binding || evidence.flowId !== expected.flowId || evidence.bindingDigest !== binding || !sameRevision(challenge.revision, expected.revision) || !sameRevision(evidence.revision, expected.revision)) return false;
-	const revisions = new Map(expected.revision.credentials.map((item) => [item.credentialId, item.revision]));
-	if (evidence.proofs.some((proof) => !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now)) return false;
-	return [authorization.requirement, currentRequirement].every((requirement) => {
-		const fresh = evidence.proofs.filter((proof) => {
-			const age = now - DateTime.toEpochMillis(proof.verifiedAt);
-			return age >= 0 && age < Math.min(maximumAgeMillis, requirement.maximumAgeMillis);
-		});
-		return satisfies(fresh, requirement);
-	});
-});
 //#endregion
-export { captureOAuthMapping, digest, invariant, nonce, oauthIdentityKey, sameIdentity, sameRevision, satisfies, storage, unavailable, validAction };
+export { captureOAuthMapping, invariant, oauthIdentityKey, sameIdentity, sameRevision, satisfies, storage, unavailable };
 
 //# sourceMappingURL=state.mjs.map

package/dist/internal/oauth/state.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"state.mjs","names":[],"sources":["../../../src/internal/oauth/state.ts"],"sourcesContent":["import {\n  type OAuthActionAuthorization,\n  type OAuthAccountRevision,\n  OAuthUnavailable,\n  OAuthExternalIdentity,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport { Crypto, DateTime, Effect, Schema } from \"effect\";\nimport { Base64Url } from \"effect/encoding\";\n\nimport { digest, randomId } from \"../crypto\";\nexport { digest } from \"../crypto\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nexport const unavailable = () => OAuthUnavailable.make({});\n\nexport const invariant: (value: unknown) => asserts value = (value) => {\n  if (!value) throw unavailable();\n};\n\nexport const nonce = randomId;\n\n/** Capture configuration/callback references while preserving adapter table, SQL\n * and Effect objects. Never freeze or mutate the consumer's original graph. */\nexport const captureOAuthMapping = <A>(input: A): A => {\n  const seen = new Map<object, unknown>();\n\n  const copy = (value: unknown): unknown => {\n    if (value === null || typeof value !== \"object\" || Effect.isEffect(value)) return value;\n    if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return value;\n    const prior = seen.get(value);\n\n    if (prior !== undefined) return prior;\n    if (Array.isArray(value)) {\n      const result: unknown[] = [];\n\n      seen.set(value, result);\n      result.push(...value.map(copy));\n\n      return Object.freeze(result);\n    }\n    const result: Record<string, unknown> = {};\n\n    seen.set(value, result);\n    for (const [key, child] of Object.entries(value)) result[key] = copy(child);\n\n    return Object.freeze(result);\n  };\n\n  return copy(input) as A;\n};\n\n/** Versioned length-delimited UTF-8 tuple; the module is deliberately excluded.\n * Reject ill-formed UTF-16 rather than letting UTF-8 replacement alias identities. */\nexport const oauthIdentityKey = Effect.fnUntraced(function* (\n  input: typeof OAuthExternalIdentity.Type,\n) {\n  const identity = snapshotOAuthSync(OAuthExternalIdentity, input);\n\n  const fields = [\n    \"effect-auth/oauth-identity-key/v1\",\n    identity.provider,\n    identity.issuer,\n    identity.subject,\n  ];\n\n  const bytes = fields.map((field) => {\n    const value = encoder.encode(field);\n\n    invariant(decoder.decode(value) === field);\n\n    return value;\n  });\n\n  const packed = new Uint8Array(bytes.reduce((size, value) => size + 4 + value.length, 0));\n  const view = new DataView(packed.buffer);\n  let offset = 0;\n\n  for (const value of bytes) {\n    view.setUint32(offset, value.length, false);\n    packed.set(value, offset + 4);\n    offset += 4 + value.length;\n  }\n\n  const crypto = yield* Crypto.Crypto;\n\n  return \"v1:\" + Base64Url.encode(yield* crypto.digest(\"SHA-256\", packed));\n});\n\nexport const sameIdentity = (\n  left: typeof OAuthExternalIdentity.Type,\n  right: typeof OAuthExternalIdentity.Type,\n) =>\n  left.provider === right.provider &&\n  left.issuer === right.issuer &&\n  left.subject === right.subject;\n\n/** Private Type storage: opaque wrappers and DateTimes are freshly reconstructed. */\nexport const storage = <S extends Schema.Codec<unknown, unknown, never, never>>(schema: S) => {\n  const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n  const encode = Schema.encodeSync(codec);\n  const decode = Schema.decodeSync(codec);\n\n  return {\n    encode: (value: S[\"Type\"]) => encode(snapshotOAuthSync(schema, value)),\n    decode: (value: string) => snapshotOAuthSync(schema, decode(value)),\n  };\n};\n\nexport const sameRevision = (left: OAuthAccountRevision, right: OAuthAccountRevision) => {\n  if (\n    left.subjectId !== right.subjectId ||\n    left.securityRevision !== right.securityRevision ||\n    left.credentials.length !== right.credentials.length\n  )\n    return false;\n  const revisions = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));\n\n  return (\n    revisions.size === left.credentials.length &&\n    new Set(right.credentials.map((item) => item.credentialId)).size === right.credentials.length &&\n    right.credentials.every((item) => revisions.get(item.credentialId) === item.revision)\n  );\n};\n\nexport const satisfies = (\n  proofs: ReadonlyArray<{\n    readonly credentialId: string;\n    readonly factors: ReadonlyArray<string>;\n    readonly userVerified: boolean;\n    readonly phishingResistant: boolean;\n  }>,\n  requirement: AuthenticationRequirement,\n) => {\n  const factors = new Set(proofs.flatMap((proof) => [...proof.factors]));\n  const count = new Set(proofs.map((proof) => proof.credentialId)).size;\n\n  return requirement.alternatives.some(\n    (alternative) =>\n      alternative.factors.every((factor) => factors.has(factor)) &&\n      count >= alternative.minimumCredentials &&\n      proofs.some(\n        (proof) =>\n          (!alternative.userVerified || proof.userVerified) &&\n          (!alternative.phishingResistant || proof.phishingResistant),\n      ),\n  );\n};\n\nexport const validAction = Effect.fnUntraced(function* (\n  authorization: OAuthActionAuthorization,\n  expected: {\n    readonly moduleId: string;\n    readonly action: OAuthActionAuthorization[\"challenge\"][\"action\"];\n    readonly flowId: string;\n    readonly commandId: string;\n    readonly revision: OAuthAccountRevision;\n    readonly intent: string;\n  },\n  currentRequirement: AuthenticationRequirement,\n  now: number,\n  maximumAgeMillis: number,\n) {\n  const challenge = authorization.challenge;\n  const evidence = authorization.evidence;\n  const intentDigest = yield* digest(expected.intent);\n\n  const binding = yield* digest(\n    // oxlint-disable-next-line no-restricted-properties -- Fixed private action fingerprint format shared with the core verifier.\n    JSON.stringify([\n      \"effect-auth/oauth-action/v1\",\n      expected.moduleId,\n      expected.action,\n      expected.flowId,\n      expected.commandId,\n      intentDigest,\n    ]),\n  );\n\n  if (\n    challenge.moduleId !== expected.moduleId ||\n    challenge.action !== expected.action ||\n    challenge.flowId !== expected.flowId ||\n    challenge.commandId !== expected.commandId ||\n    challenge.intentDigest !== intentDigest ||\n    challenge.bindingDigest !== binding ||\n    evidence.flowId !== expected.flowId ||\n    evidence.bindingDigest !== binding ||\n    !sameRevision(challenge.revision, expected.revision) ||\n    !sameRevision(evidence.revision, expected.revision)\n  )\n    return false;\n\n  const revisions = new Map(\n    expected.revision.credentials.map((item) => [item.credentialId, item.revision]),\n  );\n\n  if (\n    evidence.proofs.some(\n      (proof) =>\n        !revisions.has(proof.credentialId) || DateTime.toEpochMillis(proof.verifiedAt) > now,\n    )\n  )\n    return false;\n\n  return [authorization.requirement, currentRequirement].every((requirement) => {\n    const fresh = evidence.proofs.filter((proof) => {\n      const age = now - DateTime.toEpochMillis(proof.verifiedAt);\n\n      return age >= 0 && age < Math.min(maximumAgeMillis, requirement.maximumAgeMillis);\n    });\n\n    return satisfies(fresh, requirement);\n  });\n});\n"],"mappings":";;;;;AAcA,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAa,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAEzD,MAAa,aAAgD,UAAU;CACrE,IAAI,CAAC,OAAO,MAAM,YAAY;AAChC;AAEA,MAAa,QAAQ;;;AAIrB,MAAa,uBAA0B,UAAgB;CACrD,MAAM,uBAAO,IAAI,IAAqB;CAEtC,MAAM,QAAQ,UAA4B;EACxC,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG,OAAO;EAClF,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,eAAe,KAAK,MAAM,OAAO,WAAW,OAAO;EACvF,MAAM,QAAQ,KAAK,IAAI,KAAK;EAE5B,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxB,MAAM,SAAoB,CAAC;GAE3B,KAAK,IAAI,OAAO,MAAM;GACtB,OAAO,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC;GAE9B,OAAO,OAAO,OAAO,MAAM;EAC7B;EACA,MAAM,SAAkC,CAAC;EAEzC,KAAK,IAAI,OAAO,MAAM;EACtB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG,OAAO,OAAO,KAAK,KAAK;EAE1E,OAAO,OAAO,OAAO,MAAM;CAC7B;CAEA,OAAO,KAAK,KAAK;AACnB;;;AAIA,MAAa,mBAAmB,OAAO,WAAW,WAChD,OACA;CACA,MAAM,WAAW,kBAAkB,uBAAuB,KAAK;CAS/D,MAAM,QAAQ;EANZ;EACA,SAAS;EACT,SAAS;EACT,SAAS;CAGQ,CAAC,CAAC,KAAK,UAAU;EAClC,MAAM,QAAQ,QAAQ,OAAO,KAAK;EAElC,UAAU,QAAQ,OAAO,KAAK,MAAM,KAAK;EAEzC,OAAO;CACT,CAAC;CAED,MAAM,SAAS,IAAI,WAAW,MAAM,QAAQ,MAAM,UAAU,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC;CACvF,MAAM,OAAO,IAAI,SAAS,OAAO,MAAM;CACvC,IAAI,SAAS;CAEb,KAAK,MAAM,SAAS,OAAO;EACzB,KAAK,UAAU,QAAQ,MAAM,QAAQ,KAAK;EAC1C,OAAO,IAAI,OAAO,SAAS,CAAC;EAC5B,UAAU,IAAI,MAAM;CACtB;CAEA,MAAM,SAAS,OAAO,OAAO;CAE7B,OAAO,QAAQ,UAAU,OAAO,OAAO,OAAO,OAAO,WAAW,MAAM,CAAC;AACzE,CAAC;AAED,MAAa,gBACX,MACA,UAEA,KAAK,aAAa,MAAM,YACxB,KAAK,WAAW,MAAM,UACtB,KAAK,YAAY,MAAM;;AAGzB,MAAa,WAAmE,WAAc;CAC5F,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;CAC7E,MAAM,SAAS,OAAO,WAAW,KAAK;CACtC,MAAM,SAAS,OAAO,WAAW,KAAK;CAEtC,OAAO;EACL,SAAS,UAAqB,OAAO,kBAAkB,QAAQ,KAAK,CAAC;EACrE,SAAS,UAAkB,kBAAkB,QAAQ,OAAO,KAAK,CAAC;CACpE;AACF;AAEA,MAAa,gBAAgB,MAA4B,UAAgC;CACvF,IACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,QAE9C,OAAO;CACT,MAAM,YAAY,IAAI,IAAI,KAAK,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAAC;CAE5F,OACE,UAAU,SAAS,KAAK,YAAY,UACpC,IAAI,IAAI,MAAM,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,MAAM,YAAY,UACvF,MAAM,YAAY,OAAO,SAAS,UAAU,IAAI,KAAK,YAAY,MAAM,KAAK,QAAQ;AAExF;AAEA,MAAa,aACX,QAMA,gBACG;CACH,MAAM,UAAU,IAAI,IAAI,OAAO,SAAS,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC;CACrE,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC;CAEjE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,SAAS,YAAY,sBACrB,OAAO,MACJ,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;AACF;AAEA,MAAa,cAAc,OAAO,WAAW,WAC3C,eACA,UAQA,oBACA,KACA,kBACA;CACA,MAAM,YAAY,cAAc;CAChC,MAAM,WAAW,cAAc;CAC/B,MAAM,eAAe,OAAO,OAAO,SAAS,MAAM;CAElD,MAAM,UAAU,OAAO,OAErB,KAAK,UAAU;EACb;EACA,SAAS;EACT,SAAS;EACT,SAAS;EACT,SAAS;EACT;CACF,CAAC,CACH;CAEA,IACE,UAAU,aAAa,SAAS,YAChC,UAAU,WAAW,SAAS,UAC9B,UAAU,WAAW,SAAS,UAC9B,UAAU,cAAc,SAAS,aACjC,UAAU,iBAAiB,gBAC3B,UAAU,kBAAkB,WAC5B,SAAS,WAAW,SAAS,UAC7B,SAAS,kBAAkB,WAC3B,CAAC,aAAa,UAAU,UAAU,SAAS,QAAQ,KACnD,CAAC,aAAa,SAAS,UAAU,SAAS,QAAQ,GAElD,OAAO;CAET,MAAM,YAAY,IAAI,IACpB,SAAS,SAAS,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAChF;CAEA,IACE,SAAS,OAAO,MACb,UACC,CAAC,UAAU,IAAI,MAAM,YAAY,KAAK,SAAS,cAAc,MAAM,UAAU,IAAI,GACrF,GAEA,OAAO;CAET,OAAO,CAAC,cAAc,aAAa,kBAAkB,CAAC,CAAC,OAAO,gBAAgB;EAC5E,MAAM,QAAQ,SAAS,OAAO,QAAQ,UAAU;GAC9C,MAAM,MAAM,MAAM,SAAS,cAAc,MAAM,UAAU;GAEzD,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI,kBAAkB,YAAY,gBAAgB;EAClF,CAAC;EAED,OAAO,UAAU,OAAO,WAAW;CACrC,CAAC;AACH,CAAC"}
+{"version":3,"file":"state.mjs","names":[],"sources":["../../../src/internal/oauth/state.ts"],"sourcesContent":["import {\n  type OAuthAccountRevision,\n  OAuthUnavailable,\n  OAuthExternalIdentity,\n  snapshotOAuthSync,\n} from \"@yielded/auth/OAuth\";\nimport type { AuthenticationRequirement } from \"@yielded/auth/Sessions\";\nimport { Crypto, Effect, Schema } from \"effect\";\nimport { Base64Url } from \"effect/encoding\";\n\nimport { randomId } from \"../crypto\";\nexport { digest } from \"../crypto\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nexport const unavailable = () => OAuthUnavailable.make({});\n\nexport const invariant: (value: unknown) => asserts value = (value) => {\n  if (!value) throw unavailable();\n};\n\nexport const nonce = randomId;\n\n/** Capture configuration/callback references while preserving adapter table, SQL\n * and Effect objects. Never freeze or mutate the consumer's original graph. */\nexport const captureOAuthMapping = <A>(input: A): A => {\n  const seen = new Map<object, unknown>();\n\n  const copy = (value: unknown): unknown => {\n    if (value === null || typeof value !== \"object\" || Effect.isEffect(value)) return value;\n    if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype) return value;\n    const prior = seen.get(value);\n\n    if (prior !== undefined) return prior;\n    if (Array.isArray(value)) {\n      const result: unknown[] = [];\n\n      seen.set(value, result);\n      result.push(...value.map(copy));\n\n      return Object.freeze(result);\n    }\n    const result: Record<string, unknown> = {};\n\n    seen.set(value, result);\n    for (const [key, child] of Object.entries(value)) result[key] = copy(child);\n\n    return Object.freeze(result);\n  };\n\n  return copy(input) as A;\n};\n\n/** Versioned length-delimited UTF-8 tuple; the module is deliberately excluded.\n * Reject ill-formed UTF-16 rather than letting UTF-8 replacement alias identities. */\nexport const oauthIdentityKey = Effect.fnUntraced(function* (\n  input: typeof OAuthExternalIdentity.Type,\n) {\n  const identity = snapshotOAuthSync(OAuthExternalIdentity, input);\n\n  const fields = [\n    \"effect-auth/oauth-identity-key/v1\",\n    identity.provider,\n    identity.issuer,\n    identity.subject,\n  ];\n\n  const bytes = fields.map((field) => {\n    const value = encoder.encode(field);\n\n    invariant(decoder.decode(value) === field);\n\n    return value;\n  });\n\n  const packed = new Uint8Array(bytes.reduce((size, value) => size + 4 + value.length, 0));\n  const view = new DataView(packed.buffer);\n  let offset = 0;\n\n  for (const value of bytes) {\n    view.setUint32(offset, value.length, false);\n    packed.set(value, offset + 4);\n    offset += 4 + value.length;\n  }\n\n  const crypto = yield* Crypto.Crypto;\n\n  return \"v1:\" + Base64Url.encode(yield* crypto.digest(\"SHA-256\", packed));\n});\n\nexport const sameIdentity = (\n  left: typeof OAuthExternalIdentity.Type,\n  right: typeof OAuthExternalIdentity.Type,\n) =>\n  left.provider === right.provider &&\n  left.issuer === right.issuer &&\n  left.subject === right.subject;\n\n/** Private Type storage: opaque wrappers and DateTimes are freshly reconstructed. */\nexport const storage = <S extends Schema.Codec<unknown, unknown, never, never>>(schema: S) => {\n  const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n  const encode = Schema.encodeSync(codec);\n  const decode = Schema.decodeSync(codec);\n\n  return {\n    encode: (value: S[\"Type\"]) => encode(snapshotOAuthSync(schema, value)),\n    decode: (value: string) => snapshotOAuthSync(schema, decode(value)),\n  };\n};\n\nexport const sameRevision = (left: OAuthAccountRevision, right: OAuthAccountRevision) => {\n  if (\n    left.subjectId !== right.subjectId ||\n    left.securityRevision !== right.securityRevision ||\n    left.credentials.length !== right.credentials.length\n  )\n    return false;\n  const revisions = new Map(left.credentials.map((item) => [item.credentialId, item.revision]));\n\n  return (\n    revisions.size === left.credentials.length &&\n    new Set(right.credentials.map((item) => item.credentialId)).size === right.credentials.length &&\n    right.credentials.every((item) => revisions.get(item.credentialId) === item.revision)\n  );\n};\n\nexport const satisfies = (\n  proofs: ReadonlyArray<{\n    readonly credentialId: string;\n    readonly factors: ReadonlyArray<string>;\n    readonly userVerified: boolean;\n    readonly phishingResistant: boolean;\n  }>,\n  requirement: AuthenticationRequirement,\n) => {\n  const factors = new Set(proofs.flatMap((proof) => [...proof.factors]));\n  const count = new Set(proofs.map((proof) => proof.credentialId)).size;\n\n  return requirement.alternatives.some(\n    (alternative) =>\n      alternative.factors.every((factor) => factors.has(factor)) &&\n      count >= alternative.minimumCredentials &&\n      proofs.some(\n        (proof) =>\n          (!alternative.userVerified || proof.userVerified) &&\n          (!alternative.phishingResistant || proof.phishingResistant),\n      ),\n  );\n};\n"],"mappings":";;;;;AAaA,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAExD,MAAa,oBAAoB,iBAAiB,KAAK,CAAC,CAAC;AAEzD,MAAa,aAAgD,UAAU;CACrE,IAAI,CAAC,OAAO,MAAM,YAAY;AAChC;;;AAMA,MAAa,uBAA0B,UAAgB;CACrD,MAAM,uBAAO,IAAI,IAAqB;CAEtC,MAAM,QAAQ,UAA4B;EACxC,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG,OAAO;EAClF,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,eAAe,KAAK,MAAM,OAAO,WAAW,OAAO;EACvF,MAAM,QAAQ,KAAK,IAAI,KAAK;EAE5B,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxB,MAAM,SAAoB,CAAC;GAE3B,KAAK,IAAI,OAAO,MAAM;GACtB,OAAO,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC;GAE9B,OAAO,OAAO,OAAO,MAAM;EAC7B;EACA,MAAM,SAAkC,CAAC;EAEzC,KAAK,IAAI,OAAO,MAAM;EACtB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG,OAAO,OAAO,KAAK,KAAK;EAE1E,OAAO,OAAO,OAAO,MAAM;CAC7B;CAEA,OAAO,KAAK,KAAK;AACnB;;;AAIA,MAAa,mBAAmB,OAAO,WAAW,WAChD,OACA;CACA,MAAM,WAAW,kBAAkB,uBAAuB,KAAK;CAS/D,MAAM,QAAQ;EANZ;EACA,SAAS;EACT,SAAS;EACT,SAAS;CAGQ,CAAC,CAAC,KAAK,UAAU;EAClC,MAAM,QAAQ,QAAQ,OAAO,KAAK;EAElC,UAAU,QAAQ,OAAO,KAAK,MAAM,KAAK;EAEzC,OAAO;CACT,CAAC;CAED,MAAM,SAAS,IAAI,WAAW,MAAM,QAAQ,MAAM,UAAU,OAAO,IAAI,MAAM,QAAQ,CAAC,CAAC;CACvF,MAAM,OAAO,IAAI,SAAS,OAAO,MAAM;CACvC,IAAI,SAAS;CAEb,KAAK,MAAM,SAAS,OAAO;EACzB,KAAK,UAAU,QAAQ,MAAM,QAAQ,KAAK;EAC1C,OAAO,IAAI,OAAO,SAAS,CAAC;EAC5B,UAAU,IAAI,MAAM;CACtB;CAEA,MAAM,SAAS,OAAO,OAAO;CAE7B,OAAO,QAAQ,UAAU,OAAO,OAAO,OAAO,OAAO,WAAW,MAAM,CAAC;AACzE,CAAC;AAED,MAAa,gBACX,MACA,UAEA,KAAK,aAAa,MAAM,YACxB,KAAK,WAAW,MAAM,UACtB,KAAK,YAAY,MAAM;;AAGzB,MAAa,WAAmE,WAAc;CAC5F,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;CAC7E,MAAM,SAAS,OAAO,WAAW,KAAK;CACtC,MAAM,SAAS,OAAO,WAAW,KAAK;CAEtC,OAAO;EACL,SAAS,UAAqB,OAAO,kBAAkB,QAAQ,KAAK,CAAC;EACrE,SAAS,UAAkB,kBAAkB,QAAQ,OAAO,KAAK,CAAC;CACpE;AACF;AAEA,MAAa,gBAAgB,MAA4B,UAAgC;CACvF,IACE,KAAK,cAAc,MAAM,aACzB,KAAK,qBAAqB,MAAM,oBAChC,KAAK,YAAY,WAAW,MAAM,YAAY,QAE9C,OAAO;CACT,MAAM,YAAY,IAAI,IAAI,KAAK,YAAY,KAAK,SAAS,CAAC,KAAK,cAAc,KAAK,QAAQ,CAAC,CAAC;CAE5F,OACE,UAAU,SAAS,KAAK,YAAY,UACpC,IAAI,IAAI,MAAM,YAAY,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,MAAM,YAAY,UACvF,MAAM,YAAY,OAAO,SAAS,UAAU,IAAI,KAAK,YAAY,MAAM,KAAK,QAAQ;AAExF;AAEA,MAAa,aACX,QAMA,gBACG;CACH,MAAM,UAAU,IAAI,IAAI,OAAO,SAAS,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC;CACrE,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM,YAAY,CAAC,CAAC,CAAC;CAEjE,OAAO,YAAY,aAAa,MAC7B,gBACC,YAAY,QAAQ,OAAO,WAAW,QAAQ,IAAI,MAAM,CAAC,KACzD,SAAS,YAAY,sBACrB,OAAO,MACJ,WACE,CAAC,YAAY,gBAAgB,MAAM,kBACnC,CAAC,YAAY,qBAAqB,MAAM,kBAC7C,CACJ;AACF"}

package/dist/internal/passkey-actions.mjs

@@ -0,0 +1,55 @@
+import { digest } from "./crypto.mjs";
+import { Schema } from "effect";
+import * as M from "@yielded/auth/Passkey";
+//#region src/internal/passkey-actions.ts
+const passkeyCanonicalJson = (schema) => {
+	const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));
+	return {
+		encode: (value) => Schema.encodeSync(codec)(M.snapshotPasskeySync(schema, value)),
+		decode: (text) => Schema.decodeUnknownSync(codec)(text)
+	};
+};
+const passkeyDigest = (schema, value) => digest(passkeyCanonicalJson(schema).encode(value));
+const passkeyEnrollmentDigest = (ceremony) => {
+	if (ceremony.context._tag !== "Enrollment") throw M.PasskeyUnavailable.make({});
+	return passkeyDigest(Schema.Tuple([
+		M.PasskeyModuleId,
+		Schema.Literal("enrollment"),
+		Schema.Struct({
+			...M.PasskeyBegin.fields,
+			name: M.PasskeyLabel
+		}),
+		M.PasskeyProfile,
+		M.PasskeyRevision,
+		M.PasskeyUserHandle,
+		Schema.Array(M.PasskeyDescriptor)
+	]), [
+		ceremony.moduleId,
+		"enrollment",
+		{
+			flowId: ceremony.flowId,
+			commandId: ceremony.commandId,
+			profileId: ceremony.profile.profileId,
+			name: ceremony.context.name
+		},
+		ceremony.profile,
+		ceremony.context.revision,
+		ceremony.context.userHandle,
+		ceremony.allowedCredentials
+	]);
+};
+const passkeyRemoveDigest = (moduleId, commandId, credential) => passkeyDigest(Schema.Tuple([
+	M.PasskeyModuleId,
+	Schema.Literal("remove"),
+	M.PasskeyBegin.fields.commandId,
+	M.PasskeyCredential
+]), [
+	M.PasskeyModuleId.make(moduleId),
+	"remove",
+	M.PasskeyBegin.fields.commandId.make(commandId),
+	credential
+]);
+//#endregion
+export { passkeyCanonicalJson, passkeyDigest, passkeyEnrollmentDigest, passkeyRemoveDigest };
+
+//# sourceMappingURL=passkey-actions.mjs.map

package/dist/internal/passkey-actions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-actions.mjs","names":[],"sources":["../../src/internal/passkey-actions.ts"],"sourcesContent":["import * as M from \"@yielded/auth/Passkey\";\nimport { Schema } from \"effect\";\n\nimport { digest } from \"./crypto\";\n\nexport const passkeyCanonicalJson = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n) => {\n  const codec = Schema.fromJsonString(Schema.toCodecJson(Schema.toType(schema)));\n\n  return {\n    encode: (value: S[\"Type\"]) => Schema.encodeSync(codec)(M.snapshotPasskeySync(schema, value)),\n    decode: (text: unknown): S[\"Type\"] => Schema.decodeUnknownSync(codec)(text),\n  };\n};\n\nexport const passkeyDigest = <S extends Schema.Codec<unknown, unknown, never, never>>(\n  schema: S,\n  value: S[\"Type\"],\n) => digest(passkeyCanonicalJson(schema).encode(value));\n\nexport const passkeyEnrollmentDigest = (ceremony: M.PasskeyCeremony) => {\n  if (ceremony.context._tag !== \"Enrollment\") throw M.PasskeyUnavailable.make({});\n\n  return passkeyDigest(\n    Schema.Tuple([\n      M.PasskeyModuleId,\n      Schema.Literal(\"enrollment\"),\n      Schema.Struct({ ...M.PasskeyBegin.fields, name: M.PasskeyLabel }),\n      M.PasskeyProfile,\n      M.PasskeyRevision,\n      M.PasskeyUserHandle,\n      Schema.Array(M.PasskeyDescriptor),\n    ]),\n    [\n      ceremony.moduleId,\n      \"enrollment\",\n      {\n        flowId: ceremony.flowId,\n        commandId: ceremony.commandId,\n        profileId: ceremony.profile.profileId,\n        name: ceremony.context.name,\n      },\n      ceremony.profile,\n      ceremony.context.revision,\n      ceremony.context.userHandle,\n      ceremony.allowedCredentials,\n    ],\n  );\n};\n\nexport const passkeyRemoveDigest = (\n  moduleId: string,\n  commandId: string,\n  credential: M.PasskeyCredential,\n) =>\n  passkeyDigest(\n    Schema.Tuple([\n      M.PasskeyModuleId,\n      Schema.Literal(\"remove\"),\n      M.PasskeyBegin.fields.commandId,\n      M.PasskeyCredential,\n    ]),\n    [\n      M.PasskeyModuleId.make(moduleId),\n      \"remove\",\n      M.PasskeyBegin.fields.commandId.make(commandId),\n      credential,\n    ],\n  );\n"],"mappings":";;;;AAKA,MAAa,wBACX,WACG;CACH,MAAM,QAAQ,OAAO,eAAe,OAAO,YAAY,OAAO,OAAO,MAAM,CAAC,CAAC;CAE7E,OAAO;EACL,SAAS,UAAqB,OAAO,WAAW,KAAK,CAAC,CAAC,EAAE,oBAAoB,QAAQ,KAAK,CAAC;EAC3F,SAAS,SAA6B,OAAO,kBAAkB,KAAK,CAAC,CAAC,IAAI;CAC5E;AACF;AAEA,MAAa,iBACX,QACA,UACG,OAAO,qBAAqB,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC;AAEtD,MAAa,2BAA2B,aAAgC;CACtE,IAAI,SAAS,QAAQ,SAAS,cAAc,MAAM,EAAE,mBAAmB,KAAK,CAAC,CAAC;CAE9E,OAAO,cACL,OAAO,MAAM;EACX,EAAE;EACF,OAAO,QAAQ,YAAY;EAC3B,OAAO,OAAO;GAAE,GAAG,EAAE,aAAa;GAAQ,MAAM,EAAE;EAAa,CAAC;EAChE,EAAE;EACF,EAAE;EACF,EAAE;EACF,OAAO,MAAM,EAAE,iBAAiB;CAClC,CAAC,GACD;EACE,SAAS;EACT;EACA;GACE,QAAQ,SAAS;GACjB,WAAW,SAAS;GACpB,WAAW,SAAS,QAAQ;GAC5B,MAAM,SAAS,QAAQ;EACzB;EACA,SAAS;EACT,SAAS,QAAQ;EACjB,SAAS,QAAQ;EACjB,SAAS;CACX,CACF;AACF;AAEA,MAAa,uBACX,UACA,WACA,eAEA,cACE,OAAO,MAAM;CACX,EAAE;CACF,OAAO,QAAQ,QAAQ;CACvB,EAAE,aAAa,OAAO;CACtB,EAAE;AACJ,CAAC,GACD;CACE,EAAE,gBAAgB,KAAK,QAAQ;CAC/B;CACA,EAAE,aAAa,OAAO,UAAU,KAAK,SAAS;CAC9C;AACF,CACF"}

package/dist/internal/passkey-inputs.mjs

@@ -0,0 +1,73 @@
+import { Schema } from "effect";
+import * as M from "@yielded/auth/Passkey";
+import { CleanupLimit } from "@yielded/auth/Persistence";
+import { SessionInvalidationWindow } from "@yielded/auth/Sessions";
+import { SubjectId } from "@yielded/auth/Schema";
+//#region src/internal/passkey-inputs.ts
+const metadata = {
+	moduleId: M.PasskeyModuleId,
+	subjectId: SubjectId
+};
+const identity = {
+	...metadata,
+	commandId: M.PasskeyCommandId,
+	credentialId: M.PasskeyCredentialId
+};
+const passkeyOperationInputs = {
+	issue: Schema.Struct({ ceremony: M.PasskeyCeremony }),
+	context: M.PasskeyAccess,
+	consume: Schema.Struct({
+		access: M.PasskeyAccess,
+		ceremony: M.PasskeyCeremony,
+		credential: M.PasskeyCredential,
+		assertion: M.PasskeyAssertionVerified
+	}),
+	cleanup: Schema.Struct({
+		moduleId: M.PasskeyModuleId,
+		limit: CleanupLimit
+	}),
+	lookup: Schema.Struct({
+		rpId: M.PasskeyProfile.fields.rpId,
+		protocolCredentialId: M.PasskeyProtocolCredentialId
+	}),
+	listForSubject: Schema.Struct({
+		...metadata,
+		rpId: M.PasskeyProfile.fields.rpId
+	})
+};
+const passkeyManagementInputs = {
+	list: Schema.Struct({
+		...metadata,
+		cursor: Schema.optionalKey(M.PasskeyCredentialId),
+		limit: Schema.Int.check(Schema.isBetween({
+			minimum: 1,
+			maximum: 64
+		}))
+	}),
+	completeEnrollment: Schema.Struct({
+		access: M.PasskeyAccess,
+		ceremony: M.PasskeyCeremony,
+		verified: M.PasskeyRegistrationVerified,
+		management: M.PasskeyManagementPolicy
+	}),
+	inspectRemove: Schema.Struct({
+		...metadata,
+		credentialId: M.PasskeyCredentialId
+	}),
+	rename: Schema.Struct({
+		...identity,
+		name: M.PasskeyLabel
+	}),
+	remove: Schema.Struct({
+		moduleId: M.PasskeyModuleId,
+		commandId: M.PasskeyCommandId,
+		credential: M.PasskeyCredential,
+		authorization: M.PasskeyActionAuthorization,
+		management: M.PasskeyManagementPolicy,
+		invalidation: SessionInvalidationWindow
+	})
+};
+//#endregion
+export { passkeyManagementInputs, passkeyOperationInputs };
+
+//# sourceMappingURL=passkey-inputs.mjs.map

package/dist/internal/passkey-inputs.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-inputs.mjs","names":[],"sources":["../../src/internal/passkey-inputs.ts"],"sourcesContent":["import * as M from \"@yielded/auth/Passkey\";\nimport { CleanupLimit } from \"@yielded/auth/Persistence\";\nimport { SubjectId } from \"@yielded/auth/Schema\";\nimport { SessionInvalidationWindow } from \"@yielded/auth/Sessions\";\nimport { Schema } from \"effect\";\nconst metadata = { moduleId: M.PasskeyModuleId, subjectId: SubjectId };\n\nconst identity = {\n  ...metadata,\n  commandId: M.PasskeyCommandId,\n  credentialId: M.PasskeyCredentialId,\n};\n\nexport const passkeyOperationInputs = {\n  issue: Schema.Struct({ ceremony: M.PasskeyCeremony }),\n  context: M.PasskeyAccess,\n  consume: Schema.Struct({\n    access: M.PasskeyAccess,\n    ceremony: M.PasskeyCeremony,\n    credential: M.PasskeyCredential,\n    assertion: M.PasskeyAssertionVerified,\n  }),\n  cleanup: Schema.Struct({\n    moduleId: M.PasskeyModuleId,\n    limit: CleanupLimit,\n  }),\n  lookup: Schema.Struct({\n    rpId: M.PasskeyProfile.fields.rpId,\n    protocolCredentialId: M.PasskeyProtocolCredentialId,\n  }),\n  listForSubject: Schema.Struct({ ...metadata, rpId: M.PasskeyProfile.fields.rpId }),\n};\n\nexport const passkeyManagementInputs = {\n  list: Schema.Struct({\n    ...metadata,\n    cursor: Schema.optionalKey(M.PasskeyCredentialId),\n    limit: Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 64 })),\n  }),\n  completeEnrollment: Schema.Struct({\n    access: M.PasskeyAccess,\n    ceremony: M.PasskeyCeremony,\n    verified: M.PasskeyRegistrationVerified,\n    management: M.PasskeyManagementPolicy,\n  }),\n  inspectRemove: Schema.Struct({ ...metadata, credentialId: M.PasskeyCredentialId }),\n  rename: Schema.Struct({ ...identity, name: M.PasskeyLabel }),\n  remove: Schema.Struct({\n    moduleId: M.PasskeyModuleId,\n    commandId: M.PasskeyCommandId,\n    credential: M.PasskeyCredential,\n    authorization: M.PasskeyActionAuthorization,\n    management: M.PasskeyManagementPolicy,\n    invalidation: SessionInvalidationWindow,\n  }),\n};\n"],"mappings":";;;;;;AAKA,MAAM,WAAW;CAAE,UAAU,EAAE;CAAiB,WAAW;AAAU;AAErE,MAAM,WAAW;CACf,GAAG;CACH,WAAW,EAAE;CACb,cAAc,EAAE;AAClB;AAEA,MAAa,yBAAyB;CACpC,OAAO,OAAO,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC;CACpD,SAAS,EAAE;CACX,SAAS,OAAO,OAAO;EACrB,QAAQ,EAAE;EACV,UAAU,EAAE;EACZ,YAAY,EAAE;EACd,WAAW,EAAE;CACf,CAAC;CACD,SAAS,OAAO,OAAO;EACrB,UAAU,EAAE;EACZ,OAAO;CACT,CAAC;CACD,QAAQ,OAAO,OAAO;EACpB,MAAM,EAAE,eAAe,OAAO;EAC9B,sBAAsB,EAAE;CAC1B,CAAC;CACD,gBAAgB,OAAO,OAAO;EAAE,GAAG;EAAU,MAAM,EAAE,eAAe,OAAO;CAAK,CAAC;AACnF;AAEA,MAAa,0BAA0B;CACrC,MAAM,OAAO,OAAO;EAClB,GAAG;EACH,QAAQ,OAAO,YAAY,EAAE,mBAAmB;EAChD,OAAO,OAAO,IAAI,MAAM,OAAO,UAAU;GAAE,SAAS;GAAG,SAAS;EAAG,CAAC,CAAC;CACvE,CAAC;CACD,oBAAoB,OAAO,OAAO;EAChC,QAAQ,EAAE;EACV,UAAU,EAAE;EACZ,UAAU,EAAE;EACZ,YAAY,EAAE;CAChB,CAAC;CACD,eAAe,OAAO,OAAO;EAAE,GAAG;EAAU,cAAc,EAAE;CAAoB,CAAC;CACjF,QAAQ,OAAO,OAAO;EAAE,GAAG;EAAU,MAAM,EAAE;CAAa,CAAC;CAC3D,QAAQ,OAAO,OAAO;EACpB,UAAU,EAAE;EACZ,WAAW,EAAE;EACb,YAAY,EAAE;EACd,eAAe,EAAE;EACjB,YAAY,EAAE;EACd,cAAc;CAChB,CAAC;AACH"}